madsen @ madsen @lemmy.world

Posts

1

Comments

94

Joined

2 yr. ago

Great. I'm looking forward to hearing all the Apple zealots change their tune on side-loading from "iOS is more secure because it doesn't allow side-loading " to "side-loading is amazing, I'm so glad Apple invented it!"

It's most likely resembling NSA code because it's using EternalBlue which was leaked back in 2017 by ShadowBrokers. The title of the article is misleading/click-baity. (No offense to the OP, I know you just used the title from the article.)

With that little, they may be able to recreate the timbre of someone's voice, but speech carries a multitude of other identifiers and idiosyncrasies that they're unlikely to get with that little audio, like personal vocabulary (we don't choose the same words and phrasings for things), specific pronunciations (e.g. "library" vs "libary"), voice inflections, etc. Obviously, the more training data you have, the better the output.

From the article:

What sets Insanet’s Sherlock apart from Pegasus is its exploitation of ad networks rather than vulnerabilities in phones. A Sherlock user creates an ad campaign that narrowly focuses on the target’s demographic and location, and places a spyware-laden ad with an ad exchange. Once the ad is served to a web page that the target views, the spyware is secretly installed on the target’s phone or computer.

If they're using ads on a web page to install spyware, then they're most definitely exploiting vulnerabilities—unless they're showing the user a 'do you want to install XYZ?', in which case this isn't newsworthy at all. Ads aren't some magical thing that can just go around installing shit silently, so I don't know wtf the article is going on about, but it doesn't make sense.

Edit: The Register seems to have a more sensible take on it: https://www.theregister.com/2023/09/16/insanet_spyware/

You're right. The consequences should be more akin to the consequences Saudi Arabia felt for murdering Khashoggi---oh, wait...

I keep hearing "exploited in the wild", but does anyone have anything concrete on it — like, IoCs, PoC, victims ... anything?

LMAO. The story will probably be that USB-C was barely being used until Apple wisely decided to start using it and the rest of the world followed suit.

The domain is mentioned in the article.

I agree, however, the domain had apparently expired (according to the article), which makes it a great deal harder to fix reasonably fast. I still think issuing a statement that they'd lost control of the domain would suffice, but no, apparently wasting food is better for the bottom line.

The response from OpenAI, and the likes of Google, Meta, and Microsoft, has mostly been to stop disclosing what data their AI models are trained on.

That's really the biggest problem, IMO. I don't really care whether it's trained on copyrighted material or not, but I do want it to "cite its sources", so to speak.

Downgraded my new desktop computer from Win11 to Win10 this weekend. Still considering if I shouldn't just go back to Linux now that Valve has made gaming on Linux viable...

Oh, this is great... And because the ChatGPT transcript is highly ranked on Google, it's almost certainly going to be used for training ChatGPT. A feedback loop of shitty information. Praise ChatGPT!

I'm pretty sure it's available on GOG. I bought it some years back because it looked interesting but I never got around to actually playing it. I'll have to give it a go.

For those that want to pay tribute to Bram, I suggest donating to ICCF, which is the charity that has also been mentioned in Vim's splash screen since the very beginning (see also: :help iccf in Vim/Neovim). I'm kinda embarrassed that I never got around to it before — I've been using Vim/Neovim for more than two decades!

It'd work in Vim too, at least after being given a range. :% s/needle/replacement/

For me IRC scores points on not having push notifications, rich text, custom emojis, embedded images/video, etc. It's plain text communication — multiplayer notepad, if you will — and it's great at what it does. I love that I don't need anything but a terminal window for utilizing the full capabilities of IRC, and the lack of persistent chat history is a great counter to FOMO. (Yeah, you can stay online or have a bot that logs everything — the point is that most people don't.)

A little more info in the title than just the CVE number would make these posts a lot more useful.

As I said, I skimmed through it and wasn't sure exactly what I was looking for.

Thanks!

I've skimmed through the whole thing, but I'm unsure what you're referring to. A little help, please?