Notices by Bradalot “:verified:” (bradr@infosec.exchange)

@pluralistic

immigrants remind us that the rest of the world has dealt with this before, and they know things.

What's the opposite of doom scrolling?

Spain just pulled off one of the fastest energy transformations in Europe.

Even without seeing the talk at Minnebar by Paul Cantrell (@inthehands), this review/reflection/meditation by Matthew Tift (@mtift) moved me deeply.

In particular, I want to share it with my EU friends as they develop and revise their national tech and energy infrastructures to reduce their, um, supply chain risks.

https://matthewtift.com/blog/caring-about-software-caring-about-people

#DigitalSovereignity #EuroOffice #EUTech

@0xabad1dea

A surprising amount can be read from the data, and for some users, it can be life-threatening.

The entire WhatsApp profile database (including correlatable phone numbers and face photos) leaked.

https://www.heise.de/en/news/3-5-Billion-Accounts-Complete-WhatsApp-Directory-Retrieved-and-Evaluated-11083244.html

#Privacy #WhatsApp #Databreach

@inthehands

We should pay a lot more attention to the •human system• dependencies we’re introducing when we import a library, not just the code.

For big-co environments: This is also a great argument for making the conversation about dependencies broadly cross-functional, and up and down the organization, rather than a silo'd intra-engineering conversation about whether to "buy or build".

@mattly

I think I get it (not sure). You're saying "make datasheets".

And I'm saying (too boldly) "Enact software liability, and datasheets will make themselves."

@mattly

Consider: Having good product or component datasheets is downstream from holding product liability and warranty exposure.

Since software is subject to neither of the latter, it will not create either of the former.

@darnell @Mashable

To me, this is a distinction without a difference. That ID company is likely at greater risk to breaching my privacy by leaking my ID, not lesser.

Though to be honest, I'm more concerned about the chilling effect. The internet is affected more by allocations of liability than allocations of compliance.

https://cybernews.com/security/popular-apps-left-biometric-data-ids-of-millions-of-users-in-danger/

@darnell @Mashable

I think the physical store analog would not be "You are required to show id when buying a porn mag", but rather something like "You are required to give a copy of your ID (not just show it) to the thrift store owner on entry, because they can't be sure some donor didn't wrap their cocktail glasses in pages torn out of a porn mag."

@patrickcmiller

"I said, good day, sir!"