@MediaActivist@todon.eu"While the possibility of socially engineering backdoors in critical software seems like an indictment of open-source projects, it’s not exclusive to open source and could happen anywhere. In fact, the ability for the engineer to discover this backdoor before it was shipped was only possible due to the open nature of the project.” The Other Players Who Helped (Almost) Make the World’s Biggest Backdoor Hack
@raiders@darktundra.xyzRaiders offensive lineman Jackson Powers-Johnson can't help but laugh at the draft rumors surrounding him https://www.yardbarker.com/nfl/articles/raiders_offensive_line…
@LillyHerself@Mastodon.socialIt's likely that this photo can only really be appreciated on a larger screen, as it's taken in very little light.
Digital photography has an amazing ability to capture colour images in next to no light, and with such rich blacks. Can't help but remember how hard it was to get anywhere near this with old style photography.
I'd love to see others' dark photos too - shall we start a hashtag for it?
@unchartedworlds@scicomm.xyz
@josemurilo@mato.socialWhat a great #fedithread!
Lots of ideas & links.
RE: https://cosocial.ca/@evan/112185826897209052
@thomasfuchs@hachyderm.ioPeriodic reminder to get help for your mental health and help others with theirs. I’m at my scheduled Ketamine treatment.
@dichotomiker@dresden.networkGoogle founder Larry Page wants to run the whole society without the need of loudly spoken words.
Others just try to help: https://www.youtube.com/watch?v=oKpGjQ8MqtM
@rae@bne.socialBe the grease, not the grit. #FutureOffWork
How do you become a friction fixer at work? Professor Bob Sutton has some suggestions - ABC News
https://www.abc.net.au/news/…
@andycarolan@social.lolHere is a quick tour of my personality, values and quirks! It's purpose is to help others better understand me and get the most from our interactions.
#UserManual
@jamesgleick@zirk.usNot sure the word “bachelor” means what Pecker thinks it means. https://masto.ai/@Nonilex/112321734734683254
@megapenguinx@social.linux.pizzaWelcome to Penguin Picks
In a world dominated by screens, my media consumption feels devoid of impact. I'm done with tech reviews; I want to share what excites me and help others find cool stuff. Join me as I explore and recommend diverse media, aiming for a neat but spontaneous journey. Let's inject meaning back into our digital lives.
<…
@arXiv_mathAT_bot@mastoxiv.pageStrong minimal model theorem and Massey products
Martin Markl
https://arxiv.org/abs/2404.19607 https://arxiv.org/pdf/2404.19607
@rae@bne.socialBe the grease, not the grit. #FutureOffWork
How do you become a friction fixer at work? Professor Bob Sutton has some suggestions - ABC News
https://www.abc.net.au/news/…
@cliffwade@allthingstech.socialI want to make a list of some of the best and most interesting tech related Mastodon accounts that we have available and I need your help!
Comment below with any and all tech folks or tech accounts that you feel should be included in a list and that you follow and recommend others to follow as well!
#Tech
@Techmeme@techhub.socialMumbai-based Neysa, which offers a suite of generative AI tools to help clients manage their AI projects, raised a $20M seed led by Matrix, Nexus, and NTTVC (Jessica Rajan/The Economic Times)
https://economicti…
@edintone@mastodon.greenDiscovery of Genetically-Varied Worms in Chernobyl Could Help Human Cancer Research https://www.goodnewsnetwork.org/discovery-of-genetically-varied-worms-in-chernobyl-could-help-human-cancer-research/
@blakes7bot@botsin.spaceSeries B, Episode 10 - Voice from the Past
VILA: Blake? You read me Blake? I'm gonna have to get the others to help. You realize this?
[Astroid. Nagu gestures for Blake to come in. Five or six people are sitting on couches, including Shivan, wrapped in a complete body bandage]
https://blake.torpidity.net/s/210/279 📺 B7BC
@NicolasGriseyDemengel@piaille.fr"Ask the question at talks", when you're confused by unfamiliar jargon.
I couldn't agree more. I often do this when I hear a new acronym. It's not a crusade against acronyms but against _unexplained_ acronyms that only prevent people from understanding your point.
Don't hesitate to do the same! And if you're a speaker (at work or in conferences) please introduce your acronyms before you use them 🙂
@AnthonyCollette@infosec.exchangeYou Can Be...
Brilliant At The Basics Of Cybersecurity
The World has changed.
What worked to keep us safe online 15, 10 or even 5 years ago — simply doesn’t work anymore.
But staying safe online doesn’t have to be hard or complicated.
One by one, you can master these Fundamentals of Cybersecurity:
☑️ Use a high-quality Password Manager.
☑️ Create strong, unique, modern passwords for each online account.
☑️ Use a DiceWare passphrase to lock your phone / laptop / tablet.
☑️ Use a DiceWare passphrase to lock your Password Manager.
☑️ Use Multi-factor Authentication for each online account that offers it.
We can thank The Electronic Frontier Foundation (EFF) for this great advice.
We know it can feel overwhelming. Start small and build from there.
REMEMBER — You have the power to keep yourself safer online!
***** FREE LAPTOP STICKERS | HELP US SPREAD THE WORD! *****
If you’d like 2 free Brilliant At The Basics Of Cybersecurity laptop stickers, we'll be happy to send them out to you right away.
1.) Visit this Brilliant At The Basic page on our website: #BrilliantAtTheBasics
_________________
♻️ Please feel free to share this post and let others know about this offer.
@thomasfuchs@hachyderm.ioPeriodic reminder to get help and help others for your and their mental health. I have severe treatment-resistant depression and I’m at my regular Ketamine appointment.
@arXiv_csET_bot@mastoxiv.page"ChatGPT Is Here to Help, Not to Replace Anybody" -- An Evaluation of Students' Opinions On Integrating ChatGPT In CS Courses
Bruno Pereira Cipriano, Pedro Alves
https://arxiv.org/abs/2404.17443
@arXiv_csCV_bot@mastoxiv.pageThis https://arxiv.org/abs/2403.15360 has been replaced.
initial toot: https://mastoxiv.page/@arXiv_csCV_…
@arXiv_mathAT_bot@mastoxiv.pageStrong minimal model theorem and Massey products
Martin Markl
https://arxiv.org/abs/2404.19607 https://arxiv.org/pdf/2404.19607
@servelan@newsie.socialUS Asked China and India to Help Prevent Russian Nuclear Strike: CNN
https://www.businessinsider.com/us-asked-non-allies-prevent-russia-using-nuclear-weapons-report-2024-3
@UP8@mastodon.social🪦 50 Americans have died in Ukraine since the Russian invasion
#war …
@incurablehippie@verified.mastodonmedia.xyzI wrote to the UK Council for Psychotherapy after they withdrew from the Coalition Against Conversion Therapy... [1/2]
@deprogrammaticaipsum@mas.to"The hatred against Microsoft, starting with the letter to hobbyists in 1976, fueled by Dijkstra, Wulf, Papert, and so many others, naturally spread to BASIC. If you read carefully, the “13 ways to loathe VB” penned by Verity Stob are directed more to Microsoft than to the language itself:
> 13. Bill is making even more money out of this. And I am powerless to stop him. In fact, I am helping him.
Of course, abominations such as On Error Resume Next did not help."
@cdarwin@c.imThis is a little disappointing, but age teaches us that kind, simple and practical are enough, even in the face of the worst things we’ve lived through: suicides, mental illness, odious leaders, sudden death.
My friend Don was called one day by an aging and suicidal friend. His friend asked, “What is the point of it all?”
After a moment, Don replied gently, “Mornings are nice.”
And, wildly, it was enough. His friend improved.
@rose@linuxrocks.onlineA few things currently and credibly threaten to kill billions of people. This is not hyperbole. Runaway climate change, solar weather, a nuclear exchange, several others. Front page news occasionally reminds us of a few of these, but mostly it's about sick princesses, manufactured crises in USA congress, and other relative fluff. We bemoan the steep decline of the media business, but does a healthy one actually materially help us? We're swirling around the drain either way.
@burger_jaap@mastodon.social @blakes7bot@botsin.spaceSeries C, Episode 02 - Powerplay
AVON: I must talk with Zen, find out what we have to do to help the others.
[Scene - the corridor, Tarrant, Klegg, Harmon and the remaining two guards]
https://blake.torpidity.net/s/302/215 📺 B7B3
@rene_mobile@infosec.exchangeMy current take on the #xz situation, not having read the actual source backdoor commits yet (thanks a lot #Github for hiding the evidence at this point...) besides reading what others have written about it (cf. #rustlang for such central library dependencies would maybe (really big maybe) have made it a bit harder to push a backdoor like this because - if and only if the safety features are used idiomatically in an open source project - reasonably looking code is (a bit?) more limited in the sneaky behavior it could include. We should still very much use those languages over C/C for infrastructure code because the much larger class of unintentional bugs is significantly mitigated, but I believe (without data to back it up) that even such "bugdoor" type changes will be harder to execute. However, given the sophistication in this case, it may not have helped at all. The attacker(s) have shown to be clever enough.
6. Sandboxing library code may have helped - as the attacker(s) explicitly disabled e.g. landlock, that might already have had some impact. We should create better tooling to make it much easier to link to infrastructure libraries in a sandboxed way (although that will have performance implications in many cases).
7. Automatic reproducible builds verification would have mitigated this particular vector of backdoor distribution, and the Debian team seems to be using the reproducibility advances of the last decade to verify/rebuild the build servers. We should build library and infrastructure code in a fully reproducible manner *and* automatically verify it, e.g. with added transparency logs for both source and binary artefacts. In general, it does however not prevent this kind of supply chain attack that directly targets source code at the "leaf" projects in Git commits.
8. Verifying the real-life identity of contributors to open source projects is hard and a difficult trade-off. Something similar to the #Debian #OpenPGP #web-of-trust would potentially have mitigated this style of attack somewhat, but with a different trade-off. We might have to think much harder about trust in individual accounts, and for some projects requiring a link to a real-world country-issued ID document may be the right balance (for others it wouldn't work). That is neither an easy nor a quick path, though. Also note that sophisticated nation state attackers will probably not have a problem procuring "good" fake IDs. It might still raise the bar, though.
9. What happened here seems clearly criminal - at least under my IANAL naive understanding of EU criminal law. There was clear intent to cause harm, and that makes the specific method less important. The legal system should also be able to help in mitigating supply chain attacks; not in preventing them, but in making them more costly if attackers can be tracked down (this is difficult in itself, see point 8) and face risk of punishment after the fact.
H/T @… @… @… @… @…
@AnthonyCollette@infosec.exchangeYou Can Be...
Brilliant At The Basics Of Cybersecurity
The World has changed.
What worked to keep us safe online 15, 10 or even 5 years ago — simply doesn’t work anymore.
But staying safe online doesn’t have to be hard or complicated.
One by one, you can master these Fundamentals of Cybersecurity:
☑️ Use a high-quality Password Manager.
☑️ Create strong, unique, modern passwords for each online account.
☑️ Use a DiceWare passphrase to lock your phone / laptop / tablet.
☑️ Use a DiceWare passphrase to lock your Password Manager.
☑️ Use Multi-factor Authentication for each online account that offers it.
We can thank The Electronic Frontier Foundation (EFF) for this great advice.
We know it can feel overwhelming. Start small and build from there.
REMEMBER — You have the power to keep yourself safer online!
***** FREE LAPTOP STICKERS | HELP US SPREAD THE WORD! *****
If you’d like 2 free Brilliant At The Basics Of Cybersecurity laptop stickers, we'll be happy to send them out to you right away.
1.) Visit this Brilliant At The Basic page on our website: #BrilliantAtTheBasics
_________________
♻️ Please feel free to share this post and let others know about this offer.
@Mediagazer@mstdn.socialGoogle rolls out new changes to its Search ranking to help surface good content, downrank content that summarizes others' work, and more, as AI content spreads (David Pierce/The Verge)
https://www.theverge.com/2024/3/5/24091099/goo…
@blakes7bot@botsin.spaceSeries C, Episode 02 - Powerplay
AVON: I must talk with Zen, find out what we have to do to help the others.
[Scene - the corridor, Tarrant, Klegg, Harmon and the remaining two guards]
https://blake.torpidity.net/s/302/215 📺 B7B3
@Techmeme@techhub.socialGoogle joins the C2PA steering committee to develop a standard to label AI content via metadata alongside Adobe, the BBC, Microsoft, Sony, and others (Tiffany Hsu/New York Times)
https://www.nytimes.com/2024/02/08/business/media/google-ai.html
@arXiv_csRO_bot@mastoxiv.pageStimulate the Potential of Robots via Competition
Kangyao Huang, Di Guo, Xinyu Zhang, Xiangyang Ji, Huaping Liu
https://arxiv.org/abs/2403.10487 https://…
@andycarolan@social.lolHere is a quick tour of my personality, values and quirks! It's purpose is to help others better understand me and get the most from our interactions.
#UserManual
@pelayoarbues@sigmoid.socialDesde junio de 2020, dedico una hora a la semana para conectar con desconocidos. Ya he tenido el placer de charlar con mšs de 80 personas con las que he charlado sobre datos, carrera laboral, formación, frustraciones, proyectos personales o management. Comparte o apúntate 👉 https://www.pelayoarbues.com/notes/Office-<…
@AnthonyCollette@infosec.exchangeFor Security Teams Inside Organizations
Let’s take a deep dive into this piece of consumer messaging —
1958. American Football. A sports reporter bluntly asks coach Vince Lombardi “What are you going to change to turn this team around after a string of failures and losing seasons?”
His reply: “I am not going to change anything. We will use the same players, the same plays and the same training system. But we will concentrate on becoming brilliant at the basics.”
This is an incredibly motivating message. And it paid off!
In the next nine seasons, Coach Lombardi’s team, the Green Bay Packers, went on to win five NFL Championships and two Super Bowls.
The phrase “Brilliant At The Basics” found its way into popular culture, becoming a recurring theme.
And the graphic? For the general public, the lightbulb image = Good Idea.
Consumers are already familiar with these two concepts.
In Your Organization, You Define “The Basics”
Find the sweet spot between everything that’s possible and what your users are willing and able to do.
☑️ Ask yourself "What should our users know? What actions should they take?"
☑️ Define them clearly and give them a simple, catchy name — "The Basics."
☑️ Show your users "This Is How We Do It Here."
☑️ Let them know they can master The Basics.
☑️ Then let your users know there's More Where That Came From, if they're interested, but … The Basics are the focus.
We should deliver cybersecurity advice to non-technical people in bite-size, digestible pieces. Consumers hate feeling like they’re at the pointy end of a firehose. And they don’t like being lectured to. Let’s not overwhelm them. First lay a strong foundation, then line by line, concept by concept — build up from there.
My partner led consumer product development programs that sold $100M and $400M of consumer products every year. Now he develops consumer products for Pokémon. We have hard-won experience when it comes to speaking to and persuading consumers.
We want to share that with you.
Would you like to experiment with this messaging and these laptop stickers in your organization?
Three additional benefits for you:
☑️ Over time, if The Basics in your organization change, the graphics and the laptop stickers stay the same.
☑️ A campaign like this might help identify potential Cyber Champions in your organization.
☑️ The laptop stickers provide persistent visibility for Cybersecurity within your organization.
We’d be happy to send some free samples for you to try out with your users.
1.) Visit this Brilliant At The Basic page on our website: #BrilliantAtTheBasics
_________________
♻️ Please feel free to share this post and let others know about this offer.
@cdarwin@c.imA complicated cast of immune and other characters may contribute to long COVID
Morgan’s lab and others have zeroed in on immune proteins that defend us from bacteria and viruses.
These proteins, part of a defense called complement, circulate in the blood, and get chopped up during an infection.
The resulting fragments sound a “we’re under attack” alarm and help form a molecular machine that busts pathogens.
Once the infection clears, the fragments fade away.
Bu…
@rene_mobile@infosec.exchangeMy current take on the #xz situation, not having read the actual source backdoor commits yet (thanks a lot #Github for hiding the evidence at this point...) besides reading what others have written about it (cf. #rustlang for such central library dependencies would maybe (really big maybe) have made it a bit harder to push a backdoor like this because - if and only if the safety features are used idiomatically in an open source project - reasonably looking code is (a bit?) more limited in the sneaky behavior it could include. We should still very much use those languages over C/C for infrastructure code because the much larger class of unintentional bugs is significantly mitigated, but I believe (without data to back it up) that even such "bugdoor" type changes will be harder to execute. However, given the sophistication in this case, it may not have helped at all. The attacker(s) have shown to be clever enough.
6. Sandboxing library code may have helped - as the attacker(s) explicitly disabled e.g. landlock, that might already have had some impact. We should create better tooling to make it much easier to link to infrastructure libraries in a sandboxed way (although that will have performance implications in many cases).
7. Automatic reproducible builds verification would have mitigated this particular vector of backdoor distribution, and the Debian team seems to be using the reproducibility advances of the last decade to verify/rebuild the build servers. We should build library and infrastructure code in a fully reproducible manner *and* automatically verify it, e.g. with added transparency logs for both source and binary artefacts. In general, it does however not prevent this kind of supply chain attack that directly targets source code at the "leaf" projects in Git commits.
8. Verifying the real-life identity of contributors to open source projects is hard and a difficult trade-off. Something similar to the #Debian #OpenPGP #web-of-trust would potentially have mitigated this style of attack somewhat, but with a different trade-off. We might have to think much harder about trust in individual accounts, and for some projects requiring a link to a real-world country-issued ID document may be the right balance (for others it wouldn't work). That is neither an easy nor a quick path, though. Also note that sophisticated nation state attackers will probably not have a problem procuring "good" fake IDs. It might still raise the bar, though.
9. What happened here seems clearly criminal - at least under my IANAL naive understanding of EU criminal law. There was clear intent to cause harm, and that makes the specific method less important. The legal system should also be able to help in mitigating supply chain attacks; not in preventing them, but in making them more costly if attackers can be tracked down (this is difficult in itself, see point 8) and face risk of punishment after the fact.
H/T @… @… @… @… @…
@arXiv_csHC_bot@mastoxiv.pageCapturing Cancer as Music: Cancer Mechanisms Expressed through Musification
Rostyslav Hnatyshyn, Jiayi Hong, Ross Maciejewski, Christopher Norby, Carlo C. Maley
https://arxiv.org/abs/2402.06777
@AnthonyCollette@infosec.exchangeFor Security Teams Inside Organizations
Let’s take a deep dive into this piece of consumer messaging —
1958. American Football. A sports reporter bluntly asks coach Vince Lombardi “What are you going to change to turn this team around after a string of failures and losing seasons?”
His reply: “I am not going to change anything. We will use the same players, the same plays and the same training system. But we will concentrate on becoming brilliant at the basics.”
This is an incredibly motivating message. And it paid off!
In the next nine seasons, Coach Lombardi’s team, the Green Bay Packers, went on to win five NFL Championships and two Super Bowls.
The phrase “Brilliant At The Basics” found its way into popular culture, becoming a recurring theme.
And the graphic? For the general public, the lightbulb image = Good Idea.
Consumers are already familiar with these two concepts.
In Your Organization, You Define “The Basics”
Find the sweet spot between everything that’s possible and what your users are willing and able to do.
☑️ Ask yourself "What should our users know? What actions should they take?"
☑️ Define them clearly and give them a simple, catchy name — "The Basics."
☑️ Show your users "This Is How We Do It Here."
☑️ Let them know they can master The Basics.
☑️ Then let your users know there's More Where That Came From, if they're interested, but … The Basics are the focus.
We should deliver cybersecurity advice to non-technical people in bite-size, digestible pieces. Consumers hate feeling like they’re at the pointy end of a firehose. And they don’t like being lectured to. Let’s not overwhelm them. First lay a strong foundation, then line by line, concept by concept — build up from there.
My partner led consumer product development programs that sold $100M and $400M of consumer products every year. Now he develops consumer products for Pokémon. We have hard-won experience when it comes to speaking to and persuading consumers.
We want to share that with you.
Would you like to experiment with this messaging and these laptop stickers in your organization?
Three additional benefits for you:
☑️ Over time, if The Basics in your organization change, the graphics and the laptop stickers stay the same.
☑️ A campaign like this might help identify potential Cyber Champions in your organization.
☑️ The laptop stickers provide persistent visibility for Cybersecurity within your organization.
We’d be happy to send some free samples for you to try out with your users.
1.) Visit this Brilliant At The Basic page on our website: #BrilliantAtTheBasics
_________________
♻️ Please feel free to share this post and let others know about this offer.
@thomasfuchs@hachyderm.ioThis is literally trying to get smarter by eating shit.
@Xavier@infosec.exchangeI have a son turning 18 tomorrow. He is #autistic, #aspie, #bipolar, and has #tourettes. It's a beautiful combination of conditions, but as you can imagine, it doesn't set him up for success in the social skills department.
Now he's turning 18 and has very few people turning up as his party. What can I do as a dad to help? There's the "fix it" side of me that wants to get creative on ways to get people to his party. But I don't know if that will make things worse.
I'd love to hear from others #neurdivergent and #actuallyautistic folks.
EDIT... Sorry I forgot to mention that my son has complained about how few people are coming. So I do know he wants more people.
@shellsharks@infosec.exchangeWhat does the #infosec / #cybersecurity (or infosec-adjacent) community think of "establishing" a go-to hashtag for asking infosec-related questions? Something like #AskSecFedi or #AskFediSec? Personally I think the latter has a better ring to it but curious what others think. I've seen a lot of people in the community ask questions that don't get answered due to classic social reach issues but perhaps a dedicated hashtag could help alleviate some of that. (If you have a catchier tag feel free to comment!)
@Xavier@infosec.exchangeI have a son turning 18 tomorrow. He is #autistic, #aspie, #bipolar, and has #tourettes. It's a beautiful combination of conditions, but as you can imagine, it doesn't set him up for success in the social skills department.
Now he's turning 18 and has very few people turning up as his party. What can I do as a dad to help? There's the "fix it" side of me that wants to get creative on ways to get people to his party. But I don't know if that will make things worse.
I'd love to hear from others #neurdivergent and #actuallyautistic folks.
EDIT... Sorry I forgot to mention that my son has complained about how few people are coming. So I do know he wants more people.
