• 0 Posts
  • 552 Comments
Joined 1 year ago
cake
Cake day: June 11th, 2023

help-circle
  • I have never felt so old.

    Name, address, and phone number of the account holder used to be published in books that got sent to everyone in the city and also just left lying in boxes that had phones in them if you needed to make a call while you weren’t home, because your phone used to be tied to a physical location.
    You also used to have to pay extra to make calls to places far away because it used more phone circuits. And by “far away” I mean roughly 50 miles.

    It’s not the biggest thing in the world, privacy wise, since a surprising amount of information is considered public.
    If you know an address, it’s pretty much trivial to find the owners name, basic layout of the house, home value, previous owners, utility bill information, tax payments, and so on. I looked up my information and was able to pretty easily get the records for my house, showing I pay my bills on time, when I got my air conditioner replaced and who the contractor who did it was.

    As an example, here’s the property record for a parking structure owned by the state of Michigan. I chose a public building accessible by anyone and owned by a government to avoid randomly doxing someone, but it’s really as easy as searching for public records for some county or city and you’ll find something pretty fast.


  • Depends on the vendor for the specifics. In general, they don’t protect against an attacker who has gained persistent privileged access to the machine, only against theft.
    Since the key either can’t leave the tpm or is useless without it (some tpms have one key that it can never return, and will generate a new key and return it encrypted with it’s internal key. This means you get protection but don’t need to worry about storage on the chip), the attacker needs to remain undetected on the server as long as they want to use it, which is difficult for anyone less sophisticated than an advanced persistent threat.

    The Apple system, to its credit, does a degree of user and application validation to use the keys. Generally good for security, but it makes it so if you want to share a key between users you probably won’t be using the secure enclave.

    Most of the trust checks end up being the tpm proving itself to the remote service that’s checking the service. For example, when you use your phones biometrics to log into a website, part of that handshake is the tpm on the phone proving that it’s made by a company to a spec validated by the standards to be secure in the way it’s claiming.


  • Package signing is used to make sure you only get packages from sources you trust.
    Every Linux distro does it and it’s why if you add a new source for packages you get asked to accept a key signature.

    For a long time, the keys used for signing were just files on disk, and you protected them by protecting the server they were on, but they were technically able to be stolen and used to sign malicious packages.

    Some advanced in chip design and cost reductions later, we now have what is often called a “secure enclave”, “trusted platform module”, or a general provider for a non-exportable key.
    It’s a little chip that holds or manages a cryptographic key such that it can’t (or is exceptionally difficult) to get the signing key off the chip or extract it, making it nearly impossible to steal the key without actually physically stealing the server, which is much easier to prevent by putting it in a room with doors, and impossible to do without detection, making a forged package vastly less likely.

    There are services that exist that provide the infrastructure needed to do this, but they cost money and it takes time and money to build it into your system in a way that’s reliable and doesn’t lock you to a vendor if you ever need to switch for whatever reason.

    So I believe this is valve picking up the bill to move archs package infrastructure security up to the top tier.
    It was fine before, but that upgrade is expensive for a volunteer and donation based project and cheap for a high profile company that might legitimately be worried about their use of arch on physical hardware increasing the threat interest.



  • In isolation it’s not great, but in conjunction with your own advocate talking about you not following a doctor’s orders? It doesn’t bolster confidence that the individual would follow doctors orders in the future.

    It means she hasn’t been able to quit drinking!

    Yes, that’s exactly the point. It’s quite unlikely her medical troubles started when she was hospitalized.
    A history of not following medical advice casts doubt about a future of following medical advice.

    Yes, addiction is a disease that the individual may lack the ability to control. That doesn’t change that it’s a risk factor for non-compliance that’s absent in others who need the transplant.


  • Not made up, I just read a couple other articles that mentioned it.
    It’s also part of the whole “the only people who can talk freely are the people with an interest in the doctors being wrong”.

    People aren’t turned away because they didn’t exercise or because they work too much or they don’t get enough sleep or they didn’t follow doctor’s orders. So, in Nathan and Amanda’s case, you’re seeing someone being told, ‘You didn’t follow doctor’s orders, so we’re not going to help you. We’re going to let you die’

    As a quote from the other interested party, as well as the “in documents shared with CTV News, notes show […] their decision was based on ‘minimal abstinence outside of hospital.’” is pretty much spelling it out.


  • It actually takes surprisingly little if it’s done consistently and without giving your body time to rest.

    A standard drink has roughly 14g of ethanol in it. People with notable liver damage tend to have a history of a decade or more drinking 30-50 grams a day, or two to three drinks.
    People who drink more than 80g a day for a decade are almost guaranteed to have liver problems (~5-6 drinks).

    Obviously drinking a half gallon a day is worse, but consistent long term drinking is also not great.

    It is essentially a poison that’s only around because it’s easy to make and traditional at this point.




  • Well, stopped drinking when she got the diagnosis, not before, didn’t comply with medical advice to stop drinking before hospitalization, and as they said in the article there are a lot of criteria for a living donation, and it’s only an option if you otherwise qualify for a donation because of the possibility of rejection requiring an urgent transplant.

    A different article said they were trying to raise funds to get the transplant done at an unspecified European hospital, so “yes”. I think it’s telling that they didn’t go to the US, a north American country, or specify the country.
    It’s worth remembering that the only people who can talk freely are the people who were decided against and are talking about suing.

    No one wanted her to die, but with organ transplants it’s a case where you’re more or less picking who will die. Phrasing it as being punished for bad behavior is unfair to the people who need to decide which people are likely enough to benefit, which isn’t easy.



  • Eeeh, I still think diving into the weeds of the technical is the wrong way to approach it. Their argument is that training isn’t copyright violation, not that sufficient training dilutes the violation.

    Even if trained only on one source, it’s quite unlikely that it would generate copyright infringing output. It would be vastly less intelligible, likely to the point of overtly garbled words and sentences lacking much in the way of grammar.

    If what they’re doing is technically an infringement or how it works is entirely aside from a discussion on if it should be infringement or permitted.


  • Basing your argument around how the model or training system works doesn’t seem like the best way to frame your point to me. It invites a lot of mucking about in the details of how the systems do or don’t work, how humans learn, and what “learning” and “knowledge” actually are.

    I’m a human as far as I know, and it’s trivial for me to regurgitate my training data. I regularly say things that are either directly references to things I’ve heard, or accidentally copy them, sometimes with errors.
    Would you argue that I’m just a statistical collage of the things I’ve experienced, seen or read? My brain has as many copies of my training data in it as the AI model, namely zero, but “Captain Picard of the USS Enterprise sat down for a rousing game of chess with his friend Sherlock Holmes, and then Shakespeare came in dressed like Mickey mouse and said ‘to be or not to be, that is the question, for tis nobler in the heart’ or something”. Direct copies of someone else’s work, as well as multiple copyright infringements.
    I’m also shit at drawing with perspective. It comes across like a drunk toddler trying their hand at cubism.

    Arguing about how the model works or the deficiencies of it to justify treating it differently just invites fixing those issues and repeating the same conversation later. What if we make one that does work how humans do in your opinion? Or it properly actually extracts the information in a way that isn’t just statistically inferred patterns, whatever the distinction there is? Does that suddenly make it different?

    You don’t need to get bogged down in the muck of the technical to say that even if you conceed every technical point, we can still say that a non-sentient machine learning system can be held to different standards with regards to copyright law than a sentient person. A person gets to buy a book, read it, and then carry around that information in their head and use it however they want. Not-A-Person does not get to read a book and hold that information without consent of the author.
    Arguing why it’s bad for society for machines to mechanise the production of works inspired by others is more to the point.

    Computers think the same way boats swim. Arguing about the difference between hands and propellers misses the point that you don’t want a shrimp boat in your swimming pool. I don’t care why they’re different, or that it technically did or didn’t violate the “free swim” policy, I care that it ruins the whole thing for the people it exists for in the first place.

    I think all the AI stuff is cool, fun and interesting. I also think that letting it train on everything regardless of the creators wishes has too much opportunity to make everything garbage. Same for letting it produce content that isn’t labeled or cited.
    If they can find a way to do and use the cool stuff without making things worse, they should focus on that.



  • As written the headline is pretty bad, but it seems their argument is that they should be able to train from publicly available copywritten information, like blog posts and social media, and not from private copywritten information like movies or books.

    You can certainly argue that “downloading public copywritten information for the purposes of model training” should be treated differently from “downloading public copywritten information for the intended use of the copyright holder”, but it feels disingenuous to put this comment itself, to which someone has a copyright, into the same category as something not shared publicly like a paid article or a book.

    Personally, I think it’s a lot like search engines. If you make something public someone can analyze it, link to it, or derivative actions, but they can’t copy it and share the copy with others.



  • So, you’re correct that active emergencies take priority.

    That being said, in essentially every place that has 911, both numbers connect to the same place and the only real difference is pick-up order and default response.
    It’s the emergency number not simply because it’s only for emergencies but because it’s the number that’s the same everywhere that you need to know in the event of an emergency.

    It should be used in any situation where it should be dealt with by someone now, and that someone isn’t you. Finding a serious crime has occurred is an emergency, even if the perpetrator is gone and the situation is stable.
    A dead person, particularly a potential murder, generally needs to be handled quickly.

    It’s also usually better to err on the side of 911, just in case it is an emergency that really needs the fancy features 911 often gives, like location lookups.



  • That is a good point.
    On the flip side, they’re not largely selling something that has any physical finiteness to it anymore, and the sales volumes have increased drastically, resulting in significantly higher profits despite a smaller inflation adjusted unit cost.

    The cost of a good decreasing as an industry matures feels right. Jello cost 23¢ a box in 1940. Adjusted for inflation it should cost $5.17 a box now, but it’s only $1.59.
    When there’s 2 games to buy, they can be justifiably more expensive than when there’s a massive surplus.
    The games are different, but it’s not like consumers can’t find a different one they’ll also enjoy if the first one they look at is too expensive.

    Inflation has made $60 less valuable, but they’re not selling to the same market that they were 30 years ago either.
    It’s hard to use inflation to justify raising prices or adding exploitative features when you’re already seeing higher inflation adjusted profits due to a larger more accessible market, lower risk due to reduced publishing overhead, and more options for consumers, which would be expected to bring prices down.