• 0 Posts
  • 105 Comments
Joined 1 year ago
cake
Cake day: June 30th, 2023

help-circle



  • Yeah, I think there is a lot of potential for code analysis. There’s a limited cross section of ways malware can do interesting things, but many permutations of ways to do that.

    So look for the interesting things, like:

    • accessing other programs’ address spaces
    • reading/writing files
    • deleting/moving files
    • sending/receiving network traffic
    • os system calls and console commands
    • interacting with hardware
    • spawning new processes
    • displaying things on the screen
    • accessing timing information

    Obviously there’s legitimate uses for each of these, so that’s just the first step.

    Next, analyze the data that is being used for that:

    • what’s the source?
    • what’s the destination?
    • what kind of transformations are being applied to the data?

    Then you can watch out for things like:

    • is it systematically going through directories and doing some operation to all files? (Maybe ransomware, data scrubbing, or just maliciously deleting stuff?)
    • is it grabbing data from somewhere and sending it somewhere else on the internet? (Stealing data?)
    • is it using timing information to build data? (Timing attacks to figure out kernel data that should be hidden?)
    • is it changing OS settings/setup?

    Then generate a report of everything it is doing and see if it aligns with what the code is supposed to do. Or you could even build some kind of permissions system around that with more sophistication than the basic “can this app access files? How about the internet?”

    Computer programs can be complex, but are ultimately made up of a series of simple operations and it’s possible to build an interpreter that can do those operations and then follow everything through to see exactly what is included in the massive amount of data it sends over the network so that you can tell your file sharing program is also for some reason sending /etc/passwords to a random address or listening for something to access a sequence of closed ports and then will do x, y, z, if that ever happens. Back doors could be obvious with the right analysis tools, especially if it’s being built from source code (though I believe it’s still possible with binaries, just maybe a bit harder).




  • I want to see some videos of salesmen trying to sell touchscreens like they are cars of the future and so great. Followed by the same salesman selling the return to tactile buttons as a big step forward because of how bad of an idea the touchscreens are.

    Most likely the first one will be older, but I bet there’s many that could be lead to do both in the same day by two different people showing interest in the same model but different year of a vehicle.










  • I’ve also been avoiding playing games that involve some third party launcher or login. I’m not perfectly consistent with this and have bought some games before realizing they had this, but even steam games can be subject to a company deciding they don’t want to support their game anymore (which IMO is fair) and just killing the game off entirely, which isn’t fair. I’d like to see a requirement that other steps be taken to keep it going without their active support. Like opening the source and relinquishing all copyrights on that code. If they want to keep parts of it, then pull it out into a library that they continue to maintain.


  • And if they didn’t develop the culture of sweeping safety issues under the rug at all levels, they won’t have much trouble keeping ahead because I’m sure that even at the height of Boeing’s safety ignoring, I bet most of the communication still looked like they took safety seriously. Just those in the know realized that they could make themselves look better by faking it and their management wouldn’t care. I’ve gotta assume that some number of them will think the current safety culture overhaul is really trying to send a message of “just be smarter about ignoring safety, don’t let it get to the point where doors fall off mid-flight and we need to kill some whistleblowers”.



  • But this is just using a voice. It might even be their natural voice. I don’t think there’s fraud because it wasn’t presented as Scarlett’s voice. If it wasn’t presented as not her voice, then maybe those other two would apply, though is allowing a service to use your voice the same as endorsement? Is it enough to sound like someone to be considered impersonating them?

    This situation lands in a grey area where I can’t endorse or condemn it. I mean, it would have been smarter to just use a different voice. Find a celebrity that would sign on or just use an unrecognisable voice. Ethical or not, and legal or not, it was stupid.


  • Yeah, it is kinda sketchy, though they might have backed down because they realized there was no winning this in the court of public opinion, regardless of whether they were trying to act in good faith prior to the controversy coming out.

    IMO Johansonn making it public was an obvious strategic move because it gave her a strong position because of how unpopular AI is these days. She might have otherwise just paid some lawyers a lot of money to accomplish nothing if it was legally fine and she was adamant about them not using a voice that sounded like hers (guessing the best she would have gotten without going public is them paying her some money to continue using that similar voice or maybe a bit more money to use her actual voice, either way they would have gotten what they wanted).