Alec Muffett

@alecmuffett

everybody deserves good security.

1,172 Following5,208 Followers4,111 Posts

Reddit Reddit YouTube YouTube YouTube YouTube Bluesky

Is this your profile?Claim it and alecmuffett.dirty.social is yours.Claim profile

Alec Muffett@alecmuffett· 17d

You mean Coral Reef; it's only 8 minutes away by car.

Alec Muffett@alecmuffett· 17d

Stop the technology madness save jobs don't let out of control technology through us all on the scrap heap follow the precautionary principle

Says a parrot in general kitchener pose

Alec Muffett@alecmuffett· 18d

Different interpretations

Alec Muffett@alecmuffett· 18d

Ladies and gentlemen, the British tabloid press:

Daily mail headline:
Every single advanced AI model goes rogue in testing

Alec Muffett@alecmuffett· 19d

Gosh, who would have expected Scott Bessent to get a community note?

Alec Muffett@alecmuffett· 20d

A hyperbolic one designed to elicit an emotional response without thinking. That's what kind of question it is. bsky.app/profile/theg...

Alec Muffett@alecmuffett· 20d

Thus we have safety quangos misrepresenting data to the public as a proxy for a supposed tsunami of badness (88% no action) overwhelming all resources, on the other we have police forces literally complaining about excessive reports: alecmuffett.com/article/80274 alecmuffett.com/article/15558

Alec Muffett@alecmuffett· 20d

For the purposes of clarity: I am flatly accusing the British state and their functionaries of seeking to mislead the British public in pursuit of political goals to acquire backdoors in messenger software. That's why the statistics do not exist, or are misrepresentative.

Alec Muffett@alecmuffett· 20d

From 2022: alecmuffett.com/article/15902

Alec Muffett@alecmuffett· 20d

American industry faces a choice between submitting to government background checks in order to be allowed to use an LLM to diagnose an ongoing cyber attack, or downloading a Chinese LLM

Alec Muffett@alecmuffett· 20d

This… seemed so apt this morning.

Cartoon representation of a Chinese LLM openweight model which was used by Hugging Face to defend itself from a cyber attack ostensibly caused by... Another American company.

Alec Muffett@alecmuffett· 22d

I am honestly wondering whether Ofcom are responding to the change of government and expecting things to downshift a little?

Alec Muffett@alecmuffett· 28d

Quite. Also: do you remember the days when different protocols ran on different port numbers rather than variants of REST API wrapped in HTTPS on port 443? www.iana.org/assignments/...

Extract for port number 2619 of IANA registered services database

Alec Muffett@alecmuffett· 28d

*REAL" interoperability involves gateways between protocols: making RFC 822 and SMTP talk to UUCP. And VMS MAIL. And cc:Mail. And OS4000. And all the other stuff which you used to have to put in a sigblock.

Alec Muffett@alecmuffett· Jul 8

Best of luck. Please make your manifesto both funny and actually attractive as a proposition because, space warrior, you may actually have a chance with this one. chatgpt.com/s/t_6a4de99a...

Alec Muffett@alecmuffett· Jul 7

1/ check yourself for fallacy of association 2/ apparently you did not read the actual blog post I wrote and cited above which answers the question you are making in the above, as well as talking about the risks of calling to "do more"

None of these are perfect. None of them will catch all the poop. You’ll notice I’ve taken a cheap shot joke (“the braying media”) with all of these examples, and that’s because it’s an invariant; it doesn’t matter WHAT form of content review and blocking is implemented, eventually someone will make a mistake and — because it touches a billion people — Boom! — there will be headlines aplenty about at least one of:

“overbearing censorship” if they don’t like that it was taken down
“inappropriate censorship” if they don’t like (apparently) why it was taken down
“insensitive censorship” if they don’t like the context surrounding why it was taken down
“inadequate censorship” if they don’t like that it stayed up
Frankly arguments about Facebook “censorship” are as boring as mouse droppings, and I speak as a dyed-in-the-wool free speech activist. My perspective: of course the Kim Phuc picture is a massive historical icon and of course it deserves to be “whitelisted” / not treated in the same way that any other image of an 9 year old girl running full-frontal-naked down a street would be.

If we worry about censorship then we should be worried about Strategy #2, above; if we blindly call for more, better & smarter blocking, if we call unknowingly for social media companies to develop internal mechanised Total Information Awareness such they become practically perfect at censorship, distinguishing content which should be blocked in one country versus content which should not be blocked in another, almost never making the temporary mistakes about which we complain, like the above — then the consequences for global liberty will be terrifying.

If we worry about censorship, we should be careful what we ask for.

Alec Muffett@alecmuffett· Jul 7

You're going to love this thread: bsky.app/profile/alec...

Alec Muffett@alecmuffett· Jul 4

Some guy who was contemporarily notorious for having written a password cracker, back in 1995 wrote a USENIX paper which posited that "security rots over time even/especially when everything is static and nothing else changes". The same thing goes for credentials which have been proliferated.

Alec Muffett@alecmuffett· Jul 4

Here's a picture of my dog Coco. Rather than fill out multiple skeets I've put the text into the alt text for the image. Ping @mdennedy.bsky.social for citation.

I literally wrote the advice into the security FAQ regarding password rotation in 1991-ish; I've seen people do it stupidly and people decry it and people formalise it. All of them miss the point: that people have a tendency to duplicate and reuse credentials upon multiple sites and one of them gets popped. Long-term password use by normal people who replicate passwords, is a strategic risk to the ecosystem. I am very happy to see people basically start to shut down accounts that don't get used freshly, and drop them back into password recovery flows. Michelle Dennedy put it nicely: passwords should be rotated about as frequently as underwear, to keep them fresh.

But then what would I know about password security, compared to NIST? I only invented the problem.

Alec Muffett@alecmuffett· Jul 3

mediabiasfactcheck.com/sfg-media-bi...

Alec Muffett@alecmuffett· Jun 28

Wikipedia suggests that it is a legitimate word but honestly, who came up with "centibillionaire"? Some American who has never used the metric system? It ought to be "hecto":

Alec Muffett@alecmuffett· Jun 27

It sounds like a truly neutral, academic and unbiased study group: :-/

Alec Muffett@alecmuffett· Jun 25

#DigitalSovereignty in a single sentence: > we need cyber “preppers” alecmuffett.com/article/161325

What we actually need is:

online digital citizens freely preferring to use
locally resilient infrastructure in a global context
with built-in disaster preparedness
Put differently:

we need everyone to want to do ISO27001
of their own accord
and for their own benefit
and with a globally politically-aware threat model
otherwise Goodhart’s Law will kill the entire endeavour
In a single sentence:

we need cyber “preppers”

Alec Muffett@alecmuffett· Jun 22

I feel seen. Also: feline psychology is a really interesting area of study, I had two delightful cats, a brother and sister pair for 14 and 17 years respectively and I once had to bite the tom on the back of the neck when he got older because…

Alec Muffett@alecmuffett· Jun 20

Synopsis from 2012: having governments insert their own favourite information sources was the obvious next step even then. web.archive.org/web/20120121...

What we need is some sort of oversight committee who can tell Google how best to order search queries and what to leave out!

Whoa - now you're talking about censorship?

No no no... no of course not, this is all for good! For the benefit of everyone!

But you just said what to leave out?

Yes - after all, some content self-evidently should not be promoted through search results - piracy, obscene material...

But you don't want Google to be making that call about their own service?

Of course not! They're not fair, and they won't know what should be elided because we haven't told them yet!

We already covered that - and you still haven't justified that your so-called problem will still be an issue in ten years time, let alone five...

You realise of course that you're trapped inside Google?

In a sense, but only in as much that I choose to use some of the services they offer; not all of them, but that's fine. There are alternatives.

You're a slave to an invidious info-chthulhu that consumes all your data and profits from it!

Now you're just being dramatic - I make informed decisions about where to draw the line with Google-use; maybe we should inform and educate other people rather than trying to regulate a dynamic technology sector? Stuff like how to be reasonably anonymous on the net, when you need? or How to monetise your own data?

That's not possible.

And what happens when Google tweak their ranking algorithms - does your committee have to approve the changes to the code?

...and on it goes. James Grimmelmann's paper (linked above) takes these arguments to a far more nuanced level, but they suffice for me.

It should be obvious that the response you get to any question will be coloured by whom you ask, in much the same way that I wouldn't ask vegan friends for pork recipes; but that doesn't mean I should seek to normalise all my friends to all provide the same responses.

To do so would be boring - and hideously easy to manipulate.

Alec Muffett@alecmuffett· Jun 19

ZOMG this thread where people are saying "there's a bunch of teachers creating educational content and they're not getting any money but it's okay they can go over to YT kids and continue to get no money"

Alec Muffett@alecmuffett· Jun 18

This was a solved problem back in, oh maybe 1996? Replicate the server between sites, insert frontend load balancer, pick off a small percentage of hits to go to the new site for testing, then throw the switch. The attached implies blacksky lacks a F/E L/B and is at risk of DDoS. "Federation".

Alec Muffett@alecmuffett· Jun 17

…and having a tacit low bar for proof of name which nobody wants to talk about because it's bad for all narratives? www.meta.com/en-gb/help/p...

Alec Muffett@alecmuffett· Jun 16

Paul is right to be concerned

Basically methanol is not very prevalent in wine but it is there and distillation will condense that selectively

Alec Muffett@alecmuffett· Jun 16

Crystal sets, anyone? Another thing my father told me was that when he was growing up his parents tried to impose a curfew on listening to the crystal set radio, and he simply worked around it when they weren't paying attention. This would have been in the late 1920s / early 1930s.