BC TECH
Saved by @ThomassRichards

Next up in Privacy Technology at #enigma2021, Kelly Huang from @ethyca speaking about "GONE, BUT NOT "FORGOTTEN"—TECHNICAL & PRACTICAL CHALLENGES IN OPERATIONALIZING MODERN PRIVACY

 Just imagine there's a global pandemic forcing everyone to stay home and buy their stuff over the internet. And you've been working on your sanitization-on-demand startup. You've got more users than you can count! ... literally, because your data's all over.
Now you're a multi-national international country with privacy issues because your information is all over the place.

Now a user writes to request you delete their data. Where is it? How do you do that? Who's responsible for privacy in your business.
How do you operationalize privacy rights?

Primary stakeholders:
* Legal
* Business
* Engineering
We spend a lot of time on Twitter analyzing the legal rulings, but it's harder where the "rubber meets the code" 🥁
Three rights:
* access
* rectification
* deletion

Legal's trying to uphold them, but it's a technical question!

Legal wants to decrease risk but don't know software
The business wants to stay in business and make money. They want to be able to use data for things like placing ads and analysis.
It takes a lot of time to handle these requests, too!

They need a streamlined technical solution.
Program management wants to streamline and make things efficient and predictable... but they don't understand the technical limitation
As a software engineer, you've seen technical debt. So much technical debt. All the weight of the decisions that were made in the past, especially if you scaled without a data plan.

Average SMB has data in 10 different systems.
How do we delete?
Some poor software engineer is trying to track down what data is where?
What even *is* PII? There's no real standard.
What should be returned? What should be deleted.

Make a definition and stick to it.
Some of your databases might use email addresses as a primary key, some user IDs, etc.
1. Define PII
2. Find all the PII
3. Use pseudonymization to replace PII with some kind of random value which can't be tied back to the user

[reminder I am livetweeting this is not me speaking]
How do you do this at scale?
Maybe a centralized team who can handle this?
If you're a small company, plan ahead!
Be careful when you're doing sanitization -- some databases really don't like batch processes and you can make things fall over.
Speed
* you have a timeline -- often 30 or 45 days
* but that's not enough time if you haven't planned for streamlined speed

Ideally you won't need it, but have a backup plan, in case something goes wrong with a slow data system
Plan for a solution that grows with your business, not just a hacked-together series of SQL queries, but instead a centralized portal with extensibility as the business changes and technical systems grow.

... and as new privacy laws come into place
Privacy is way, way more than compliance. But compliance needs to happen.

Let's all do our part

[ end of talk ]

More from Lea Kissner

Lea Kissner
Lea Kissner
@LeaKissner
We're kicking off the Privacy Tech session at #enigma2021 with Mitch Negus speaking about "NO DATA, NO PROBLEM—GIVING NUCLEAR INSPECTORS BETTER TOOLS WITHOUT REVEALING STATE

A nuclear catastrophe hasn't occurred... yet. So we need to stay vigilant. Nuclear inspectors go in according to treaties to check what's going on and check compliance with treaty rules.

But as sophisticated analytics become more common, states will only want to share the minimum amount of information necessary under the treaty.

But perhaps we can use MPC -- secure multi-party computation

Yao's garbled circuits were first demonstrated on the millionaire's problem -- figuring out who's richer without revealing actual amounts.

Used for other things like cryptocurrency these days.

Can we use this for nuclear inspection?

MPC can be used to compute anything computed by a computer [but it's expensive!]
TECH
Lea Kissner
Lea Kissner
@LeaKissner
In more Securing Democracy at #enigma2021, @ChrFolini talking about "THE ADVENTUROUS TALE OF ONLINE VOTING IN

Switzerland is a direct democracy where citizens get to vote at least 4x/year, with a lot of mail-in voting. We have a long history of online voting.

Disclaimer: THIS IS NOT SWEDEN.

[I get the picture that @ChrFolini has had to explain the difference several times.]


Process around mail-in ballots.

[tl;dr it's very complicated and wasn't threat-modeled until recently]


But the in-person ballots are complicated, too!


Most security folks don't think that we can't make a secure online voting system.

@ChrFolini says this is because of encryption
[Note: this is not the main reason that a lot of people cite -- we're more worried about things like malware but it's complicated]
WORLD
Advertisement
Lea Kissner
Lea Kissner
@LeaKissner
Next up at #enigma2021, Sanghyun Hong will be speaking about "A SOUND MIND IN A VULNERABLE BODY: PRACTICAL HARDWARE ATTACKS ON DEEP LEARNING"

(Hint: speaker is on the

In recent years ML models have worked from research labs to production, which makes ML security important. Adversarial ML research studies how to mess with ML

For example by messing with the training data (c.f. Tay which became super-racist super-fast) or by foiling ML models by changing inputs in ways humans can't see.


Prior work considers ML models in a standalone, mathematical way
* looks at the robustness in an isolated manner
* doesn't look at the whole ecosystem and how the model is used -- ML models are running in real hardware with real software which has real vulns!


This talk focuses on hardware-level vulnerabilities. This is particularly interesting because these can break cryptographic guarantees (because those are outside of their threat models)
e.g. fault injection attacks, side-channel attacks
SCIENCE
Lea Kissner
Lea Kissner
@LeaKissner
Last talk about Securing Democracy at #enigma2021: @jackhcable speaking about "THE FULL STACK PROBLEM OF ELECTION

Let's imagine that elections use all the security measures security people have been advocating: risk-limiting audits, paper ballots, etc. Would people trust the elections more?

Jack would argue no. Most people don't understand this stuff and most of the claims people are making can't be disproven. And are massively bogus already.

Georgia did a full recount on paper ballots and it very much didn't stop people from doubting the election!

Are election security results in vain? The point of election security is to convince the loser they lost.

No! Have to focus on the whole stack, from election infrastructure to campaigns to people and mis/dis-informaton


One takeaway from the talk: the parts of the stack must work in tandem. Can't fight misinformation in a vacuum, but must build on other election security measures.
POLITICS
Lea Kissner
Lea Kissner
@LeaKissner
Last up in Privacy Tech for #enigma2021, @xchatty speaking about "IMPLEMENTING DIFFERENTIAL PRIVACY FOR THE 2020

Differential privacy was invented in 2006. Seems like a long time but it's not a long time since a fundamental scientific invention. It took longer than that between the invention of public key cryptography and even the first version of SSL.


But even in 2020, we still can't meet user expectations.
* Data users expect consistent data releases
* Some people call synthetic data "fake data" like
"fake news"
* It's not clear what "quality assurance" and "data exploration" means in a DP framework


We just did the 2020 US census
* required to collect it by the constitution
* but required to maintain privacy by law

But that's hard! What if there were 10 people on the block and all the same sex and age? If you posted something like that, then you would know what everyone's sex and age was on the block.
TECH , TEACH

More from Tech

Simon DeDeo
Simon DeDeo
@SimonDeDeo
So, today, for the first time in 25 (!) years of Apple, I downgraded. From the 2016 MacBook Pro to my 2013, which I had kept in a drawer...


It was pretty simple to do—Apple Time Machine backups let me do it with one click.

That first tweet captures, in two pictures, how badly Apple has “lost the plot” (to quote @wylieprof). On the right is the Apple MagSafe adapter, from 2013. On the left, what I had “upgraded” to.

Thanks, Apple! I really was nostalgic for worrying about yanking my computer off the table.

Oh and I really appreciated not knowing if my computer was charging. What was great was the little whoop sound you used, so that the speaker before me could be informed I was charging my laptop.
TECH
EverythingOppresses
EverythingOppresses
@SoOppressed
The first area to focus on is diversity. This has become a dogma in the tech world, and despite the fact that tech is one of the most meritocratic industries in the world, there are constant efforts to promote diversity at the expense of fairness, merit and competency. Examples:

USC's Interactive Media & Games Division cancels all-star panel that included top-tier game developers who were invited to share their experiences with students. Why? Because there were no women on the

ElectronConf is a conf which chooses presenters based on blind auditions; the identity, gender, and race of the speaker is not known to the selection team. The results of that merit-based approach was an all-male panel. So they cancelled the conference.

Apple's head of diversity (a black woman) got in trouble for promoting a vision of diversity that is at odds with contemporary progressive dogma. (She left the company shortly after this

Also in the name of diversity, there is unabashed discrimination against men (especially white men) in tech, in both hiring policies and in other arenas. One such example is this, a developer workshop that specifically excluded men: https://t.co/N0SkH4hR35
TECH
Advertisement
Guillaume Chaslot
Guillaume Chaslot
@gchaslot
The YouTube algorithm that I helped build in 2011 still recommends the flat earth theory by the *hundreds of millions*. This investigation by @RawStory shows some of the real-life consequences of this badly designed AI.


This spring at SxSW, @SusanWojcicki promised "Wikipedia snippets" on debated videos. But they didn't put them on flat earth videos, and instead @YouTube is promoting merchandising such as "NASA lies - Never Trust a Snake". 2/


A few example of flat earth videos that were promoted by YouTube #today:
https://t.co/TumQiX2tlj 3/

https://t.co/uAORIJ5BYX 4/

https://t.co/yOGZ0pLfHG 5/
TECH , FLAT EARTH
Qiao Wang
Qiao Wang
@QwQiao
People sometimes ask me what my vision of DeFi is. This is a very tough question. DeFi is very messy with thousands of experiments happening. But high level, I think DeFi will go through 2 phases:

During the 1st phase (next 2-5 years), we'll continue to build games, casinos, and speculative products.

This sounds uninspiring. But it has two main important consequences.

1) This will ultimately lead to hundreds of millions of users to install wallets and get uncomfortable with the UX.

2) This will force the tech (especially scaling) to mature.

Once we've achieved these two goals, phase 2 begins. In phase 2, products that serve real economic activities / integrated with the real economy will be built and flourish.

Right now, such products barely exist. @terra_money comes to mind. But this is the kind of products that I really look forward to. They are more economically sustainable, and create more value.
TECH
Sarah Drasner
Sarah Drasner
@sarah_edo
🔥 It's probably common knowledge that Netlify makes deployment incredibly simple- you can connect a repo, pick a build command and 🚀

or just drop a folder in and you're done!

...but here are some other things you might not know about our deploys that are very special 🧵


Netlify has a concept of "atomic" deploys- which means a few things:

- You can preview a deploy when you've or someone else has just put in a PR

- You can roll back to ANY previous state, with one click, in milliseconds

- You always know what state your cache is in!

Netlify allows you to cancel a deploy- did you just put in a change, merge it and then realize you've made a terrible mistake? I've never done that. 😬 er...

No worries. You can cancel that deploy with the click of a button.

You can lock a deploy. Let's say you get everything ready for a big release, code review and tests are complete, it's all ready.

You can lock a deploy in a state to get ready for a major release, so that you know exactly what you're releasing and sleep well the night before. 😴


You can even get notifications about locked deploys via email, outgoing webhook, or Slack. Netlify can notify you when a deploy is either locked or unlocked.
TECH

You May Also Like

Guillaume Chaslot
Guillaume Chaslot
@gchaslot
The YouTube algorithm that I helped build in 2011 still recommends the flat earth theory by the *hundreds of millions*. This investigation by @RawStory shows some of the real-life consequences of this badly designed AI.


This spring at SxSW, @SusanWojcicki promised "Wikipedia snippets" on debated videos. But they didn't put them on flat earth videos, and instead @YouTube is promoting merchandising such as "NASA lies - Never Trust a Snake". 2/


A few example of flat earth videos that were promoted by YouTube #today:
https://t.co/TumQiX2tlj 3/

https://t.co/uAORIJ5BYX 4/

https://t.co/yOGZ0pLfHG 5/
TECH , FLAT EARTH
WORLD OF SANATAN DHARMA
WORLD OF SANATAN DHARM...
@world_sanatan
LESSER KNOWN DETAILS ABOUT THE BATTLE OF PRATAPGAD - THIS YOU ALL SHOULD READ

In the 1659 Adilshah sent Afzalkhan with the army of 75000 soldiers to destroy Chhatrapati Shivaji Maharaj with his empire. He was the main soldier, warrior and minister in Adilshahi Sultanate.


He was the Subhedar of Wai province.

He was very powerful physically. His height was 7.3 ft. due to same he was very popular as a strong man from Adilshahi Sultanate.

Whole India was not daring to fight with Adilshahi due to Afzal Khan.

Badi Begum Sahiba sent him to kill Chhatrapati Shivaji on any cost.

Voluntary he decided to destroy Chhatrapati Shivaji’s empire with him. He started his operation against Chhatrapati Shivaji from "wai". He destroyed many temples like as Tulja Bhavani Temple.

He destroyed so many villages, killed villagers to torture Chhatrapati Shivaji.

DETAILED VIEW- Running commentary

1. Chhatrapati Shivaji chose Pantaji as a lawyer to communicate with Afzal Khan. Pantaji was very sharp minded, who did his job very nicely.

2. He presented Chhatrapati Shivaji is fearing Afzal Khan and he wanted to invite him in his kingdom near Pratapgad.

3. Pantaji succeed in the communication with Afzal Khan and he brought him as per the planning of Chhatrapati Shivaji.
ALL
Advertisement
Nigeria Stories
Nigeria Stories
@NigeriaStories
The Story of how Mary Slessor Stopped the killing of Twins but sadly died of Fever.

All you need to know

Retweet to educate someone


Killing new-born twins was common practice in the 19th century among the Ibibio people of Nigeria, but one Scotswoman went to great lengths to put an end to this.

Aberdeen-born Mary Slessor was one of the few missionaries in Africa who learnt the local language, adapted to the native customs and environment and gained the trust of the locals in order to make a truly positive impact.

Her father, a shoe-maker from Buchan, became incapacitated by alcoholism and Mary more or less became the breadwinner for the family.

From the age of 11, she worked as a ‘half-timer’ mill girl in the Baxter Brothers and Co Ltd, spending half the day at a school provided by the mill owners and the other half working for the company
HISTORY
Kirsti Miller
Kirsti Miller
@KirstiMiller30
@FionaPearman @ScottMorrisonMP Morrison is our statue of unempathic neoliberalism - erected by evangelical and corporate Australia to celebrate their victory over compassion, equality and secular humanism. 

Hopefully it gets pulled down like the statues of dubious heroes of oppression from an earlier age.


@ScottMorrisonMP The two-party-preferred system in 
Australia politics isn’t working for people, and it sure isn’t working for the planet.

@ScottMorrisonMP My collapse of faith in our democracies isn’t an accident. It’s one of the central victories of the neoliberal project, delivered through two generations of privatisation, outsourcing and deregulation, underfunding of government services (locked in by tax cuts),...

@ScottMorrisonMP restricting freedom of information, targeting whistleblowers and raiding the media who report on them, delegitimising and gagging public interest advocacy, and criminalising protest.

@ScottMorrisonMP Politics in Australia today relies hugely on the fact that most people don’t know most of what’s going on so as to get away with stuff that couldn’t be done under real scrutiny we have seen a clear example of this with the National Coronvirus Cabinet.
FOR LATER READ
Robin Berjon
Robin Berjon
@robinberjon
Recently, the @CNIL issued a decision regarding the GDPR compliance of an unknown French adtech company named "Vectaury". It may seem like small fry, but the decision has potential wide-ranging impacts for Google, the IAB framework, and today's adtech. It's thread time! 👇

It's all in French, but if you're up for it you can read:
• Their blog post (lacks the most interesting details): https://t.co/PHkDcOT1hy
• Their high-level legal decision: https://t.co/hwpiEvjodt
• The full notification: https://t.co/QQB7rfynha

I've read it so you needn't!

Vectaury was collecting geolocation data in order to create profiles (eg. people who often go to this or that type of shop) so as to power ad targeting. They operate through embedded SDKs and ad bidding, making them invisible to users.

The @CNIL notes that profiling based off of geolocation presents particular risks since it reveals people's movements and habits. As risky, the processing requires consent — this will be the heart of their assessment.

Interesting point: they justify the decision in part because of how many people COULD be targeted in this way (rather than how many have — though they note that too). Because it's on a phone, and many have phones, it is considered large-scale processing no matter what.
TECH