5 ms·

>>demonstrate they will use it responsibly. The problem is to define "demonstrate" and the criteria. Remember the gatekeeper is now an unemployed gal who "kno

by toss1 4y ago

>>demonstrate they will use it responsibly. The problem is to define "demonstrate" and the criteria. Remember the gatekeeper is now an unemployed gal who "know lot's of things about cyber security" according to her main page. Seems likely a competent bad actor could easily impersonate a well-meaning reporter... Yes, security through obscurity isn't security, but this also seems incredibly irresponsible for any "security researcher". AFAIK, just basic standard good practice is to report the flaws and allow a reasonable interval before publishing, and there seems to be no hint of this. Modern society really is held together with duct tape, baling twine, and a few pieces of bubble gum... [EDIT: pronouns]

Rhinozz 4y ago
>>Remember the gatekeeper is now [...] unemployed [...] who "know lot's of things about cyber security" according to [its] main page. Seems likely a competent bad actor could easily impersonate a well-meaning reporter... ...and it has a Wikipedia article (https://en.wikipedia.org/wiki/maia_arson_crimew https://en.wikipedia.org/wiki/maia_arson_crimew), and has demonstrated in other cases (cf. https://www.dailydot.com/debug/feelyou-mental-health-app-data-leak/ https://www.dailydot.com/debug/feelyou-mental-health-app-dat...) that it has at least a reasonable grasp on what to leak and what not to leak.
- toss1 4y ago
  Good to see that; thanks for digging deeper. I hope he has done this behind the scenes and the holes are patched, because I'm sure that by now, someone with worse intent has already followed those footsteps...
  - Rhinozz 4y ago
    In the aforementioned Daily Dot article: > CommuteAir added that the server, which was taken offline prior to publication after being flagged by the Daily Dot, did not expose any customer information based on an initial investigation. As a side note, maia uses it/its pronouns.
    - mananaysiempre 4y ago
      If TFA (may not be accessible right now) is to be believed, “the” server is a very generous understatement of the size of the exposed infrastructure, and customer information was very much accessible if not accessed per maia’s words. So seeing a statement like this from the CommuteAir PR people actually makes me feel less reassured, not more. (The attacking side looks better so far—maia itself is not a “watch the world burn” type, judging from its breach history, even if its writing makes you wonder whether the absurdist parody is deliberate or the author is in fact slightly manic. Kind of like Justine Tunney.)
    - pc86 4y ago
      According to wikipedia maia has used both it/its and she/her at various times, so it seems either is appropriate.
      - komali2 4y ago
        Sure but "he" isn't, which is what OP used.
- vunicipna 4y ago
  [flagged]
  - irjustin 4y ago
    > down to other more selfish reasons, e.g. Edward Snowden's mass theft and leaking of NSA secrets. What was Snowden's selfish reasons?
    - toss1 4y ago
      Snowden was a compromised asset of Russia, working for them. Most of what he released had nothing to do with his stated purpose. People have all kinds of reasons for doing that sort of thing. Sometimes they really believe in the other country, sometimes it's entirely selfish. We won't know even if he says something on the topic, since we can never know his mind, and he'd demonstrated that he's dishonest.
      - irjustin 4y ago
        > Snowden was a compromised asset of Russia, working for them. So Snowden was a Russian asset, who wanted to go against Russia by leaking information about a US surveillance program, and then after failing being a Russian asset, went back to Russia...?? I'm having a lot of trouble with this line of logic, can you point me to something credible on this? I can 100% believe there was a selfish purpose, but this doesn't seem like it.
        toss1 4y ago
        >>go against Russia by leaking information about a US surveillance program The information Snowden leaked was in no way against Russia, it benefited Russia enormously. Even the stuff that was on his claimed point created turmoil in the US to this day, which harms the US and only helps Russia The other stuff he leaked helped Russia directly, and directly endangered and likely got killed US people and/or assets. and of course he claimed his laptop was secure while he was in Hong Kong on his way to Russia. Anyone who thinks it stayed that way and he was allowed/invited to stay in Russia is a fool. There is nothing he did that didn't harm the US and benefit Russia, and he was a very successful Russian op. the mere fact that it is still being debated here in the Us shows how successful it was, even if just a provocation/disinformation operation.
kuschku 4y ago
Please give maia the respect she deserves and use the correct pronouns.
- birdyrooster 4y ago
  Apparently the pronouns to use are it/its? According to other people which makes your comment even better.
  - ConfuSomu 4y ago
    she uses both pronoun sets: it/its and she/her[1]. [1]: https://maia.crimew.gay/ https://maia.crimew.gay/
- LastTrain 4y ago
  She goes by it, so go look in the mirror. We're all trying our best here.
  - kuschku 4y ago
    Maia uses both she and it pronouns. The poster before me misgendered it though, which absolutely isn't okay.
    - counterfoil 4y ago
      [flagged]
    - LastTrain 4y ago
      I try and use a person's preferred pronoun. Sometimes I fail, and that absolutely OK.
- corndoge 4y ago
  https://en.m.wikipedia.org/wiki/Maia_arson_crimew#cite_note-pronouns-6 https://en.m.wikipedia.org/wiki/Maia_arson_crimew#cite_note-...
- 4y ago
_yb2s 4y ago
I think the point here is to expose the nofly list as an unethical and/or illegal government program by leaking it to journalists that can evaluate and summarize it's contents, not to help them secure it better. White hat hacking assumes that the hacked party is doing normal or ethical business, and that helping them secure it would be generally beneficial. Also, I'm pretty confident that Maia, as a famous hacker and cybersecurity expert, isn't going to be easily duped by someone impersonating a journalist, and knows how to verify such things.

by toss1 4y ago

Rhinozz 4y ago

>>Remember the gatekeeper is now [...] unemployed [...] who "know lot's of things about cyber security" according to [its] main page. Seems likely a competent bad actor could easily impersonate a well-meaning reporter... ...and it has a Wikipedia article (https://en.wikipedia.org/wiki/maia_arson_crimew https://en.wikipedia.org/wiki/maia_arson_crimew), and has demonstrated in other cases (cf. https://www.dailydot.com/debug/feelyou-mental-health-app-data-leak/ https://www.dailydot.com/debug/feelyou-mental-health-app-dat...) that it has at least a reasonable grasp on what to leak and what not to leak.

toss1 4y ago
Good to see that; thanks for digging deeper. I hope he has done this behind the scenes and the holes are patched, because I'm sure that by now, someone with worse intent has already followed those footsteps...
- Rhinozz 4y ago
  In the aforementioned Daily Dot article: > CommuteAir added that the server, which was taken offline prior to publication after being flagged by the Daily Dot, did not expose any customer information based on an initial investigation. As a side note, maia uses it/its pronouns.
  - mananaysiempre 4y ago
    If TFA (may not be accessible right now) is to be believed, “the” server is a very generous understatement of the size of the exposed infrastructure, and customer information was very much accessible if not accessed per maia’s words. So seeing a statement like this from the CommuteAir PR people actually makes me feel less reassured, not more. (The attacking side looks better so far—maia itself is not a “watch the world burn” type, judging from its breach history, even if its writing makes you wonder whether the absurdist parody is deliberate or the author is in fact slightly manic. Kind of like Justine Tunney.)
  - pc86 4y ago
    According to wikipedia maia has used both it/its and she/her at various times, so it seems either is appropriate.
    - komali2 4y ago
      Sure but "he" isn't, which is what OP used.
vunicipna 4y ago
[flagged]
- irjustin 4y ago
  > down to other more selfish reasons, e.g. Edward Snowden's mass theft and leaking of NSA secrets. What was Snowden's selfish reasons?
  - toss1 4y ago
    Snowden was a compromised asset of Russia, working for them. Most of what he released had nothing to do with his stated purpose. People have all kinds of reasons for doing that sort of thing. Sometimes they really believe in the other country, sometimes it's entirely selfish. We won't know even if he says something on the topic, since we can never know his mind, and he'd demonstrated that he's dishonest.
    - irjustin 4y ago
      > Snowden was a compromised asset of Russia, working for them. So Snowden was a Russian asset, who wanted to go against Russia by leaking information about a US surveillance program, and then after failing being a Russian asset, went back to Russia...?? I'm having a lot of trouble with this line of logic, can you point me to something credible on this? I can 100% believe there was a selfish purpose, but this doesn't seem like it.
      - toss1 4y ago
        >>go against Russia by leaking information about a US surveillance program The information Snowden leaked was in no way against Russia, it benefited Russia enormously. Even the stuff that was on his claimed point created turmoil in the US to this day, which harms the US and only helps Russia The other stuff he leaked helped Russia directly, and directly endangered and likely got killed US people and/or assets. and of course he claimed his laptop was secure while he was in Hong Kong on his way to Russia. Anyone who thinks it stayed that way and he was allowed/invited to stay in Russia is a fool. There is nothing he did that didn't harm the US and benefit Russia, and he was a very successful Russian op. the mere fact that it is still being debated here in the Us shows how successful it was, even if just a provocation/disinformation operation.

kuschku 4y ago

Please give maia the respect she deserves and use the correct pronouns.

birdyrooster 4y ago
Apparently the pronouns to use are it/its? According to other people which makes your comment even better.
- ConfuSomu 4y ago
  she uses both pronoun sets: it/its and she/her[1]. [1]: https://maia.crimew.gay/ https://maia.crimew.gay/
LastTrain 4y ago
She goes by it, so go look in the mirror. We're all trying our best here.
- kuschku 4y ago
  Maia uses both she and it pronouns. The poster before me misgendered it though, which absolutely isn't okay.
  - counterfoil 4y ago
    [flagged]
  - LastTrain 4y ago
    I try and use a person's preferred pronoun. Sometimes I fail, and that absolutely OK.
corndoge 4y ago
https://en.m.wikipedia.org/wiki/Maia_arson_crimew#cite_note-pronouns-6 https://en.m.wikipedia.org/wiki/Maia_arson_crimew#cite_note-...
4y ago

_yb2s 4y ago

I think the point here is to expose the nofly list as an unethical and/or illegal government program by leaking it to journalists that can evaluate and summarize it's contents, not to help them secure it better. White hat hacking assumes that the hacked party is doing normal or ethical business, and that helping them secure it would be generally beneficial. Also, I'm pretty confident that Maia, as a famous hacker and cybersecurity expert, isn't going to be easily duped by someone impersonating a journalist, and knows how to verify such things.