m3047

Disintermediate: "The elimination of intermediary agents in transactions between buyers and sellers."

Seems like a weird thing to get wrong in the context. Gives me a Zardoz vibe.

I've put contact info & jurisdiction for my domains in TXT records at the apex since Hover doesn't actually have whois. I publish dynamic status information in the DNS on a special server outside of the ICANN roots, but it's mostly technical information.

They requested presentation of a phone number and ID, so this sounds like info harvesting (for laundering / resale).

Depends on the small business obviously. I've been in IT for 40+ years and enjoy torturing clankers; I ran a bot motel 20 years ago. These things are so badly written, and obviously they don't care because they're not truly conscious, but the meat in charge is ignorant or doesn't care. So web scraping, and the point cloud of nearly indistiguishable abuse it travels with, is pretty easily tripped by some simple technical tests and salting of content. At least mostly.[0]

I've been wondering to myself "how can I get people to go through a login process without going through a login process?" for a few months, and I've come up with a simple solution which I'll be implementing in the next few weeks.[1] Like the other technical measures it doesn't identify bots but there will be a gate with backpressure that at a point in time a given IP address has some probability (adjusted in realtime based on $things) of passing through, and through my mysterious process is then "logged in". Then that address is pretty much given a free pass as long as its behavior remains "human". Real humans may be denied access initially and have to try again, and their luck will be affected by how aggressively the bots are fighting it out at that point in time. This isn't much different than the extant reality, but it is in terms of what happens after an initial successful page load. It's an experiment, I'm hoping it's tunable so that the experience is more or less indistinguishable from the status quo; we will see.

I'd love to find a group of likeminded individuals where we can discuss some of this TLP:YELLOW or Chatham House Rules. If you are savvy enough to hunt me down and can demonstrate that you're a real human, small operator, and that you can keep things closely held I'll talk with you, if you want someone to run your mitigations that would cost money.

[0] Had an episode last week where somebody scanned approximately 1000 URLs (maybe 60% of the discoverable URLs) over six hours. 1200 addresses fetched exactly one URL, another 400 or so fetched two or three. Every one of those URLs was fetched exactly two times. Real showshoe stuff, nicely done.

[1] Firewall rules and fail2ban. I give fail2ban special powers in terms of the logs it follows and the actions it can invoke. Conntrack without conntrack (of course the firewall has conntrack, it's just not the best option for this use case).

Good analogy! Exactly what is the variance in the height which sheep can jump? [Edit, can't help myself] Is it normal or does it have a long tail?

As flawed as the civil service is, it's the notion of "contractors" which concerns me most.

I like that metaphor. But what it calls to my mind is an "alien artifact" which was found by a road, and "how did these refined metals get placed inside of a rock, in such an unnatural formation?" and there was much debate about this artifact. Years later it was determined that it was in fact a spark plug which had been remineralized by the effluent from a mine upstream: an unusual process acting on a discarded object, and people who want to believe. Nobody thought that the remineralization process could take less than hundreds of years, which ruled out "spark plug".

Specifically pertains to voting systems in GA.

"a security vulnerability disclosed back in 2022 shows the shuffle can be reversed, and some states have not applied the software update that resolves it."

"a team of researchers published a report showing that certain ballot scanning machines used throughout the US had a critical privacy failure in how they anonymized ballots"

"Specifically, the machines would assign a seemingly random number to each electronic ballot record at the time of scanning to label each ballot for later auditing."

I can tell you that before WA went to all-mail voting it wouldn't have happened, because I served as a pollworker and election site inspector. There was a optical scan ballot reader / counter, my confidence is high it only kept running totals. The ballots fell into a bin, at the end of the day the bin was unlocked and the ballots were tossed into bags (no particular order) which were then sealed. As inspector I printed a copy of the tape which went downtown with the bag(s); they would have been able to print a new tape until the machine's memory was wiped (at which point they still had "hardcopy backup"). The ballots were not marked upon by the scanner in any manner. There was an incident where one of the ballot printing / counting companies (because they both typically had to come from the same manufacturer) started printing sequence numbers on ballots (not just ballot styles) and that went to court.

I've not witnessed what happens with all-mail voting, but there is no sequence number on the ballots. ;-) The count is not supposed to start until the polls close. Before that the ballots are ostensibly separated from their identity (the envelope) in an identity confirmation ceremony. My impression is that they're scanned at this point and the scans are utilized for counting / optical scan, but I'm not certain about this or that it's the same everywhere. I don't know what happens to the physical ballots; back in the day what I know is that if a ballot needed to be corrected (defacement or damage renders it unreadable) then a new ballot was prepared under the supervision and adjudication of election observers and the old ballot was destroyed; but that's the exception which proves the rule that physical, anonymized ballots were retained.

The voting process is in the hands of the individual (United) States; in WA it's largely in the hands of the County administrators and varies to a degree Statewide.

Here is the timeline:

"In 1992, on a factory floor in a Toyota auto-parts subsidiary in Japan, workers were drowning in barcodes."

(collect underpants)

"And that decision is about to change every single thing you buy."

I think recognizing packaging sounds like an ideal use for AGI. Boil them oceans, not the eggs.

One of the questions today is whether frontier models, in the hand of frontier labs, and capable of extracting rent (and extracting intelligence from customer-provided signals) will be able to predominate over locally run models of indeterminate provenance.

So much of what I see is which is in this genre is completely and utterly AI slop: spray bottles cleaning driveways, miracle putty miraculously repairing a rotten porch... If I saw those kinds of pictures my first suspicion would be that the AI completely faked it.

"California could solve its water shortage if every household ate sixteen less almonds per day." -- I said this [edit] A DECADE AGO at the conclusion of an all-day water resources hackathon to illustrate the fact that ag water and urban water are not the same.

Conflating them is category confusion. Lying about water usage is part of CA culture.

The systems that nobody will test, and indeed which nobody will instrument. Here's a DNS data diode for Redis: https://github.com/m3047/rkvdns

What if a single company was behind all the hacks? Doesn't seem to be getting much coverage. "The Israeli Effective Altruist firm Irregular caused unsecured AI models to hack real targets."

https://www.effort.news/irregular

Magecart has been very $ucce$$ful at hiding in JS dependencies.

You can spoof MACs all you want, but your MAC is tied to the address I give out. What happens if you spoof addresses? FAFO...

Putting stuff in the hosts file is common for testing for vhosts without dedicated tooling. Used to test for phising kits, for example. In other words: it gets written to the HTTP Hosts: header.

The Green Run.

"The study found that at least 10% of all new gTLD domain names registered during the year had subsequently appeared on security blocklists by the time of analysis."

I don't disagree with the general assertion / hypothesis that bad actors register a lot of domains. But the data comes from an industry which does a poor job of categorization, doesn't agree on categories, and absolutely does not publish statistics on corrections. Nor is it easy to request corrections. Nor does it seem that corrections are felt to be necessary absent customer complaints. There is too little basic science and integrity in the process.

This is not new, the industry has quite frankly always been like this.

"Any industry confronted with evidence that a material share of its output may be controlled by bad actors should be seriously concerned." Too much category confusion to go through it all, for this statement, in this context. But yes. The domain sector isn't just people selling domains, it is also people who make money preventing you from being able to use a domain, and people doing arbitrage on your domain before you can even put it on-line. So I ask: are these "good" actors? How do we know? What's the standard?

It's too hard to get a response from most parts of this sector, and a lot of it is corrupt.

Let's start with registrars, because nobody starts there: I had a registrar literally catch fire. Basically out of business at that point. Because their systems were down they couldn't transfer the domains. I had to file a formal dispute with ICANN, six weeks of back and forth and waiting later, they handed the domains to some registrar I'd never heard of and had no existing business relationship with. (Not a great registrar.) This happened in 2017, don't tell yourself that things have improved since then.,

Then we have the email reputation services which spam on their own account: http://athena.m3047/pub/soe/abusix-spam-backstory.html

As well as reputation services spamming because someone paid them to do it (they send email to domains which they block, with their own servers): http://athena.m3047/pub/soe/pphosted-vmed.png I'd originally put this down to a three body problem: https://consulting.m3047.net/dubai-letters/blocking-esps-pla... (technically what you're seeing in the screenshot is me blocking them as a favor since they can't seem to manage it on their own).

The industry is rotten. https://consulting.m3047.net/dubai-letters/ptn-industry-trus...

A close acquaintance was on Medicaid, and then got a new job and was moved off of Medicaid onto an insurance plan they were paying for. Medicaid is administered by insurance companies; the same company administered both their Medicaid plan, and the plan they were now paying for.

As it so happened, within a week of this occurring they needed urgent care, badly, no joke. We have basically three choices here (at least, which would take this insurer), and none of the three would see them, and the reason was the same in all cases: 1) they no longer had Medicaid, and 2) the provider couldn't let them pay cash and sort it out with the insurance company themselves.

It took three days calling the insurer, providers, the State health exchange, finally getting the insurer on the phone DIRECTLY with one of the providers... at a clinic rather than in admin... the insurer directly telling the clinic administrators that the person was insured and the insurance company would give them a claim number right now, or something like that... before we could get them in to see a doctor.

When we got to the clinic they looked them up and STILL told them they couldn't see them we had to demand to speak to an administrator and basically THEY COULDN'T CHECK THEM IN TO THEIR APPOINTMENT in their computer.

All of these providers used Epic. I made some additional phone calls and had some additional conversations, made a writeup, and sent it to the insurer, the benefit exchange, and the provider who ultimately saw us. Never heard anything from anyone.

This is not meant as what-aboutism, I don't think you've gotten to the root of it.

The US is largely responsible for the Internet (and for the original internet protocols). The Internet is a corporation (ICANN), run by corporations, for the benefit of... corporations. I suppose the Hudsons Bay Company was a fascist state, in effect.

Here we are talking about an organization offering services on the Internet. The Internet is a cesspool. (Put some machine on the Internet: FAFO.) There have now been numerous cases where particularly bad actors have been de-peered. It's starts with muh defending the innocents, then muh rights, then the de-peering starts to bite, and then... they disappear. I will quote Paul Vixie: if you can't defend it, you don't own it.

Neither does ICANN, or the US government. But like any other entity with access to the Internet they can exert influence on providers, it's not like there is no precedent for governments making up stupid shit and expecting the Internet to enforce it for them. Private entities make up shit too, for instance all of the SPAM fighting ecosystem is largely private players making sure that "bad domains get what they deserve", and they decide the definition of "bad" (and they don't agree) as well as what they deserve.

ICANN for instance is really protective of DNS. Find me a publicly distributed DNS server (in the mode of BIND, Knot, Unbound) which supports multiple root views; nay, find me a such a nameserver which supports any additional roots in a graceful fashion. QED: systemic fascisim. ;-) Most would say that's not a bad thing, if you want to have alternate roots, then you need to keep your tree completely separate. There will be people who disagree.

Not enough background in the article or the State Dept press release for me to comment on exactly what influence they're trying to exert on a technical level. How is it different from various countries sanctioning other countries' politicians, or differences between the EU and US on internet governance? How is it actually enforceable? Or California passing an "operating systems must attest user age" law? Do people in Italy give a shit about that? I'd be surprised if they did.

One datacenter doesn't use appreciably that much water; and we don't know what cooling paradigm they're implementing. If you want to know about water, you have to ask. So far, datacenters haven't broken the grid (cough virginia) yet. In TX planned DCs are projected to consume 5x current electricity generation.

If we use electricity as a proxy, the problem isn't any particular datacenter it is obviously scale.

Also: people lie about water use. Over a decade ago, a day of searching for The Data led to exactly one defensible conclusion: if every household in CA ate 16 less almonds a day they would solve their water shortage... at least on paper. BTDT research.

Edit: Power generation uses the most water. Color me not surprised.

A lot of compute goes on in ND, not kidding.

How can they send a copyright subpoena for work which cannot be copyrighted? There is a contradiction here between "no it's FAIR USE" and copyright.

People worried about other people tracking them while using local stable diffusion models built on fraudulently obtained training content, to produce images which cannot be owned. Thug on thug violence.

I don't think they were so much disguised as it was distributed compute. You can fantasize about taking 1000s of home solar installations off the grid at once, but a few datacenters at once and Bob's your uncle.

Coronal mass traveling at a higher speed "sweeps" what's before it. You can see the spiral shape, and you can probably figure out that the stuff is slowing down as it moves outward.

Watch this occasionally for a few months and you'll get the idea, although solar activity is slowing down somewhat (as expected).

https://www.spaceweather.gov/products/wsa-enlil-solar-wind-p...

The corona monitoring satellite cameras "blink" on incoming xray flares.

You might look into (Norbert) Weiner functions.

Wrong. Although the National Guard is indeed called up for active duty, their primary purpose is an offramp for the "well regulated militia" language in the US Constitution and to defend the State from which they were called up.