The antišŸš«-derailmentšŸšƒ & threadšŸ§µ hijackingšŸ”« threadšŸ§µ ā‰

Sometimes shielding against future coders is also within scope.

The limitation you unveilled is not preventing you from from posting that content. itā€™s only preventing you from posting it in a specifically formatted way which can be used to exploit stuff.

And when I say I can see why they would prevent it, itā€™s because even if the current devs handle that case, they might be aware that once their dev is complete theyā€™ll probably be moved into a newer development and Junior devs will be set in charge of maintaining their work.

So just ā€œtrusting that the next wave of untrained devs will not fuck up and turn this into a security issueā€ has been proven time and time again as a terrible Idea.

You misunderstand what Iā€™m saying.

Data should be data. Data parsing for the purpose of pretty-printing should never lead to remote execution, heap overflow or anything like that. If the codebase is sane, this just doesnā€™t happen, and making it happen requires a special kind of effort. If the codebase isnā€™t sane, or dubious, or untrustworthy, then developers pile on layers of code to guard against possible harmful data.

This has nothing to do with junior or senior programmers. There are plenty of shitty old coders and talented young ones. This only has to do with competence. You donā€™t code for future incompetence anymore than hotel maids lay plastic sheets on the floor of the guestsā€™ rooms in case the maids in the next shift might have trodden in a dog turd.

You are relying too much on ā€œshouldā€.

Just because you parsed the data on your code doesnā€™t mean a junior dev put in charge of maintaining your code wonā€™t fuck up your parsing.

Iā€™m not saying that what is happening here is the best practice.

Just that I can understand why someone would go to extra lengths to make it even harder for someone to accidentally enable remote code execution.

Agree. Although you have higher odds of getting someone randomly allocated to maintain your project to accidentally fuck up your input sanitization.

Actually, ā€œcoding with future incompetenceā€ is at the heart of every best practice guide.

See all the formatting standards, all the ā€œreadability mattersā€, all the guidelines all the modern languages haveā€¦

All of those globally accepted best practices stem from ā€œcoding in a way to mitigate future incompetenceā€.

2 Likes

Dunno if itā€™s interesting for anyone here (though I hope so :wink: ), but there is currently a petition against biometric mass surveillance going on in the EU. If youā€™re interested, you can sign it hereā€¦

1 Like

Signing a petition to fight for the right to be anonymousā€¦ The irony is strong with this one.

Itā€™s an official european citizen initiative, so itā€™s obvious you have to have the signature verified somehow. And I have no problem with providing some of my data to the EU when I can actually have at least a bit of influence on politics. I mean, if I write a letter to some ministery itā€™s not anonymous as wellā€¦ but that wonā€™t keep me from doing it, if I have a reason to.

Yeah I realize that.

The problem with this one is, all youā€™re going to do is leave your name somewhere. Nothing will change because the powers that be love mass surveillance, big data loves mass surveillance, and the two are in cahoots.

You can dance on your head and sign whichever petition you want, all youā€™re going to do is identify yourself as someone who should receive ads for VPN services, and possibly end up on a list of people who question authority.

As far as I know, if enough people sign it (1 million within one year), the EU commission has to take a look at that. I have no idea if it might change anything, and I know that lobbyism and the like are mostly making every law on earth, but - if I donā€™t sign it, Iā€™ve done nothing. If I sign it, I told the authorities that govern my country that I am not okay with mass surveillance. Thatā€™s one of the points of democracy, I mean, if I am sure I canā€™t change anything I might as well live under some dictator.

And Iā€™m okay with ending up on a list of ā€œpeople who question authorityā€ - simply because I live in a country where this has no negative repercussions and because I might help making that list big enough that it will become useless, and therefore less dangerous for people who live in more restrictive countries.

Iā€™m not naive, just still optimistic :wink:

2 Likes

If you sign it, youā€™ve helped the authorities profile you on your own accord (which is what European citizens initiatives are half about, really) and nothing will change. Yeah, the commissioner will look into it given enough signatories. Heā€™ll take a quick look and then heā€™ll received Google reps, have dinner with them at the Fouquetā€™s and shelf the file.

If you donā€™t sign it, at least you keep flying under the radar.

Tell me exactly what honest person is, who doesnā€™t stand to profit from it. What new information will this petition provide exactly? Nobody wants mass surveillance.

You of all people should know better.

That much is obvious :slight_smile:

Nahā€¦ questioning authority is a popular sport in todayā€™s Germany :wink:
You can be pretty nonconformistic and still have a job, a home, whatever, and you donā€™t have to fear prison for just stating your opinion.
I know we have quite a troubled past with that point, but today, I think it is one of the few countries in the world where you can even openly oppose the government and still donā€™t have to fear consequences (as long as you remain non-violent, obviously). That leads to idiotic movements as well, like those ā€œReichsbĆ¼rgerā€, who even say Germany doesnā€™t really exist at all - and yet, they are allowed to roam the streets and state their (hilarious) opinion.

I think most people who donā€™t sign it donā€™t do so because they want to fly under the radar, but more because they just donā€™t care. And that might be what most politicians think - that they can install all this shit, and people just wonā€™t care - especially because everyone is a lot more busy thinking about the pandemic than anything else. They already pushed through some very bad laws considering data privacy in the last few monthsā€¦

Lots, simply because, like I said, they donā€™t care at all. I usually hear this wonderful ā€œbut Iā€™ve got nothing to hideā€ - answer whenever Iā€™m talking to people about anything privacy-related.
And video surveillance? Like, everywhere you go? ā€œNah, itā€™s okay, because Iā€™m no criminalā€. :expressionless:

And - we Germans of all people should know better that this might change very fast, agree with you on that :wink:

1 Like

There is that. But more worryingly; thereā€™s a lot of people who think mass surveillance is an acceptable tradeoff for what they get out of it - rebates in supermarkets with their membership cards, cheaper shipping with their Amazon Prime account, tailored ads and the convenience of single signon.

Iā€™d like to be able to say that if those people knew what they lose for the nickel-and-dime things they get out of the deal, theyā€™d rebel. But I know they wonā€™t because people have a bovine approach to personal information management.

As for ā€œdoing somethingā€, not everything is worth doing just because itā€™s a right and itā€™s touted as a hallmark of democracy. Voting for example is pretty pointless. Most people will jump at me for saying that, because theyā€™ve been brainwashed into thinking you must vote to assert the fact that you live in a democracy. But voting has been turned into a Pavlovian reflex by fascist sumbitches and their corporate masters. The truth is, people drag their asses to the voting booth and press buttons that arenā€™t connected to anything, and they think it serves a purpose other than reassuring themselves.

Case in point: in 2005, I was living in France when the referendum for the European Constitution took place. I voted no (silly me, but there ya go) and a majority voted likewise in France and in the Netherlands. As a result, the entire project fell apart. What happened in the end? The powers that be at the time signed the Treaty of Lisbon, which is the exact same thing, but between themselves this time, without asking nobodyā€™s opinion - donā€™t make the same mistake twice.

Thatā€™s the year a realized, you know what? If they donā€™t care about our input and only act on it when it suits them, why the hell should I get up early on public holidays to play that game? Iā€™ll just stay in bed and watch what they planned on happening whether I vote or not. And I havenā€™t cast a single ballot since. And Iā€™m glad to say, Europe is going the direction Europe wants to go whether I get up or not :slight_smile:

Part of me is afraid you might be very right hereā€¦

To be honest, I started voting less than ten years ago - before that, I simply couldnā€™t find any party I totally agreed with, and so I decided no party was ā€œworthyā€ of my vote. Now I found one (thatā€™s happily somewhere around the 1%ā€¦), and I vote for them. I know they will never ever have much influence. But by doing so, I simply say that what they do is important for me, nothing more, nothing less. And I would be pretty angry if I would vote for one of the 2, maybe 3 big parties that finally rule the country and they make some shitty decisions (they inevitably will), and I would have to say ā€œwell, I voted for themā€¦ā€. So thatā€™s why I vote :wink:
Oh, and because all those frustrated idiots that didnā€™t vote for a long time as well now tend to vote for some rightwing-idiots, and I kinda want to set a counterweightā€¦

Yep, and thatā€™s why I get on everybodyā€™s nerves from time to time, trying to make them a bit more aware. Sometimes it even works :wink:

Thatā€™s true. But I just personally feel better if I have the opportunity to state my opinion. Maybe it changes nothing at all. Maybe others see it, and ā€œdareā€ to open their mouths as well. Maybe others disagree, and I have an interesting discussion. Maybe it changes something in the long run. But at least, there are those possibilities. If I just stay silent, nothing happens at allā€¦ :wink:

1 Like

Well, I admire your optimism and your faith in the system. But like you yourself says, it probably only serves to make you feel better.

Only? Hey, Iā€™m enough of a hedonist to be quite satisfied with that :stuck_out_tongue:

2 Likes

I must say, Iā€™ve never heard anyone state theyā€™re signing a European citizenā€™s initiative to pursue hedonistic purposes :slight_smile:

I mean, the matter is important to me, totally! But like I said, Iā€™m not naiveā€¦ so, Iā€™m not sure if my sign makes any difference, if it really leads to better laws or whatever.
But it gives me the feeling of ā€œmaybe having some influenceā€, of not being totally passive, and I think thats actually the main reason why people sign such things :wink:

And Iā€™m totally sure most things people do are done to pursue hedonistic purposes - sometimes obviously, sometimes less so :wink:

1 Like

My only issue with these actions is the same as with mass action against companies who abuse your data.

Ultimately nothing will actually change, but we will have some sort of whiplash and the facade that things changed (which will be enough to prevent real change from happening)

As inā€¦ virtually the only way to ensure that there is no abuse of biometric mass surveillance is if you open up all the channels so that they can be monitored constantly. Which is in itself a bigger breach of privacy!

And even with that, any malicious agent will keep on doing it.

Just like with all the fuss about data privacyā€¦ now we have to deal with 27 popups on every page we visitā€¦ and whomever used to harvest your data will still continue to do so. Simply because there is no way to actually monitor that.

:pensive:

Still, that is a good initiative anyway!
Even if only to help shape some minds.

i will with the next batch. i have a very small handful of test mags left over but they are already set aside for the next batch and resting comfortably in Michelleā€™s inventory warehouse.

1 Like

That is exactly the backlash you talked about. Big data simply went ā€œOh you wanted GDPR did you? Well there you go: now you can click smoothly on Agree or Customize your cookie preferences in a very annoying, very long, very wordy GDPR-compliant page in EVERY SINGLE FUCKING PAGE you visit. Happy now?ā€

The net resut is: everybody is annoyed at the GDPR because they have to click on Agree on every page to get to the meat of the website. And nobody wants to customize cookies: either people donā€™t care, or they do care but they know itā€™s all a lie and big data will track them anyway. Exactly what big data wanted.

You just canā€™t rein that industry in. Not when they have the lawmakers in their pockets.

Well okay, but what is the alternative? What is your idea for preventing people being tracked (not only by phone, but visually as well) on every single step they make?
Thing is, I can, to some degree and with some work, protect quite a bit of my online-privacy. Like, using TOR, deleting cookies, whatever - it might take some efforts, but it is at least possible to be ā€œa bit harder to trackā€. With surveillance cams, thatā€™s completely impossible - I canā€™t change the way I walk, and I donā€™t want to change the way I look, especially since I am usually sticking out in every possible crowdā€¦ so, if there would be a working way to bypass this camera stuff, Iā€™d be less nervous about it. But there isnā€™t. I know there is this project with different kinds of very asymmetric hairstyles and makeup that confuse cameras and facial recognition, but aside from that, there are not many possibilities.

Okay, but advocating for less privacy because people will be too lazy to use it anyway is kinda hilarious. If people are too lazy to delete their cookies or to log in every time they visit a site, itā€™s their problem. But for those who care, the possibilities are there, and thatā€™s what is important.

Like, take a totally unrealistic example. Cam surveillance on all public places, but you can use a little button to say ā€œno, I donā€™t want thatā€, and then you gain some super-invisibility-skill of some sort - Iā€™d be happy about that, no matter how many people would be too lazy to push that button.
Sadly, cam surveillance doesnā€™t work like that.

I think there are two big problems about privacy - one, that people just donā€™t care because theyā€™ve got ā€œnothing to hideā€, and the second that people resignate and think itā€™s all out of control anyway. I refuse to belong to either group. It has never helped anyone to just stick the head into the sand.