Categories
Aside Links

Transparency Follows After Trust Is Lost

Via Wired:

Speaking at Davos, Uber CEO Dara Khosrowshahi pointed out that consumers face a challenge in trying to understand tech’s influence in the age of big data. He called this an “information asymmetry.” In his previous job, as CEO of Expedia, Khosrowshahi said, customers were shown a tropical island while they waited for their purchase page to show up. As a test, engineers replaced the placid image with a stressful one that showed a person missing a train. Purchases shot up. The company subbed in an even more stressful image of a person looking at a non-working credit card, and purchases rose again. One enterprising engineer decided to use image of a cobra snake. Purchases went higher.

What’s good for a business isn’t always good for that businesses’ users. Yet Khosrowshahi stopped testing because he decided the experiment wasn’t in line with the Expedia’s values. “A company starts having so much data and information about the user that if you describe it as a fight, it’s just not a fair fight,” said Khosrowshahi.

The tech industry often responds to these concerns with a promise to be more transparent—to better show how its products and services are created and how they impact us. But transparency, explained Rachel Botsman in the same Davos conversation, is not synonymous with trust. A visiting professor at the University of Oxford’s Said School, Botsman authored a book on technology and trust entitled “Who Can You Trust?” “You’ve actually given up on trust if you need for things to be transparent,” she said. “We need to trust the intention of these companies.”

I think that it’s how little design flourishes are used to imperceptibly influence consumers that should be used to justify more intensive ethics and legal education to designers and engineers. Engineers of physical structures belong to formal associations that can evaluate the appropriateness of their members’ creations and conduct. Maybe it’s time for equivalent professional networks to be build for the engineers and developers who are building the current era’s equivalents to bridges, roads, and motor vehicles.

Categories
Aside Links

19 Tiny Habits That Lead to Huge Results

While I wouldn’t necessarily identify Cole’s nineteen habits as ‘tiny’ in aggregate I would agree that most of the habits he identifies are important for developing a well-balanced life. Perhaps the most important habit, to my mind right now, is to reflect on oneself and to value oneself, to the point where you can identify aspirations goals and strive to achieve them. If I’m being honest, it’s really hard for me to visualize or express such personal aspirations and thus one of my more important ‘tasks’ over the coming months is to both clarify such aspirations and identify how to achieve and exceed them.

Categories
Links

Promoting Instagram Addiction

From The Globe and Mail:

Matt Mayberry, who works at a California startup called Dopamine Labs, says it’s common knowledge in the industry that Instagram exploits this craving by strategically withholding “likes” from certain users. If the photo-sharing app decides you need to use the service more often, it’ll show only a fraction of the likes you’ve received on a given post at first, hoping you’ll be disappointed with your haul and check back again in a minute or two. “They’re tying in to your greatest insecurities,” Mr. Mayberry said.

I didn’t know that how ‘likes’ were doled out were designed to get you to keep coming back into social media applications. If Instagram is toying with its users this way then I’m going to seriously evaluate whether I ever want to use the application again. Activities like those described are just slimy and I don’t feel the need to provide such companies with either my content or my attention.

Categories
Links

Anti-Virus and Windows Vista

From Ben Farthi:

In my role as the head of Microsoft security, I personally spent many years explaining to antivirus vendors why we would no longer allow them to “patch” kernel instructions and data structures in memory, why this was a security risk, and why they needed to use approved APIs going forward, that we would no longer support their legacy apps with deep hooks in the Windows kernel — the same ones that hackers were using to attack consumer systems. Our “friends”, the antivirus vendors, turned around and sued us, claiming we were blocking their livelihood and abusing our monopoly power! With friends like that, who needs enemies? They just wanted their old solutions to keep working even if that meant reducing the security of our mutual customer — the very thing they were supposed to be improving.

Anti-virus programs remain a problem in terms of the attack surface they can open up. This surface, combined with the failure of many products to effectively identify and act on malware signatures, means that consumers tend to put far too much trust in products that often function poorly at best.

Categories
Links Videos

Oprah Winfrey’s 2018 Golden Globes Speech

I have no idea whether or not this speech might herald Oprah’s potential entry into politics as a candidate, or as an effort to leverage her reputation and power to equalize power imbalances in the media and entertainment space, or as part of another activity that she plans on undertaking. What I do know is that her speech is amazingly powerful and has parallels with some of the best speeches of Obama that launched him as a candidate: if this was her political ‘coming out’ speech then it’s remarkably impressive in its accessibility to the general public and depth of meaning and importance to the public writ large.

Categories
Links

Meltdown/Spectre Explained To The Public

Robert Graham has helpfully explained what the Meltdown and Spectre vulnerabilities mean for most end-users. In short: patch now and things should be ok. But chipmakers and OS vendors are going to have to rethink some baseline ways of doing business.

Categories
Links Writing

WordPress Supply Chain Attacks

Per Wordfence there are four reasons for supply-chain (i.e. plugin-based) attacks on WordPress installations:

The first reason is simply scale. According to w3techs, WordPress powers 29.2% of all websites – a massive user base to go after. In addition, at the time of this writing there were 53,566 plugins available for download in the official WordPress.org plugin repository. That is a lot to work with on both fronts.

Secondly, the WordPress.org plugin directory is an open, community-driven resource. According to the plugin guidelines page, “It is the sole responsibility of plugin developers to ensure all files within their plugins comply with the guidelines.” This means that while there is a small team tasked with managing the plugin repository and another small team focused on security, ultimately users rely on plugin developers to keep them safe.

Thirdly, most WordPress sites are managed pretty casually. Making a change to a website at a larger company might include code review, testing and a formal change control process. But that’s probably not happening consistently, if at all, on most smaller websites. In addition, many site owners don’t monitor their WordPress sites closely, which means malware can often remain in place for many months without being discovered.

Lastly, the WordPress plugin repository has a huge number of abandoned plugins. When we looked back in May, almost half of the available plugins hadn’t been updated in over two years. This represents a great opportunity for ne’er do wells looking to con unsuspecting plugin authors into selling something they created years ago and have moved on from.

The aforementioned points outline why acquiring and infecting WordPress plugins is a reasonable way of penetrating WordPress installs. However, I think that Wordfence is missing the most important reason that such attacks succeed: few actual users of WordPress are technically component to monitor what, exactly, their plugins are doing. Nor are the shared hosting services particularly good at identifying and alerting technically-illiterate users that their sites are compromised and what the site owners need to do to remediate the intrusion.

Trying to get individual users to more carefully monitor how their plugins work is a fool’s errand. What’s needed is for hosts to provide a community service and actively not just identify hijacked plugins (and sites) but, also, provide meaningful remediation processes. User education and alerts aren’t enough (or even moderately sufficient): companies must guide site owners through the process of cleaning their sites. Otherwise malware campaigns aimed at WordPress will persist and grow over time.

Categories
Links Photography

Photographic Rules and Human Physiology

Ming Thein:

We’ve touched on the cliches, we’ve touched on the physiology (much more detail in this and this article) but we haven’t touched on some things that generally make sense; I use the term ‘generally’ because as always there are exceptions dependent on the subject, scene and communicative intent of the photographer. Whilst for instance hard shadows usually make for interesting architectural images, they aren’t always so good for senior portraits or product photography. But this can be simplified into a logical statement like “shadows can assist with spatial orientation of a composition, and enhancing texture” – which I think is legitimate. But ultimately, the photographer has to decide if they actually want an obvious spatial orientation or not – they may not, for instance, if the intention is to make an extremely abstract composition. The example images given deliberately violate at least one, sometimes more, of the commonly bandied photographic rules – yet to my eyes at least, they still work.

I hadn’t really considered how the human body helps to dictate or guide the ‘rules’ of photography. While Ming Thein’s discussion is brief it’s perhaps useful for opening up new ways of thinking about the photos that we choose to take, and how deliberate shots vary from snapshots.

Categories
Links

A Deep Dive Into Russian Surveillance In The Silicon Valley Area

Via Foreign Policy:

This focus on signals and technical intelligence persisted until much more recently, multiple former U.S. intelligence officials told me. “It was almost like everyone they had there was a technical guy, as opposed to a human-intelligence guy,” one former official recalled. “The way they protected those people — they were rarely out in the community. It was work, home, work, home. When they’d go out and about, to play hockey or to drink, they’d be in a group. It was hard to penetrate.” The same official also noted that San Francisco was integral to the discovery by U.S. intelligence of a new class of Russian “technical-type” intelligence officer, working for the rough Russian equivalent of the National Security Agency, before this organization was eventually folded by Putin back into the FSB. This group, which was not based at the consulate itself, was identified via its members’ travel patterns — they would visit the Bay Area frequently — and the types of individuals, all in high-tech development, with whom they sought contact. According to this former U.S. official, these Russian intelligence officers were particularly interested in discussing cryptology and the Next Generation Internet program.

But it was the consulate’s location — perched high atop that hill in Pacific Heights, with a direct line of sight out to the ocean — that likely determined the concentration of signals activity. Certain types of highly encrypted communications cannot be transmitted over long distances, and multiple sources told me that U.S. officials believed that Russian intelligence potentially took advantage of the consulate’s location to communicate with submarines, trawlers, or listening posts located in international waters off the Northern California coast. (Russian intelligence officers may also have been remotely transmitting data to spy stations offshore, multiple former intelligence officials told me, explaining the odd behaviors on Stinson Beach.) It is also “very possible,” said one former intelligence official, that the Russians were using the San Francisco consulate to monitor the movements, and perhaps communications, of the dozen or so U.S. nuclear-armed submarines that routinely patrol the Pacific from their base in Washington state.

All in all, said this same official, it was “very likely” that the consulate functioned for Russia as a classified communications hub for the entire western United States — and, perhaps, the entire western part of the hemisphere.

There is a lot to this very long form piece, including descriptions of Russian intelligence operations and communications patterns, how lawful Russian overflights of American territory might be used for a variety of intelligence purposes, and the Trump administration’s likely cluelessness about why closing the Russian consulate in San Francisco was so significant. But most interestingly, for me, was how the consulate likely functioned as an outpost for Russian signals intelligence operations, both due to the depth of analysis in the article but also for what it tells us about how Western-allied consulates and diplomatic facilities are likely used.1 In effect, the concerns raised by former FBI and other American counter-intelligence officers speaks to how America and her allies may conduct their own forms of surveillance.

  1. In a provincial sense, the concerns and opinions espoused by American counter-intelligence officers also raises questions as to the role of Canada’s significant number of diplomatic facilities scattered throughout China and other regions where the United States is more challenged in building out State Department facilities.
Categories
Links Writing

The Dangers of Policy Learning

Via the New York Times:

Seizing on immigration as the cause of countless social and economic problems, Mr. Trump entered office with an agenda of symbolic but incompletely thought-out goals, the product not of rigorous policy debate but of emotionally charged personal interactions and an instinct for tapping into the nativist views of white working-class Americans.

Donald Trump isn’t so much tapping into ‘nativist’ views as, instead, exploiting citizens’ unawareness of the benefits of both immigration and trade. Immigrants contribute to the tax base, take less time off, and their direct descendants also contribute more to the tax base than ‘long-term’ citizens. Immigration is a net gain for ‘regular’ American workers but they haven’t been told just how, and why, their own lives and the social benefits they draw on are significantly improved by immigration into America.

Even as the administration was engaged in a court battle over the travel ban, it began to turn its attention to another way of tightening the border — by limiting the number of refugees admitted each year to the United States. And if there was one “deep state” stronghold of Obama holdovers that Mr. Trump and his allies suspected of undermining them on immigration, it was the State Department, which administers the refugee program.

The State Department is a core centre of American soft power; it’s programs, educational efforts, international outreach, and more are responsible for spreading American values around the world.1 That the administration is hollowing out the department is the truest evidence that the Trump administration is unaware of how, and why, America has managed to maintain its position in the world. While American military might is significantly responsible for the development and maintenance of its imperial stature in the world, this stature is solidified and extended through an adoption of American values. Such values are more than those associated with the military; they’re linked with those spread by staff from State who promote American values in more formal diplomatic efforts as well as the other range of activities undertaken by consular and embassy staff throughout the world.

It is incredibly hard to believe that the Trump administration is barely one year into a four year term. Given the lasting damage the administration has already done to America’s ability to project power around the world, it’s hard to imagine just what America’s stature will be in a few more years. But what’s most significant is that his administration has learned so quickly how to engage in the deliberate hollowing out of the institutions which have long been hallowed to Americans. This kind of learning is indicative that the administration might be successful on more of its more outrageous campaign promises, promises which are being supported by the Congress and Senate, and thus indicative of a broader series of values (or lack thereof) which are held by many American politicians.

  1. In the interests in disclosure: I will personally be enrolled in the State Department’s International Visitor Leadership Program in the coming fall.