BC TECH
Saved by @ThomassRichards

Next up in Privacy Technology at #enigma2021, Kelly Huang from @ethyca speaking about "GONE, BUT NOT "FORGOTTEN"—TECHNICAL & PRACTICAL CHALLENGES IN OPERATIONALIZING MODERN PRIVACY

 Just imagine there's a global pandemic forcing everyone to stay home and buy their stuff over the internet. And you've been working on your sanitization-on-demand startup. You've got more users than you can count! ... literally, because your data's all over.
Now you're a multi-national international country with privacy issues because your information is all over the place.

Now a user writes to request you delete their data. Where is it? How do you do that? Who's responsible for privacy in your business.
How do you operationalize privacy rights?

Primary stakeholders:
* Legal
* Business
* Engineering
We spend a lot of time on Twitter analyzing the legal rulings, but it's harder where the "rubber meets the code" 🥁
Three rights:
* access
* rectification
* deletion

Legal's trying to uphold them, but it's a technical question!

Legal wants to decrease risk but don't know software
The business wants to stay in business and make money. They want to be able to use data for things like placing ads and analysis.
It takes a lot of time to handle these requests, too!

They need a streamlined technical solution.
Program management wants to streamline and make things efficient and predictable... but they don't understand the technical limitation
As a software engineer, you've seen technical debt. So much technical debt. All the weight of the decisions that were made in the past, especially if you scaled without a data plan.

Average SMB has data in 10 different systems.
How do we delete?
Some poor software engineer is trying to track down what data is where?
What even *is* PII? There's no real standard.
What should be returned? What should be deleted.

Make a definition and stick to it.
Some of your databases might use email addresses as a primary key, some user IDs, etc.
1. Define PII
2. Find all the PII
3. Use pseudonymization to replace PII with some kind of random value which can't be tied back to the user

[reminder I am livetweeting this is not me speaking]
How do you do this at scale?
Maybe a centralized team who can handle this?
If you're a small company, plan ahead!
Be careful when you're doing sanitization -- some databases really don't like batch processes and you can make things fall over.
Speed
* you have a timeline -- often 30 or 45 days
* but that's not enough time if you haven't planned for streamlined speed

Ideally you won't need it, but have a backup plan, in case something goes wrong with a slow data system
Plan for a solution that grows with your business, not just a hacked-together series of SQL queries, but instead a centralized portal with extensibility as the business changes and technical systems grow.

... and as new privacy laws come into place
Privacy is way, way more than compliance. But compliance needs to happen.

Let's all do our part

[ end of talk ]

More from Lea Kissner

Lea Kissner
Lea Kissner
@LeaKissner
Last talk about Securing Democracy at #enigma2021: @jackhcable speaking about "THE FULL STACK PROBLEM OF ELECTION

Let's imagine that elections use all the security measures security people have been advocating: risk-limiting audits, paper ballots, etc. Would people trust the elections more?

Jack would argue no. Most people don't understand this stuff and most of the claims people are making can't be disproven. And are massively bogus already.

Georgia did a full recount on paper ballots and it very much didn't stop people from doubting the election!

Are election security results in vain? The point of election security is to convince the loser they lost.

No! Have to focus on the whole stack, from election infrastructure to campaigns to people and mis/dis-informaton


One takeaway from the talk: the parts of the stack must work in tandem. Can't fight misinformation in a vacuum, but must build on other election security measures.
POLITICS
Lea Kissner
Lea Kissner
@LeaKissner
In more Securing Democracy at #enigma2021, @ChrFolini talking about "THE ADVENTUROUS TALE OF ONLINE VOTING IN

Switzerland is a direct democracy where citizens get to vote at least 4x/year, with a lot of mail-in voting. We have a long history of online voting.

Disclaimer: THIS IS NOT SWEDEN.

[I get the picture that @ChrFolini has had to explain the difference several times.]


Process around mail-in ballots.

[tl;dr it's very complicated and wasn't threat-modeled until recently]


But the in-person ballots are complicated, too!


Most security folks don't think that we can't make a secure online voting system.

@ChrFolini says this is because of encryption
[Note: this is not the main reason that a lot of people cite -- we're more worried about things like malware but it's complicated]
WORLD
Advertisement
Lea Kissner
Lea Kissner
@LeaKissner
We're kicking off the Privacy Tech session at #enigma2021 with Mitch Negus speaking about "NO DATA, NO PROBLEM—GIVING NUCLEAR INSPECTORS BETTER TOOLS WITHOUT REVEALING STATE

A nuclear catastrophe hasn't occurred... yet. So we need to stay vigilant. Nuclear inspectors go in according to treaties to check what's going on and check compliance with treaty rules.

But as sophisticated analytics become more common, states will only want to share the minimum amount of information necessary under the treaty.

But perhaps we can use MPC -- secure multi-party computation

Yao's garbled circuits were first demonstrated on the millionaire's problem -- figuring out who's richer without revealing actual amounts.

Used for other things like cryptocurrency these days.

Can we use this for nuclear inspection?

MPC can be used to compute anything computed by a computer [but it's expensive!]
TECH
Lea Kissner
Lea Kissner
@LeaKissner
Next up at #enigma2021, Sanghyun Hong will be speaking about "A SOUND MIND IN A VULNERABLE BODY: PRACTICAL HARDWARE ATTACKS ON DEEP LEARNING"

(Hint: speaker is on the

In recent years ML models have worked from research labs to production, which makes ML security important. Adversarial ML research studies how to mess with ML

For example by messing with the training data (c.f. Tay which became super-racist super-fast) or by foiling ML models by changing inputs in ways humans can't see.


Prior work considers ML models in a standalone, mathematical way
* looks at the robustness in an isolated manner
* doesn't look at the whole ecosystem and how the model is used -- ML models are running in real hardware with real software which has real vulns!


This talk focuses on hardware-level vulnerabilities. This is particularly interesting because these can break cryptographic guarantees (because those are outside of their threat models)
e.g. fault injection attacks, side-channel attacks
SCIENCE
Lea Kissner
Lea Kissner
@LeaKissner
Last up in Privacy Tech for #enigma2021, @xchatty speaking about "IMPLEMENTING DIFFERENTIAL PRIVACY FOR THE 2020

Differential privacy was invented in 2006. Seems like a long time but it's not a long time since a fundamental scientific invention. It took longer than that between the invention of public key cryptography and even the first version of SSL.


But even in 2020, we still can't meet user expectations.
* Data users expect consistent data releases
* Some people call synthetic data "fake data" like
"fake news"
* It's not clear what "quality assurance" and "data exploration" means in a DP framework


We just did the 2020 US census
* required to collect it by the constitution
* but required to maintain privacy by law

But that's hard! What if there were 10 people on the block and all the same sex and age? If you posted something like that, then you would know what everyone's sex and age was on the block.
TECH , TEACH

More from Tech

Patrick McKenzie
Patrick McKenzie
@patio11
Torn between "I think losing $100 million when someone beats you at security research is pretty much exactly what you signed up for doing yield farming" and "Maaaaaaaybe not the future of finance you were expecting, huh."

How to put this in regular finance terms...

Suppose hypothetically you have an account at a brokerage with some valuable asset in it. You take a margin loan against that asset to fund your normal spending, or pay a tax bill, or maybe buy something at another brokerage.

For reasons known only to the brokerage, they don't denominate your loan in dollars. They denominate it in shares of a money market fund, which are worth $1 +/- epsilon and basically never deviate from that.

And you think "Hmm, I have a large equity cushion against this loan."

One day, a computer system at the brokerage reports, sorta-kinda erroneously, that the value of the money market fund is actually $1.30 per share. The equity cushion is gone. Your valuable asset is sold, at timing you didn't choose, at wrong price, to pay an inflated phantom debt

And your recourse is... probably tweeting at patio11 saying he finds too much joy in this.

Which I don't; I just feel like this is why you don't trust a CPU built out of redstone to build reliable financial infrastructure on top of.
TECH
Jared Spool
Jared Spool
@jmspool
A common misunderstanding about Agile and “Big Design Up Front”:

There’s nothing in the Agile Manifesto or Principles that states you should never have any idea what you’re trying to build.

You’re allowed to think about a desired outcome from the beginning.

It’s not Big Design Up Front if you do in-depth research to understand the user’s problem.

It’s not BDUF if you spend detailed time learning who needs this thing and why they need it.

It’s not BDUF if you help every team member know what success looks like.

Agile is about reducing risk.

It’s not Agile if you increase risk by starting your sprints with complete ignorance.

It’s not Agile if you don’t research.

Don’t make the mistake of shutting down critical understanding by labeling it Bg Design Up Front.

It would be a mistake to assume this research should only be done by designers and researchers.

Product management and developers also need to be out with the team, conducting the research.

Shared Understanding is the key objective


Big Design Up Front is a thing to avoid.

Defining all the functionality before coding is BDUF.

Drawing every screen and every pixel is BDUF.

Promising functionality (or delivery dates) to customers before development starts is BDUF.

These things shouldn’t happen in Agile.
TECH
Advertisement
Biz Stone
Biz Stone
@biz
Originally, tweet length was 160 minus username length. One day, I turned to Jack and pointed out that I got one more character than him. He said, "That's not fair. We should standardize." I agreed. He said, "How about 140?" I said, "Sure." And he updated the code.

Last year, we upgraded tweet length to 280 and guess what? Use of 'please' is up 54% and 'thank you' is up 22%. I love that! Also, people are asking more questions and having more conversations. All this, and the majority of tweets are still under 140. It worked.
TECH
Colby Fayock
Colby Fayock
@colbyfayock
Next.js has taken the web dev world by storm

It’s the @reactjs framework devs rave about praising its power, flexibility, and dev experience

Don't feel like you're missing out!

Here's everything you need to know in 10 tweets

Let’s dive in 🧵


Next.js is a @reactjs framework from @vercel

It couples a great dev experience with an opinionated feature set to make it easy to spin up new performant, dynamic web apps

It's used by many high-profile teams like @hulu, @apple, @Nike, & more

https://t.co/whCdm5ytuk


@vercel @hulu @Apple @Nike The team at @vercel, formerly Zeit, originally and launched v1 of the framework on Oct 26, 2016 in the pursuit of universal JavaScript apps

Since then, the team & community has grown expotentially, including contributions from giants like @Google

https://t.co/xPPTOtHoKW


@vercel @hulu @Apple @Nike @Google In the #jamstack world, Next.js pulled a hefty 58.6% share of framework adoption in 2020

Compared to other popular @reactjs frameworks like Gatsby, which pulled in 12%

*The Next.js stats likely include some SSR, arguably not Jamstack

https://t.co/acNawfcM4z


@vercel @hulu @Apple @Nike @Google The easiest way to get started with a new Next.js app is with Create Next App

Simply run:

yarn create next-app

or

npx create-next-app

You can even start from a git-based template with the -e flag

yarn create next-app -e https://t.co/JMQ87gi1ue

https://t.co/rwKhp7zlys
TECH
Austin Energy
Austin Energy
@austinenergy
LIVE: ❄️ City of Austin leadership including @AustinEnergyGM will address the unprecedented severe weather.
💻 Due to tech limitations, it will only be available via Facebook Live here: https://t.co/PchiwUgP0M
We will be live-tweeting in this thread.

Mayor Steve Adler: This will require us all to come together and help one another.
City Manager Spencer Cronk: As a City, we are doing our best to help those in need.

Cronk: Stay off the roads and conserve energy. Every little bit helps.

COA Office of Homeland Security and Emergency Management Director Juan Ortiz: Currently we have a warming center at the Palmer Events Center. You can show up at any time. As of this morning, cold weather shelters remain active. 282 were sheltered overnight.

Ortiz: Urge residents to conserve much power as possible to help with the emergency issues. We are working with critical facilities to ensure that access to those facilities remain open, so ambulances can get in.
TECH

You May Also Like

f1talks.pl
f1talks.pl
@f1talks
Oleg Karpov pisze, że gdyby Siergiej Sirotkin zdobył w pierwszej części sezonu więcej punktów od Strolla, to jego kontrakt z automatu zostałby przedłużony na kolejny sezon. Tak się nie stało i Williams ma możliwość szukania innych opcji i to właśnie robi. #F1pl

Czego w artykule brakuje, to informacji, że SMP prawdopodobnie przekazało Williamsowi część środków na sfinansowanie sezonu 2019. W przypadku zakończenia współpracy ekipa z Grove będzie musiała zwrócić te środki. #F1pl

To tłumaczy wysokie kwoty jakich Williams ma oczekiwać za fotel od nowego kierowcy. Jest pewnie próg opłacalności i dopóki nie zostanie osiągnięty, to zmiana z finansowego punktu widzenia nie będzie się zwyczajnie opłacała. #F1pl

Tyle można znaleźć w oświadczeniach prasowych... 😂😂😂
SPORT
What The Trans!?
What The Trans!?
@WhatTheTrans
A thread on how absurd the UK is on transgender issues and how the UK got so transphobic

In 2015 Parliament held an inquiry looking into the state of Transgender equality. Trans people of all stripes outlined many different problems across many, many different areas.

As a result Parliament created a list of recommendations including legal recognition for non binary people, gender recognition act reform, allowing 16 year olds to change their legal gender and reform of NHS gender identity services.

The government under Theresa May ignored everything that was recommended except for Gender recognition act reform. This act came into law in 2003 and gave trans men and women (but not non-binary people) the ability to legally change their gender on their birth certificates.

The process at that time to change your birth certificate under the GRA was to make an application to a panel of cisgender people who would decide if you were sufficiently trans based on your payslips, photo ID and bank statements. You would not get the option to speak to them.

(Also this process cost £140 which is just a tax on being trans)
SOCIETY
Advertisement
Jaya_Upadhyaya
Jaya_Upadhyaya
@Jayalko1
DEVI KARUMARIAMMAN, THIRUVERKADU (TN)

Devi is worshipped here as both Swayambhu (self-manifested) and as Parashakti (with 4 arms holding skull,sword,trishul,udukkai/damru).

Here, Muruga got Vel from Devi to fight Suran. So the place was called Vel kadu which became Verkadu.


It is said that there was an anthill here long ago. Devi appeared in the dream of a devotee and asked him to build a shrine at that spot. When the anthill was removed, the swayambhu murti of Devi emerged. So Devi is called Karuvil Illadha Karumari ( not in the womb of mother).


Once, Devi went to Surya in the form of an old woman but Surya neglected her. Devi’s anger made Surya lose his brightness.
To appease her, Surya said that His rays would fall on Her directly twice in a year and touch her feet. Also, Sunday is celebrated as day of Devi Karumari.


There is also a wooden image of Devi (Marachilai Amman) here. Devotees offer locks to her in the belief that She would safe guard their houses.
Temple tank (Thiruchamber Poigai) is said to have been created by Subramanya. Taking dip in it is said to cure skin related disorders.
ALL
Trader knight
Trader knight
@Traderknight007
Pyramiding 2.0

A thread-


What is pyramiding?

It is simply adding to your winners.

Why use pyramiding?

1. It makes your winners bigger than your losers.

• Because you are adding positions when your trades are going your way, you are increasing your gains but your losers will be small comparatively.

2. You lose less during Draw-down time ( it saves you from losing big during whipsaws )

• Many times when the market is in sideways mode, Entering a trade with full risk might not be the best idea.

• So, you test the waters with a small position first, it could be ⅓ or ¼ of your total risk.

• So if the Breakout fails or whipsaws come, then you will only lose a small part of your overall risk.

• Then when position starts to go in your favor you can add to it.

3. It helps you to concentrate on a few trades,

They say that don’t put all your eggs in one basket, but don’t put them in too many either.

• See, Everyone can see charts and find breakouts, pullbacks etc.
ALL , SWING TRADING , PYRAMIDING
\u092c\u094d\u0930\u093e\u0939\u094d\u092e\u0923\u094b\u0902 \u0915\u093e \u0907\u0924\u093f\u0939\u093e\u0938\U0001f441\ufe0f\U0001f441\ufe0f
ब्राह्मणों का इतिहास👁️...
@BRAHMIN_0052
MOHIYAL_BRAHMIN_KING
RAJA_PORUS
King_Porus_History

1)King Porus was a famous Indian king, his real name was #Purushotama. He belonged to PURU tribe mentioned in #RIG_VEDA, the Ancient books of India.


2) Porus ruled the Punjab region and expanded his kingdom between the Jhelum River and Chenab River in the Indian Subcontinent. He was a legendary warrior and more war skills. He made the army most powerful with war skills. Even Alexander had also made difficulty to defeat Porus.

3)Word of Mouth Oral tradition in #Mohyal_Brahmin families since ancient times has kept the Great Saga of their Great Elder known to them as Maharaja “ #Puru” alive.

4) When #Alexander the Great invaded India in 326 BC he was challenged near Taxila by a mere chieftain of the Area. He was King #Porus, a #Vaid_Mohyal. After his encounter with Porus, Alexander met with more resistance near Multan where the forces were predominantly #Mohyal.

5)The Bali rulers of Multan fiercely engaged with Alexander's army in skirmishes in which many senior Generals died. Later during the long and bitter fighting in #Multan, Alexander got hurt by an arrow which pierced his chest ,
RELIGION