dawnbreez

12 ms·

61.
by dawnbreez 5y ago
> Maybe the last sentence where they put a deadline on it, but that part was strange anyways since they explicitly said this is NOT a CCPA request, so that deadline doesn't even apply to this email. That's the threat, yeah. And
62.
by dawnbreez 5y ago
> Because there's a precise definition of "human subject research" which is actually a lot more limited than many people think. We've had two different cases now where that disconnect has led to studies which cause st
63.
by dawnbreez 5y ago
The example you gave is not relevant. The researchers in this study are already directly contacting everyone they need consent from, and if an individual declines, the rest of the sample can still be studied (unlike in a classroom setting,
64.
by dawnbreez 5y ago
"Someone can be shot at, therefore a researcher shooting people to see how they react is ethical." "Someone can be sued, therefore a researcher making vague legal threats to see if people waste money on lawyers is ethical
65.
by dawnbreez 5y ago
> BTW, if you are actually being threatened by a lawyer then they send certified mail or show up at your door. Sure, but if you haven't lawyered up by that point you're going to have a bad time. Doubly so if you aren't fam
66.
by dawnbreez 5y ago
> how would people have reacted if this had been limited to large corporations you do not like? Those large corporations we do not like have lawyers on retainer specifically to deal with this situation (probably by suing the pants off of
67.
by dawnbreez 5y ago
> I'm a former pentester, and deceptions like this were run all day, every day, by a dedicated team. It's often phase one of phishing, since you end up assuming you're talking to a trustworthy source. So I'm wondering
68.
by dawnbreez 5y ago
Following those questions by citing a statute of the law, however, IS a legal threat. Implicit in citing specific parts of the law is the threat that those parts of the law apply to this situation .
69.
by dawnbreez 5y ago
As someone in another comment thread pointed out, the requirements also put you on the spot if 50,000 Cali citizens have personal data that you've got access to. And, as someone also pointed out in that thread, being on Hackernews an
70.
by dawnbreez 5y ago
Not a lawyer, but: Not really. You do have to present the case to the judge in a certain format to start it, but as I understand it, there's no requirement for you to send notice to the guy you're suing in a specific format. Once
71.
by dawnbreez 5y ago
It's kind of hard not to log IPs when running a service over the internet. You kind of have to have their IP address in order to know where to send the info they want. Further, logging an IP address has also been necessary for securi
72.
by dawnbreez 5y ago
It's also worth noting that under US law, a lawyer who gives you legal advice can be held liable if that advice causes trouble down the line. This creates even more incentives to have a paywall--one, it keeps people from bugging you fo
73.
by dawnbreez 5y ago
> So what happens when a site receives a CCPA inquiry from an actual person concerned about privacy instead of a researcher under a fake identity? They conclude that it's a Princeton research study and throw it in the trash. This is
74.
by dawnbreez 5y ago
> Not all human subjects research requires informed consent — or even consent. There have been multiple examples of this going horribly, horribly wrong. (Naturally, the worst examples were government-funded and ran during the Cold War.)
75.
by dawnbreez 5y ago
I worked at an Amazon air-shipping warehouse for a couple years, and hearing this confirms my suspicions about the management there. Lower management (supervisors, people actually in the building) were very aware of problems, but the people
76.
by dawnbreez 5y ago
Was Challenger the one where they buried the issue in a hundred-slide-long PowerPoint? Or was that the other shuttle?
77.
by dawnbreez 5y ago
No, no, back up a second. The argument being made in the parent comment is that once there is one entity with enough stake in the network to dictate where it goes, they can just pull out before tanking the network. But my understanding was
78.
by dawnbreez 5y ago
But...if you no longer have value on the network, doesn't that mean you no longer have enough stake to control the network?
79.
by dawnbreez 5y ago
Frankly, this has me excited. I can't wait to see what new, exciting tech AMD invents to eat Intel's lunch, again.
80.
LetsEncrypt certificates are valid for 1s too long(bugzilla.mozilla.org)
4 points by dawnbreez 5y ago|1 comments
81.
by dawnbreez 5y ago
No? I think that there is reason to not trust anything from a given domain if that domain is in use by bad actors.
82.
by dawnbreez 5y ago
The main issue is that the researchers are now untrustworthy because they conducted this experiment without permission. Essentially, the kernel dev team can no longer trust that any given patch from U of M isn't the same research team
83.
by dawnbreez 5y ago
Security research has its own standards of ethics, and these researchers violated those standards. 1. You don't conduct a penetration test without permission to do so, or without rules of engagement laying out what kinds of actions and
84.
by dawnbreez 5y ago
There's only one way the kernel dev team can afford to look at this: A bad actor tried to submit malicious code to the kernel using accounts on the U of M campus. They can't afford to assume that the researchers weren't mal
85.
by dawnbreez 5y ago
logged into my ancient hn account just to tell all of you that pentesting without permission from higher-ups is a bad idea yes, this is pentesting
86.
by dawnbreez 9y ago
"Install an arbitrary piece of code on your machine to improve your privacy." Note that there is no link to the source code, no checksum. There's no indication that DDG isn't doing exactly what they claim to be protectin
87.
by dawnbreez 9y ago
Call it Protestant.
88.
by dawnbreez 9y ago
>where delegation isn’t possible. This is the issue--delegation absolutely is possible in the use cases brought up by MPs and by bystanders. There's not really an excuse when email accounts can be set to auto-forward, and when ema
89.
by dawnbreez 9y ago
Perhaps if the penalty is based on days since exposure--immediately revealing the breach gets you a minimal fine, but waiting six weeks is enough to cause a major fine (or add to sentences for fraudulent trading related to the incident), an
90.
by dawnbreez 9y ago
As someone who plays a "competitive" first-person shooter (Counter-Strike: Global Offensive) I can say that at least one game does the exact opposite. Players compete directly, and elimination is for the rest of a ~5 minute "

More ›