Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[hector13]

I am, funnily enough, neither a murderer or a drug dealer.

That's exactly what a murderer and drug dealer would say!

Damn you figured out I meant both I mean here take this *hands TV a white powder*

This isn't the White House!

It could be if you take this *hands EJ a little brown pill*

[Starver]

Whoops!

(I've made grevious typos myself, but sounds like that's a doozy...)

[martinuzz]

A Dutch guy, Johannes Zuurbier, has yet again sent a warning email to the US government.
He is the administrator for the Malinese domain, which ends with .ml

Now, the US military uses the domain .mil

According to Zuurbier, over the past few years, he has recieved over 1000 emails that were intended for internal US military communication, but that ended up at his email, because people forgot to type the i.

The emails include confidential information; tax reports, passwords, travel plans of high ranking officers...

He warned the US before but got no reply. He now tried again, because he is about to stop working as the administrator for the .ml domain, and the new administrator will be the Malinese government, which has good relations with Russia. He warns that he can no longer stop confidential emails from the US military from falling into the wrong hands.

[McTraveller]

Well that's silly anyway: email is not confidential.  Simply writing "confidential" on it, doesn't make it so.

I suppose perhaps if you are sending strongly-encrypted messages, then email could send confidential information, but if you're just sending plain-text confidential information via email... well that's a bigger problem than mis-typing the address in the TO: field.

For example: My work mandates an email client plugin that verifies the recipients are in your allowed list, and it will warn you at least two times if you try to send an email to someone not in that list.  You basically have to try to send an email to the wrong person.

[Starver]

I somehow got the idea that there was systematic misrouting (e.g. the typo was in various mail-handling scripts, not even directly accessible by service-users).

I'm actually strangely comforted that there are consciencious (or at least non-/dev/nulling) postmaster@s still out there. Twenty or thirty years ago I would regularly send the (copious) 419 emails I received on to the postmaster@ for the header-identifiable mediating sources (as sole owner of my own subdomain, I could indeed pick up things sent speculatively to <anything[1]>@mySubdomain.myISP.co.uk). I didn't get many actual replies[2], but I like to think that the respective admin/subordinate gained a benefit from my 'report'. I've long since stopped doing this[3], as Eternal September became Web2.0 and even (unrelated to the above) sending mail to the current contact address on the AppStore tends to often enough ellicit a "we don't monitor this address, please use Twitter/Facebook/log into our forums/etc to contact us" autoresponse. Which I don't feel is right, though I do understand why they might do that.

I actually admire this domain-admin[4]. Maybe the fact we know about it is a little rash (for various reasons) or even not entirely due to pure-heartedness, or indeed the true and faifhful culmination of never being actually listened to behind the scenes. Having had a mere taste of the great power/responsibility involved, I can definitely imagine being there, in that position, and technically better to do this than to wipe my hands and abdigate all responsibility from the off.



[1] Grossly outnumbering anything spammily sent to any name@ I actually 'published' out there for actual use. Clearly there was even then a tendncy to automatically probe with whatever@domain.one being merged with regardless@domain.two (or possibly some composite/procedural pre-@ names), just because it was an easy way to land on more 'private' and less outward going individuals' mailboxes that might yet be pysychologically unimmunised against such things.

[2] Occasionally something automated clearly set up as a spam-trap of its own, perhaps demanding an "I am not a bot" confirmation of some kind to allow delivery to continue to the genuine human-read mailbox.

[3] Save for "Hi, it's ISP here click on <obviousfakelinkISP@randombusiness-or-blogsite.obviousforeignTLD> regarding your bill/the imminent deletion of your email account", which I pack up and send to the publicised phishing@actual.ISP.domain address, when they arrive in various mailboxes I 'manage' or am asked to monitor. No replies for them, either, but the ISPs involved do(/did once?) say they invited such things. Presumably to know what to autofilter.

[4] Ok, so he also sounds just as much a 'details person' as I am, when I can be. And receiving actual clear 'leakage' from a .mil account is something I haven't had for a while[5], but I could see how you'd want to keep an eye out for such things wandering through 'my domain' if they did. No matter whether I thought my hat was white, black or some form of grey. Exactly which shade of hat he has resolved to wear, behind the scenes, would just be a matter of opportunism. The error(s) already having been made by others.

[5] I know someone who managed to 'gain' a .mil domain, back when we were both in university. Not sure how. But he was banned from the academic network (without direct supervision/escorting) for more local nephariousness

[Loud Whispers]

This causes physical pain

[Duuvian]

I learned from here

https://www.techdirt.com/2023/07/21/wyden-bill-targeting-data-broker-sales-to-law-enforcement-passes-in-the-house/

about this

https://www.wyden.senate.gov/news/press-releases/wyden-applauds-bipartisan-passage-of-his-fourth-amendment-is-not-for-sale-act-in-the-house-judiciary-committee

Spoiler (click to show/hide)

“The Fourth Amendment is Not For Sale Act will restore Americans’ Fourth Amendment rights and stop the government from using its credit card when it should be getting a warrant,” Wyden said. “Regular Americans who use their phones on a daily basis are not consenting to send all their movements, contacts and web browsing information to the government. I applaud the Judiciary Committee for advancing our bill on a bipartisan basis, and look forward to following suit in the Senate.

“In the coming weeks I plan to release a comprehensive surveillance reform bill, to be considered by Congress as it debates reauthorization of Section 702 of FISA, which will include essential elements of this bill, to ensure government agencies don’t buy their way around Americans’ Constitutional rights.”

Reps. Andy Biggs, R-Ariz., Ken Buck, R-Colo., Pramila Jayapal, D-Wash., Thomas Massie, R-Ky., and Sara Jacobs, D-Calif., also cosponsored the legislation in the House.

Big thumbs up. Wyden seems to generally know what he's doing when it comes to the subject of internet regulations. I haven't read the bill text yet.

[EuchreJack]

I haven't read the bill text yet.

Big mistake, generally.
But hey, if you don't see me edit this, maybe it's not horrible.

https://www.congress.gov/bill/117th-congress/senate-bill/1265

It's not horrible, just has loopholes. What a shock.  It'll probably have more before it passes.
It only covers data that the Government paid to acquire.  If a tech company voluntarily hands over info, and that disclosure does not violate a Privacy Policy or Term of Use, then the Government can still have and use the data.  And I think companies have been putting in language "we plan to assist law enforcement by giving them your data upon request".  And the Government probably won't be checking the Privacy Policies or Terms of Service, instead it will be a legal defense after someone is facing trial.

[Duuvian]

Thanks for the link EJ.

I think rather than being a loophole, it's related more to the limited (narrowly tailored) scope of the bill. It's not trying to regulate how or what data is collected by third parties, that would require a different narrowly written bill.

It seems to be more in line with cutting off routes of collecting information from those third parties (data brokers), I think effectively meaning it requires a warrant rather than a checkbook as the Wyden site said.

As to what you've mentioned of tech companies' ToS voluntarily handing over data upon request, I don't think tech companies would want to hand over customer data for no monies without specific reason and certainly not in bulk; see Apple about to leave the UK for example. I'd expect they may voluntarily report things to the government, just as you or I would be able to were that our choice however I am by no means sure of that and it's more of an assumption. In addition would those ToS be US specific? If not it's possible that they are writing a broadly applicable ToS to do business in more intrusive environs.

EDIT: Mixed up section on FISA and non FISA so I changed some stuff in the post, mainly by taking out the FISA stuff I had mistakenly posted. Essentially I applied the section regarding non-FISA permissable information collection on non-US persons and applied it to the whole bill and not just that section, until I pondered why that would apply and realized it did not.

[McTraveller]

Someone explain to me why pilots reject new contracts with 42% pay increases, or 30% pay increases, or the UPS folks are rejecting their contract and threatening strike (I wasn't able to see the terms they rejected in the very lazy search I conducted).  What are they being asked to give up (if anything) in exchange?

It's my understanding that the corporate overlords are offering pretty big headline pay increases - what's missing? Are they reasonably asking for stock instead of just pay? Is it benefits / pension?

I mean this seems to perpetuate the divide in the US between "labor and management" - I mean yes I see the "these companies are making millions in profit - we should see some of that" - but don't you have to be careful in the balance of how much of that is profit sharing versus wage increase? Is the high profit due to circumstantial changes, or is it a new baseline?  Isn't forcing a company to commit to higher wages than they can reasonably expect to sustain a losing proposition in the long run?

[Frumple]

Usually when you see something like that, it's because the ground conditions are absolute shit in some way or another and the pay increase doesn't -- can't, because jacking the remuneration when conditions are shit often just increases employee churn to the detriment of everyone involved, as people get paid enough to get out even faster, leaving the people effected constantly losing expertise -- actually offset that.

Other times, the pay was so shit a 30% increase or whatever still leaves them well below equivalent positions, or it's still well below the equivalent raise in value the position(s) in question have provided the company, or any pile of things like that.

You can be pretty well assured that if the folks involved are rejecting significant pay increases, they're doing it for damn good reason. What looks substantial from an outside perspective is often woefully inadequate in practice, and employers are well damn aware of that.

[JoshuaFH]

From what I've personally experienced, companies are willing to shoot themselves in the foot and lose valuable talent if it means they can perpetuate the plutocratic culture where they feel entitled to simply treat people like shit unconditionally and never budge whatsoever. They know that losing ground and being forced to treat people like how they deserve to be treated is a slippery slope that legitimately threatens the otherwise unassailable wealth of the 1%.

[Lord Shonus]

Someone explain to me why pilots reject new contracts with 42% pay increases, or 30% pay increases, or the UPS folks are rejecting their contract and threatening strike (I wasn't able to see the terms they rejected in the very lazy search I conducted).  What are they being asked to give up (if anything) in exchange?

It's my understanding that the corporate overlords are offering pretty big headline pay increases - what's missing? Are they reasonably asking for stock instead of just pay? Is it benefits / pension?

If you're offered 42% higher pay, but costs of living have gone up 23%, your workload has gone up 200%, and corporate profits are up almost 400%, it is a really shitty offer. That's why so many companies trumpet their impressive-sounding figures, because they count on lots of people going "oh that seems so reasonable!!" and pressuring the unions to bend over and assume the position.

That's assuming that pay is the only contention. UPS in particular is demanding money be spent to improve the working conditions at their various facilities (many of which are extremely run-down and desperately in need of repair), better measures taken to deal with the increasing heat problems in trucks and hubs, a ban on excessive mandatory overtime, and a host of other long-standing problems.

[Micro102]

It also seems like UPS doesn't want to install air conditioners in their trucks while we are experiencing record high, literally lethal temperatures/humidity.

[Egan_BW]

Oh yeah. AC in vehicles is an absolute requirement in heat like this.