BC TECH
Saved by @ThomassRichards

Next up in Privacy Technology at #enigma2021, Kelly Huang from @ethyca speaking about "GONE, BUT NOT "FORGOTTEN"—TECHNICAL & PRACTICAL CHALLENGES IN OPERATIONALIZING MODERN PRIVACY

 Just imagine there's a global pandemic forcing everyone to stay home and buy their stuff over the internet. And you've been working on your sanitization-on-demand startup. You've got more users than you can count! ... literally, because your data's all over.
Now you're a multi-national international country with privacy issues because your information is all over the place.

Now a user writes to request you delete their data. Where is it? How do you do that? Who's responsible for privacy in your business.
How do you operationalize privacy rights?

Primary stakeholders:
* Legal
* Business
* Engineering
We spend a lot of time on Twitter analyzing the legal rulings, but it's harder where the "rubber meets the code" 🥁
Three rights:
* access
* rectification
* deletion

Legal's trying to uphold them, but it's a technical question!

Legal wants to decrease risk but don't know software
The business wants to stay in business and make money. They want to be able to use data for things like placing ads and analysis.
It takes a lot of time to handle these requests, too!

They need a streamlined technical solution.
Program management wants to streamline and make things efficient and predictable... but they don't understand the technical limitation
As a software engineer, you've seen technical debt. So much technical debt. All the weight of the decisions that were made in the past, especially if you scaled without a data plan.

Average SMB has data in 10 different systems.
How do we delete?
Some poor software engineer is trying to track down what data is where?
What even *is* PII? There's no real standard.
What should be returned? What should be deleted.

Make a definition and stick to it.
Some of your databases might use email addresses as a primary key, some user IDs, etc.
1. Define PII
2. Find all the PII
3. Use pseudonymization to replace PII with some kind of random value which can't be tied back to the user

[reminder I am livetweeting this is not me speaking]
How do you do this at scale?
Maybe a centralized team who can handle this?
If you're a small company, plan ahead!
Be careful when you're doing sanitization -- some databases really don't like batch processes and you can make things fall over.
Speed
* you have a timeline -- often 30 or 45 days
* but that's not enough time if you haven't planned for streamlined speed

Ideally you won't need it, but have a backup plan, in case something goes wrong with a slow data system
Plan for a solution that grows with your business, not just a hacked-together series of SQL queries, but instead a centralized portal with extensibility as the business changes and technical systems grow.

... and as new privacy laws come into place
Privacy is way, way more than compliance. But compliance needs to happen.

Let's all do our part

[ end of talk ]

More from Lea Kissner

Lea Kissner
Lea Kissner
@LeaKissner
In more Securing Democracy at #enigma2021, @ChrFolini talking about "THE ADVENTUROUS TALE OF ONLINE VOTING IN

Switzerland is a direct democracy where citizens get to vote at least 4x/year, with a lot of mail-in voting. We have a long history of online voting.

Disclaimer: THIS IS NOT SWEDEN.

[I get the picture that @ChrFolini has had to explain the difference several times.]


Process around mail-in ballots.

[tl;dr it's very complicated and wasn't threat-modeled until recently]


But the in-person ballots are complicated, too!


Most security folks don't think that we can't make a secure online voting system.

@ChrFolini says this is because of encryption
[Note: this is not the main reason that a lot of people cite -- we're more worried about things like malware but it's complicated]
WORLD
Lea Kissner
Lea Kissner
@LeaKissner
Next up at #enigma2021, Sanghyun Hong will be speaking about "A SOUND MIND IN A VULNERABLE BODY: PRACTICAL HARDWARE ATTACKS ON DEEP LEARNING"

(Hint: speaker is on the

In recent years ML models have worked from research labs to production, which makes ML security important. Adversarial ML research studies how to mess with ML

For example by messing with the training data (c.f. Tay which became super-racist super-fast) or by foiling ML models by changing inputs in ways humans can't see.


Prior work considers ML models in a standalone, mathematical way
* looks at the robustness in an isolated manner
* doesn't look at the whole ecosystem and how the model is used -- ML models are running in real hardware with real software which has real vulns!


This talk focuses on hardware-level vulnerabilities. This is particularly interesting because these can break cryptographic guarantees (because those are outside of their threat models)
e.g. fault injection attacks, side-channel attacks
SCIENCE
Advertisement
Lea Kissner
Lea Kissner
@LeaKissner
Last talk about Securing Democracy at #enigma2021: @jackhcable speaking about "THE FULL STACK PROBLEM OF ELECTION

Let's imagine that elections use all the security measures security people have been advocating: risk-limiting audits, paper ballots, etc. Would people trust the elections more?

Jack would argue no. Most people don't understand this stuff and most of the claims people are making can't be disproven. And are massively bogus already.

Georgia did a full recount on paper ballots and it very much didn't stop people from doubting the election!

Are election security results in vain? The point of election security is to convince the loser they lost.

No! Have to focus on the whole stack, from election infrastructure to campaigns to people and mis/dis-informaton


One takeaway from the talk: the parts of the stack must work in tandem. Can't fight misinformation in a vacuum, but must build on other election security measures.
POLITICS
Lea Kissner
Lea Kissner
@LeaKissner
We're kicking off the Privacy Tech session at #enigma2021 with Mitch Negus speaking about "NO DATA, NO PROBLEM—GIVING NUCLEAR INSPECTORS BETTER TOOLS WITHOUT REVEALING STATE

A nuclear catastrophe hasn't occurred... yet. So we need to stay vigilant. Nuclear inspectors go in according to treaties to check what's going on and check compliance with treaty rules.

But as sophisticated analytics become more common, states will only want to share the minimum amount of information necessary under the treaty.

But perhaps we can use MPC -- secure multi-party computation

Yao's garbled circuits were first demonstrated on the millionaire's problem -- figuring out who's richer without revealing actual amounts.

Used for other things like cryptocurrency these days.

Can we use this for nuclear inspection?

MPC can be used to compute anything computed by a computer [but it's expensive!]
TECH
Lea Kissner
Lea Kissner
@LeaKissner
Last up in Privacy Tech for #enigma2021, @xchatty speaking about "IMPLEMENTING DIFFERENTIAL PRIVACY FOR THE 2020

Differential privacy was invented in 2006. Seems like a long time but it's not a long time since a fundamental scientific invention. It took longer than that between the invention of public key cryptography and even the first version of SSL.


But even in 2020, we still can't meet user expectations.
* Data users expect consistent data releases
* Some people call synthetic data "fake data" like
"fake news"
* It's not clear what "quality assurance" and "data exploration" means in a DP framework


We just did the 2020 US census
* required to collect it by the constitution
* but required to maintain privacy by law

But that's hard! What if there were 10 people on the block and all the same sex and age? If you posted something like that, then you would know what everyone's sex and age was on the block.
TECH , TEACH

More from Tech

John Horton
John Horton
@johnjhorton
What happens when a skill you have becomes obsolete? No, this isn't a R vs. Stata thread---it's a thread about a working paper w/ @sonnytambe!
https://t.co/w6nLf1tnST


The skill we look at is Adobe Flash, which @apple decided to no longer support back in 2010, which in turn caused demand/interest to plummet, as measured on @StackOverflow and in online labor markets, one of which is our empirical context


Despite the big fall-off in Flash jobs posted, very little else appeared to change in the market for Flash skills: wages for Flash jobs didn't fall, jobs didn't become easier to fill & openings weren't inundated with out-of-work Flash programmers


What happened was that (a) new entrants stopped specializing in Flash and (b) at least some existing Flash specialists started moving to other skills. In short, the demand shock quickly became a supply shock


At the level of the individual Flash worker, using a matched sample, we find (a) no fall-off in their wages, (b) some decline on-platform hours-worked. The most-focused on Flash workers had substantial increases in application intensity and a movement towards new skills
TECH
Kevin Roose
Kevin Roose
@kevinroose
On press call, Zuckerberg says FB users "naturally engage more with sensational content" that comes close to violating its rules. Compares it to cable TV and tabloids, and says, "This seems to be true regardless of where we set our policy lines."

Zuckerberg says FB is in the process of setting up a "new independent body" that users will be able to appeal content takedowns to. Sort of like the "Facebook Supreme Court" idea he previewed earlier this year.

Zuckerberg: "One of my biggest lessons from this year is that when you connect more than 2 billion people, you’re going to see the good and bad of humanity."

This is how Facebook says it's trying to change the engagement pattern on its services. https://t.co/3p0PGc912o


.@RebeccaJarvis asks Zuckerberg if anyone is going to lose their job over the revelations in the NYT story. He dodges, says that personnel issues aren't a public matter, and that employee performance is evaluated all the time.
TECH
Advertisement
Paul Stamatiou \U0001f4f7
Paul Stamatiou 📷...
@Stammy
Just published 15,000+ words on security keys. 🔐📱💻

With SIM attacks at their highest, now is a great time to take a closer look at your online security.

Removing SMS from your two-factor auth is a start, but authenticator apps have downsides too...

https://t.co/Dk0MPJHL2V


Just look at these headlines from recent SIM swap and port attacks.

It's all too established for attackers to find ways to socially engineer control of your phone number and start gaining control of your accounts.

I first talk about some general security tips.


Unfortunately not all websites let you remove your phone number from accounts.

You may consider migrating your phone carrier to @googlefi , which requires email account access to do anything (and can be locked down with security keys and even Advanced Protection)


Beyond SMS, I talk about issues that TOTP authenticator apps (the code generators) have as a form of two-factor auth. They're so, so much better than relying on SMS for your second factor but they still have issues like utilizing shared secrets and lacking phishing prevention.

Enter security keys!

Utilizing public key cryptography they don't have any shared secret between the client and the server. They prevent phishing by taking the website domain into account.

Even if you get tricked by a clone phishing website, your key won't.
TECH
Sarah Drasner
Sarah Drasner
@sarah_edo
🔥 It's probably common knowledge that Netlify makes deployment incredibly simple- you can connect a repo, pick a build command and 🚀

or just drop a folder in and you're done!

...but here are some other things you might not know about our deploys that are very special 🧵


Netlify has a concept of "atomic" deploys- which means a few things:

- You can preview a deploy when you've or someone else has just put in a PR

- You can roll back to ANY previous state, with one click, in milliseconds

- You always know what state your cache is in!

Netlify allows you to cancel a deploy- did you just put in a change, merge it and then realize you've made a terrible mistake? I've never done that. 😬 er...

No worries. You can cancel that deploy with the click of a button.

You can lock a deploy. Let's say you get everything ready for a big release, code review and tests are complete, it's all ready.

You can lock a deploy in a state to get ready for a major release, so that you know exactly what you're releasing and sleep well the night before. 😴


You can even get notifications about locked deploys via email, outgoing webhook, or Slack. Netlify can notify you when a deploy is either locked or unlocked.
TECH
Tanay Jaipuria
Tanay Jaipuria
@tanayj
YouTube’s ad business is officially bigger than Netflix.

YouTube ads at ~$35B run-rate vs Netflix at ~$31B run-rate
TECH

You May Also Like

Richard James
Richard James
@RJSHutton
I think a plausible explanation is that whatever Corbyn says or does, his critics will denounce - no matter how much hypocrisy it necessitates.


Corbyn opposes the exploitation of foreign sweatshop-workers - Labour MPs complain he's like Nigel

He speaks up in defence of migrants - Labour MPs whinge that he's not listening to the public's very real concerns about immigration:

He's wrong to prioritise Labour Party members over the public:

He's wrong to prioritise the public over Labour Party
POLITICS
Vibhu Vashisth
Vibhu Vashisth
@VIBHU_Tweet
राम-रावण युद्ध समाप्त हो चुका था। जगत को त्रास देने वाला रावण अपने कुटुम्ब सहित नष्ट हो चुका था।श्रीराम का राज्याभिषेक हुआ और अयोध्या नरेश श्री राम के नेतृत्व में चारों दिशाओं में शन्ति थी।
अंगद को विदा करते समय राम रो पड़े थे ।हनुमान को विदा करने की शक्ति तो राम में थी ही नहीं ।


माता सीता भी हनुमान को पुत्रवत मानती थी। अत: हनुमान अयोध्या में ही रह गए ।राम दिनभर दरबार में, शासन व्यवस्था में व्यस्त रहते थे। संध्या को जब शासकीय कार्यों में छूट मिलती तो गुरु और माताओं का कुशल-मंगल पूछ अपने कक्ष में जाते थे। परंतु हनुमान जी हमेशा उनके पीछे-पीछे ही रहते थे ।


उनकी उपस्थिति में ही सारा परिवार बहुत देर तक जी भर बातें करता ।फिर भरत को ध्यान आया कि भैया-भाभी को भी एकांत मिलना चाहिए ।उर्मिला को देख भी उनके मन में हूक उठती थी कि इस पतिव्रता को भी अपने पति का सानिध्य चाहिए ।

एक दिन भरत ने हनुमान जी से कहा,"हे पवनपुत्र! सीता भाभी को राम भैया के साथ एकांत में रहने का भी अधिकार प्राप्त है ।क्या आपको उनके माथे पर सिन्दूर नहीं दिखता?इसलिए संध्या पश्चात आप राम भैया को कृप्या अकेला छोड़ दिया करें "।
ये सुनकर हनुमान आश्चर्यचकित रह गए और सीता माता के पास गए ।


माता से हनुमान ने पूछा,"माता आप अपने माथे पर सिन्दूर क्यों लगाती हैं।" यह सुनकर सीता माता बोलीं,"स्त्री अपने माथे पर सिन्दूर लगाती है तो उसके पति की आयु में वृद्धि होती है और वह स्वस्थ रहते हैं "। फिर हनुमान जी प्रभु राम के पास गए ।
ALL
Advertisement
Peter McCormack [Jan/3\u279e\u20bf \U0001f511\u220e]
Peter McCormack [Jan/3...
@PeterMcCormack
1/ So here is a thread on how I turned $32,000 into $1.2m and back to pretty much zero (once taxes are paid).

Just note, I am not bitter or salty in any way at all, the last 2 years have been an amazing ride - travelled the world, been wealthy, been poor.

2/ Dec '16, my advertising agency folded, I had a little bit of money left and I put $32k into Bitcoin and Ether. As it started to go up I diversified into everything, Monero, Dash, this that, any crap - even Ripplecoin. Everything just kept going up.

3/ By March I think I had around $300k and $500k by the summer. I used to take 25% out but towards the end of the summer I got greedy and put it all back in and by December it was $1.2m.

4/ Thinking I was an absolute genius I decided to start a bunch of businesses. As silly as it sounds I had this goal of making $5m as I wanted to buy Bedford Town Football Club and get them in the league, and as Crypto was going up forever I needed 6 months.

5/ So:
- Trading (income 1)
- Podcast (income 2)
- Mining (income 3)
- Mining pool (income 4)
- Consulting (income 5)

Yes - all of the above as a one-man army :)
LIFE
Bharadwaj
Bharadwaj
@BharadwajSpeaks
Hinduism is a minority religion in Punjab.

During the Khalistan movement, the minority Hindus and Jains were subjected to several attacks. Hindu and Jain temples were frequently vandalized and desecrated. This thread documents a few instances.

Thread

Durgiana Mandir is one of the oldest temples of Amritsar. According to the regional Hindu tradition, the temple was built on the spot where Lava and Kusha bound Hanuman. The temple annually attracts millions of Hindus from all over the country.


Amristsar has a very ancient Hindu history.

According to the regional Hindu tradition recorded in the "Survey of Amritsar", Amritsar got its name from Amrit immersed by Lava and Kusha in a pond.


Durgiana Mandir was rebuilt in 1921.

It was used to house the Murtis of Vishnu and Durga which were thrown out from the Parikrama of Harmandir Sahib in 1905.

Because of its presence in Amritsar, it became a frequent target of radicals during the Khalistan movement.


In 1982, in what was a completely unprovoked attack, the Dal Khalsa "activists" threw a severed cow head inside Durgiana temple.
RELIGION
Enigma
Enigma
@ainittomai
The Eye of Horus. 1/*


I believe that @ripple_crippler and @looP_rM311_7211 are the same person. I know, nobody believes that. 2/*

Today I want to prove that Mr Pool smile faces mean XRP and price increase. In Ripple_Crippler, previous to Mr Pool existence, smile faces were frequent. They were very similar to the ones Mr Pool posts. The eyes also were usually a couple of "x", in fact, XRP logo. 3/*


The smile XRP-eyed face also appears related to the Moon. XRP going to the Moon. 4/*


And smile XRP-eyed faces also appear related to Egypt. In particular, to the Eye of Horus. https://t.co/i4rRzuQ0gZ 5/*
CULTURE