I am not, in fact, your music library

Dear Lazyweb, any idea what bullshit Chrome extension keeps trying to load URLs on my site of the form:
/user/DNA_lounge/library/music/Ryoji+Ikeda
/user/DNA_lounge/library/music/She+Wants+Revenge
/user/DNA_lounge/library/music/Elefant/_/Bokkie
/user/DNA_lounge/library/music/Interpol/_/Slow+Hands
/user/DNA_lounge/library/music/Alva+Noto
/user/DNA_lounge/listening-report/week
/user/DNA_lounge/listening-report/year
/user/DNA_lounge/listening-report/week
/user/DNA_lounge/obsessions

I don't think this is a botnet, but maybe it is? I'm getting a ton of them from (possibly) otherwise legit-seeming IPs reporting plausible and modern Windows Chrome user agents, so I'm hesitant to just fail2ban them all.

Is that what Spotify URLs are shaped like? This is a question that no search engine can answer.

Previously, previously.

Tags: , , , , ,

Today in "Finding Out"

eBay to Pay $3 Million in Connection with Corporate Cyberstalking Campaign:

eBay was charged criminally with two counts of stalking through interstate travel, two counts of stalking through electronic communications services, one count of witness tampering and one count of obstruction of justice and has entered into a deferred prosecution agreement. Pursuant to the agreement, eBay admitted to a detailed recitation of all the relevant facts about its conduct and agreed to pay a criminal penalty of $3 million, which is the statutory maximum fine for these six felony offenses.

Previously: eBay exec gets 5 years for sending spiders and cockroaches to online critics. "I can't believe that rich white fratboys would do something like this", says prosecutor.

The seven convicted eBay employees and contractors include Baugh, who was sentenced to 57 months in prison in September 2022; David Harville, former Director of Global Resiliency, who was sentenced to 24 months in prison in September 2022; Stephanie Popp, former Senior Manager of Global Intelligence, who was sentenced to 12 months in prison in October 2022; Philip Cooke, a former Senior Manager of Security Operations, who was sentenced to 18 months in prison and 12 months of home confinement in July 2021; Stephanie Stockwell and Veronica Zea, a former Manager of Global Intelligence and a contract intelligence analyst, respectively, who were each sentenced to one year in home confinement in October and November 2022. Brian Gilbert, a former Senior Manager of Security Operations, has pleaded guilty and is awaiting sentencing.

Previously, previously, previously, previously.

Tags: , , , ,

Safari auto-fill

Dear Lazyweb,

Since I switched from 1Password to Keychain, it seems that desktop Safari won't ever auto-fill my billing address into checkout forms. Why?

I have all 4 checkboxes checked in "Safari / Settings / Auto Fill". My card in Contacts is marked as "my card" and contains my address.

The web forms in question have all the usual semantic crud, e.g., on the DNA Lounge store (though I see this happening on other sites as well):

<INPUT TYPE=TEXT NAME="first_name" CLASS="name" AUTOCOMPLETE="billing cc-given-name" ...
<INPUT TYPE=TEXT NAME="address1" CLASS="address" AUTOCOMPLETE="billing address-line1" ..., etc.

Nothing is filled in by default, or starts completing as I type. Right clicking on a field and selecting "Autofill / Contacts" on the field just does completely useless crap. It requires me to select the card to auto-fill (as if I would ever want to auto-fill a card that was not mine!) and then it tries to fill the entire address including city into "address1".

It fills in my credit card number, expiration date and CVV automatically. But am I to understand that auto-filling my billing address is not something I should want to do?


Update: Apparently the magic I am looking for is "Safari / Edit / AutoFill Form" which is Cmd-Shift-A. I recall in the past that form elements had a little "head" icon on them that would fill things in, but I have not seen that lately.


Previously, previously, previously.

Tags: , , ,

Google agrees to settle $5bn lawsuit claiming it secretly tracked users

"Well that's alright then!"

US district judge Yvonne Gonzalez Rogers in Oakland, California, put a scheduled trial in the proposed class action, which was due to begin in February, on hold on Thursday after lawyers for Google and for consumers said they had reached the preliminary settlement.

The lawsuit had sought at least $5bn. Settlement terms were not disclosed, but the lawyers said they have agreed to a binding term sheet through mediation, and expected to present a formal settlement for court approval by 24 February 2024.

Neither Google nor lawyers for the plaintiff consumers immediately responded to requests for comment.

Previously, previously, previously, previously, previously.

Tags: , , , , , ,

Conversations I still have in this, the year Twenty Twenty Three, with the Absolutely Deranged:

Me: Have you seen [SHOW]? It's really good!
Them: That does sound really good. What service is it on?
Me: How the fuck should I know?
Them: *Taps at phone* Oh, it is not on one of the 7 streaming services I pay for. I guess I shall not watch this show.
Me: You are a grown-assed adult. You type [SHOW] into Pirate Bay, click first link, receive candy.
Them: But that sounds harrrrrrrrrrd.

Make your New Year's resolution be to stop being That Guy.

Previously.

Tags: , , , , , , ,

Jan. 6 rioter nabbed in Bumble dating app sting pleads guilty to assaulting officers

"I regret exactly nothing lol," the woman told NBC News on Wednesday.

Nearly three years ago, a young professional in the nation's capital was sitting in her apartment after the Jan. 6 attack and saw that the FBI was looking for help identifying the rioters who stormed the U.S. Capitol. So she opened up the Bumble dating app, changed her political beliefs to conservative and got to swiping. [...]

The woman referred to as "Witness 1" in Taake's FBI affidavit has previously recalled how "comically minimal ego-stroking" from her led Trump supporters to give her information about their activities on Jan. 6.

"I felt a bit of 'civic duty' I guess, but truthfully, I was mostly just mad and thinking, f--- these guys," she said, speaking anonymously for fear of online reprisal. Her strategy, she said, was saying "Wow, crazy, tell me more" to guys on repeat until they gave her enough for her to send their information to the FBI. [...]

"One of my friends was like, 'You basically got all these confessions just being, like, Haha! Then what?'" she said.

Previously, previously, previously.

Tags: , ,

Rajat Khare doesn't like people writing about him

An Indian venture capitalist is mounting an international legal campaign to pressure major media outlets to remove his name from articles or take down the stories altogether:

Reuters published a special investigation under the headline "How an Indian startup hacked the world," detailing how Appin allegedly became a "hack for hire powerhouse that stole secrets from executives, politicians, military officials and wealthy elites around the globe" [...] Khare retained the powerhouse "media assassin" firm Clare Locke LLP, which boasts on its website about "killing stories," to send Reuters several legal threats over the past year about the story [...]

Khare had his name removed from a joint investigation between The Sunday Times and the nonprofit Bureau of Investigative Journalism, titled, "Caught on camera: confessions of the hackers for hire." Three paragraphs that reported on Khare were removed from both publications following legal threats on his behalf [...]

In Switzerland, meanwhile, lawyers acting for Khare managed to take out an injunction that forced the Swiss Radio and Television's investigative team (SRF Investigativ) to scrub the tech entrepreneur's name from a story alleging that Appin assisted the Qatari government in spying on FIFA officials ahead of the 2022 World Cup.

He doesn't even have a Wikipedia page!

Previously, previously, previously.

Tags: , , ,

Migrating from 1Password to Apple Keychain

I had been a user of 1Password for at least 12 years, but now I'm breaking up with them and have switched to Apple Keychain instead. So far, I have no regrets.

  1. 1Password 7 was the last version where the program was a product that you could buy. 1Password 8 requires that you pay them monthly rental. I find this business model despicably extractive, and I won't have my passwords held hostage that way.

  2. 1Password 8 can no longer use stand-alone or iCloud vaults, at all. You must store your passwords in their Clown service only.

  3. 1Password 7 on iOS is no longer receiving maintenance, and so it barely works any more. E.g., to log into a web site from iOS Safari, you have to unlock 1Password for it to fill in the user name, then immediately unlock it again to fill in the password, even if you have "auto lock after 5 minutes" selected. Then it is a crapshoot as to whether you'll have to unlock a third time to get your TOTP code.

  4. 1Password 8 on macOS is an "Electron" app, which means that it contains an entire embedded copy of Chrome, so that even if you choose not to run a web browser owned by the world's largest advertising company, your password manager remains bug compatible with the latest Chrome exploits such as the recent WebP bug.

Here's how I migrated:

  1. In macOS 1Password, select "Primary" vault;
  2. File / Export / All Items / iCloud Keychain CSV;
  3. System Settings / Passwords / "..." menu / Import.

If you have multiple vaults, do that for each of them.

This migrates all of the password data, including notes and TOTP seeds, but only for entries that have all of: a URL, a user name, and a password. If any of the three are missing, it won't import. It missed a bunch of them for me. It told me, "380 of 596 passwords were successfully imported", but it wouldn't tell me which ones are missing. All of my important ones seemed to be there, though, so I decided to just Leeroy Jenkins it. I suspect the missing ones were duplicate entries, since 1Password tends to accumulate those.

For non-website-password things (door codes, wifi passwords, etc.), the best solution appears to be to use Notes.app and create a locked note with those passwords in plain text. Locked notes are client-side encrypted before being stored in iCloud. If you haven't memorized it, you'll also want to save your Apple ID password in that secure note, because Apple Keychain won't ever auto-fill that one for you.

To get 1Password out of your face:

  1. On macOS: "File / Quit 1Password Entirely" and remove it from "General / Login Items".

  2. On both macOS and iOS: disable the 1Password extension ("Safari / Settings / Extensions"). This prevents the "Unlock 1Password" dialog from popping up when you click on a login field in desktop Safari;

  3. On iOS: Settings / Passwords / Password Options / Un-check 1Password. This removes it from the password suggestion list.

Weirdness I have noticed:

  • On macOS, sometimes Safari won't auto-fill my billing address on forms.

  • On iOS, the "password suggestion" list still has 1Password listed as the top suggestion. I didn't want to delete the app in case something didn't get exported properly, but apparently you have to do that to get its hooks out of Safari. (Fixed by item 3 above.)

If you had been using 1Password shared vaults, I do not know what a good non-1Password-based solution for that is. Likewise, if you need to share passwords with non-Apple devices, I don't have answers for that.

Please note: If you have come here to recommend a different password manager, I implore you to not do that, as I just do not care. This is what I did. If something else works for you, good for you. Write it up on your own blog.

Previously, previously.

Tags: , , , , ,

Zuckerbunker

Inside Mark Zuckerberg's Top-Secret Hawaii Compound:

With NDAs forbidding workers from discussing the project, the secluded North Shore compound has gained a mythic status on Kauai. One local architect unaffiliated with the Zuckerberg project jokes that it reminds him of medieval rulers who, according to legend, killed the architects of their most ambitious projects so the secrets of their designs would die with them. [...]

The plans show that the two central mansions will be joined by a tunnel that branches off into a 5,000-square-foot underground shelter, featuring living space, a mechanical room, and an escape hatch that can be accessed via a ladder. "There's cameras everywhere," David says -- and the documents back this up. More than 20 cameras are included on plans for one smaller ranch operations building alone. Many of the compound's doors are planned to be keypad-operated or soundproofed. Others, like those in the library, are described as "blind doors," made to imitate the design of the surrounding walls. The door in the underground shelter will be constructed out of metal and filled in with concrete -- a style common in bunkers and bomb shelters. [...]

The smaller Hawaiian island of Lanai, off the coast of Maui, is now almost completely owned by Oracle billionaire Larry Ellison. New Zealand, considered by some to be the ideal place to wait out an apocalyptic event, is now riddled with bunkers for the tech elite. Recently reinstalled OpenAI CEO Sam Altman has an arrangement with Peter Thiel, first revealed to The New Yorker, where the pair will take a jet to one of Thiel's New Zealand properties in the case of an apocalyptic event. [...]

"In order to justify having a palace, you've got to show you've done basic due diligence on its bunker capabilities," Rushkoff says of the plans. "It shows it's not just luxury. This is your skin in the game."

In his book, Rushkoff criticizes what he calls "the mindset" -- a belief that "with enough money and technology, wealthy men can live as gods and transcend the calamities that befall everyone else." In doing so, he writes, they apply the same exit strategy of Silicon Valley startups to civilization itself.

"If anybody has enough money to insulate himself from the damage created for society, it would be Zuckerberg," says Rushkoff. "That's sort of what it is. He's destroyed the government and society, and now he can go to Hawaii and build a fort."

Previously, previously, previously, previously, previously, previously, previously, previously, previously.

Tags: , , , , ,

"An off switch? She'll get years for that."

Your Smart TV Knows What You're Watching:

ACR identifies what's displayed on your television, including content served through a cable TV box, streaming service, or game console, by continuously grabbing screenshots and comparing them to a massive database of media and advertisements. Think of it as a Shazam-like service constantly running in the background while your TV is on.

These TVs can capture and identify 7,200 images per hour, or approximately two every second. The data is then used for content recommendations and ad targeting, which is a huge business; advertisers spent an estimated $18.6 billion on smart TV ads in 2022, according to market research firm eMarketer.

For anyone who'd rather not have ACR looking over their shoulder while they watch, we've put together a guide to turning it off on three of the most popular smart TV software platforms in use last year. Depending on the platform, turning off ACR took us between 10 and 37 clicks.

Previously, previously, previously, previously, previously, previously, previously.

Tags: , , , , , ,