Court Rules Facebook Widgets Can Be Considered Wiretaps by redkemper in technology

[–]Kaizyx 0 points1 point  (0 children)

I'm reminded of something by your post...

We have spent decades telling users not to open random links and attachments they get in emails that they are not expecting. Email clients have even been written to make opening those things more difficult and require more effort or block them completely as a security measure.

The web developer/technology community has irresponsibly blown up and undone all that hard work. Webpages, analogous to email messages, get to attach whatever they want and have those attachments automatically downloaded to the user's system from whatever source and executed even if the user hasn't vetted them, wasn't expecting them and hasn't had an opportunity to express consent.

How do we expect that users can take responsibility for the security of their information under these conditions?

We’re losing the war against surveillance capitalism because we let Big Tech frame the debate by JRepin in technology

[–]Kaizyx 1 point2 points  (0 children)

I would think such regulation would be handled via contract.

The key problem is that the mechanisms where contracts are negotiated are completely broken.

Traditionally, "vote with your wallet" has been the mechanism the market has to apply pressure upon companies to negotiate fair contracts because those who didn't went out of business. However, online advertising, data mining/sale, market research, B2B, etc, have become major revenue streams to permit online companies to not experience that market pressure and ignore consumers voting with their wallet.

This means contracts are no longer written in good faith, and the regulations in the contract more often than not regulate the user/customer, while providing the company unlimited rights. This in turn means that people are even less likely to pay for services because there is no advantage of doing so.

Bizarre internet 'dot' glitch lets you watch ad-free YouTube vids and bypass paywalls by jaishad in technology

[–]Kaizyx 0 points1 point  (0 children)

I'm assuming that you're trying to get at the idea that people shouldn't access content/services at all under terms that they disagree with. Unfortunately that "solution" is constructed under a gross understatement of the problem that only views this as a simple dispute between two parties in an otherwise free market.

This isn't a free market. This is industry operating in concert with a status quo that holds entire sectors of humanity (education/information, arts/culture, communication) hostage as their "private property" and demanding ransom. A ransom where major players buy up everything in sight to re-enforce the ransom. A ransom where too many people who play by the rules and do everything they are asked get hurt without chance to be made whole.

There is no good choices right now and industry is only making it harder to make the right choices and to support creators and online services.


[–]Kaizyx 0 points1 point  (0 children)

I think this is the wrong conclusion about the point of things like this.. Of course we should compensate people for their creative work and the work to distribute that work. Many people would be willing to pay too.

The key problem is that the content/services market in its present form is fixed in a very flawed form. There's no way for consumers to compensate creators and online services without having disproportionate harm done to themselves. In this case:

  • In online advertising: Having their devices, privacy and psychology compromised/degraded by bad ads (ad platforms are out of control, ads are not vetted, platforms waive all responsibility for the ads delivered by their platforms).
  • In paywall/subscription models: The consumer is expected accept that they only pay for an opportunity (license) to access content and services, an opportunity that can be taken away at any time. Consumers are also expected to accept that they can't place demands upon providers and creators when they pay.

What's more, as virtually everyone in the content creation/publication and online services industry is engaged in the same kinds of unethical and corrupt activities in some form or another, there exists no competition to go to or other levers that consumers may use to avoid these situations while continuing to educate themselves, and access arts and culture.

In case you thought you were having a bad day, w3schools' certificate just expired. by AuthorizedAuthor in sysadmin

[–]Kaizyx 0 points1 point  (0 children)

The core problem is Let's Encrypt's short certificate lifetimes. These lifetimes mean that as a matter of practicality, automation is required and there must be a network path of some sort between the ACME server and the system that is acquiring the certificate, even if indirect. In some high-stakes environments, this travel path does not exist.

For instance, let's consider a well-secured industrial facility, at this facility there is a secure zone (for control systems) and an insecure zone (office systems). The only connectivity that may exist between the zones is a data diode so nobody outside can interact with the control systems (incoming), but the control systems can report parameters to the office and HQ (outgoing).

Even if you complete the ACME exchange and obtain the cert on an insecure zone system, the data diode will prevent the certificate from transiting to the secure zone system. Instead, long-lived certificates are used in these environments where more manual intervention is possible.

I think we need to recognize that Let's Encrypt is a tool for commodity public websites, anything else and it quickly falls down on the job.


[–]Kaizyx 0 points1 point  (0 children)

DNS Validation won't work either given that requires the requesting host to have Internet access to do an update of public DNS records and to obtain the certificate from the ACME server. When a network may not have an Internet connection for security, neither operation can succeed.

ICANN Board Rejects Sale of .ORG Registry by InsaneOstrich in technology

[–]Kaizyx 2 points3 points  (0 children)

I work in the industry, I'll try to ELI5,

Basically, all domain names (e.g. reddit.com) throughout the world belong to a global public records system called the Domain Name System. This system is kind of like a series of phonebooks for the Internet.

There are many different phonebooks out there, anyone can write one but whether it is included in the global system that everyone uses is another story.

ICANN on behalf of the Internet community (us) decides which "top level" phonebooks like .com, .net, .org (Top Level Domains) are official and how they fit in with other official top level phonebooks. ICANN has legal agreements with the groups who write those phonebooks to make sure they follow certain rules.

The people writing the top level phonebooks usually allow other companies to help them write and maintain their phonebooks. These companies are the registrars who deal with domain name owners directly, collect money, enter the information, etc. Domain owners (like Google with google.com) can write their own phonebooks too for their domains, kind of like how a company may have a book of their own containing phone extensions for employees.

In this case, Ethos Capital, an outsider attempted to buy out the group who writes the .org Top Level Domain "phonebook", the Public Interest Registry for $1.1 billion USD. This was a bad thing for a variety of reasons, which are hard to ELI5:

  • The Public Interest Registry is a non-profit group who sells domain names to organizations like Wikipedia and EFF and small groups like open source software projects. Ethos Capital would have converted PIR to a for-profit mission, driving up costs that registrars would need to pass down to domain owners like Wikipedia, EFF, open source software projects, legal clinics, etc.
  • They wanted to make this a leveraged buyout which would have placed a debt of $360 million USD upon the PIR. This would drive up costs further that registrars would again need to pass down.

In any case, the buy-out request invoked a section in the PIR's agreement with ICANN that requires ICANN to consider whether it's really in the Internet community's interest that that happen. Part of ICANN's processes also requires that in decisions like this that they seek public comment.

ICANN was given a mountain of evidence and open letters from the Internet community, along with urging from the Californian Attorney General. Given a mountain of evidence that could not be ignored, ICANN's hand was forced to say "no".

I hope this is at least moderately understandable considering the complexity of the situation.

Rented future - the dangerous rise of life as a service by JRepin in technology

[–]Kaizyx 0 points1 point  (0 children)

While technically true, I think we should consider that the accepted definition of "luxury" is decades - maybe even a century out of date in some categories.

Many things today are misclassified as luxuries simply on the basis that they are better than what existed or did not exist at all decades or centuries ago. You could argue that all modern apartments are luxuries because they have advances in safety and security that people got by without in the past. You could also argue that all electronic devices are luxuries because people in the past didn't need them.

As well, many things are misclassified because we as a society are overloading items of necessity with recreational/non-essential functions. For instance there was a point in time that telephones were just devices to contact people by voice. There were times where cars didn't have onboard computers. Those things are going away now and we need to accept that "luxury" functions may exist on basic necessity items because it isn't economic to create simplified versions.

As a society, we have grossly failed to maintain an updated understanding of what is a necessity for a very long time. As a result, practically everything we use today is classified as a "luxury" and nothing exists as a necessity anymore.

.ORG Isn’t Broken, and We Don’t Need Private Equity to ‘Fix’ It by MyNameIsGriffon in technology

[–]Kaizyx 12 points13 points  (0 children)

I guess my thought is that nobody buys something without expecting to make money so when we end up seeing massive price increases there should be a consensus that .org isn’t the desired domain for organizations anymore.

The thing about this conclusion that troubles me is that we can't build an Internet this way. Keeping our valuable non-profits and other public benefit organizations as nomads constantly shifting to a suitable registry of the day is not tenable or fair to them. It would only serve to undermine their hard work while destroying the point of DNS to create memorable, stable namespaces.


[–]Kaizyx 5 points6 points  (0 children)

If you use fully-featured DNS server software like ISC BIND, you can run a server that implements a DNS resolver like At the same time, you can locally define custom TLDs or domains ("zones" in DNS parlance) which your server will claim to be authoritative for. Anyone using your DNS server as their configured resolver will be able to then resolve those custom names in addition to conventional public names.

Some companies use this technique to create ".local" domain names for services within their company LAN. It's generally severely frowned upon as it's unknown if such custom names will come into existence on the public DNS at some point and you won't be able to resolve those names due to the conflict.

As for propegation into the public space, that is not possible unless there is some human coordination that happens for other resolvers to pick up the idea that your server is authoritative for those names. Otherwise your server is pretty hidden.


[–]Kaizyx 65 points66 points  (0 children)

Ah, if that's the case, apologies to /u/Powystan for mis-reading into the question and going off on a tangent.

In such a case there's multiple reasons:

Some TLD registries do not have price controls. .org does. There have been many situations where an organization or group registered a domain name on one the other registries and when renewal comes around, the price is substantially higher because they know you'll need to pay to keep the domain. It's blackmail, but the registry agreement lets them do it.

Also, a TLD can factor into your trustworthiness; "eff.org" is seen as more trustworthy and professional than "eff.ninja" for instance.

This trustworthiness can have operational impacts with website reports (like Google Safe Browsing), email delivery, etc. One example of this off the top of my head is that there are mail operators who outright block all email originating from .xyz and .info because there is more spam originating from them than legitimate mail. .org is a safe bet for this.

Plus, if an organization already has a .org, a lot of their organization infrastructure - including their computer networks may be using the .org domain and a transition would be potentially thousands of dollars of infrastructure change work that can potentially compromise their ability to do work.


[–]Kaizyx 69 points70 points  (0 children)

DNS operator here. Anyone on the planet can set up their own Domain Name System (DNS) server and set up any domain name zone on that server that they like. You can even set up "microsoft.com", "amazon.com" or "google.com" if you so please. Where this becomes tricky is that the rest of the planet doesn't share your opinion that you/your server is the authority for that given name, so nobody is going to be able to get to your website, connect to your services or send you email except you and maybe your friends.

Currently, the general consensus is that we coordinate through ICANN to designate what Top Level Domain (TLD) registries like ".org" exist and who operates those registries and from there, those registries designate domain names to people who register domain names.

Firefox is showing the way back to a world that’s private by default by Bemuzed in technology

[–]Kaizyx 1 point2 points  (0 children)

Cloudflare has done a lot of hidden harm to the Internet.

First of all, they have normalized the fact that DDoS attacks happen and have shifted the blame for dealing with attacks to victims ("should have been using cloudflare!"). Today there is much less resources and public calls for dealing with sources of attacks and attacks are becoming stronger and Cloudflare only serves to profit keeping it that way so websites are forced to use their services "or else". The Internet is less stable.

Second of all, they have made the Internet much less accountable. It used to be that with relative certainty we could figure out where malicious websites (malware, phishing, credit card and identity theft forums, DDoS-for-hire "stresser" services) were hosted and build cases to conduct takedowns like McColo. Now they're all behind the freedom-of-speech righteous Cloudflare where there is no accountability. The Internet is less secure.

Thirdly, with their public DNS/DNS-over-HTTPS service, they are in a prime position to violate net neutrality. They can in essence provide their website clients a "fast lane" (faster DNS resolution = faster website loading) to Firefox users. This means that websites that do not use Cloudflare may appear to load slower in Firefox and may be essentially blackmailed to use their services. The Internet is less neutral.

Apple drops a bomb on long-life HTTPS certificates: Safari to snub new security certs valid for more than 13 months by nizmoz in sysadmin

[–]Kaizyx 6 points7 points  (0 children)

I wouldn't say that this statement is entirely true.

Regardless if it is the CAB Forum as a body or as in this case Apple introducing public policy, it's not uncommon for such policies to result in technical constraints (code) being introduced into software. This means that if such software exists within your private environment, you must take those constraints into account in your operation of your private PKI if you wish to avoid certificate errors.

The Great Google Revolt: Some of its employees tried to stop their company from doing work they saw as unethical. It blew up in their faces. by [deleted] in technology

[–]Kaizyx 0 points1 point  (0 children)

The culture of openness had gotten a bit too skewed recently towards disruption than towards positive action. And the firings are just a matter of correcting for it.

Arguably Google Inc itself is guilty of the same, but greater offense in society. They have no place to talk about order. They have abused society's culture of freedom and likewise skew things toward disrupting society in ways that are not positive.

They misuse their leverage to tear apart aspects of society they do not like, including privacy and freedom of association. They also do not respect the voluntary process of adoption of their ideas, removing those who refuse their ideas from online visibility. They trample upon consensus-based public standards processes by misusing the market dominance of their products to go ahead to implement their ideas to force their way.

For them their disruptions are "clever", "innovative" and "progress", but on the whole it does not result in positive action in the longterm.

I think in many regards, Google is reaping what they sow. They are feeling the result of the longterm normalization of disruption and radicalism where law, rules and order are fungible if you're clever enough or innovative enough to step over them or even upon them in the name of "progress".

If Google expects people - including employees to be civil and respect and take seriously their processes and policy, they need to lead by example.

The future of distributed shell commands. by MordecaiKravits in linux

[–]Kaizyx 0 points1 point  (0 children)

As a network engineer, I've always found interactive shells the wrong tool for the job of working with a large number of hosts at once. This post is kind of an XY problem.

The issue with shells in this regard is that there is little way to verify that shell A is behaving in the same way as shells B through Z, or even yet shell H could be yet different still. It is indeed possible to monitor output of each command and guess things are going well, but at the same time, there may be inconsistencies in the lesser visible environment which may cause different hosts to behave differently which may cause unpredictable and risky results.

The better solution is to use a management tool like ansible and to create the configuration/playbook on a test host with verifiable steps that can raise an alert if something goes wrong, then have that tool perform the mass-operation and monitor success.

The only time where direct mass SSH may be okay is if you're doing extremely basic commands, like rebooting. Anything more complex than that is generally a no-go.

The city of Largo, Florida, is spending $1.7M to transition from Linux to Microsoft Windows. by pdp10 in linux

[–]Kaizyx 0 points1 point  (0 children)

While this is very much and undeniably true, and while Red Hat does use community-developed software in their work, we can barely call the meat and potatoes of the work of Red Hat does a "community effort".

If they have to pay people to care about a given purpose, it's not a community effort, that's employment. If they have to do a long laundry list of work themselves to bridge chasms and make Linux viable for a given purpose, it's not a community effort either. That's their credit. If they have to do research themselves to determine government needs, that is their private work.

Most people in the community are still very much at best at arm's length from that work.


[–]Kaizyx 2 points3 points  (0 children)

Or, of course the other possibility is, such a small team is likely not enough to have a significant effect.

I think herein is a major problem with the open source community. The community is prone to over-estimate the power of small-scale efforts because that is what works for the majority of problems that FOSS developers voluntarily tackle. This is where that whole "scratch your own itches" line of thinking comes from too.

I don't think people in the community really appreciate the amount of resources that it takes to design, build and support infrastructures and tooling that can power an organization like governments, because let's face it - the FOSS community has never tackled that problem firsthand. The community has generally stuck with the scale of an individual desktop computer owned by a developer where small efforts can have relatively major impact, so that's the measuring tape that the community measures everything by.

EU judge tells Google it landed on Monopoly’s ‘Go to jail’ square by Kassina in worldnews

[–]Kaizyx 0 points1 point  (0 children)

it is not a question about google, but rather about the general policy. Companies do shit, as much as people do shit. But the lives of many people are dependend on the existance of the company, the bigger, the more. And they have no fault when a CEO is doing shit.

I agree with you completely. However, perhaps this speaks to the problem presented when few large companies drive society to depend upon them in such ways, society begins letting them do what they want because of the leverage they hold over people's lives. We can't pretend that companies do not leverage this exclusivity to ensure that society can't switch away from them or the like.

With this in mind, I think if we keep knee-capping large companies for their social and ethical debt, the average size of the largest companies will be smaller and it will be easier for capitalism to do its thing with an actual market where we are not constantly running on the edge of social destruction if we lose companies.

Honestly, I like the German system for that pretty much. If you can proove that a CEO has knowingly caused a fine against the company, he can (and has to be) forced by the board of directors to repay the company from his personal posessions the fine back.

I like the theory behind this system as well, but I'm not sure if it holds much weight in the current status quo.

Currently, the market rewards those who take the most risk, cut the most corners, and those willing to break the law are especially valued. At the same time, the market penalizes those who follow the rules because they don't take the risks the market wants. There are many CEOs who consider that law you highlight among many others to be challlenges to be overcome in the quest for delivering profit, rather than limits on what they should do.

I feel that things like the VW emissions cheating, Google's abuse of their position and any other socially bankrupt thing will only stop when people like investors are forced to pay the price for creating the demand for socially bankrupt things.


[–]Kaizyx 2 points3 points  (0 children)

Creating fines that are to a magnitude that it endangers bankrupcy will cause more harm to alot of innocent people who have no fault in the situation than it brings good.

If society is relying upon super-important companies running on a deficit of ethical and social responsibility, it is no more a tenable situation than relying upon a super-important company verging on bankruptcy already. It's just when a company is socially and ethically bankrupt, there's nothing to force the company to reorganize because those things aren't a direct financial liability.

Thus I feel that we shouldn't have businesses that are "too big to fail" in this regard. If such corporations go out of business, so be it. It will be a collective pulling off the band-aid not living beyond our ethical and social means. We can pick up the pieces and new businesses will come into existence to fill the void. Google is not irreplaceable.

Mycroft is being targeted by a patent troll by ikidd in linux

[–]Kaizyx 2 points3 points  (0 children)

And it would be nice to see the bigger fish either step in and help or at least organize some sort of patent troll defense fund to help out "the little guy".

The problem is that throughout all of tech including open source, we have a big giant tragedy of the commons going on. Thanks to the neo-libertarian culture that disproportionately puts individual freedom above all that is currently thriving, we permit those who can make a difference in important issues to turn the other way and justify doing so by saying "not my obligation".

Because of this, we do not have strong public programmes and associations of stakeholders to protect the "little guy" as we insist that it's nobody's obligation to make those things happen. We instead have a model where smaller actors are on their own to solve their own problems, including protecting themselves legally and coming up with the resources to do so again on their own.

Indiana House OKs legislation barring companies from microchipping their employees by Cmoney61900 in technology

[–]Kaizyx 0 points1 point  (0 children)

That sounds a little extreme. I got a chip in my hand, why should I be prohibited from doing that if I want to?

This is very much "it isn't you, it's us" situation.

The entire issue is that humanity is inherently biased toward those who have certain traits while discriminating upon others who do not. Naturally decisions are biased toward those who "have". We already have gross inequality due to economic status or possessions or things like those who drive vs. those who do not. It is also much the same reason why we have deemed eugenics to be a bad thing.

Only once we can resolve the bias while allowing humanity as a whole to move forward - rather than just individuals, then we can begin using such such features like chips in the due course of society.

For now though? You can keep using your chip for personal usages like entering your house or starting your vehicle or logging into your personal devices but society shouldn't be involved in its usage. It doesn't know how to use your chip correctly without negatively impacting the whole.

She fractured her spine after the car ran a red light. Uber said she signed away her rights to a jury trial. by fatcat111 in news

[–]Kaizyx 1 point2 points  (0 children)

Their service is matching independent drivers with passengers.

We could also say that travel agents for instance are just "matching" people with locations not owned by the agency. However, such agencies are indeed liable if they "match" and send their customers to a location in which that customer may experience harm but don't do due dilligence to prevent that harm. This is because at the end of the day, the travel agent is regarded by the customer as a professional expert in making determinations of safe, secure and enjoyable locations and it is that agent that is making the match to the customer. With this in mind, agencies carry Errors and Omissions insurance should they put a customer in harm's way.

With this in mind, Uber customers likewise are inherently trusting Uber as a professional expert in the field of choosing safe drivers. When they fail to do that task, they should be liable for professional negligence leading to harm. Sure, they may not have "known" that this driver was risky, but that lack of knowledge is on them because they are the trusted expert on their drivers. Uber should thus carry E&O insurance for this purpose if they are uncomfortable or incapable of paying out full damages themselves.

Website scraper hammering web server by GeekgirlOtt in sysadmin

[–]Kaizyx 1 point2 points  (0 children)

This is why many of us use a waf like Cloudflare.

In my opinion, Cloudflare has done a lot to allow the tech community to brush everything from network abuse to insecure devices under the rug while shifting blame to victims for "allowing" themselves to be attacked.

While sure, Cloudflare is one of those free things you can "do for yourself" and you can't directly control the source of attacks, it really feels like a temporary technical solution to a social problem. This solution like many other similar solutions now means that there is less community urgency to tackle the actual problems at hand, ergo people become complacent. This in turn takes a lot of heat off of the bad actors and those who enable them through negligence or wilful collaboration.

The Decade We Learned There’s No Such Thing as Privacy Online - And a corrupt U.S. government seems incapable and unwilling to do anything about it. by mvea in technology

[–]Kaizyx 0 points1 point  (0 children)

If I'm understanding them correctly, they mean things like:

  • Google reserves the right to de-list/de-rank your website from searches, meaning people are unlikely to discover your website when searching about a topic.
  • Facebook and Twitter can block messages containing your website URL, meaning people can't talk about your website on social media.
  • Cloudflare whose service you can't reasonably implement on your own can decide not to extend their services to your website, leaving you vulnerable to DDoS on an Internet that now blames victims of attacks for not being protected.
  • Paypal and Patreon can decide to not process payments (including donations) for you.
  • Google and Microsoft among other major freemail providers reserves the right to for any reason block your website from sending email messages to your users that use their email services - even if your users legitimately request the messages (e.g. account sign-up info, password resets, newsletters, etc).

Even just one of these things can be in effect a death penalty for the majority of independent websites today. Big tech companies are in essence, middlemen who enjoy the ability to make arbitrary decisions about who exists in the ecosystem of the modern Internet and who doesn't.