social.gl-como.it
STASERA ci sarà questo evento per chi abita a Bergamo o intorni. È un corso introduttivo su git che è uno strumento per gestire le varie versione di un gruppo di file.
Mi farebbe piacere che ci andaste, anche perché è organizzato dal @bglug, l'associazione di cui faccio parte
fablabbergamo.it/2024/06/09/in…
(taggo @VivereBergamo per conoscenza)
Se sei uno studente, un hobbista, uno sviluppatore o un professionista IT, questo corso è perfetto per te. Git, nato per supportare lo sviluppo del kernel Linux, è ora lo standard per la collaborazione nel mondo open source e aziendale.staff FABLAB BERGAMO (FABLAB BERGAMO)
Apparently the SORBS DNS blocklist has closed down for good. There was an announcement to that end on the mailop mailinglist recently, and I've seen articles on various tech newstickers today: jort.link/www.mail-archive.com…
(I wasn't aware that SORBS was sponsored directly by Proofpoint.)
If you still have references to dnsbl.sorbs.net anywhere in your mail server or antispam configuration, now is the time to remove them.
"Artificial Intelligence -- Generative AI exists because of the transformer. This is how it works."
<- LLM bot so-called "AI" explained brilliantly, with pictures, by the @FT
Spoiler: it's not intelligent in any way, & it's not really artificial either
Part 1 of 2. Second in a minute.
The technology has resulted in a host of cutting-edge AI applications — but its real power lies beyond text generationFinancial Times
"What Is ChatGPT Doing … and Why Does It Work?"
writings.stephenwolfram.com/20…
By Stephen Wolfram of Mathematica fame.
A much more technical but still highly readable explanation. What the smoke is made of and how the mirrors are angled.
Post #2/2.
Stephen Wolfram explores the broader picture of what's going on inside ChatGPT and why it produces meaningful text. Discusses models, training neural nets, embeddings, tokens, transformers, language syntax.writings.stephenwolfram.com
For those who aren’t aware, Microsoft have decided to bake essentially an infostealer into base Windows OS and enable by default.
From the Microsoft FAQ: “Note that Recall does not perform content moderation. It will not hide information such as passwords or financial account numbers."
Info is stored locally - but rather than something like Redline stealing your local browser password vault, now they can just steal the last 3 months of everything you’ve typed and viewed in one database.
I've written up my thoughts on the Copilot Recall feature in Microsoft Copilot+ PCs
I think it will enable fraud and endanger users, and is not the sign of a company who are committed to security first.
The ICO wants to know the safeguards around Recall, which can take screengrabs of your screen every few seconds.Imran Rahman-Jones (BBC News)
Copilot+ Recall has been enabled by default globally in Microsoft Intune managed users, for businesses.
You need to enable DisableAIDataAnalysis to switch it off. learn.microsoft.com/en-us/wind…
Learn how to manage Recall for commercial environments using MDM and group policy. Learn about Recall features.learn.microsoft.com
Two quick updates -
A) if you disallow recording of a website in Control Panel or GPO, in Chrome it is still recorded - disallow recording only works in Edge browser
B) Firefox and Tor Browser is recorded always, including in private mode - the exception is Hollywood DRM’d videos
I got ahold of the Copilot+ software.
Recall uses a bunch of services themed CAP - Core AI Platform. Enabled by default.
It spits constant screenshots (the product brands then “snapshots”, but they’re hooked screenshots) into the current user’s AppData as part of image storage.
The NPU processes them and extracts text, into a database file.
The database is SQLite, and you can access it as the user including programmatically. It 100% does not need physical access and can be stolen.
And if you didn’t believe me.. found this on TikTok.
There’s an MSFT employee in the background saying “I don’t know if the team is going to be very happy…”
They should probably be transparent about it, rather than telling BBC News you’d need to be physically at the PC to hack it (not true). Just a thought.
So the code underpinning Copilot+ Recall includes a whole bunch of Azure AI backend code, which has ended up in the Windows OS. It also has a ton of API hooks for user activity monitoring.
Apps themselves can also search and make themselves more searchable.
It opens a lot of attack surface.
The semantic search element is fun.
They really went all in with this and it will have profound negative implications for the safety of people who use Microsoft Windows.
If you want to know where tech companies are with AI safety, know Microsoft Recall won’t record screenshots of DRM’d movies..
..but will record screenshots of your financial records and WhatsApp messages, as corporate interests were prioritised over user safety.
And it’s enabled by default.
Copilot+ Recall feature pop quiz:
You deal with a sensitive matter on my Windows PC. E.g. an email you delete. Does Copilot Recall still store the deleted email?
Answer: yes. There's no feature to delete screenshots of things you delete while using your PC. You would have to remember to go and purge screenshots that Recall makes every few seconds.
If you or a friend use disappearing messages in WhatsApp, Signal etc, it is recorded regardless.
It comes up a lot as people are rightly confused, but if you wonder what problem Microsoft are trying to solve with Recall:
It isn't them being evil, it's business leaders who are middle aged and can't remember what they're doing driving decision making about which problems to solve.
A huge amount of business leaders are dudes who have no idea what the fuck is happening. This leads to the Recall feature.
Microsoft exists in and is driven by that bubble.
Some screenshots of Recall's SQLite database here: mastodon.social/@detective/112…
Just to clarify, I can access it without SYSTEM too. Microsoft are about to set cybersecurity back a decade by empowering cyber criminals via poor AI safety. Feature ships in a few weeks.
Attached: 4 images Can confirm that Recall data is indeed stored in a SQLite3 database. The folder it's in is fully accessible only by SYSTEM and the Administrators group.Mastodon
The latest Risky Business episode on Recall is good, but one small correction - it doesn’t need SYSTEM rights.
Here’s a video of two MSFT employees gaining access to the Recall database folder - with SQLite database right there. Watch their hacking skills. (You don’t need to go this length as an attacker, either). Cc @riskybusiness
I’m not being hyperbolic when I say this is the dumbest cybersecurity move in a decade. Good luck to my parents safely using their PC.
Stealing everything you’ve ever typed or viewed on your own Windows PC is now possible with two lines of code — inside the Copilot+ Recall disaster.
My look at the feature, FAQs from the community etc
this is the out of box experience for Windows 11's new Recall feature on Copilot+ PCs. It's enabled by default during setup and you can't disable it directly here. There is an option to tick "open Settings after setup completes so I can manage my Recall preferences" instead.
HT @tomwarren
You allow BYOD so people can pick up webmail and such. It’s okay, because when they leave you revoke their access, and your MDM removes all business data from the machine ✅
What the employee does: opens Recall, searches their email, files etc and pastes the data elsewhere.
Nothing is removed from Recall, as it is a photographic memory of everything the former employee did.
Security and privacy researchers - You can now install Copilot+ Recall on any ARM hardware (doesn’t need an NPU) or in Azure VMs.
Guide from @detective
The devices launch THIS MONTH to customers so I suggest people look at this.
github.com/thebookisclosed/Amp…
One stop shop for enabling Recall in Windows 11 version 24H2 on unsupported devices - thebookisclosed/AmperageKitGitHub
Asus and MSI are launching AMD- and Nvidia-powered gaming laptops that include Microsoft’s Copilot Plus AI features.Tom Warren (The Verge)
I really dislike Microsoft's wording around this. They throw around terms like "encrypted" and "secure" to placate the lay person, when they know as well as anybody that encrypted data has to be decrypted at runtime, and if the user has access to the unencrypted data, so does any malware running with that user's privileges.
And you just know that it's gonna be on by default, if you turn it off Windows updates will randomly re-enable it, etc. This will be a privacy nightmare.
Recent DHS published report handed to the US President which said it had "identified a series of Microsoft operational and strategic decisions that collectively pointed to a corporate culture that deprioritized enterprise security investments and rigorous risk management"
Microsoft: let’s use AI to screenshot everything users do every 5 seconds, OCR the screenshots, make it searchable and store it in AppData!
If anybody is wondering if you can enable Recall on a machine remotely without Copilot+ hardware support - yep.
I’ve also found a way to disable the tray icon.
I went and looked at YouTube for Recall to get out of the echo chamber and I can only find one positive video. Even the people at the event are slating it, including people with media provided Copilot+ PCs.
There’s some content creators who’ve realised it records their credit cards, so they’re making videos of their cards going walkies.
It’s going to be interesting to see how Microsoft get out of this one. They may have contractual commitments to ship Recall with external parties.
I thought they were risking crashing the Copilot brand with this one, but I was wrong looking at the videos and comments on them - I think they’re crashing the Windows consumer brand.
The reaction to photographic memory of what people do at home has - you’ll be surprised to know - not been seen as a reason to buy a device, but a reason why not to.
yep. And there’s loads of tangible security benefits from the rest of the work going on in Windows 11 in terms of security.
They just shit their own bed on this one by not understanding their customers, Apple must be so happy.
Actual clown show announcing it immediately after this blog post:
blogs.microsoft.com/blog/2024/…
But yeah, the direction 11 was going in has been great, then they abruptly veered right off the cliff.
Microsoft runs on trust, and our success depends on earning and maintaining it. We have a unique opportunity and responsibility to build the most secure and trusted platform that the world innovates upon.Microsoft Corporate Blogs (The Official Microsoft Blog)
@never_released Fraud? Domestic violence is the event that's going to be disastrous for them. The first time a man beats his wife to death after finding a screenshot of a convo she didn't want him to see?
The Microsoft Murderer Trial would certainly test the aphorism that there's no such thing as bad publicity.
Investments by oil despots yields products that despots want.
businessinsider.com/microsoft-…
arabnews.com/node/2507356/busi…
consultancy-me.com/news/8148/p…
cio.com/article/2079045/pwc-mi…
bloomberg.com/news/articles/20…
Global technology giants including Amazon.com Inc., Alphabet Inc.’s Google and Microsoft Corp. are among firms working to ramp up their presence in Saudi Arabia amid pressure from the government, which has said it will stop giving contracts to compan…Matthew Martin (Bloomberg)
Saudi Arabia had been flooding American tech companies with cash since 2018.
Twitter was just one example of anti-democracy oil oligarchs hijacking tech.
Kushner's $2 billion in Saudi sovereign funds isn't buying beach-front condos in Gaza, it's being spent on torpedoing tech brands like Microsoft.
Google, Apple, Oracle, Amazon, Microsoft, all had MBS visit in 2018. The investments continued after the Khassoghi murder & its accelerated in recent months.
vox.com/technology/2023/5/1/23…
All the ways Saudi Arabia’s cash powers tech startups and venture capitalJonathan Guyer (Vox)
Microsoft made a sudden shift towards AI development in 2018 under pressure from investors. As did the Big Five.
Recall was one of the products developed with those investments.
Sure, and it's an coincidence that the WaPo ousted it's editor in favor of someone who wants TuckerKarlson op-eds.
I suppose you believe it was pure incompetence that drove Musk's management of Twitter into the shitter.
Rupert Murdoch marries his ruZZian handler, nothing to see here.
But co-pilot's creation has nothing to do with the billions of autocratic petro-dollars being pumped into Microsoft. Your not trying nearly hard enough to stick your head in the sand.
part of me suspects there is some government/agency pressure behind the whole idea, because who really benefits from this
then again I wonder if I am just being overly paranoid, and remind myself of Hanlon's razor
The security story around Windows Recall hits a brick wall as it's discovered the data it collects is unencrypted.Zac Bowden (Windows Central)
Microsoft has been declining to comment on criticism of Recall for a week - but they have apparently told a journalist off the record at Future that changes will be made before Copilot+ devices drop in the coming days.
This may include an attempt to invalidate researcher criticism, we’ll see.
"will have the option to choose not to"
so opt-out
WIRED has a piece about Total Recall, a now released tool which dumps keypresses, text and screenshots (they’re JPEGs) from Microsoft Recall
wired.com/story/total-recall-w…
Total Recall software by @xaitax github.com/xaitax/TotalRecall
Example search for ‘password’:
🪟 Captured Windows: 133
📸 Images Taken: 36
🔍 Search results for 'password': 22
📄 Summary of the extraction is available in the file:
C:\Users\alex\Downloads\TotalRecall\2024-06-04-13-49_Recall_Extraction\TotalRecall.txt
This tool extracts and displays data from the Recall feature in Windows 11, providing an easy way to access information about your PC's activity snapshots. - xaitax/TotalRecallGitHub
I hadn’t been aware until today of the external reaction to Recall. Holy shit. Tim Apple must be pleased.
Everything from media coverage to YouTube to TikTok is largely negative. All the comments are negative.
These videos have tens of millions of views and hundreds of thousands of comments.
I knew it would be bad but.. it’s worse. I’ve spent hours looking at the sentiment and.. well, they probably would have got better coverage from launching an NFT of pregnant Clippy.
But Kevin, ZDNet says not to worry :chuckle: :wheeze:
zdnet.com/article/is-microsoft…
It's one of the signature features of the next-generation Microsoft Copilot+ PCs, and at first glance it acts like the worst kind of spyware. But it's getting a bad rap.Ed Bott (ZDNET)
I'm sure someone suggested that Apple was doing the same thing on their platform soon too.
Unless I was remembering 9to5mac.com/2022/11/02/rewind-… ... ?
We do a lot on our computers every day, and although apps like web browsers let you keep track of...Filipe Espósito (9to5Mac)
Would Apple have continued their OpenDirectory, They would be in a pretty awesome position now... 🙄
But macOS Server was sadly not a priority.... 🤷
A key element of Recall is Microsoft say only you can access your Recall, it is per user.
ArsTechnica enabled Recall on Windows 11 box and tested the claim. By logging in as another user they could access the database and screenshots.
arstechnica.com/ai/2024/06/win…
Op-ed: The risks to Recall are way too high for security to be secondary.Ars Technica
If you want to know how Microsoft have got themselves into this giant mess with Recall, here’s what the documentation says between the lines:
you, the customer, are a simpleton who doesn’t want to be an AI genius yet. Have a caveman mode.
Recall and Copilot+ is also coming to ASUS systems, including AMD, in a deal with Microsoft.
ASUS Announces Complete Portfolio of AI-Powered Copilot+ PCs asus.com/us/news/pnm9tg6qccql6…
Nvidia announced they are bringing Copilot+ and Recall to PCs, in a deal with Microsoft: theverge.com/2024/6/2/24169568…
Asus and MSI are launching AMD- and Nvidia-powered gaming laptops that include Microsoft’s Copilot Plus AI features.Tom Warren (The Verge)
EXTREMELY FUCKING RELATED:
youtube.com/watch?v=uYdtpU8FKO…
youtube.com/watch?v=I3DwhTc7Z4…
youtube.com/watch?v=7pMrssIrKc…
Grab the GN Foil CyberSkeleton V2 shirt! https://store.gamersnexus.net/products/limited-edition-foil-cyberskeleton2-cotton-tshirtWith ASUS' issues now spanni...YouTube
Three Copilot+ Recall questions that keep coming up.
Q. Can you alter the Recall history?
A. Yes. You can change the OCR database and change the screenshots as the logged in user or as software running as the local user. There is no audit log of changes.
Q. Are they snapshots, as Microsoft says, or screenshots?
A. They are just screenshots, jpegs.
Q. What is to stop apps on your machine accessing your Recall covertly?
A. Nothing. There is no audit log of access.
Well, I think I see how they *could* use that as an excuse for saying, …
“Look, there's nothing stopping you from making/using 3rd party tools to eliminate any of the data you do not want in there. *So it's not our problem!*”
🙄
.
(But if sensitive data is in there for even a short time, it's a risk!)
@hacks4pancakes A long time ago, I saw a movie called "The Net", where multiple people's lives were ruined (including what was effectively an assassination) by surreptitious modification of digital records.
I think it's time to reboot The Net.
If anybody is wondering what Microsoft's reaction to any of the Copilot+ Recall concerns are, they're continuing to decline comment to every media outlet.
I've seen comments MS staff have been given for enterprise customers, which are nonsense handwaving.
Product ships live on devices from Dell, Lenovo etc this month. x.com/zacbowden/status/1798221…
I do hope they understand that this strategy does not work with governments. You know, organizations that, believe it or not, really do have more money and more attorneys than Microsoft.
I'm wondering if this is going to be an every-generation thing where MS has to get slapped down HARD by people with the sole monopoly on legitimate use of force, only to slowly forget the lesson over the next two decades.
Or they could spend a tiny amount on due dilligence, but that's boring.
I don't understand what you keep complaining about.
Guy clearly says "this is my computer, this is my Recall".
If you want to have *your* computer and *your* recall, you'll have to build it yourself. Leave the guy alone.
@kcarruthers Wait, I assumed Recall was something that was a year or two down the line? It was that fucking stupid and ill thought through I assumed it had to be just a concept at most?
It's actually going live to public this month? WTAF?
That's even worse than AI LLM's going public as prematurely as they have.
How did MS's lawyers approve this? How did nobody realise just how horrible it is before the public reaction?
did you catch Steve Gobson’s take on recall, after your wonderful breakdown, on this week’s episode of Security Now episode 977?
Apple link podcasts.apple.com/us/podcast/…
Grc’s website 16 kb downloadable page (not there yet though 🤷)
Show Security Now (Audio), Ep A Large Language Model in Every Pot - Problems With Recall, End of ICQ, Email @ GRC - Jun 4, 2024Apple Podcasts
Well, your supervisor at work will appreciate the possibility to easily look into what you did all day.
This tool extracts and displays data from the Recall feature in Windows 11, providing an easy way to access information about your PC's activity snapshots. - xaitax/TotalRecallGitHub
You can now remotely dump Recall data and screenshots over the internet from Linux etc. Changes in flight for parsing data too.
github.com/Pennyw0rth/NetExec/…
Gets all users Recall folders and dumps them, then renames screenshots to include .jpg (unnecessary but helpful). I cherry-picked the download_folder functionality from #320 and then improved it du...GitHub
Turns out speaking out works.
Microsoft are making significant changes to Recall, including making it specifically opt in, requiring Windows Hello face scanning to activate and use it, and actually encrypting the database.
There are obviously going to be devils in the details - potentially big ones.
Microsoft needs to commit to not trying to sneak users to enable it in the future, and it needs turning off by default in Group Policy and Intune for enterprise orgs.
theverge.com/2024/6/7/24173499…
Microsoft is making its controversial AI-powered Recall feature optional. The changes come after security experts warned the feature could be a disaster for cybersecurity.Tom Warren (The Verge)
Sounds like they finally ran this plan past legal, and after having to administer enough sedatives to drop a herd of elephants, the attorneys managed to stop screaming long enough to put put a basic list of Things That Must Happen.
FWIW, policy analysts cost about 1/10th what an attorney charges per-hour. That's actually a pretty standard FAFO tax, if you think about it.
Obviously, I recommend you do not enable Recall, and you tell your family not to enable it too.
It’s still labelled Preview, and I’ll believe it is encrypted when I see it.
There are obviously serious governance and security failures at Microsoft around how this played out that need to be investigated, and suggests they are not serious about AI safety.
Recall's gonna happen. Either accept that Big Brother has won, or use something else.
If you're one of the hapless slobs who can't use something else because your boss loves Big Brother, my condolences.
you nailed it with "serious governance failures" and quoting by the way tha latest CISA report.
Recall allows the company’s new line of Windows 11 Copilot+ devices to screenshot every action a person takes on their PC.therecord.media
I should be transparent btw that I took Satya and Charlie’s commitment to security at face value too - I even published a blog on it backing that up - and I have concerns (it isn’t just me).
They’re now going to have to win trust back about winning trust back.
I know somebody at a retailer in Europe that is selling Copilot+ PCs. They’ve had fewer than a thousand preorders through to customers.
In relative terms, for them it’s about as successful as Suicide Squad Kill The Justice League.
which is super annoying to me.
They had the chance to finally sell a powerful #Windows laptop to compete with Apple on battery life and performance.
And what did they do? They made it all about the NPU, so now the only reason to buy it is a feature nobody wants or understands.
I really want to know how they're going to square this new and improved concept with the fact that it's going to literally be used in abusive situations to get a better hold on the victims.
I realize this isn't a solvable problem, but the fact that it never even apparently showed up on their radar as a potential abuse is...upsetting to say the least.
why do multiple sources and OEM themselves they say it isn’t available ?
A reminder that a few weeks ago at RSA, Microsoft signed CISA's Secure By Design pledge... and then shipped an enabled by design keylogger that OCRs your screen constantly into AppData.
Edit: I should say that's less a reflection on Microsoft and more a reflection on CISA's Secure By Design pledge.. it's a good idea, but the scope is extremely limited.
I think MS are a way off extracting themselves from Recall situation they've got themselves into.
This is just one YouTube comments section on a video since the not-enabled-by-default change - 500k views - but there's loads more, similar on TikTok.
I imagine it's going to continue through week and into next week when the laptops ship.
I have heard rumblings MS are discussing trying to take action against me over the whole thing, which a) good luck and b) would be pouring petrol on the flames.
Some backstory - it's being reported Microsoft developed Recall in secret to try to avoid scrutiny. windowscentral.com/software-ap…
I'm hearing that various MSFT people are furious about how this played out over the past few weeks, which IMHO represents a serious lack of introspection.
The world is up-in-arms over Windows Recall, but why? It stems from Microsoft's seeming lack of care for Windows and its users.Zac Bowden (Windows Central)
That article isn't even good propaganda, I give it a C-.
But yeah, I suspect that this was kept secret from their policy and legal teams as well, because I'm going to assume that the people working on those teams are competent.
I also really, really, really want to know the gender makeup of the supersekrit skunkworks team that tested this. I mean, I feel confident in my hypothesis, but best to await confirmatory evidence.
Microsoft have paused the rollout of Windows 11 24H2 in preview channel, it was the version containing Recall. Microsoft have not explained why.
x.com/brandonleblanc/status/17…
I don't know if it was publicly known but it was possible to use Recall on more hardware via Mach2, before this was pulled.
I have an image where when viewed on a Copilot+ Recall PC, a Windows process crashes as it tries to process the screenshot.
New email signature?
Microsoft’s President Brad Smith appears before US House Committee on Homeland Security tomorrow.
His testimony: homeland.house.gov/wp-content/…
In this bit he talks about Recall (not named), where he pats himself and Microsoft on the back for “a feature change” and job well done.
Given it has been a complete cybersecurity and privacy car crash - and as of today the changes (plural) they’re referring to haven’t even been implemented - it seems like Microsoft fails to grasp customer needs: safety.
One other thing - Microsoft's written testimony to the US House says, quoting, bolded by MS:
"Before I say anything else, I think it’s especially important for me to say that Microsoft accepts responsibility for each and every one of the issues cited in the CSRB’s report. Without equivocation or hesitation. And without any sense of defensiveness."
Counterpoint: they publicly disputed the report in the media. theverge.com/2024/4/25/2413991…
Microsoft has faced a series of security issues in recent years. Now, the company is trying to win back trust and focus on security as a top priority.Tom Warren (The Verge)
I should say that if Brad is asked about Recall tomorrow, the answers may raise some.. uh... eyebrows here.
I don't know what MS SLT have been told, but expect fun when the feature drops on consumer laptops in a few days.
As I mentioned in my blog, there is some more security hardening there on Copilot+ PCs (this was before MS put out their blog)... but it's still easily bypassable.
Microsoft’s Recall puts the Biden administration’s cyber credibility on the line
cyberscoop.com/microsoft-recal…
Interesting article. All through this, CISA and the DHS have declined to comment.
Why has the White House remained silent on the launch of a product that violates the spirit and letter of its flagship cybersecurity initiatives?eliasgroll (CyberScoop)
The Verge reports today that "Windows engineers are scrambling to get additional changes tested and ready for the release of Copilot+ PCs next week."
It also says "Recall was developed in secret at Microsoft, and it wasn’t even tested publicly with Windows Insiders."
I've also been told Microsoft security and privacy staff weren't provided Recall, as the feature wasn't made available broadly internally either.
theverge.com/2024/6/13/2417770…
Microsoft had one of its best Xbox showcases ever. There were new game reveals, a handheld tease afterward, and more.Tom Warren (The Verge)
Brad Smith just said Recall was designed to be disabled by default. That is not true. Microsoft’s own documentation said it would be enabled by default - they only backtracked after outcry.
He has somehow got almost every detail about Recall wrong while testifying.
Obviously, I’ll wait to see the announcement but it sounds like they’ve finally realised they need to take the time and get the feature right (and frankly consider the target audience - most home users, it ain’t).
They should have announced this before or during the US House hearing.
Announcement is out. Good on Microsoft for finally reaching a sane conclusion.
- Recall won’t ship as a feature at launch on Copilot+ PCs any more.
- Won’t be available in Insider preview channel at launch, as it was pulled.
When it does appear in preview channels, privacy and security researchers need to keep a close eye on what Microsoft are doing with the feature.
Microsoft tried developing this feature in secret in a way which tried to avoid scrutiny. Thank you to everyone who stood up.
Their InfoSec team is Super Pissed. *They* weren't informed.
Let me say again:
Linux people had to contain MicroSoft InfoSec* from killing Microsofties (last Thurs at the HackSpace meeting).
* InfoSec is InfoSec no matter who you work for. We didn't want our brothers and sisters to go to prison. This is The Way.
I've always used Windows.
I have played with Ubuntu (really like DDE) and the second they retire Windows 10 and I have to have a Windows with recall, Windows is going in the bin and I'm full on Linux.
This was just insanely stupid.
this article uses a lot of absolutes to describe a Microsoft product.
“When Windows Recall is enabled, it places a permanent visual indicator icon on the Taskbar …This icon cannot be hidden or moved.”
“Your existing Windows 11 PC is not eligible to run Windows Recall and very likely never will be.”
I fully expect malware that surreptitiously enables Recall on any Windows 11 PC and exfiltrates data.
Who in their right mid would see Recall and 'That is a wonderful idea and nothing will ever go wrong with its deployment!'
Seriously. you couldn't have come up wit ha better honeypot for malware to harvest data with.
he won't be, he's the CEO and the chairman at the same time for one thing, and he's led something like a 500% share price increase since he took over. Plus, he likely didn't decide everything along the way.
Nobody needs to be fired, just maybe don't try to ship stuff like this enabled by default in the future, where it's clearly risky.
a man can dream. Nearly all enshittification of windows, office, and microsoft accounts are his doing. (I don’t work with Azure so I have no idea what’s going down there). He is the wizard of oz of pulling profit from users while abusing them.
But if this becomes a threshold moment, an infected wound where everything that’s shit about microsoft now turns people away, and keeps people away, valuation will freefall, Azure-AI or not.
Won’t happen, but I can dream
@Kierkegaanks he definitely has a problem to manage now as they've just eroded customer so much over the past 5 years in search of inorganic growth.
I had a popup just now to change my search engine to Bing, where the options were basically 'change now' or 'change later'. It just all feels.. cheap and seedy.
the only comment I disagree with is the "Hey, I don't remember what I was looking at".
I think everyone eventually has a senior moment and thinks of a similar solution, but within seconds we dismiss such an idea as idiotic madness... like Microsoft should have!
Hahahhahhahahahahahahahahaha.
*Inhaaaales*
HAHAHAHAHAHAHAHAHAHAHAHA!
Well, they Aren't suing you in Seattle (King County, WA) because we have Anti SLAPP. I'm reasonably certain you're not in East Texas (though they have a presence I'm sure) but you get that tossed for "Wrong Fucking Venue".
They made an aircraft with no fuselage and you pointed it out ... wah.
Doesnt matter they have contracts with US feds for cloud. Nobody can make them change. They are too big to hold accountable.
I guess we could all start using Apple PCs but naw?
While that might be a nice partial interim success, #MicroSoft
will certainly not stop sneaking on users - it s their business concept, and you dont need graphical snapshots to track a user. There s telemetry you cant turn off. Try run a #Windows PC without net connection (or blocking connections to the overlords), and you will know.
There is one way to turn it off: install Linux.
If I was strategic team at MS, I would have every possible statistic I could get on Linux adoption at the personal level.
I wouldn't know how to look into this, but I would bet a solid five internets that downloads of Ubuntu and other Linux desktops skyrocketed in the last week
Not necessarily installs, yet, but there's a pattern now set, where capitalists overstep a bit, and it triggers interest in alternatives (Hey Twi-umm, X, hey buddy...), and they will be aware of that too.
still:
beige.party/@slowbiex/11248664…
Microsoft, Google, Slack et.al. are basically shifting the overton window: “we’re moving towards complete surveillance to train AI for you” And after a public outcry: “ok, we’ll only do partial surveillance but it’s set to default opt-in”beige.party
How can we be so sure?
We know that Google lied about the Chrome's private functions.
db
@evacide I’m not sure if that’s true, honestly, as the public reaction to the feature was overwhelmingly negative.
The other thing is I couldn’t speak to the privacy implications as I just didn’t know enough about that - so I’m glad you and others did.
Microsoft will have known the problems with this one and they just.. tried to do it anyway. It’s really worrying I think as it signifies a feeling of a blank cheque with AI.
@Kensan @evacide there is constant internal dissent at Microsoft, directed into Yammer. One problem here it didn’t stop it being rolled out at Build to the world’s press, by which point laptops were in boxes.
That’s not a healthy security or privacy culture. This was Microsoft execs queuing up to score own goals and high five themselves, at the expense of their own customers.
My bio on Twitter is literally “portable toilet cleaner” and I had to publicly unpick things with others.
@evacide That’s what I suspected… How this whole thing came about reflects on the company culture is what I find more disconcerting than the actual feature itself.
Thank you for your much needed cleaning services in great service of everyone!
mastodon.social/@Kensan/112565…
@mjausson@mastodon.design @hacks4pancakes@infosec.exchange That is what I find alarming: Microsoft has very smart and capable people but somehow concerns were pushed aside and the product was implemented and approved as it is being dissected by exter…Mastodon
Still not helpful, they need to completely scrap the idea. This just gives black hats another angle of attack.
And I'm pretty sure we'll find out that FBI or whatever will be able to turn recall on remotely and completely trample on people's privacy.
Not Microsoft's first blunder doing this kind of thing.
Apparently it already is true one day later? 🤷 soapbox.hackdefendr.com/@jeff/… But in the end, it matters not.
Yeah so we just confirmed via bleeding edge Windows 11 update that Recall will “accidentally” get (re)enabled during the update.Roommate: “Yeah Linux Desktop is sounding better and better!”
So months/years in development and we're asked to accept that mere days/weeks after it was announce Microsoft have re-engineered it to make it safer and more secure?
Or, and hear me out, did MS always intend this as the end-result but have made it more palatable by giving us the shittest possible implementation first? The ol' Ask for Lots, Settle for Less philosophy.
"Hurrah Microsoft have Listened!"
Have they fuck. Don't fall for this. We've been played.
@R0B0_G0D oh there’s definitely some of that going on.
Some of the features they’re talking about were in the product before the blog - I haven’t got into that yet as said features don’t actually work properly, I don’t think they realise. The launch will be a car crash still. But at least it’s not on by default.
Encrypting the database, at rest? If anything can get ahold of unencrypted data from the database, its all fubar, no matter what they do.
But it is good that they are changing some things
so… would that be considered a recall of Recall?
They also need to make it possible not to install it at all.
Functionality which is installed but turned off is too easy to get accidentally or maliciously enabled, and non experts have no way of determining if that has happened. Same issue as always connected microphones. You don't make a software switch to fix that. You make a hard switch or a separate disconnectable component.
"Speaking out works"
I hate to be that guy but this is a known Microsoft playbook...
1. Advertise something awful that people hate
2. People spread the hate online
3. Microsoft acts as a good guy and tones it down a little bit so people can say that they changed and they are the good guys even if the new way is still awful
4. In a couple of updates return to the original proposal silently
Works every time...
hey thanks for continuing to post on this.
I saw on bighard's website that they're rolling this Copilot out to Win10 as well but it's not clear if Recall will be on there? Have you been able to find anything on that aspects of this? Thanks again!
support.microsoft.com/en-us/wi…
Windows is the first PC platform to provide centralized AI assistance for customers. Together, with Microsoft Copilot, Copilot in Windows helps you bring your ideas to life.support.microsoft.com
"Yes. You can change the OCR database and change the screenshots as the logged in user or as software running as the local user. There is no audit log of changes."
One of the very first tasks I had to do at Microsoft was implement an audit log for a service that was used by maybe 200 different people (or groups). It was considered important!
Good thing Windows isn't used by more than 200 people, or
This tool extracts and displays data from the Recall feature in Windows 11, providing an easy way to access information about your PC's activity snapshots. - xaitax/TotalRecallGitHub
ars piece has factually contradicting sentences:
* "... says admin access to the system isn’t required to read another user’s Recall database. "
* "Another user with an admin account can easily grab any other user’s Recall database and all the Recall screenshots by clicking through a simple UAC prompt. "
Next to each other.
I get they want clicks through sensationalism, but wtf, this needs correcting.
> I knew it would be bad but.. it’s worse
Because "someone" has added MS-shaming to his agėnda, but for what reasons remains unknown.
"well, they probably would have got better coverage from launching an NFT of pregnant Clippy" ...
That is both, such an amazingly awful analogy, while being likely true, that's it's truly frightening.
Also, thatmental image has be reaching for brain bleach...thanks for that.
Isn't it Great how Microsoft *solved* All The Problems the community has listed, in a few days, before it ships.
So all that has been secured, unit tested, QAd, and packaged in One Week.
Windows Users: I have a beach front time-share in Wyoming you just may be interested in.
Off topic, but as a casual user of Windows (pretty much exclusively for games) is there a current best tool for removing/blocking all the existing telemetry?
It's been a while since I did the research and I'm getting the "let's set up your computer [ad preferences]" popups again.
I'd be interested if anyone in thread has recommendations
Can you ask Recall if, and when, what kind of pr0n the person has been watching?
I guess yes. Browsers have tabs that don't remember the history for that purpose.
What are the (so far) considered countermeasures to Recall?
e.g. if you have an addon showing a 1x1 drm in all browser pages (wildvine demo or similar) does Recall still record the entire browser page (for “not-Edge” browsers)?
e.g. if you deliberately mangle the sqlite database file does recall stop adding to it?
I am curious what countermeasures are already considered by others.
I've been surprised to see Paul Thurrott consistently dismissing the #Recall security outcry as fake news: thurrott.com/windows/windows-1…
After I left Twitter, I hadn't seen much from Paul anymore. Now that's he was in my Threads, it seemed like he'd gone the MAGA way with what he writes.
Oh well. Unfollow & thanks for all the years of funny #Microsoft keynote shitposts.👋
In the most avoidable PR nightmare in recent Microsoft history, the withering criticism of Windows 11 Recall continues unabated.Paul Thurrott (Thurrott.com)
ugh describe remotely? You mean as a remote administrator, eg it's a corporate / school device?
This is going very well
Gonna be a laugh riot* when bad actors figure out that you can also remotely plant evidence in Recall that someone did something they didn't, eg view CSAM.
*it will not, as this will further erode public trust in anything and only help awful people, even low-tech CSAM traders who will have plausible deniability
Are you aware of this news from EU law enforcement? The timing is remarkable
heise.de/en/news/Encryption-Po…
Freedom of information request provides insights into the European "Going Dark" expert group, which is tasked with cracking the "encryption problem".Stefan Krempl (heise online)
PLEASE use #AltText when posting things like this! Folk with visual impairments are JUST as vulnerable to information theft as the rest of us!
[Image in the post above shows incontrovertibly that Microsoft's new 'recall' feature makes passwords available to hackers]
With Recall I'm unsure how to handle suppliers remoting in to provide support.
We can't control whether Recall is enabled on *their* PC.
We'd need a remote control app which specifically won't proceed if Recall is enabled on the viewer's side.
I have no knowledge of $COUNTRYs regulations for stealing data. But this seems like one could argue under certain circumstances that MS was complicit in such acts if they occur and can be traced to this feature. And in the most clandestine way.
Also, the line 'Windows is a personal experience.' took me some time to comprehend.
I'd very much disagree.
Completely off topic here but that statement confused me.
is doublepulsar.com your blog? can you use the user preferred color scheme instead of just hardcoding white on black?
some ppl have SERIOUS struggles reading white on black, and that includes me, sadly
What is the aim of Microsoft there. This looks a bad idea from every angle.
Nobody would like this feature activated.
So why???
So … I'm easily gleeful to hate on recall for a host of reasons.
But – I really like the idea, as a feature, in principle. Or at least, something pretty adjacent.
I want to be able to look back through what I've done and I want to be able to search through that. I love even the dumb page history in Safari and I wish it worked better helping me find fuzzily from page content.
I love knowing the music I've heard recently.
I'd love much more of this.
But there seems to have been so little thought to safety put in the Recall.
And while "yeah – wang an AI in there" makes it kind of work from screen grabs, I feel like a real solution that had some semantic understanding of my history could be far more powerful.
I'm happy with my, properly secured personal machine, to keep intimate history of what I've done with it and help me search that. I'd have a system wide and very apparent incognito mode as necessary. But a feature like that needs _a_lot_ of care.
I literally almost spit my coffee out.
I can't find a hole in your logic...I'm Trying, just...can't.
One stop shop for enabling Recall in Windows 11 version 24H2 on unsupported devices - thebookisclosed/AmperageKitGitHub
My first reason for not upgrading to #Windows11 is that I'm lazy.
#MicrosoftRecall will be my second reason.
infosec.exchange/@malwarejake/…
I mean you have to admire how they Totally fuck users, but still kiss Hollywood's ass.
It would be stunningly amazing, if it weren't clinically psychotic that RIAA and MPAA concerns are more valuable than, you know, Users.
so, ... your image analysis technology and your NPU HW are now so efficient that you don't even notice the power impact of doing this continuously in the background, and this is the only use case you could come up with?
Which means, I suppose, this is something they always wanted to do but was prevented because sending those images to the cloud for processing is clearly much worse.
Perhaps, when their privacy/security teams told them that it was a bad idea to process user screenshot images in the cloud, designers of these features assumed it would be OK to do it locally. And when they overcame this largest objection, other concerns must have seemed ... fine, in comparison.
Security/privacy teams are rarely in a position to kill off entire features, so this was most likely some kind of a compromise.
On a related note, a lesson I had to learn the hard way is to not push hard on the biggest security/privacy issue to the exclusion of others. If/when it somehow gets resolved, you look like you are trying to make excuses when you bring up the remaining concerns "but ... but ... domestic abuse".
*BAM* Immediately Opt-Out for BUSINESS ACCOUNTS.
WHY Aren't The Corporate Lawyers Lined The Fuck Up in 56th St. with Belt Sanders?!?
I usually occupy a "Director of IT" role and I would be dragging my company's legal team with pitchforks and plasma cutters to Redmond (if I didn't live here and it wasn't a short walk and I actually worked for someone else that I oddly allowed to have Windows machines on my network).
In addition to security concerns, do you know if there are any study in term of cost of energy driven by Recall ?
Just imagine the ecological price of 1.4Giga (billion )computer burning, let say 10watt for recall...
And it will be active during activity. Let say 3000h per day per computer.
14 GigaWatt worldwide × 3kh ... 52 GWh...
This is an ecological nightmare.
Speaking from my compliance aspect, this comprehensively fails PCI and GDPR immediately and the SOC2 controls list ain't looking so good either.
A general comment on corporate nature--they will abuse this info (even if by some fluke it doesn't leak like a sieve). It's only a matter of time. It's in their nature to abuse any collection of personal data. Any corporation that doesn't loses profit.
The OCR thing isn't new, of course--years ago I searched my Google Drive for "fish" and the first hit it found was a photo I took on my phone, not tagged or renamed, of a shop sign "WEIRD FISH".
How does Recall treat Citrix Workspace sessions? (I mean, I'm using my private computer to log into my works desktop)
I'm sure my employer would be very happy to learn that it's recorded on my private machine when I access client data.
OMG - I expected it, but still I'm shocked. If I assume negligence, I can be fined up to 250000 CHF - just by having client data on my screen.
Somehow I'm hesitating seeing this as a desirable feature.
Why can't they just make an improved version of searching in/with the browser history ... argh...
I've took a look at the past year of work Microsoft has done on Recall, which is due to roll out to compatible Windows devices soon
tl;dr it's much better from a security and privacy point of view. My partner managed to hack my Recall memory in 5 minutes to browse prior Signal discussions, by guessing my Windows Hello PIN.
There's a bunch of risks people who enable it need to understand.
Microsoft are rolling out Recall to users in Windows Insider (testing) before a wider rollout to all compatible systems.
It's definitely one to watch (and yes, I am) from a security point of view.
bbc.co.uk/news/articles/cj3xjr…
Recall had been dubbed a "privacy nightmare" but has made changes since its original launch was pulled.Imran Rahman-Jones (BBC News)
Companies dealing with sensitive info should ban all computers capable of running Recall from their networks.
Tabletop scenario for you:
Employee gets into a dispute with employer, leaves, had sensitive role. Employer revokes access, devices etc. Employee had logged in via BYOD to email, IM etc.
Due to Recall, employee walks away with 6 months of screenshots of everything she's ever worked on in a text indexed form - every email, chat, document, Teams call with video snapshots, transcripts of verbal calls etc - even if they set M365 to not store documents locally.
What does the employer do now?
Windows has always been the place where computing innovation happens first. This was the case when we introduced Copilot+ PCs lasWindows Experience Blog
Original botched launch still haunts new version of data-scraping AI feature.Andrew Cunningham (Ars Technica)
@Kevin Beaumont @Fi 🏳️⚧️ @soc @Reijo Pitkänen
Stopping malicious leaks is almost impossible, but Recall sounds to me like it makes even accidental leaks trivial.
@soc @reijomancer @munin that is not a workable answer, it just handwaves the problem away.
For one thing, most orgs who deploy BYOD don't have rights to wipe home PCs. For the other thing, if somebody is malicious, they've removed the MDM software.
@reijomancer @munin In which world does "BYOD" not include MDM?
So the obvious answer to Kevin's question is "the employer wipes the device" – case closed.
@munin So, BYOD dies a messy death because the oroborus of capitalism decides it's cheaper to pay for work devices and real MDM instead of letting employees float the cost of their off-hours wage slavery?
Ugly, but sign me up.
Throw more self-interest entropy into this farce called Recall.
I mean, clearly, this means BYOD cannot be allowed for windows shops;
credentials must only be managed in ways where they can be automatically rotated,
and offboarding must be centrally managed in a way that allows immediate and irrevocable lockdown of all access simultaneously.
Signal have rolled out an update to all users that stops Microsoft Recall from capturing Signal conversations.
I’ve tested this and it works. Brilliant work by the @signalapp team. 💪
They call on Microsoft to build better, as there was no standardised way as an app developer to do this. Because Signal is open source, now app developers have a template to protect their users from Windows.
signal.org/blog/signal-doesnt-…
Signal Desktop now includes support for a new “Screen security” setting that is designed to help prevent your own computer from capturing screenshots of your Signal chats on Windows.Signal Messenger
The Register took a look at Microsoft Recall and found it captured personal information, such as social security numbers and such in its database.
They also found they could access it remotely using TeamViewer, using just a PIN.
theregister.com/2025/08/01/mic…
exclusive: Our tests have shown there are ways to get around the promised security improvementsAvram Piltch (The Register)
I found an interesting Microsoft Recall issue with the latest version - Recall is enabled on my PC, but the tray icon (bottom right) saying it is running is missing.
Edit: after a reboot, it's back. I'll keep an eye on it. After the latest Windows Update the UI wasn't visible, but it was still recording.
Microsoft are upselling security controls for Microsoft Recall, which allow orgs to limit what it records specifically - if the org pay for Microsoft Purview.
I’ve had a look at how this works under the hood, it is using undocumented features in Recall. learn.microsoft.com/en-us/purv…
This article describes the prerequisites and policy configuration to help protect against sensitive information being included in a Recall snapshot.learn.microsoft.com
Porcodio Aruba se fai schifo al cazzo.
La verifica in due passaggi solo sulla tua app di merda e l'assistenza online che alla prima domanda sparisce e non si fa più sentire.
Dovete morire male 😡
È vero che la pec costa poco, ma il servizio fa schifo in modo assurdo.
This is a working prototype of V4L2 stateless VP8 and H.264 encoder support. This has been prototyped on an Hantro H1 encoder. Note that none of this work...GitLab
@rmader that is the idea yes, gstreamer will make integrating the HW encoders a lot easier.
For the pinephone I need cedrus though, not hantro. Looks like there's a bit more work happening on the hantro side so thats good for the PPP at least.
. There's still more work to do, frames are being dropped in the C code on my pinephone way too often. That needs to be solved before we know what kind of performance is possible.
. Cacheability would help a _lot_, passing memory around would be theoretically nice but not that much of a win I believe.
All I can say is thankyou, thankyou thankyou for your work on this and helping to galvanize and co-ordinate a burgeoning community around getting mainline mobile Linux photography moving forward.
It's all massively appreciated!
ELON DEMANDS BLOOD TO KEEP HIM YOUNG
gizmodo.com/tesla-cybertruck-d…
The Cybertruck has injured another owner, this time with the bottom edge of one of the truck’s doors.Lawrence Hodge, Jalopnik (Gizmodo)
This sounds basically like my understanding of modern physics.
Now who wants to talk about quantum mechanics?!
The original sources of MS-DOS 1.25, 2.0, and 4.0 for reference purposes - microsoft/MS-DOSGitHub
"Listen," one guard said, "I know we have only just met-"
"No," the other guard said, "we've worked together for years!"
"-but you can trust me when I say-"
"I can't, you have the curse that's opposite from mine!"
"I don't care for you at all."
"Well, I... oh... I love you too."
#TootFic #SmallStories #Microfiction
Brilliant!
And now I'm thinking about those guards. How did they meet? What did they do to get cursed? Is there some witch going around providing conveniently specific curses to kings with dungeons and an unhealthy obsession with puzzles?
What sort of home life do they have? What are their retirement plans? Can you imagine them trying to date somebody? Or worse, double-date? Or would that make it better?
from John Finnemore's Souveniere ProgramEveryone must love The Finnemore. EVERYONE.YouTube
Dear lazyverse, I've just read blog.prosody.im/great-invitati… and prosody.im/doc/modules/mod_inv… and I don't understand one thing: can this be used to generate an invite for an user that already exists and has been using the account for a while, but needs to reconfigure an xmpp client on a new phone?
of course they don't know their password, but I would have to reset it from prosodyctl anyway.
#xmpp
Adding a new device via invitation is not currently a thing. Password resets links (which work almost the same as invitations) are.
Generate a password reset link with this command:
'prosodyctl mod_invites example.com --reset username'
I haven't extensively tested it with clients or invite UIs beyond Snikket, though. Feedback welcome 🙂
@mattj fosstodon.org/@snikket_im/1122…
@shuro Snikket is XMPP for people who don't know what #XMPP is 🙂If you're happy with Conversations, continue using it! Snikket is more limited because it focuses on a specific use case.
If you want an easy-to-use messaging solution for a group of people (e.g. family, friends, clubs), plus companion apps and easy onboarding without forcing people to learn what a "XEP" is, then Snikket is here for you: snikket.org/start/
We just want XMPP to reach beyond the tech crowd.
Get Started
Snikket is a fully open-source personal messaging server that allows groups of people such as family, friends, clubs and small organisations to have their own private communication space.Snikket Chat
At work we recently started experimenting with generative AI for assistance with programming. We have a new Visual Studio Code plugin which we can ask questions in English, and it spits back code.qntm.org
@Natanox @mral @trechnex youtube.com/watch?v=9GQoHIBDog…
He was clearly trying to express something profound about the experience, and Jeff Bezos is just like "Imma let you finish, but here's a fountain of champagne" and a bunch of other people in the background are cheering and spraying champagne.
Oldest living person to ever go to space, William Shatner, tries to explain the majesty of space while Jeff Bezos shakes up a bottle of champagne. Shatner cl...YouTube
Here's a fun AI story: a security researcher noticed that large companies' AI-authored source-code repeatedly referenced a nonexistent library (an AI "hallucination"), so he created a (defanged) malicious library with that name and uploaded it, and thousands of developers automatically downloaded and incorporated it as they compiled the code:
theregister.com/2024/03/28/ai_…
1/
Simply look out for libraries imagined by ML and make them real, with actual malicious code. No wait, don't do thatThomas Claburn (The Register)
I accidentally found a security issue while benchmarking postgres changes.
If you run debian testing, unstable or some other more "bleeding edge" distribution, I strongly recommend upgrading ASAP.
@dgilman
This is insane. I expect full-fledged articles out soon, but another interesting bit in news.ycombinator.com/item?id=3… :
"the apparent author of the backdoor was in communication with me over several weeks trying to get xz 5.6.x added to Fedora 40 & 41 because of it's "great new features""
This is CVE-2024-3094 for easier tracking.
I was doing some micro-benchmarking at the time, needed to quiesce the system to reduce noise. Saw sshd processes were using a surprising amount of CPU, despite immediately failing because of wrong usernames etc. Profiled sshd, showing lots of cpu time in liblzma, with perf unable to attribute it to a symbol. Got suspicious. Recalled that I had seen an odd valgrind complaint in automated testing of postgres, a few weeks earlier, after package updates.
Really required a lot of coincidences.
One more aspect that I think emphasizes the number of coincidences that had to come together to find this:
I run a number "buildfarm" instances for automatic testing of postgres. Among them with valgrind. For some other test instance I had used -fno-omit-frame-pointer for some reason I do not remember. A year or so ago I moved all the test instances to a common base configuration, instead of duplicate configurations. I chose to make all of them use -fno-omit-frame-pointer.
Afaict valgrind would not have complained about the payload without -fno-omit-frame-pointer. It was because _get_cpuid() expected the stack frame to look a certain way.
Additionally, I chose to use debian unstable to find possible portability problems earlier. Without that valgrind would have had nothing to complain.
Without having seen the odd complaints in valgrind, I don't think I would have looked deeply enough when seeing the high cpu in sshd below _get_cpuid().
That was more than just good - you probably stopped a devastating attack on the whole industry. The open source community owes you a huge debt of gratitude. Had that exploit gotten into the wild it would have been awful. Catching it early was an immense win.
I hope Microsoft recognizes how much of a contribution you made to the entire industry.
Hey dude, you really save Millions, thanks a lot.
(Luck or not you did a fantastic job).
I see you’ll be at Oxide and Friends, super cool! Unfortunate a bit too late for me (2am) so I’ll listen to it as a podcast.
I’m trying to understand the context a bit better: how did you get Debian with -fno-omit-frame-pointer, did you compile it yourself? Or did the valgrind errors came from PostgreSQL builds with liblzma linked to it?
That is true.
Binary artifacts have no business existing in Free Software (or near-binary considering how auditable pre-generated config scripts end-up being). The way it was compromised in this case is almost certain to have happened before and reminds me of the SourceForge malware debacle (so arguably that's another famous example of it happening before).
I"m not sure if many other projects do like Guix and record the checksum of the whole repository so as to ensure reproducibility purely from source.
> I"m not sure if many other projects do like Guix and record the checksum of the whole repository so as to ensure reproducibility purely from source.
If the packager chooses to use the official tarball as "the source", validating the checksum would not have helped. Also whether it's always possible to run running autoreconf depends on the content of the tarball.
Which brings me to the (preliminary) conclusion that we'd better use repos as source of trust
@lispi314 @AndresFreundTec @glyph
@kirschwipfel @lispi314 @glyph
Sounds good. But some projects have a build stage which generates lots of things. Packagers for distributions need to set up the needed environment and perform these steps. It seems much easier to use a provided artifact in these cases.
I think this attack is hard to defend against: An evil insider in the project with control over the code and artifacts. One could also hide malicious stuff in the code itself directly, in plain sight.
Thank you for your efforts, and the excellent writeup you did when reporting what you uncovered.
It’s already clear that this whole situation will shake things up quite a bit, and rightfully so.
For those interested, see also boehs.org/node/everything-i-kn… on the history behind this…
Please note: This is being updated in real time. The intent is to make sense of lots of simultaneous discoveriesboehs.org
thank you, I see the paragraph that begins:
"To reproduce outside of systemd, …"
I have someone claiming:
"The exploit requires systemd. …"
Can both be true?
Postscript: thanks to @vi for helping me to realise my misunderstanding.
Apologies for the noise.
Ricevo, e credo che sia utile per un po' di vittime di #trenord qui sul fediverso
prealpina.it/pages/lombardia-t…
“La norma nel prevedere la necessità di richiesta dell’abbonato reindirizza la misura compensativa del disagio a chi effettivamente lo ha subito, diversamente da quanto accadeva con il vecchio bonus.”
che credo voglia dire, più o meno “speriamo che la maggior parte dei pendolari si dimentichino di chiederlo e/o non vengano a sapere di doverlo chiedere”
se ho ben capito le istruzioni su come fare la richiesta sono già su regione.lombardia.it/wps/porta…
@LaVi 🕊️📚🐈 @Fabio mi pareva tempo fa di aver trovato su uno dei siti istituzionali (trenord o regione) che i treni soppressi contino uguali ai treni con più di 30 minuti di ritardo, ma adesso non ho il link sottomano (e non so se le nuove regole siano cambiate).
Comunque c'è il fatto che quei dati non dicono che i treni in ritardo sono ovviamente soprattutto in ora di punta (anche per ragioni ragionevoli, tutto sommato), e che quindi impattano molte più persone rispetto ai treni in orario alle 10 di mattina o alle 8 di sera.
1/ It’s a big day for the Radicle community :space_invader: We're excited to announce the rollout of our first release candidate for Radicle 1.0 — our most significant update to date :tada:
Start collaborating today
👉 radicle.xyz
Here’s an overview of what’s new 🧵
2/ This release marks the stabilization of Heartwood, the peer-to-peer protocol that powers Radicle with a sovereign data network for code collaboration and publishing, built on top of Git. Heartwood addresses the usability and performance concerns faced during previous protocol iterations while doubling down on Radicle's secure and resilient primitives.
Learn more about Heartwood:
radicle.xyz/guides/protocol
3/ Radicle 1.0 features the core primitives for code collaboration, including patches and issues, with CI coming soon :corn:
Typically, artifacts like patches and issues are only found on centralized platforms like GitHub or GitLab, or their self-hosted counterparts. In Radicle, they are stored directly inside repositories and replicated between peers. This means that social artifacts inherit the same properties as source code: they are local-first, user-owned, and cryptographically signed.
4/ Instead of depending on a centralized server, Radicle users run nodes connected via a peer-to-peer network. Nodes host and synchronize Git repositories across the network, using a gossip protocol, alongside Git’s transfer protocol.
With this release also comes the launch of the Radicle Network, which lets users provide bandwidth, storage, and data availability to peers of their choice.
To seed is to give back 🌱
5/ Already, the Radicle Network is growing:
📈 > 100 nodes online daily
📈 > 400 unique repositories
📈 ~ 50 public seed nodes replicating repositories
6/ If you've been waiting for the right moment to try Radicle, this is it! We’ve got some shiny new guides to help you get started:
User Guide → radicle.xyz/guides/user
Seeder Guide → radicle.xyz/guides/seeder
👾 👾 👾
We need neutral and permissionless infrastructure to truly free the web 🏴☠️
Reliance on centralized forges is not sustainable for the future of free and open source software. We built Radicle to change that.
Try Radicle. Free your code.
aha and now I've got it seeding from my own node 
app.radicle.xyz/nodes/radicle.…
Is there currently anything for exposing tags and the tags' annotations as releases and release notes? What happens when someone decides they want to delete a repo from the network? Is that even possible?
Radicle is _really_ cool so far. I hope more people pick it up :)
Debugging is twice as hard as writing the code in the first place. Therefore, if you write the code as cleverly as possible, you are, by definition, not smart enough to debug it.
— Brian W. Kernighan
Vernor Vinge, author of many influential hard science fiction works, died March 20 at the age of 79. Vinge sold his first science-fiction story in 1964, "Apartness", which appeared in the June 1965 issue of New Worlds.Mike Glyer (File 770)
Lots of people sharing their love of A Fire Upon the Deep and A Deepness in the Sky, but don't miss Rainbows End.
It's perhaps a less successful story but remains, after almost two decades, the best description of what augmented reality games and ARGs might do to the world. en.wikipedia.org/wiki/Rainbows…
@cstross Rainbows End is the one that lives in my head more than the rest of his books (though they all have their places in there).
Every time autocorrect fucks up again, I find myself wishing for the kind of interfaces described in Rainbows End.
Mastodon Just Let Me Save The Original GIF And Not The h.264 encoded MP4 You Made From It Challenge 2024 - Impossible Difficulty
:( big sadge
#scaleway offers #riscv metal instances now. And they support @alpinelinux !
It appears to be relatively vanilla alpine edge with a custom kernel.
The world's first RISC-V servers available in the cloud. Taste the new open processor architecture now. Will you take the risk?labs.scaleway.com
“Scale melds incredibly creative and thought-through hard science fiction with the kind of social-political angle Egan’s increasingly been foregrounding in his work, and you’d do well to pick it up.”
locusmag.com/2024/02/the-year-…
2023 wound up being a strange reading year for me. I started the year with a big move: from Chicago back to beautiful Buffalo, NY. While it’s wonderful to be back east and closer to the mountains, …Locus Online
Questo sito utilizza cookie per riconosce gli utenti loggati e quelli che tornano a visitare. Proseguendo la navigazione su questo sito, accetti l'utilizzo di questi cookie.
