To the best of my understanding, ZDR is often a promise that your data is not used for model training. It doesn't mean "what it says on the tin", so to speak. There are cases where data needs to be retained regardless, for example, preventing abuse. This isn't for training, so a company can still claim ZDR.
I'm fairly sure the ZDR on their site impled that neither the prompts or the model output was collected before they've changed their site few dozen times.
They still mention: "meaning they do not store or train on your data", but only on the providers side which makes quite a lot of sense, there's very little reason for them to store anything except some analytics data in cases like these.
As someone who has helped to secure critical national infrastructure several years ago, I can say that it was a mess to disclose the vulnerabilities I identified, and in some cases it took years to patch them. Some of these vulnerabilities were RCEs and mass PII leaks. It's simply not worth the risk for most people - who aren't in the USA - to bother doing this sort of security research. However, if you are in the USA, there are provisions in the CFAA that enable good-faith security research to take place (https://www.justice.gov/archives/opa/pr/department-justice-a...), so to the best of my understanding, you're able to do good-faith research without being charged or prosecuted, and you should take advantage of this if you have the skills or models to do so. I am not based in the USA, and there are no laws in my country that guarantee me zero jail time for simply trying to do the right thing, so I am not incentivized to continue finding vulnerabilities in my country's infrastructure.
Edit: If other countries don't catch up and include similar provisions in their laws, they'll simply fall behind and put their citizens at risk. I'm sure every country has individuals willing to help that currently feel unsafe - look at the large amount of bug bounty hunters worldwide who, I'm sure, wouldn't mind practicing their skills by securing their country's infrastructure.
There was a guy in Missouri who pressed F12 (view source) and saw that the state website contained the SSN of all teacher--just right there in plain text in the HTML.
He reported it responsibly and then the governor personally started attacking him and threatening him with a felony.
I checked your link and I see that is a 2022 DoJ policy. How much peace of mind do you think a DoJ policy (not a law) from 2022 gives me?
I read as far as the first sentence: "The policy for the first time directs that good-faith security research should not be charged."
Soooo... the underlying message here is that good-faith security research is technically against the law, but their policy is not to press charges. They clearly consider good-faith security research to be technically against the law, because it wouldn't make sense to say "for the first time, our policy is to NOT charge people who follow the law"--that makes no sense. What they're saying is "we could charge good-faith security researches, but let's not as a matter of policy".
Reading further you see the policy is about NOT prosecuting people who do something like use an alias as their account name. That same paragraph says their focus should be on people who access systems without permission.
And to be clear, I am advocating for red teams that operate without permission. The bad guys are attacking our systems without permission, and I think the good guys should be protected when they do the same for a good purpose.
IIRC they were part of a base64 encoded blob. IIRC base64 decoding was also referred to as an "advanced hacking technique". But your point very much stands.
> There was a guy in Missouri who pressed F12 (view source) and saw that the state website contained the SSN of all teacher--just right there in plain text in the HTML.
OP> Great reason to use <...> virtual cards wherever possible and online
> but there are hardly any adequate alternatives for the rest of the world, as far as I know.
Maybe start with your bank?
My local (Central European) bank offered virtual cards service yesterday to which I declined setting them up on site, will strongly reconsider now, thanks!
>My bank is the opposite of yours. They used to offer a similar service but shuttered it a few years ago.
Maybe a good time to call up the bank (or other banks) and ask them if they provide this or any other service that would prevent you from needing to cancel physical cards in case of these ever-increasing security incidents?
Late edit: just checked it out and the virtual cards can be ordered via the banking app, either permanent virtual or one-time use where the card auto-expires after the purchase has gone through. That's really neat! (Not gloating but sharing what I've learned, hope you can find similar security in your bank offerings).
I did some research and corroborated with Claude. No banks in my country offer anything akin to Privacy.com. There are a few "virtual card" services but they have limits that make them virtually unusable.
I doubt I'll have any influence on the products any one bank in my country offers, but it doesn't hurt to ask.
Credit for the video should go to the link referenced in https://news.ycombinator.com/item?id=50199757 (catgirl.cloud). The Twitter user reposted the video and did not credit the OP as far as I know.
Please forgive my stupidity, but is there any particular reason why companies never seem to disclose what "system" of theirs was breached? If this breach came about as a result of a security incident at a third-party, would it not benefit everyone minus the vendor to shift the blame? I understand that they say "our systems", but I've seen companies say this before when what they mean is "a system controlled by a vendor we contracted".
Hi. I was briefly following the developments regarding legal representation and thought everything was going well. Is there anything more you could disclose as to how you were misled or what happened here? Thank you again for creating and maintaining Nitter, it's such a valuable tool and I've donated a few times over the years.
Not an ad or promotion, I'm just also addicted to buying cool domains and I remember seeing this up for sale: DomainEmpire.com is currently trying to sell sesqui.net, registered in 1987, for $33,000. I think they have others that are cheaper, but you'll have to scrape WHOIS data for each domain to find their creation dates.
I was actually eyeing off a few pre-1990 domains, including sesqui.net, earlier this evening -- I generally use the service "ExpiredDomains.net" for searching and sorting by "Whois Birth Year" to find the old ones. Despite it's name, it's actually incredibly useful just to search across various domain marketplaces regardless of if they're expiring or not.
(Un)fortunately most of the super cool ones are way outside of what I budget for my "cool things to have (that don't take up any physical space)" spend.
Is it possible to block Apple Intelligence from sending data over the Internet via Little Snitch? I would assume it is, but I'm not sure if anything significant has changed in macOS 27 that makes this impossible now. I don't really mind the local features - I'd rather they stay disabled, but it's not the end of the world - but I really don't want any data leaving my Mac.
You can verify this yourself. Get an old laptop to act as a wifi hotspot and forward traffic over usb ethernet adapter to your actual router. Then run tcpdump on the computer. You will see the multitude of phone-home traffic.
Is there evidence of this anywhere on the internet? I couldn't find anything with ten minutes of searching, and I don't use little snitch, and I'm not going to put the effort in to remediate this just to figure out if this comment has weight.
> As it turned out, this behavior is on purpose. There’s an explicit whitelist that allows certain macOS services to bypass any third party firewalls and to communicate on the Internet without being even noticed by the user. A hole in the wall.
Was remediated later, but shows there is precedent.
What is "root" in macOS is more or less a power user role. Apple took away the true ability to operate as root a long time ago with System Integrity Protection which walls off the critical parts of the OS from the user entirely.
Unfortunately, SIP also restricts basic system functions that are trivial in other OSes. Apple made this very difficult, and MS would have loved to do this in Vista had they not received the backlash that they did.
You can disable SIP if you want. You can run whatever you want on your machine. Disabling SIP is indeed a security risk… then again, so is running something as root. Having a Mac w/o SIP is no more a security risk than having a Linux w/o a r/o kernel AFAIK.
The way apple talks about SIP its like a miracle we survived at all pre SIP. Pretty sure I've had SIP disabled for years now when I got nagged for something or whatever and had to disable it.
SIP is a good thing and prevents a lot of (usually PEBKAC) problems. It is also the direction where Linux is going (is now? or maybe they gave up? idk, it’s been a while since I heard about immutable distros).
For tech-aware people, it is probably not necessary indeed.
However, given that now “tech-aware” people are running completely random and unvalidated scripts w/o second thoughts (or even first thoughts actually) on their main machine, I’d say the “tech-aware” line is very very high…
Well, I block all connections to iCloud for every app (user and system) completely with Little Snitch, and the fact that it does indeed break some little features I can absolutely live without, indicates that it has at least some effect.
But still, I fully share the sentiment that creators of an OS are perfectly capable of bypassing whatever there is running on top of it.
I don't really care if anything else gets blocked as a side effect, except for Find My. As far as I know, `fmfd` and `findmydeviced` are the binaries responsible for that feature, so if I whitelist those binaries I should be fine.
Through my own usage of Little Snitch, it appears that all the iCloud-related features use individual binaries and that iCloud connections go to specific hosts for specific use cases (e.g. pxxx-contacts.icloud.com, pxxx-quota.icloud.com, pxxx-caldav.icloud.com). I'd assume the AI features are the same - specific hosts and binaries that I can block.
While I'm impressed with Framework's handling of this issue, I can't help but notice how this was yet another analytics platform breach. CRM tools and analytics platforms (Salesforce, Mixpanel, now Metabase - I'm sure I'm forgetting some) are common vectors to get access to customer metadata these days.
I don't see a solution to this in the near future. I initially thought up something quite simple: assign every customer a unique ID and use that where possible to reference a customer. That solution, however, renders the analytics and CRM tools nearly useless. There has to be a better way, though, other than haphazardly giving out customer metadata to other vendors. All of that information should stay in-house.
As for why metadata is important: I've said this before, but metadata can't easily be changed. I'd much prefer having my password or credit card number leaked in plaintext since I can change those identifiers trivially. I can't change my name, phone number, or address as easily.
Metabase can be self-hosted, but you cannot self-host Salesforce or Mixpanel or many of the other products I'm referring to. In an ideal world, every company would self-host their own instances of all of their products, since that ultimately forces them to be solely responsible for their customers' data. Using the cloud versions of these products shifts the blame from the company itself to the vendor when things go sideways, so it makes more sense for them to do this instead of taking responsibility.
"Yes, Salesforce has experienced multiple hacking incidents, particularly involving social engineering attacks that targeted its customers, leading to significant data breaches. Notably, the hacking group ShinyHunters has claimed responsibility for exploiting vulnerabilities in Salesforce's systems, affecting numerous high-profile companies." Source: https://duckduckgo.com/?q=has+salesforce+ever+been+hacked%3F...
Yes, *Salesforce has experienced multiple hacking incidents*, particularly involving social engineering attacks that targeted its customers, leading to significant data breaches. Notably, the hacking group ShinyHunters has claimed responsibility for exploiting vulnerabilities in Salesforce's systems, affecting numerous high-profile companies.
The solution is obvious: make it illegal for companies to collect and store user data where it is not strictly necessary to fulfill the direct customer needs. Collecting less data and storing it in fewer systems is the most effective way to reduce data breaches and their impact.
That is already the case for where I live, and yet I am on that breach, with names, addresses, etc. all leaked. Unfortunately it's not enough to collect "only necessary" if what's necessary is too much in the hands of the attacker.
There are people that pre-ordered their latest PC that are currently waiting for the remaining batches to become available, finish paying the PC price in full, and have it shipped to them. So this information does fullfill a direct customer need.
I have never made a purchase via Framework and still got the email from them. Probably because I once put in my data to see final shipping and import costs.
This would be nice, and I hope I get to see a future like this, but I moreso meant that I don't see a solution for this issue given the current landscape of things. Ideally, yes, companies wouldn't collect the data and it would be illegal to do so. However, this currently isn't the case, so what can be done that lets all sides win? Something has to give, and I'm certain users will receive the short end of the stick at all times - at least, until there are better laws in place.
> I'm impressed with Framework's handling of this issue
I'm not. I'd like to see some sort of tangible compensation from them, not just a "we're sorry". Maybe a discount code or a freebie, or actual hard cash. I'd also like to see them pursue legal action against Metabase. And finally, I'd like them to be upfront with how they store and use PII. Had I known that they were going go store it with a third-party - and that too, unsalted and unencrypted - I would've never even signed up.
I've had a similar thought in the past. I was thinking about the feasibility of a law being introduced where each company making over a certain amount of money per year must begin a VDP (and optionally a BBP) so that security flaws can be reported to them easily. This can easily be done by simply opening up security@companydomain and using security.txt (https://securitytxt.org). Reports must receive a response in N days, where N is calculated based on available staff, resource allocation, and revenue of the company. If they don't receive a response after N days, this can be escalated to some government agency which can take action against the company for failing to respond to a report on time.
reply