I’m familiar with the others, but what the heck did Kellog’s do?

It’s such a disappointment. We try to build a system with people to entrust our well-being to and help those in need, but it always goes wrong.

From ancient times and the king’s guard, to modern cops in some town. It always becomes corrupted.

That’s how it always starts though.

People use any device or service they want. It’s a mix of crooks, tinkerers, journalists, etc.

A company or government makes some moral panic and pushes some privacy or civil rights erosion in the name of “security”. The actual security benefit may or may not exist.

Then other companies do the same to keep up.

Then there’s only a handful of companies not doing the thing, so anyone who doesn’t want their privacy or civil rights eroded uses that, including crooks.

Then politicians and the other companies point to the holdouts as “PROOF!” their changes were good, because look how many crooks use that stuff! (The number of crooks hasn’t changed, they’ve just been concentrated to a single location.) The moral panic deepens.

The non-criminal population that cares about their privacy or civil rights speak out, but get accused of secretly being criminals, or some other crap that can be used to dismiss their concerns. “If you have nothing to hide, why are you so upset?” and all that.

Now laws get passed to force all companies to do the same thing, to stop the criminals! But let’s not worry about anyone else. The tinkerers, journalists, privacy-advocates, etc. They don’t matter.

The law gets passed, and now all toasters are legally required to record your breakfast conversations, for a silly example.

I wish mine did that. I said one thing about Trump not having as much money as he claims, and my mom got all insulted. She said that maybe we shouldn’t talk about politics, etc, and I agreed to be nice. I don’t like to talk politics at all, even with like-minded people. But she’ll blame a company getting hacked and losing my personal info on democrats, and tell me that she can’t wait until all democrats die off.

But now she just spouts of any shit that comes to her mind without a care, while I’m keeping to our dealt and shutting up. I doubt she even remembers our promise, because the moment it wasn’t convenient for her, she dropped it.

Ah yeah, propaganda and stereotyping.

So, I got malware that seemed to create an hidden proxy or VPN or something when I was online, without me having to install anything. I was on Fedora using Firefox in private mode with Ublock Origin and some script blocker. Ghostery, or Privacy Badger, or something. Fedora has it’s firewall enabled and blocking inbound connections, and SELinux was running. It would occasionally report small things like VLC or Clam AV wanting access to something.

It took me a little bit to realize something was wrong.

I realized it after Google started demanding repeated captcha attempts for everything, I started seeing unsuccessful attempts to sign into my Microsoft account from around the world, and some websites started blocking my IP for abuse. A few times, the blocking page (usually Cloudflare) showed that my public IP was over 240.0.0.0, in the unassigned block. My modem logs showed my machine making outbound connections to these random or impossible IPs at times that roughly lined up with my connection issues.

But if I simply hit refresh on those pages when they blocked me, the websites suddenly returned my correct residential IP address and started working again. I was slow to catch on. Hell, I hadn’t even used my Microsoft account for years, and I assumed Fedora with SELinux would alert me if anything strange was going on. It didn’t. My machine started acting weird, but I couldn’t place my finger on exactly how. I tried tools like Clam AV, or any number of intrusion detection solutions to assuage my growing paranoia. Problem is that they require some knowledge and you have to set them up before things go wrong.

Besides a terminal tool to unhide running processes, which inconsistently returned zero to dozens of unknown short-lived programs with increasingly high PIDs, nothing was detected. I later ran that unhide tool on a live USB of Fedora, and it did the same thing, so I assumed it was a false positive.

Ultimately, it was my fault, I know. I just went on a shady website to watch a TV show. Stupid, but not uncommon. My android phone also started acting strangely around the same time. I assume because I visited the same site to finish some season in bed using Firefox mobile. It’s been replaced entirely now.

But the point is that SELinux didn’t stop anything, I didn’t have to explicitly download or install anything to my machine, and it was some kind of drive-by infection that somehow added my machine to a kind of botnet, I think. Hard to tell just from the various logs I gathered from my machine and modem.

I don’t know what it was doing, but when I finally put all the pieces together, I completely wiped the drive in that machine, including a long dd operation on the drives with /dev/random. Still not sure what I’m going to do with it.

I’m also not sure if the infection was limited to Firefox itself, or if my entire machine was compromised. I may never know for sure.

While I was being stupid, I wasn’t being completely reckless and just running untrusted code from strange places. I watched TV in Firefox’s embedded video player. All it took was going to a website that I found by other people recommending it on social media. I should have known better, but I’m human.

If I can’t even visit a webpage without getting invisible botnet malware that escapes professionally configured tools like SELinux on Fedora, then how are complete newbies, or kids, or grandparents, or “know just enough to be dangerous nerds” (like me) supposed to be safe?

I agree that the user is the single biggest point of failure in security, and should be mindful. But when you’re not installing random Github packages, or turning off your firewall, or enabling SSH, and your machine can still get so easily pwned, what then?

That’s the value of anti-virus software. Yeah, it’s not perfect, but neither is your list of rules to follow. There is no single perfect approach, and people are lazy, impulsive, and sometimes drunkenly want to watch Breaking Bad. I don’t know what the solution is, but outright denying everyday antivirus seems… unwise, I guess?

Even if if takes a month for the vendor to be able to detect it, that’s still protection for anyone who comes after. It doesn’t have to be perfect to make a positive difference.

And, no: For anyone curious, I’m not going into more detail about the website.

Like when McDonalds offered free fries or something for everyone who used the app, but then quietly changed the terms of service for the app to include forced arbitration.

If a company does something bad, you can sue to fix it.

Suing sets legal precedent and forces all companies to abide by the ruling, more or less.

But now if a company tricks you out of your right to sue by putting arbitration clauses in everything, then you can’t sue. You can only have a (hopefully) impartial third part tell the company to stop doing something specifically to you. The company is still free to keep doing the thing to everyone else, and their arbitration doesn’t affect any other companies also doing bad things.

There are other issues too.

Let’s keep in mind that if this is a state actor or some sort of global organized crime, then they don’t put all their eggs into one basket. If that’s the case, they’re going to have a bunch of other plans and backdoor attempts ongoing. This isn’t the end and we can assume there’s something else somewhere that went unnoticed.

Security is a constantly changing war of attrition, not a goal/product/configuration.

Or even a criminal organization.

I mean, I freaking love how AI is advancing, but I also think unions are basically a requirement for all workers at this point.

Besides, hasn’t the point of machines always been to reduce the workload on people?

I welcome some kind of UBI, or maybe a post-money society that uses AI to handle most jobs and lets people pursue what they want to do with their lives.

This isn’t the same thing, but I’m reminded of Minecraft.

Minecraft is a massively popular game. Notch once said he planned to make it open source when its popularity died down. But now Microsoft owns it.

Not only that, but Mojang accounts don’t work anymore. You have to have a Microsoft account to play it now. Even trying to download and play an older version of the game offline requires Microsoft to approve it. Microsoft is actively tightening the leash on the game because it makes them money. Open sourcing the game will likely never happen now. The best we can hope for it for versions to fall into public domain after 70-ish years.

That’s how I see Microsoft. They only care about what its beneficial for them to drive profits. Working on open source projects, and open sourcing a few of their tools to get the benefits of community adoption and code review is great, sure. But they’d sooner try to incorporate Linux into Windows to keep people in their surveillance ecosystem, than to open source Windows.

Remember when Windows 10 was the last version, until they changed their minds? Remember when they floated the idea of charging a recurring subscription to use Windows, before they silently dropped the idea? Remember when there was credible talk about the next version of Windows being cloud-based where they controlled all your data and you had no privacy? Hell, you have basically no privacy on Windows 10. Trying to reclaim some involves registry edits, special third party tools, and a constant battle with automatic updates reverting your changes.

I’ll say it again. Microsoft doesn’t care about OSS. It’s just currently beneficial for them to pretend they do.

Goggle seemed to care a lot about OSS, then started making everything in Android depend on their proprietary ecosystem to function. Now Google is using the dominant position they got by taking advantage of OSS adoption, and have been pushing privacy-invading standards and trying to get rid of ad blockers online, among many other things.

For these huge companies, OSS is just a tool to get more control and power. The moment it’s no longer useful, they’ll find ways to work around the license and enshitify everything again.

It keeps happening. I refuse to keep trusting bad actors every time they dangle a shiny trinket over our heads.

I do appreciate the work this person did in finding the bug. It’s not all doom and gloom.

Damn fine work all around.

I know this is an issue fraught with potential legal and political BS, and it’s impossible to check everything without automation these days, but is there an organization that trains and pays people to work as security researchers or QA for open source projects?

Basically, a watchdog group that finds exploitable security vulnerabilities, and works with individuals or vendors to patch them? Maybe make it a publicly owned and operated group with mandatory reporting of some kind. An international project funded by multiple governments, where it’s harder for a single point of influence to hide exploits, abuse secrets, or interfere with the researchers? They don’t own or control any code, just find security issues and advise.

I don’t know.

Just thinking that modern security is getting pretty complicated, with so many moving parts and all.

😆

The fact that Chiropractic is pseudoscience; realigning your spine to allow magical spirit energy to flow better, because they think every single aliment from acne to cancer is caused by blocked chi flow, isn’t enough?

I’m pretty sure it was Debian in the early aughts.

Nicely done. The best case scenario is sugar. Most of the time, it’s nothing but water, and maybe a single drop of 100x already diluted more water, that maybe once had something non-water in it. That is, of course, assuming the machines doing the literal magic shaking didn’t spill the “active ingredient”.

Oh, this reminds me. I was asked to go to a Chiropractic “doctor” this weekend for a check up. That’s nonsense to begin with, but I went anyway.

She asked about my back hurting, and I mentioned that I threw it out really badly when I got COVID a year or two ago, and was stuck in bed coughing super hard for a week. Her immediate response was “I’ve heard the vaccine can do that.”

… Like, fucking what? How god damn stupid do you have to be to hear “I threw my back out coughing really hard.” and instantly try to insert your anti-science bullshit into the conversation?

“BUT MAH FREEDOMS!”

Yup. This is essentially the same as people suddenly screaming about “WHITE PRIDE!!!” in response to things like Black Live Matter.

The entire point is a minority not letting the majority shame or otherize them. The the majority freaks out and responses with “ME TO BUT BETTER THAN YOU DID IT!”.

It’s pathetic.