ipython

You've shifted the goalposts here. You're right that this all comes down to economics. You're not going to go to these lengths to break into a Facebook account -- however -- you have to remember that there is a lot of transitive trust nowadays.

So that Facebook account may allow you federated login to something you do care about. Or your Facebook account is the front page for your business, where a defacement or outage could cost you thousands of $$$. Or you reused your Facebook account's password as the password for your email, which probably was the recovery email for every online account you have... meaning you can now log into every service given access to your email.

Real security is about threat modeling and risk mitigation. Risk mitigation is simply the application of a rough economic model of both the attacker and defender to find a median where you are comfortable. Essentially a fancy way of determining how fast you need to run so that the bear eats the slower person first. Your example is apt- the grandma who is scammed out of $1000 is running much slower than the grandmas who were not, all things being equal.

So when it's "just" a Facebook account on the line, yes, nobody is going to go through massive effort to crack it. But that's not what the original post was about - it was about unlocking millions of $$ worth of Bitcoin. That's worth some effort. Remember also that, in this story, the person who retrieved the password does not end up with 100% of the proceeds, as you would in an adversarial scenario. In the adversarial scenario, the adversary's risk calculus is vastly different and they would be willing to spend a lot more effort (time, money, resources) into cracking that password.

sorry to hear that. I don't exaggerate, but the unfortunate part is there is a lot of FUD out there- I just had a friend install nordvpn because someone sent her a gift card scam email to her business email address. So there's a lot of misinformation out there, mostly from folks selling product.

Password management is one of those fundamental security foundations- essentially serving as the 'root of trust' for your own personal digital life. If you mess that up, you're in for a world of hurt. I don't mess around with passwords. Taking your analogy, would you intentionally stand outside under a tree in a thunderstorm, figuring that the risk of getting hit by lightning is so small?

just like anything else with cryptography, please don't roll your own. all major OSes and programming languages provide primitives to generate cryptographically strong random numbers- use that instead.

From a developers point of view- if you are given an option to provide a seed value, you’re using the wrong api. Libraries exist to provide cryptographically appropriate rngs in every major programming language- use those instead.

From my experience, the muscle memory is strong with ida. Once you’re used to it, it’s hard to switch. So I don’t expect that there was a dramatic plunge as soon as ghidra was released.

I have no inside knowledge but I expect the sales drop slowly as new users start with ghidra instead of ida.

This happens all the time. If I had a nickel for every system I broke with a time based prng, I’d have like 10 bucks by now.

The constraint is knowing when the password was created. If you know that within a day or so, that makes the problem much more tractable and you can instead focus on number of characters and the other parameters.

Sniffing traffic (yes even encrypted) would be enough to see if you’re going through the login or initial user establishment flow, and that would give you a precise time when the password was generated.

This is a serious flaw.

Not surprising behavior from Cogent, who to this day refuses to peer with Hurricane Electric's IPv6 network [see https://en.wikipedia.org/wiki/Hurricane_Electric and related footnotes].

Many, many years ago I participated in ISEF, so this is personally disappointing to me. I'll echo some of the sibling comments about the difference between kids who did the project alone versus parents/lab mentors who ... ahem ... contributed significantly to the project. In contrast, my project was entirely self-made and therefore not very impressive, but it had some gimmicks in how I presented it which managed to impress judges at the school and regional levels, enough to send me to ISEF.

ISEF was an amazing experience, especially as a kid from a school that was nothing special. Our school was so excited that they hired a public speaking specialist to work with me to prepare. Looking back, that training in public speaking directly contributed to many successes in my career decades down the line. Plus the experience of going to ISEF still brings back positive memories. I never felt like I belonged - there were some amazingly smart kids there - but the social camaraderie and the ability to meet kids that thought it was cool to be smart was eye opening.

As far as "making mistakes when you're 17" - yeah, I made mistakes then too, but I certainly paid the price for them. Especially when you make conscious decisions to defraud and falsify, if these allegations can be proven. There should be serious consequences for this.

Don't forget in-vehicle Wi-Fi access points, which are active in most modern cars/trucks. Plus you can't "opt out" as these are usually fixed names (you can't append "_nomap")

All well and good until you sign away those rights in one of the many forms you fill out- see for example this excerpt from one of my local hospital websites (emphasis mine)

It’s trivial to be coerced into signing one of these agreements when you’re in a high stress high stakes environment.

> If you get other types of services at these in-network facilities, out-of-network providers can't balance bill you, _unless you give written consent and give up your protections._

This +1000. The whole billing / insurance system is intended to wear you down in a cascading swarm of bullshit.

You want to know if a doctor is in network? Good luck, because the insurance company clearly states that they only provide that information on a best effort basis. The doctor can’t answer, as they refer you back to your insurance company.

You want an outpatient surgery? Great! Make sure your doctor and facility is in network, right? Oops, wrong again! You forgot about the anesthesiologist who you can’t pick ahead of time and is rarely in network. Good luck figuring that out later!

It’s intended to wear you down until you’re afraid of your “rating” aka credit score tanking enough that you just pay up.

Scroll to the northwest a bit and you can see that you can ride Metro straight to the data center! How convenient!

I spoke with the compliance manager at the urgent care this afternoon and had a pleasant conversation. I shared my concerns that I was never provided a copy of the paperwork I was expected to sign - and they took that feedback to hopefully improve in the future.

I had one question in case you’re still monitoring this thread. The compliance manager mentioned a “health information exchange” which I opted out of (since it was something I can control). Do you have experience with these? It seems benign from the searches I’ve done since the conversation but I would be curious if you had any insight as a medical professional

I would believe this - after all how many billions of dollars did Google pay Apple to be the primary search engine on iOS? This further erodes my confidence in Apple doing the right thing and I think the EU is doing the world a service by setting in motion alternative app stores.

So let’s say I want to book an outpatient surgical procedure. I know my surgeon is in network and the facility I visit for the procedure is in network. However there are always other services required that you may not be aware of - anesthesiologists are the most common. This is a very common occurrence which I have encountered (thanks for calling me a liar).

See for example https://www.reddit.com/r/personalfinance/comments/ho49d5/ane... - first hit of many for “anesthesiologist out of network”

Especially if you have an emergency surgery it’s not like you’re picking your anesthesiologist from an approved list before entering the OR, even if you took the time to make sure the hospital you visited is in network.

Finally look at the fine print for your insurance company’s website. You’ll see multiple disclaimers noting that the information may not be accurate - for example from blue cross blue shield:

> Blue Cross and Blue Shield Licensees have made reasonable efforts to ensure that the list of providers displayed is up to date and accurate. Please call the provider before making an appointment to verify that the provider continues to be part of the network.

Then when you call the provider to confirm, they shunt you back to your insurance provider. It’s hilarious if it didn’t have significant financial consequences.

> Sure, you are welcome to contact your insurance BEFORE you obtain services and find out what they will cover. In fact, its incumbent upon you to do that, and not expect HCP's to do that for you.

Had experience with that too. Insurance company will not give you a straight answer as to what’s covered or not- as for example the anesthesiologist may be out of network and you’ll never know until it’s too late. The health care provider won’t give you that info either. So you end up rolling the dice and hoping it all is covered at the end of the day.

> If you plan on seeking medical services without going through insurance, the ACA requires providers to provide you with a good faith estimate upfront.

That is truly funny. I have literally spent an hour across multiple agents to quote a single service out of pocket. I’ve done it multiple times across several providers. Every time it’s the same painful procedure where nobody can ever give you an answer.

I struggled to find the words to describe the way you’re treated when you ask for a quote. This is the best I’ve come up with: It’s like shopping at a luxury store with no price tags- if you dare ask the question “how much does this cost?” perhaps you don’t belong here.

Before I start, I'm not singling you out- I am happy that you're participating in this discussion and sharing your first hand knowledge.

The thing for me is that if HIPAA truly does provide me privacy of my personal information and health care information, why are all of these privacy and consent forms required?

Whenever I am handed a form that says "privacy policy" my sense is immediately raised - what is it that they're trying to hide from me through mountains of legalese? When I don't receive one (as was the case in my doctors visit) then I am REALLY on edge.

For example, with my health care visit, this thread prompted me to call the listed numbers on the website for the health care provider to discuss their privacy policy. The provider's number dumps you into an IVR that has zero way to reach a human - you must dial an extension, and there is no option for an operator. I ended up calling their headquarters to get a callback from a human.

If there are standard mechanisms and policies in place, then we should be able to understand the rules once and never have to sign another form again, because the rules would be clear, unambiguous, and applicable to every health care interaction. If the rules are clear about not waiving HIPAA privacy/security rights, then why have a privacy policy that's three pages of inscrutable legalese that gives a bunch of weasel room for them to "share" information?

100% this. I just visited an urgent care center yesterday for some strep tests. I was given an electronic signature pad and told to sign for "consent to care". No documentation was given to me on what I was signing - just that I needed to sign.

I had to ask for a paper copy of the form I was signing, which was handed to me. That document said that "I acknowledge receiving the privacy notice ..." Was that given to me? Of course not. Asking for that - well let's just say I think I was the first person to ever ask for any of this documentation. I'm sure my information has been shared with 30 other entities - for a strep test. It's insane and unenforceable as a patient who just wants to get shit done.

I would love to see that legal argument given their view of “fair use” of all the copyrighted material that went into OpenAI models.

Why would the model be self aware? There is no mechanism for the llm to know the answer to “what are you” other than training data it was fed. So it’s going to spit out whatever it was trained with, regardless of the “truth”

and if you want to read about the real world Russian illegals that were caught in the US and traded in the 2010 spy swap, read the FBI pages on Operation Ghost Stories: https://www.fbi.gov/news/stories/operation-ghost-stories-ins...

They penned two briefs, the one you linked to was never filed with the court (it “sides” with the police). The one they filed with the court is different. You can read about it here and both are linked: https://reason.com/volokh/2022/10/28/babylon-bee-files-amicu...

It is optional, yes, but in the past, there were no internet based middlemen taking a 30% cut. You paid the local kid driving the pizza to your house, not some nameless software developer making 200k+ a year.

The cuts Uber, DoorDash etc take are astronomical- that’s the real issue. Thirty percent! Nobody filed lawsuits about pizza delivery in the past because you didn’t pay a 100% premium for delivery!

I don’t do delivery services because for a family it is entirely unreasonable. I looked once- a $40 fast food order would be nearly $90 after inflated menu prices, fees, delivery, and tip.

Given the recent tsmc article which insinuated American workers did not put in nearly the hours of their Taiwanese counterparts, I’m curious where East Asian countries fall in that ranking?

I remember my first introduction to the onion was the print edition at my university. What a great publication- and they authored what has to be the best amicus brief to the Supreme Court ever. https://www.supremecourt.gov/DocketPDF/22/22-293/242292/2022...

My wife was at dinner with a bunch of other women the other night. Of a party of about 15, at least 12 of them had stories of their parents being scammed for a large amount of money. Even the scams that start online end up leveraging the phone system in some way. In total, the single table she was sitting at had lost over $10 million dollars to scammers - almost $1m per person. It's sickening.

The phone system is entirely broken. It comes down to economics- there's zero cost to make millions of calls, so your economic benefit formula is obvious- you can make millions of calls because one of them will pay you back mega-$$$. There is no accountability and no way to automatically filter out spam (as we do with email, although to be honest, spam filtering isn't great either). I don't know what to do other than to increase the cost to make phone calls in order to address the perverse incentives at work.

Edit: I’m curious about the downvotes. If you follow the links to the automated system that David built (a honeypot for robocallers) you see the top offenders are Medicare and end of life services. That jives with my own experience. So clearly they’re targeting the elderly and therefore the solution is - ask them to look for a little stir/shaken attestation checkmark before answering their phone?

Unlike other offshore bank havens, this one is fully transparent: https://www-cs-faculty.stanford.edu/~knuth/boss.html