lcamtuf

Business idea: an environmentally-conscious alternative to Bitcoin that involves solving crc32.

Ultimately, I believe that the moral compass must come mostly from within. If you are not explicitly trying to be radically different in how you approach privacy, security, and content policing on your platform, you are destined to end up the same as everybody else. (9/9)

A natural instinct for many of us is to demand regulatory solutions - but in my experience, regulatory involvement in this area severely lacks thoughtfulness and long-term insight. It is also often exacerbated by poorly-researched or misleading journalistic exposes. (8/9)

With intense political pressure, not doing it is not an option. But doing it well is an impossibility - not at the scale they operate, not without collateral damage, not without their own politics tainting the outcome. Or, as @alexstamos puts it: https://twitter.com/alexstamos/status/1078677650414006272 … (7/9)

The final problem is inherent to building platforms that serve as a conduit for communications and commerce on an unprecedented scale. Willing or not, this makes the companies the arbiters of all human conduct, from acceptable political speech to the sale of fireworks. (6/9)

They are ultimately building a world that doesn't forget and doesn't forgive - and where dirt can be dug up on any opponent - by a government, by a hacker, by a spouse. On a very human level, this page still creeps me out: https://myaccount.google.com/purchases  (5/9)

The other vice I see is the inherent hazard of tying your long-term strategy to knowing everything there is to know about your users' lives. The companies do it for good if self-serving reasons - and of all possible actors in that role, I trust them the most. But... (4/9)

In essence: if you don't write a set of immutable principles ahead of the time, if you don't draw some clear lines in the sand - you will wake up one day in a very different business and not know why. (3/9)

At the same time, they succumb to three vices. The first is incrementalism: every month, there is an intense competitive pressure to make small compromises on how you approach security and privacy; such individually unimportant tweaks add up to profound shifts over time. (2/9)

Thread: there are countless urban legends and misconceptions about the practices of tech companies such as Google and Facebook. In my experience, they take extremely good care of your data; they guard it with zeal that's unmatched by most other players in the industry. (1/9)

There is a piece of proposed legislation in NY that would allow the state to investigate your search history. It includes this passage: "For the purposes of this subdivision, [...] 'search engine' shall only include Google, Yahoo and Bing." https://nyassembly.gov/leg/?default_fld=&leg_video=&bn=S09191&term=2017&Summary=Y&Actions=Y&Text=Y …

Not many paper announcements make me say "this looks pretty cool", but this looks pretty cool.https://twitter.com/matthew_d_green/status/1059435094421712896 …

One of the best rules to live by is: be especially suspicious of claims that align with your views, for they dull your critical facilities. And seek out the best arguments of the other side, rather than ridiculing their worst.

There is probably a component of truth to the Bloomberg story, and probably some legit intelligence findings underpinning it, but I have serious doubts that the reporting is substantially accurate.

Of particular note: the unambiguous denials from the security teams of the companies named in the article, the unclear access path,, the seemingly unnecessary burning of a very sophisticated tool on a seemingly non-targeted attack against a boring platform.

Right. I have no special knowledge here, but given the exceptional claims made by Bloomberg and having seen several other cases of spectacularly inaccurate reporting cast in a very similar mold, I'd advise a lot of caution. Still prudent to worry about hw supply chains.