Jonkman Microblog
  • Login
Show Navigation
  • Public

    • Public
    • Network
    • Groups
    • Popular
    • People

Notices by Hattie Cat (hattiecat@shitposter.club), page 23

  1. Oneesan succubus (lain@pleroma.soykaf.com)'s status on Tuesday, 27-Mar-2018 16:57:19 EDT Oneesan succubus Oneesan succubus
    • Taiz
    @taiz tfw i think 48mb for a hello world rails app is supposed to be a lot
    In conversation Tuesday, 27-Mar-2018 16:57:19 EDT from pleroma.soykaf.com permalink Repeated by hattiecat
  2. Hattie Cat (hattiecat@shitposter.club)'s status on Monday, 26-Mar-2018 05:43:01 EDT Hattie Cat Hattie Cat
    Taking a break from FORTRAN. MATLAB and python - now back to... Erlang!
    In conversation Monday, 26-Mar-2018 05:43:01 EDT from shitposter.club permalink
  3. Hattie Cat (hattiecat@shitposter.club)'s status on Saturday, 24-Mar-2018 18:59:45 EDT Hattie Cat Hattie Cat
    【メモ】   Updating debian over tor:
    # apt-get install apt-transport-tor
    In /etc/apt/sources.list, replace 'http' with 'tor+http'
    In conversation Saturday, 24-Mar-2018 18:59:45 EDT from shitposter.club permalink
  4. Hattie Cat (hattiecat@shitposter.club)'s status on Saturday, 24-Mar-2018 18:52:10 EDT Hattie Cat Hattie Cat
    • Annah
    • Bob Mottram 🔧 ☕ ✅
    @bob @maiyannah @purplehippo who just happen to inject huge sums into Tory party funds and bestow newspaper editorships on Tory ex-Chancellors (George "six jobs" Osborne) to run as their personal vendetta rags. (Lebedev)
    In conversation Saturday, 24-Mar-2018 18:52:10 EDT from shitposter.club permalink
  5. Hattie Cat (hattiecat@shitposter.club)'s status on Saturday, 24-Mar-2018 18:50:12 EDT Hattie Cat Hattie Cat
    • Annah
    • Bob Mottram 🔧 ☕ ✅
    @purplehippo @maiyannah @bob But, oh look, they're letting women drive now! (Can you spell 'distraction' children?)
    In conversation Saturday, 24-Mar-2018 18:50:12 EDT from shitposter.club permalink
  6. Hattie Cat (hattiecat@shitposter.club)'s status on Saturday, 24-Mar-2018 18:40:12 EDT Hattie Cat Hattie Cat
    in reply to
    • Annah
    • Bob Mottram 🔧 ☕ ✅
    • Hattie Cat
    @maiyannah @purplehippo @bob Also the careful use of language by BBC and much MSM. Governments hostile to western interests are "régimes", while despotic governments who are our allies are "governments". 
    In conversation Saturday, 24-Mar-2018 18:40:12 EDT from shitposter.club permalink
  7. Hattie Cat (hattiecat@shitposter.club)'s status on Saturday, 24-Mar-2018 18:26:31 EDT Hattie Cat Hattie Cat
    • Annah
    • Bob Mottram 🔧 ☕ ✅
    @bob @maiyannah @purplehippo Preach. BBC News is very careful propaganda, typically by omission - it often gives "facts" without sufficient context or background (e.g. NHS winter crisis - doesn't address *why* the NHS is suffering a winter crisis). Yemen reporting gives no mention of the fact that the Saudi government is UK/US-backed. Syria reporting gives no mention of the fact that anti-Assad "resistance fighters" are often radical islamists backed up by Western arms and training. Or it just repeats government propaganda without question. I could go on.
    In conversation Saturday, 24-Mar-2018 18:26:31 EDT from shitposter.club permalink
  8. Hattie Cat (hattiecat@shitposter.club)'s status on Saturday, 24-Mar-2018 18:15:50 EDT Hattie Cat Hattie Cat
    Old (2008) but a good anecdote - software project from hell https://projectfailures.wordpress.com/2008/06/24/project-from-hell/
    In conversation Saturday, 24-Mar-2018 18:15:50 EDT from shitposter.club permalink

    Attachments

    1. Invalid filename.
      Project from Hell
      By nicolas314 from Project Failures

      A few years ago, I was hired to work as a consultant on a software project for a large French tech company. What I have witnessed there is beyond everything I could possibly have imagined in terms of software engineering. Far more serious than just a lack of professional competence was the utmost contempt for human dignity which at some point made me compare the whole experience to (what I imagine can be) jail. What I relate here is a selected list of topics that should illustrate my point, but check out by yourself.

      Scope

      Develop a piece of software for a government agency.
      Complexity is about the same as Windows Paint with a few twists.
      Not kidding.

      Government pays a few million Euros upfront, development is scheduled for two to three years. Company hires a couple of developers to start the job, and keeps doubling team size every 3 months or so as cash starts flowing in.

      7 years later, the project is still not in any decent shape.  Penalties are running in several thousand Euros per day.  Management decides to reduce costs and fires all experimented people, hires people with little or no software experience.

      10 years later, given the disastrous state of the project, middle-management decides to hire some people with software engineering experience to get back on tracks. Average turn-over for the newcomers: 3 months, the legal time to leave your job in France.

      12 years later, the project is still active. The company recovers daily penalties by billing ever-increasing change requests to the government. The year is 2008.

      Figures

      • 6 million lines of code
      • C++ based
      • 50,000+ classes
      • C++ flavour in use is obsolete, locked into compiler version, which is only distributed with one (unmaintained) Operating System.
      • CORBA-based
      • Database software from a company gone bankrupt
      • Several layers on top of each other to handle the Graphical User Interface, none of which actually maintained by the authors.
      • Build takes 48 hours on 32 parallel machines.
      • 40 to 50 simultaneous processes needed to run one User Interface
      • No dynamic library linking: executable sizes in the range of several hundred megabytes
      • Startup time is about 15 minutes
      • Mean time between crashes: 30 seconds to 30 minutes

      No software engineer will tell you that C++ is an easy language.  In fact, it is probably one of the worst computer languages in terms of complexity. It is actually so complex that even its creators admit that they still do not master all of it. See a famous spoof Stroustrup interview here:
      http://www-users.cs.york.ac.uk/~susan/joke/cpp.htm

      Faced with such an incredible maze of bottomless complexity, people tend to react in a different way. The geek wannabees have all heard about C++ and want to show that they can do it too.  They dive into it without fear and get maimed beyond recognition, spending countless hours trying to figure out how a pageful of gobbledygook crashes endlessly without apparent reason.  People with more sense quickly turn to other languages and other projects. Life is too short.

      Maintaining a large body of software in any language is a hard task. Imagine a team having to maintain 6 MILLION LINES of code and you get an idea of how far insanity can reach in the realm of software engineering. 6 million is a big number: if you wanted to read all the lines quickly at one per second, you would spend about seventy days non-stop in front of your screen.

      Just to give you a taste, here are two anecdotes:

      One developer was given the task of checking why right-clicking on the interface completely froze the application. After several days of careful examination and incredible amounts of patience, he found out that right-clicking worked fine, only that it took about 45 minutes for the context menu to popup. Menus were all dynamically generated from huge (static!) content every time you right-clicked the main window.

      At some point end-users reported that “Load data from CD-ROM” did not work at all. This one took several weeks to sort out, but in the end the bug report was flagged as ‘already solved’, because data were indeed being loaded. The only point was that it took 7 straight days for 700 MBytes to get in. Patience is a virtue.

      Version Control gone wild

      It took several years until one bright guy in the team came up with the idea of using version control tools. First attempt was not convincing, so the team switched to another system, then another a couple of years later, losing all history with each change.

      The tool that was finally chosen is a disaster with a graphical user interface, an abomination coming directly from Sweden. A team of four people is actually dedicated full-time to performing most maintenance issues on the version control software, which gives things like:

      • Doing a first checkout requires taking an appointment with the version control team, usually granted a week later.
      • Editing files is not permitted without authorization from middle management. You have to tell your manager in advance which files you want to edit, then send an official permission request which gets filed with the version control team who may take action within a couple of days.
      • Every modification of the code triggers branching, which means you have to merge back all modifications you receive. With so many files in store you may think that two people working on the same file would be rare, but it turned out that most work happened within the same 100 files or so.
      • Check-in needs to go through a painful procedure whereby your code is reviewed by automagic bug-detecting software and eventually by middle management. Needless to say, this does not prevent bugs from creeping in faster than developers can remove them. A closer look at the number of registered bugs showed that every defect correction brought in twice as many bugs as it corrected.
      • Versioning is simple. Old software is version 1, today’s software is version 2, software in the future is version 3.  Nobody can actually tell which version has been delivered to the customer.

      At some point, an official delivery was scheduled, totally independent from any kind of planning set within the team. When the day came, the customer was actually sent a blank CD with installation instructions because nobody had been able to build the software in weeks. The customer found out they had been delivered a blank CD, officially complained, and was given an old version to replace the previous delivery. They found out because the displayed date in the “About” box was the same as last year.

      Peopleware

      Pay peanuts, get monkeys.

      With a large number of people without any software engineering experience, is it really a surprise that bugs keep creeping in in vast numbers? A really bright manager must have realized that human costs were the main source of cost in a pure software project. Not at all deterred by this extraordinary discovery, he decided to fire all people with any kind of experience but keep all managers in. It was not uncommon to see “C++ for dummies” on many people’s desks.

      Meet the Team

      55 people in the team: 20 developers, 35 managers.
      That’s right: more managers than actual developpers.
      Managers keep organizing meetings where they show the same PowerPoint presentation over and over ad nauseam, while developers kill time by chatting in the vast open-space office.
      Few managers have any experience with software engineering. At that time SCO was suing IBM about Linux. Even if the whole thing was a bluff, it really worked with such people who all understood that they had to pay soon for Free Software.  None of them ever mentions ‘Software Libre’, but they all know about ‘Software Gratuit’. Needless to say, the project is peppered with GNU libraries all over the place and these guys have absolutely no idea this turns the whole thing into a vast unshared GNU-compliant project. But hey, given the abysmal quality of this thing, nobody will ever insist that they release the sources.

      Technical knowledge is low. Few people know about Internet, those who do think it is only made for porn. Mentioning you have seen something on the Internet brings you winks and smiles.

      Welcome to Hell

      The whole experience could have been funny if the top management had not decided to behave like nazis in a concentration camp. Just to give some examples:

      • It is forbidden to come to work after 9am. One day, the site manager stayed behind the main gates and fired on the spot every person who came in after 9.01am, including a number of managers and sales.
      • Smokers take more pauses so produce less. Management tried to force everybody to stop smoking by coercion. Did not work.
      • Coffee machines are regularly out of order for several days. Somebody who drinks coffee is less productive than somebody sitting at his desk, typing away precious lines of code.
      • The same coffee machines are switched off whenever officials come to visit the site, to give the impression that everybody is at work.
      • Toilets are the most disgusting I have ever seen. The idea is probably to increase productivity: spend less time in the loo, you work more (and better).

      You are probably wondering now why people kept coming to work in such an environment. The first and main reason was the deep economy crisis France was going through at that time (and still is today, to a certain extent).  Having a job and a salary was considered a privilege, no matter what conditions were attached.

      Another reason was that for many, this contract was the first they ever got with a real company. Without any reference it is impossible to gauge how much your job sucks. Most beginners thought it was perfectly normal to be forced to be there at 9am sharp or be fired, when absolutely nothing imposed such a constraint except the sick mind of a manager.
      As to how a government can let such things happen: we all know how it works. The guys in charge of budget at the ministery are pals with the top-management in a number of companies. In a country like France, corruption is not uncommon at that level, goes mostly undiscovered and is rarely prosecuted. Apparently this is not reserved to France. I have heard the same stories a little bit everywhere in Europe and the US.

      Next time you think your job sucks, think again.

      Relevant sites:

      • Anatomy of a runaway IT project
      • The daily WTF
  9. Hattie Cat (hattiecat@shitposter.club)'s status on Thursday, 22-Mar-2018 18:20:18 EDT Hattie Cat Hattie Cat
    in reply to
    • Hattie Cat
    All the more reason for using F-Droid.
    In conversation Thursday, 22-Mar-2018 18:20:18 EDT from shitposter.club permalink
  10. Hattie Cat (hattiecat@shitposter.club)'s status on Thursday, 22-Mar-2018 18:19:22 EDT Hattie Cat Hattie Cat
    RT 82% of mobile (Android) apps send PII to at least on ad tracking service, and many send to more than one. What data is being leaked and where does it go?   https://shitposter.club/url/1680375
    In conversation Thursday, 22-Mar-2018 18:19:22 EDT from shitposter.club permalink

    Attachments

    1. Invalid filename.
      Apps, trackers, privacy, and regulators: a global study of the mobile tracking ecosystem
      By adriancolyer from the morning paper

      Apps, trackers, privacy, and regulators: a global study of the mobile tracking ecosystem Razaghpanah et al., NDSS’18

      Sadly you probably won’t be surprised to learn that this study reveals user tracking is widespread within the mobile app (Android) ecosystem. The focus is on third-party services included in apps, identified by the network domains they try to connect to. These services typically operate in the background, inheriting the permissions of the apps in which they are embedded, and offer no visual clue within the app as to what is happening.

      In this work, we focus on studying third-party services whose main function relies on collecting tracking information from users, which we henceforth refer to as Advertising and Tracking Services (ATS).

      The data collected by such services mostly ends up in the hands of data brokers and exchanges where it is sold. Want to buy data for people who have visited weather.com on a mobile device in the last 30 days? Go ahead…

      While there are regulations, such as the Children’s Online Privacy Protection Act (COPPA) in the United States, and the forthcoming GDPR in the EU, to date these seem to have had little effect in curbing practices. For example, “there are still countless examples of games and children’s apps that use third party services collecting tracking data without parental consent.”

      Overall, the authors conclude that…

      … a small number of companies have a monopoly on controlling a large portion of the ecosystem and they have the ability to track users and share the tracking data with other entities, all with little to no transparency.

      Since this is a study of the Android app ecosystem, you might think that e.g., Google could enforce stricter rules in the Play store to clamp down on this behaviour. However, with no further comment I leave you with Figure 4 from the paper, showing the companies that are the major perpetrators and beneficiaries of ATS-related services.

      We find that Alphabet has penetration in over 73% of all our measured apps with ownership of only 3.6% of all ATS and ATS-C service. Facebook — known by average users for providing social networking services — has ATS presence in over 31% of all measured apps while owning only 0.35% of all ATS and ATS-C services through the Facebook Graph API.

      (ATS-C in the above stands for Advertising and Tracking Services Capable. These are domains that collect tracking information, but have a primary purpose other than specifically providing ads and analytics).

      To collect the data for the study, the authors rely on a user base voluntarily installing the Lumen Privacy Monitor app (previously called Haystack, and available at https://www.haystack.mobi). Data was collected from about 11,000 users. If ever you see a vendor, especially a vendor whose business is tracking people for the purposes of serving advertisements, offering a VPN “for your own protection,” you would do well to be wary:

      Lumen works by leveraging the Android VPN permission to capture and analyze network traffic, including encrypted flows, locally on the device and in user-space. Lumen inserts itself as a middleware between apps and the network interface… It runs locally on the device and intercepts all network traffic — both over WiFi and the mobile network — without requiring root permissions… The use of the VPN permission to analyze app traffic on user-space is not novel.

      The overall data collected by Lumen (as of August 2017) contains the ports, origin application, destination domain, requested app permissions, IP address, TLS-handshake information, and the types of unique identifiers leaked by over 8.5M flows from 14,599 apps to 40,553 unique fully-qualified domain names and 13,453 unique second level domains. (All gathered with explicit consent).

      Any third party library, even ATS-C libraries whose primary purpose is not providing advertising and tracking services, can piggyback app permissions to access UIDs — or any other permission protected data — or obtain them via side-channels (without user consent) to track the use activities across different apps on the same device.

      The team use a combination of classification, manual inspection, and known ATS domains to classify the third-party domains that libraries were connecting to.

      Key findings

      The authors identified 2,552 different domains harvesting one or more of the UIDs from the following table, including 223 domains previously unknown to be ATS domains:

      We find that third-party domains, representing only 20.0% of all domains, are responsible for a disproportionate fraction (39.9%) of all UID harvesting… The most common value harvested by ATSes is the semi-persistent Android ID. Interestingly the Android ID is also collected by ATS-C domains along with at least one persistent UID in 34% of cases. In addition to making it possible for ATS-C services to persistently track a user, this behaviour contradicts Android’s developer policy center guidelines which state that the Android ID should not be associated with any other personally-identifiable information.

      The IMEI, a persistent value uniquely identifying a mobile device, is the fourth most commonly harvested UID, and disproportionately gathered by ATS and ATS-C domains.

      16 of the 20 most pervasive ATS and ATS-C domains are owned by Alphabet:

      Applications are not happy to leak information just to one third party though. 82% of apps connect to at least one ATS domain (75% to at least one ATS-C domain), and 29% connect to at least five ATS domains (29% connect to at least five ATS-C domains also). Games and educational apps turn out to be the worst offenders.

      What starts on mobile doesn’t stay on mobile. 39% of all identified ATSes are also present as third-parties in Alexa Top 1000 websites.

      The ability to perform cross-device tracking would allow them to link mobile app and Web usage behavior and possibly reveal a very privacy-invasive insight into an individual’s virtual and real-world habits.

      Regulatory impact

      An analysis of the publicly available privacy policy information for the 10 most dominant ATS providers shows that with the exception of Alphabet and Facebook, all of them happily admit to sharing your data with third-parties. “Therefore, developers who use services provided by these organizations provide a gateway for more third-party organizations to track their users.”

      When we look at where the users are, and where the ATS services are, we can monitor the flow of tracking information across borders and jurisdictions. The United States hosts over 40% of all ATS servers, and those servers are at the terminating end of 73% of all ATS-related flows. Over 50% of all cross-border ATS traffic ends up in the United States.

      We also find that even users from countries with strong consumer and privacy protection laws (e.g., Switzerland, Germany, and Spain) have sizable fractions of ATS-related traffic flowing into nations with weaker regulatory frameworks. Such trans-national flow of data makes it unclear which privacy and consumer protection laws are applicable to ATS-related data.

      With regards to the EU in particular (and the forthcoming GDPR legislation), we can clearly see services hosted in the United States busily harvesting PII out of Europe:

      We hope that our findings will spark and inform more public discourse and result in stronger regulatory frameworks to protect user privacy.

  11. Hattie Cat (hattiecat@shitposter.club)'s status on Thursday, 22-Mar-2018 18:15:12 EDT Hattie Cat Hattie Cat
    Protip. Avoid using the "native" app for any social media platform if at all possible. They tend to gather all the data they can and leak it back to the mothership.
    In conversation Thursday, 22-Mar-2018 18:15:12 EDT from shitposter.club permalink
  12. Hattie Cat (hattiecat@shitposter.club)'s status on Thursday, 22-Mar-2018 18:13:17 EDT Hattie Cat Hattie Cat
    Back when I had a Facebook account and their messaging system was still open, I wrote an XMPP client that simply monitored people logging onto and off FB. I realized I could infer what people's daily rhythms were, what timezone they were in. Needless to say I never used FB messenger, and never used the native FB app either.
    In conversation Thursday, 22-Mar-2018 18:13:17 EDT from shitposter.club permalink
  13. Hattie Cat (hattiecat@shitposter.club)'s status on Thursday, 22-Mar-2018 18:01:38 EDT Hattie Cat Hattie Cat
    in reply to
    • Dolus
    • Mister M. T. Sack
    @thatbrickster @dolus Surprised the government hasn't changed all those posters at Heathrow that say "welcome" to saying "fuck off".
    In conversation Thursday, 22-Mar-2018 18:01:38 EDT from shitposter.club permalink
  14. kaniini (kaniini@pleroma.dereferenced.org)'s status on Thursday, 22-Mar-2018 16:21:03 EDT kaniini kaniini
    Mastodon: "We'll protect you from Cambridge Analytica and Palantir!"

    meanwhile they are using the same big data search engine that Cambridge Analytica and Palantir use 🤔
    In conversation Thursday, 22-Mar-2018 16:21:03 EDT from pleroma.dereferenced.org permalink Repeated by hattiecat
  • After
  • Before
  • Help
  • About
  • FAQ
  • TOS
  • Privacy
  • Source
  • Version
  • Contact

Jonkman Microblog is a social network, courtesy of SOBAC Microcomputer Services. It runs on GNU social, version 1.2.0-beta5, available under the GNU Affero General Public License.

Creative Commons Attribution 3.0 All Jonkman Microblog content and data are available under the Creative Commons Attribution 3.0 license.

Switch to desktop site layout.