@paco @BenAveling it is just a stupid electronic device

[phaysis@mastodon.coffee]

@paco Zach and Miri's Eternal Porno

[deafferret@flyovercountry.social]

@paco

Now people who know very little in a domain feel like they can skip learning that domain and just make a personal tool with an LLM that will meet their needs.

That's what I do with 99% of the objects in my life? Everyone does? I have almost zero knowledge of how my clothes and car and house and prescription drugs are manufactured. I just use them and focus on what I happen to do for a job (computer programming).

[paco@infosec.exchange]

@deafferret I think you missed the point. You don’t MAKE car, house, clothes, or drugs. And you don’t think you can, either. You use the ones others make.

But people think they can use an LLM to make software, when they’ve never done that before. And not just any software, but software in a domain where they have only cursory knowledge.

Like a person who has never designed a game and has never made a mobile app (and maybe has never written code at all) thinks they can use an LLM to make a mobile game.

If you said you could use an LLM to make your own prescription drugs, when you’re a software developer by trade, then you’d be like these non-programmers who think they can write software now that they have an LLM.

[johnjburnsiii@kzoo.to]

@paco

Does "productive work" also mean: accurate work?

[tg_esq@mastodon.online]

@paco
Bluesky asked me to give my ID information and documents to a third party provider when Australia introduced its under-16 ban a month or two ago.

I deleted Bluesky.

[sinux@piaille.fr]

@elaine @paco how is it winning if you have to rely on the G.A.F.A.M.? That's against the ideology a lot of Linux users agree with.
But yeah, I agree with you that it should be a client-side standard (if possible) that would not use third-party online services and break privacy.

[troed@swecyb.com]

@paco No one should let anyone get away with "third party". Your subcontractor - you own it, just as if it had been your own employees. Don't like it? Don't outsource your responsibilities.

[theorangetheme@en.osm.town]

@paco Yet another reason in the litany of reasons I refuse to join Discord. People need to like... stop... using it.

[retrosponge@kind.social]

@paco Fucking hell

[michael@westergaard.social]

No they didn’t. They did their own age verification and stored images of passports in Zendesk (iirc, or some other support desk software). Discord acted completely irresponsibly and discord NEEDS age verification due to their young target audience and child enthusiast problem. I agree with your point, but your representation of what happened at Discord is entirely wrong.

[michael@westergaard.social]

Yes, I remembered correctly: it was zendesk. youtube.com/watch?v=GbXATeFfkRA

[damiano_chech@techhub.social]

@paco Damn, this is both hilarious and terrifying. 70,000 people handed over their documents so Discord could “verify their age,” and now all those files are just floating around the internet. Does anyone really think this is safe?

[tuxonbike@norden.social]

@paco “At Discord, protecting the privacy and security of our users is a top priority.” says the service without e2ee for direct messages.

[elbeetoots@mastodon.nl]

@paco Well, you know, at least that company knows how to NOT safely store sensitive personal data...

[rolfbly@mastodon.social]

@theorangetheme @paco

I had to ask something on a discord forum about this app I use.

The tone of voice is of teens on the loose.

While it's ok & just fine to be a teen on the loose (I've been one myself, and looking back I firmly believe it's a fundamental human right to do really dumb things), COMMA, it's, well, a state of mind I left behind. Mostly. I think. I hope.

[ki@chaos.social]

@elaine @paco
So... your idea of data security is to give even more user data to these companies with too much power that we'd love to burn to the ground? (metaphorically) The very same companies that feed every piece of data they can get their hands on into LLMs?

[f4grx@chaos.social]

@TG_Esq @paco way to go!

[paco@infosec.exchange]

@kerfuffle Is it worth highlighting? I mean, admitting that it happened is surely the lowest possible expectation. Do we pat them on the back and give them a participation trophy? In some jurisdictions, this disclosure is mandated by law (which is why these laws are good). Is it worth mentioning that they chose to do what the law said they must?

[paco@infosec.exchange]

@michael Was it Zendesk? Someone else replied that it was 5CA and sent this link

Holding statement regarding Security Incident

We are aware of a recent security incident. Learn how 5CA is responding and protecting client and community data.

5CA (5ca.com)

The phrase “our vendor used to review age-related appeals” in the discord disclosure made it sound like the vendor did the appeals. So maybe discord did the initial verification, but this vendor was doing more than just storing images.

[curiously@mastodon.au]

@paco inevitable.
Too good a target of course this happened and will keep happening. Waiting for the big one that makes photo ID worthless.