Need to let loose a primal scream without collecting footnotes first? Have a sneer percolating in your system but not enough time/energy to make a whole post about it? Go forth and be mid: Welcome to the Stubsack, your first port of call for learning fresh Awful youāll near-instantly regret.
Any awful.systems sub may be subsneered in this subthread, techtakes or no.
If your sneer seems higher quality than you thought, feel free to cutānāpaste it into its own post ā thereās no quota for posting and the bar really isnāt that high.
The post Xitter web has spawned soo many āesotericā right wing freaks, but thereās no appropriate sneer-space for them. Iām talking redscare-ish, reality challenged āculture criticsā who write about everything but understand nothing. Iām talking about reply-guys who make the same 6 tweets about the same 3 subjects. Theyāre inescapable at this point, yet I donāt see them mocked (as much as they should be)
Like, there was one dude a while back who insisted that women couldnāt be surgeons because they didnāt believe in the moon or in stars? I think each and every one of these guys is uniquely fucked up and if I canāt escape them, I would love to sneer at them.
(Semi-obligatory thanks to @dgerard for starting this)
Timnit Gebru on Twitter:
We received feedback from a grant application that included āWhile your impact metrics & thoughtful approach to addressing systemic issues in AI are impressive, some reviewers noted the inherent risks of navigating this space without alignment with larger corporate players,ā
navigating this space without alignment with larger corporate players
stares into middle distance, hollow laugh
No need for xcancel, Gebru is on actually social media: https://dair-community.social/@timnitGebru/113160285088058319
This quote flashbanged me a little
When you describe your symptoms to a doctor, and that doctor needs to form a diagnosis on what disease or ailment that is, thatās a next word prediction task. When choosing appropriate treatment options for said ailment, thatās also a next word prediction task.
From this thread: https://www.reddit.com/r/gamedev/comments/1fkn0aw/chatgpt_is_still_very_far_away_from_making_a/lnx8k9l/
Instead of improving LLMs, they are working backwards to prove that all other things are actually word prediction tasks. It is so annoying and also quite dumb. No chemisty isnāt like coding/legos. The law isnāt invalid because it doesnāt have gold fringes and you use magical words.
None of these fucking goblins have learned that analogies arenāt equivalences!!! They break down!!! Auuuuuuugggggaaaaaaarghhhh!!!
The problem is that there could be any number of possible next words, and the available results suggest that the appropriate context isnāt covered in the statistical relationships between prior words for anything but the most trivial of tasks i.e. automating the writing and parsing of emails that nobody ever wanted to read in the first place.
This is just standard promptfondler false equivalence: āwhen people (including me) speak, they just select the next most likely token, just like an LLMā
so mozilla decided to take the piss while begging for $10 donations:
We know $10 USD may not seem like enough to reclaim the internet and take on irresponsible tech companies. But the truth is that as you read this email, hundreds of Mozilla supporters worldwide are making donations. And when each one of us contributes what we can, all those donations add up fast.
With the rise of AI and continued threats to online privacy, the stakes of our movement have never been higher. And supporters like you are the reason why Mozilla is in a strong position to take on these challenges and transform the future of the internet.
the rise of AI you say! wow that sounds awful, itās so good Mozilla isnāt very recently notorious for pushing that exact thing on their users without their consent alongside other privacy-violating changes. what a responsible tech company!
upside of this: theyāll get told why theyāre not getting many of those $10 donations
downside of that (rejection): that could be exactly what one of the ghouls-in-chief there need to push some or other bullshit
the ability of Mozillaās executives and PMs to ignore public outcry is incredible, but not exactly unexpected from a thoroughly corrupt non-profit
could revitalise the ivory trade by mining these towers
(/s, about the trade bit)
We know $10 USD may not seem like enough to reclaim the internet with the browser we barely maintain and take on irresponsible tech companies that pay us vast sums of money. But the truth is that as you read this email, hundreds of Mozilla supporters worldwide havenāt realized weāre a charity racket dressed up as a browser who will spend all your money on AI and questionable browser plugins. And when each one of us contributes what we can, we can waste the money all the faster!
With the rise of AI (youāre welcome, by the way, for the MDN AI assistant) and continued threats to online privacy like question like integrating a Mr. Robot Ad into firefox without proper code review, the stakes of our movement have never been higher. And
markssupporters like you are the reason why Mozilla is in such a strong position to take on these challenges and transform the future of the internet in any way we know how ā except by improving our browser of course that would be silly.(Iām feeling extra cynical today)
is this what gaslighting is?
Gaslighting? What are you talking about? Thereās no such thing as gaslighting. Maybe youāre going crazy
Today in you canāt make this stuff up: SpaceX invades Cards Against Humanityās crowdfunded southern border plot of land.
Article (Ars Technica) Lawsuit with pictures (PDF)
Reddit Comment with CAHās email to backers
The above Ars Technica article also lead me to this broader article (reuters) about SpaceXās operations in Texas. I found these two sentences particularly unpleasant:
County commissioners have sought to rechristen Boca Chica, the coastal village where Johnson remains a rare holdout, with the Musk-endorsed name of Starbase.
At some point, former SpaceX employees and locals told Reuters, Starbase workers took down a Boca Chica sign identifying their village. They said workers also removed a statue of the Virgin of Guadalupe, an icon revered by the predominantly Mexican-American residents who long lived in the area.
Reading all of this also somehow makes Elon Muskās anti-immigrant tweets feel even worse to me than they already were.
Damn, 3 hours late to the party. Despite my disdain for their game, i can only recall enjoying CAHās liberal antics.
CAH is definitely a game you only play with people youāve known your whole life, isnāt it?
Once played with randoms at a hacker con and almost died of embarrassment.
Considering the style of humor they have and Musk tries to show, I do wonder how hurt Musk is over all this. And only a matter of time before his sycophants create āCAH is dyingā graphs and animal meme images with testicles.
Paul Krugman and Francis Fukuyama and Daniel Dennett and Steve Pinker were in a āhuman biodiversity discussion groupā with Steve Sailer and Ron Unz in 1999, because of course they were
I look forward to the ābut we often disagreedā non-apologies. With absolute lack of self reflection on how this helped push Sailer/Unz into the positions they are now. If we even get that.
Pinker: looking through my photo album where Iām with people like Krauss and Epstein, shaking my head the whole time so the people on the bus know I disagree with them
Also John McCarthy and Ray fucking Blanchard
Mr AGP? Wow.
Who could have predicted that liberalism would lead into scientific racism and then everything else that follows (mostly fascism)???
Surely āscientificā is giving them far too much credit? I recall previously sneering at some quotes about skull sizes, including something like women keep bonking their heads?
I believe the term is not so much meant to convey properties of science upon them as to describe the particular strain of racist shitbaggery (which dresses itself in appears-science, much like what happens in/with scientism)
Oh, definitely. For clarity my intention was to riff off them and increase levels of disrespect towards racists. In hindsight, the question format doesnāt quite convey that.
Iām mildly surprised at Krugman, since I never got a particularly racist vibe from him. (This is 100% an invitation to be corrected.) Annoyed that 1) I recognise so many names and 2) so many of the people involved are still influential.
Interested in why Johnathan Marks is there though. Heās been pretty anti-scientific racism if memory serves. I think heās even complained about how white supremacists stole the term human biodiversity. Now, Iām curious about the deep history of this group. Marks published his book in 1995 and this is a list from 1999, so was the transformation of the term into a racist euphemism already complete by then? Or is this discussion group more towards the beginning.
Similarly, curious how out some of these people were at the time. E.g. I know that Harpending was seen as a pretty respectable anthropologist up until recently, despite his virulent racism. But Iāve never been able to figure out how much his earlier racism was covert vs. how much 1970s anthropology accepted racism vs. how much this reflects his personal connections with key people in the early field of hunter-gatherer studies.
Oh also, super amused that Pinker and MacDonald are in the group at the same time, since Iām pretty sure Pinker denounced MacDonald for anti-Semitism in quite harsh language (which I havenāt seen mirrored when it comes to anti-black racism). MacDonaldās another weird one. He defended Irving when Irving was trying to silence Lipstadt, but in Evanās account, while he disagrees with MacDonald, he doesnāt emphasise that MacDonald is a raging anti-Semite and white supremacist. So, once again, interested in how covert vs. overt MacDonald was at the time.
Yeah, Krugman appearing on the roster surprised me too. While I havenāt pored over everything heās blogged and microblogged, he hasnāt sent up red flags that I recall. E.g., here he is in 2009:
Oh, Kay. Greg Mankiw looks at a graph showing that children of high-income families do better on tests, and suggests that itās largely about inherited talent: smart people make lots of money, and also have smart kids.
But, you know, thereās lots of evidence that thereās more to it than that. For example: students with low test scores from high-income families are slightly more likely to finish college than students with high test scores from low-income families.
Itās comforting to think that we live in a meritocracy. But we donāt.
There are many negative things you can say about Paul Ryan, chairman of the House Budget Committee and the G.O.P.ās de facto intellectual leader. But you have to admit that heās a very articulate guy, an expert at sounding as if he knows what heās talking about.
So itās comical, in a way, to see [Paul] Ryan trying to explain away some recent remarks in which he attributed persistent poverty to a āculture, in our inner cities in particular, of men not working and just generations of men not even thinking about working.ā He was, he says, simply being āinarticulate.ā How could anyone suggest that it was a racial dog-whistle? Why, he even cited the work of serious scholars ā people like Charles Murray, most famous for arguing that blacks are genetically inferior to whites. Oh, wait.
I suppose itās possible that he was invited to an e-mail list in the late '90s and never bothered to unsubscribe, or something like that.
I thought that Sailer had coined the term in the early 2000s, but evidently thatās not correct
The Wikipedia article on the Human Biodiversity Institute cites the term human biodiversity as becoming a euphemism for racism sometime in the late 90s and Marksā book is from 1995, so there was apparently a pretty quick turnover. Which makes me wonder if hijacking or if independent invention. The article has a lot of sources, so I might mine them to see if thereās a detailed timeline.
Every few years there is some new CS fad that people try to trick me into doing research in ā āalgorithmsā (my actual area), then quantum, then blockchain, then AI.
Wish this bubble would just fucking pop already.
This stuff feels like a DJ is cross-fading between the different hype cycles.
Follow up for this post from the other day.
Our DSO now greenlit the stupid Copilot integration because āMicrosoft said itās okayā (of course they did), and he also was on some stupid AI convention yesterday and whatever fucking happened there, heās become a complete AI bro and is now preaching the Gospel of Altman that everyone whoās not using AI will be obsolete in few years and we need to ADAPT OR DIE. Itās the exact same shit CEO is spewing.
He wants an AI that handles data security breaches by itself. He also now writes emails with ChatGPT even though just a week ago he was hating on people who did that. I sat with my fucking mouth open in that meeting and people asked me whether Iām okay (Iām not).
I need to get another job ASAP or I will go clinically insane.
Iām so sorry. the tech industry is shockingly good at finding people who are susceptible to conversion like your CEO and DSO and subjecting them to intense propaganda that unfortunately tends to work. for someone lower in the company like your DSO, thatās a conference where theyāll be subjected to induction techniques cribbed from cults and MLM schemes. I donāt know what they do to the executives ā I imagine it involves a variety of expensive favors, high levels of intoxication, and a variant of the same techniques yud used ā but it works instantly and produces someone who canāt be convinced theyāve been fed a lie until it ends up indisputably losing them a ton of money
Yeah, I assume thatās exactly what happened when CEO went to Silicon Valley to talk to āimportant peopleā. Despite being on a course to save money before, he dumped tens of thousands into AI infrastructure which hasnāt delivered anything so far and is suddenly very happy with sending people to AI workshops and conferences.
But Iām only half-surprised. Heās somewhat known for making weird decisions after talking to people who want to sell him something. This time itās gonna be totally different, of course.
The āimportant peopleā line is a huge part of how the grift works and makes tech media partially responsible. Legitimizing the grift rather than criticizing it makes it easy for sales folks to push āthe next big thing.ā And after all, donāt you want to be an important person?
He wants an AI that handles data security breaches by itself. He also now writes emails with ChatGPT
He is the data security breach.
E: Dropped a T. But hey, at least chatgpt uses SSL to communicate, so the databreach is now constrained to the ChatGPT trainingdata. So it isnāt that bad.
Itās the exact same shit CEO is spewing.
I have realized working at a corporation that a lot of employees will just mindlessly regurgitate the company message. And not in a āI guess this is what we have to work onā way, but as if it replaced whatever worldview they had previously.
Not quite sure what to make of this TBH.
Ugh, Iām sorry man. Thatās awful.
Behind the Bastards is starting a series about Yarvin today. Always appreciate it when they wander into our bailiwick!
Also means weāre likely to have a better jumping on point to explain these people to those who arenāt already here. Hope he does one on Yud and friends in the not too distant future.
They did come up in the Tech Bros Have Built a Cult Around AI episode.
They did do one on Yud, itās hard to find and has an annoying amount of side chatter but itās a pretty solid breakdown of the dude.
The episode is mentioned here: https://shatterzone.substack.com/p/rationalist-harry-potter-and-the
But I can no longer find it on YouTube.
Their episode on Rudolph Steiner was great when explaining to the grandparents why we had to pull our kids out of a Waldorf kindergarten asap. Funny how so many things fall into the trap of āIt canāt be that stupid, you must be explaining it wrong.ā
Also, big L for me on due diligence. I thought outdoor classrooms would be good for our fellow ADHD enjoyer; nope.
A lemmy-specific coiner today: https://awful.systems/post/2417754
The dilema of charging the users and a solution by integrating blockchain to fediverse
First, there will be a blockchain. There will be these cryptocurrencies:
This guy is speaking like he is in Genesis 1
I guess it would be better that only the instances can own instance-specific coins.
You guess alright? You mean that you have no idea what youāre saying.
if a user on lemmy.ee want to post on lemmy.world, then lemmy.ee have to pay 10 lemmy.world coin to lemmy.world
What will this solve? If 2 people respond to each otherās comments, the instance with the most valuable coin will win. What does that have to do with who caused the interaction?
Yes crypto instances, please all implement this and ādisallowā everyone else from interacting with you! I promise weāll be sad and not secretly happy and that youāll make lots of money from people wanting to interact with you.
I know I wonāt be secretly happy if they do this.
thatās lemm.ee last time iāve checked. he made that mistake 14x
1 post 6 comments joined 3 months ago, āiām naive to cryptoā āI want to host an instance that serves as a competitive alternative to Facebook/Threads/X to the users in my country,ā
yeah he doesnāt even have to charge for interacting with him iāll avoid him without it
Orange site on pager bombs in Lebanon:
If we try to do what we are best at here at HN, letās focus the discussion on the technical aspects of it.
It immediately reminded me of Stuxnet, which also from a technical perspective was quite interesting.
technical aspect seems to be for now that israeli secret services intercepted and sabotaged thousands of pagers to be distributed for hezbollah operatives, then blew them up all at once. it does look like small, reportedly less than 20g each explosive charge, but orange site accepted truth is that it was haxxorz blowing up lithium batteries. israelis already did exactly this thing but with phone in targeted assassination, and actual volume of such bomb would be tiny (about 10ml)
what we are best at here at HN
Itās always bootlicking with this crowd jfc
ābest atā, they say? I shall have to update my priors
If HN is best at technical discussion that just means theyāre even worse at everything else!
They suck at technical explanations too, unless itās a Wikipedia link.
My joke didnāt land apparently but I did not mean to imply they were particularly good at technical explanations. Adjusted the working a smidge.
so according to @liveuamap, the backstory here is that this is to get his name out of news about the WildBerries shooting in Moscow - where a battle for corporate control came down to gunshots - because he was backing one of the sides
Just discovered Patrick Boyleās channel. Deadpan sneer perfection https://www.youtube.com/watch?v=3jhTnk3TCtc
edit: tried to post invidious link but didnāt seem to work
his delivery regarding the content is absolute perfection
The only invidious instance that works this week is nadeko:
Despite Soatak explicitely warning users that posting his latest rant[1] to the more popular tech aggregators would lead to loss of karma and/or public ridicule, someone did just that on lobsters and provoked this mask-slippage[2]. (comment is in three paras, which I will subcomment on below)
Obligatory note that, speaking as a rationalist-tribe member, to a first approximation nobody in the community is actually interested in the Basilisk and hasnāt been for at least a decade. As far as I can tell, itās a meme that is exclusively kept alive by our detractors.
This is the Rationalist version of the village worthy complaining that everyone keeps bringing up that one time he fucked a goat.
Also, āthis sure looks like a religion to meā can be - and is - argued about any human social activity. Iām quite happy to see rationality in the company of, say, feminism and climate change.
Sure, āreligionā is on a sliding scale, but Big Yud-flavored Rationality ticks more of the boxes on the āReligion or notā checklist than feminism or climate change. In fact, treating the latter as a religion is often a way to denigrate them, and never used in good faith.
Finally, of course, it is very much not just rationalists who believe that AI represents an existential risk. We just got there twenty years early.
Citation very much needed, bub.
[1] https://soatok.blog/2024/09/18/the-continued-trajectory-of-idiocy-in-the-tech-industry/
[2] link and username witheld to protect the guilty. Suffice to say that They Are On My List.
nobody in the community is actually interested in the Basilisk
But you should, yall created an idea which some people do take seriously and it is causing them mental harm. In fact, Yud took it so seriously in a way that shows that he either beliefs in potential acausal blackmail himself, or that enough people in the community believe it that the idea would cause harm.
A community he created to help people think better. Which now has a mental minefield somewhere but because they want to look sane to outsiders now people donāt talk about it. (And also pretend that now mentally exploded people donāt exist). This is bad.
I get that we put them in a no-win situation, either take their own ideas seriously enough to talk about acausal blackmail. And then either help people by disproving the idea, or help people by going āthis part of our totally Rational way of thinking is actually toxic and radioactive and you should keep away from it (A bit like Hegel am I right(*))ā. Which makes them look a bit silly for taking it seriously (of which you could say who cares?), or a bit openly culty if they go with the secret knowledge route. Or they could pretend it never happened and never was a big deal and isnāt a big deal in an attempt to not look silly. Of course, we know what happened, and that it still is causing harm to a small group of (proto)-Rationalists. This option makes them look insecure, potentially dangerous, and weak to social pressure.
That they do the last one, while have also written a lot about acausal trading, which just shows they donāt take their own ideas that seriously. Or if it is an open secret to not talk openly about acausal trade due to acausal blackmail it is just more cult signs. You have to reach level 10 before they teach you about lord Xeno type stuff.
Anyway, I assume this is a bit of a problem for all communal worldbuilding projects, eventually somebody introduces a few ideas which have far reaching consequences for the roleplay but which people rather not have included. It gets worse when the non-larping outside then notices you and the first reaction is to pretend larping isnāt that important for your group because the incident was a bit embarrassing. Own the lightning bolt tennis ball, it is fine. (**)
*: I actually donāt know enough about philosophy to know if this joke is correct, so apologies if Hegel is not hated.
**: I admit, this joke was all a bit forced.
Obligatory note that, speaking as a rationalist-tribe member, to a first approximation nobody in the community is actually interested in the Basilisk and hasnāt been for at least a decade.
Sure, but that doesnāt change that the head EA guy wrote an OP-Ed for Time magazine that a nuclear holocaust is preferable to a world that has GPT-5 in it.
Oh, that craziness is orthodoxy (check the last part of the quote).
Finally, of course, it is very much not just rationalists who believe that AI represents an existential risk. We just got there twenty years early.
This one?
nobody in the community is actually interested in the Basilisk
except the ones still getting upset over it, but if we deny their existence as hard as possible they wonāt be there
The reference to the Basilisk was literally one sentence and not central to the post at all, but this big-R Rationalist couldnāt resist on singling it out and loudly proclaiming itās not relevant anymore. The mālady doth protest too much.
fuckin. when did Mozillaās twitter feed turn into wall to fucking wall AI spam https://x.com/mozilla
fucking Mozilla really is going all in on this whole āyou canāt trust AI, except when we and our business partners do itā openwashing thing completely unaware of how it looks, huh? like, theyāve pushed AI so hard and violated so much community trust in the process that I canāt imagine this is doing anything but costing them their remaining donors.
who is the investor who pushed Mozilla this hard? where the fuck is this coming from?
all their hiring is AI too
havenāt really had the headspace to dig into this but one of my hypotheticals about how this could come to pass is ānot enough counter-friction leftā. foundations of the guess are: years of ill-advised products, constant killing of worthwhile projects, creep of bayfucker mentality. that shape of thing
I recall seeing people ringing alarm bells about moz ceo pay like 3~4y ago
not that the above guess eliminates the thing youāre pointing to, mind you. I agree that this drive has to be coming from somewhere. my stuff was more coming at it from the āwhy has this suddenly accelerated so muchā angle
I recall seeing people ringing alarm bells about moz ceo pay like 3~4y ago
remember when bringing up Mozillaās financials would get you yelled at by people who needed to see them as a paragon of open source in spite of all evidence to the contrary?
my personal theory for why itās accelerating so much is, their board might be doing a Sears[1]. theyāre inventing ways to make Mozilla bankrupt because thereās profit in it, and that profit window might be closing rapidly with the antitrust actions against Google coming up. this is all based on vibes though, Iām the polar opposite of an accountant
[1] see also, doing a Red Lobster. no, endless shrimp isnāt why theyāre going bankrupt, why in fuck would it be, of course itās capitalists
For some reason, the news of Red Lobsterās bankruptcy seems like a long time ago. I would have sworn that I read this story about it before the solar eclipse.
Of course, the actual reasons Red Lobster is circling the drain are more complicated than a runaway shrimp promotion. Business Insiderās Emily Stewart explained the long pattern of bad financial decisions that spelled doom for the restaurantāthe worst of all being the divestment of Red Lobsterās property holdings in order to rent them back on punitive leases, adding massive overhead. (As Ray Kroc knows, youāre in the real estate business!) But after talking to many Red Lobster employees over the past monthāsome of whom were laid off without any notice last weekāwhat I can say with confidence is that the Endless Shrimp deal was hell on earth for the servers, cooks, and bussers whoāve been keeping Red Lobster afloat. They told me the deal was a fitting capstone to an iconic if deeply mediocre chain thatās been drifting out to sea for some time. [ā¦] āYou had groups coming in expecting to feed their whole family with one order of endless shrimp,ā Josie said. āI would get screamed at.ā She already had her share of Cheddar Bay Biscuit battle stories, but the shrimp was something else: āIt tops any customer service experience Iāve had. Some people are just a different type of stupid, and they all wander into Red Lobster.ā
Some people are just a different type of stupid, and they all wander into Red Lobster.
I dated someone who worked at Red Lobster, and that absolutely checks out. the number of people whoād come in hoping to grift free shit and take it out on the servers when they didnāt get it (or would try and get someone fired so they could get free shit, depending on the night) was astounding
remember when bringing up Mozillaās financials would get you yelled at by people who needed to see them as a paragon of open source in spite of all evidence to the contrary?
yup. absolutely nuts shit. I know thereās often a lament to lack of nuance in contemporary internet but god damn if there isnāt also a massive shortage of critical thinking skills and the ability to engage with criticism well
Oh, and I just saw this: https://mastodon.social/@stevetex/113162099798398758
theyāre really speedrunning this downslide, huh
Meanwhile, over at the orange site they discuss a browser hack: https://news.ycombinator.com/item?id=41597250 As in a hack that gave the attacker control over any user of this particular browser even if they only ever visited innocent websites, only needing to know their user ID.
This is whatās known in the biz as a company destroying level fuck-up. Iām not sure this is particularly sneerable or not but Iām just agog at how a company that calls themselves āThe Browser Companyā can get the basic browser security model so incredibly wrong.
from their Wikipedia page Iām starting to get why Iāve never previously heard of The Browser Companyās browser; itās about a year old, itās only for macOS, iOS, and Windows, and itās just a chromium fork with a Swift UI overtop and extremely boring features you can get with plugins on Firefox without risking getting your entire life compromised (til Mozilla decides thatās profitable, I suppose)
Arc is designed to be an āoperating system for the webā, and integrates standard browsing with Arcās own applications through the use of a sidebar. The browser is designed to be customisable and allows users to cosmetically change how they see specific websites.
oh fuck off. so what makes something an operating system is:
- the whole UI got condensed down into an awkward-looking sidebar that takes up more space instead of a top bar
- you can re-style websites (which is the feature that enabled this hack, and which must be one of the most common browser plugins)
- you can change the browserās UI color
- it can run āits own applicationsā? which sounds like a real security treat if theyāre running in the UI context of the browser. though to be honest I donāt see why these wouldnāt just be ordinary web apps, in which case itās just a PWA feature
Iām glad Iām not the only one who was āarc? whazzat?ā when this popped up in my feed. At first I thought it was Paul Grahamās wimpy Lisp.
ā¦Paul Grahamās wimpy Lisp.
a whisp if you will
Urbit, but somehow worse
Hm, I donāt really see the sneer. They wrote a nasty bug, got notified and had a patch out for it within 36h. The remediations look reasonable too: better privacy, less firebase, actual security audits; even the bounty program is probably the right call (but they result in so many shit reports, itās probably a wash).
I gotta admit Iām kind of partial to them and their browser? Itās the non-Brave one that ships with an Adblocker by default, has much nicer UI than the existing ones, and the sync thing isnāt half bad (if it doesnāt sync security badness to all your instances, ouch). Sure they sound like a cult but I guess thatās how browser dev gets funded since the 1990s.
OK I might have been a little too harsh, but the security requirements of a browser are higher than pretty much any other piece of software except perhaps for operating system code, emails, or text messages. As a serious player in the browser space it is not optional to get the basic security model / architecture right. This isnāt a matter of a bug slipping through (which can happen to anyone), but the system being designed wrong. Hopefully this company has learned their lesson, treats it with the care it deserves going forward, and bring some diversity to the browser market.
Anyway that said letās look at how this was a colossal bug:
- The browser required an account hosted on a cloud to use. This is a central point of failure, and cloud is overrated, so should be opt-in.
- The browser allowed arbitrary script injection into any webpage based on this cloud account. This is a central point of failure, and goes directly against browser security model so should be opt-in.
- The developers did not recognize how dangerous the above was, so perhaps did not treat the back-end with the paranoia it deserved.
Compare Firefox I have an extension that allows for arbitrary CSS injection, but this extension isnāt cloud based. So this class of vulnerability isnāt possible in the first place, and also it is an extension I opted into and can enable selectively on specific sites instead of globally.
