hn773746483

Social media and "cybersecurity experts" had a big role in this. Stuff like "EU SAYS THIS IS A URGENT VULNERABILITY" and even the Prime Minister of Japan doing a nighttime PSA. They cite "the experts" posts on social media about the initial advisory, while the very same so-called experts share google search AI output mitigation strategies. None of these organizations or bodies had any details other than what was on the advisories and social media. (e.g "CVSS 10, that's bad!!")

To me, it seems more more akin to broadpwn, technically severe, wide scope (millions of iphones), yet will never be a one-size-fits-all-PWN-button.

Even in the age of AI, I don't think this is going to be weaponized down the line like how Eternalblue was... but I'm not the social media cybersec guy with 15000 followers, so don't take my words at face value ;)

It varies. Nintendo for example has plenty of different teams and internal frameworks, but not every game uses them.

In Ontario, "Frozen Treat" and "Ice Cream", "Orange Juice" and "Orange Drink" are on shelves often right beside eachother with nearly identical packaging. I only noticed the latter when I saw one was significantly cheaper, at first thought it was pulp/no pulp.

I imagine this kind of behavior is common everywhere, and the bodies responsible for enforcing things (examples: data protection, consumer protection) just go "hmmmm sorry we're understaffed", "we don't take action on everything" or just refuse to investigate internally because nobody would EVER blatantly break the law :^).

Nintendo outright ships incomplete games on carts sometimes, requiring a day 1 patch to have the game in a non-buggy state (one of the recent pokemon games was like this)

And "gamers" refuse to listen to reason and assume physical copy = they can play it for eternity, when in reality, in 5 or 10 years when a server is inevitably shut down, they're forced to pirate. Nintendo does not allow offline patches.

and the poor Fedora teams will continue to assume good faith and continue to engage with this person... all because, what, they were active on a bug tracker for a few months 5 years ago?

They won't put their foot down until the AI starts spewing hate speech, probably.

It's just social engineering. No different than say, 2FA fatigue (blowing up someone's phone with 2FA "is this you? yes/no" prompts until user/child/wife/SO/etc clicks yes) or even just simply harassing IT helpdesk until they reset "your" password.

Don't forget "sudden price hikes" and "aggressively overselling"...

And if they don't disclose, nothing happens anyway. Maybe a five figure "cost of doing business" slap on the wrist fine, not considering the amount of users affected. Enforcement is extremely selectiveand bureaucrats essentially operate on "if company in FAANG, take action, else do nothing" programming.

NOYB has been ghosting me since January, and EFF since September.

Right, but nothing stops companies from refusing SARs on baloney grounds. Complain to a DPA? They tell you to go through ADR or outright ignore you. Complain to Ombudsman? They'll tell you the same. (In my experience, the Dutch do this)

Company ignores ADR? Sure, now you can go through the legal route and spend copious amounts of money all because a multi billion dollar company knows the game and how to navigate the bureaucratic mess better than you.

Cloudflare & AWS wouldn't even INVESTIGATE a abuse report I sent because there weren't any "infringing URLs" or "specific resources".

I provided enough evidence for them to at least be able to kickstart a internal investigation or even CONTACT the abusive customer, which they did not do.

If it were a stresser, all they would see is a login panel. It's not like these sites are publicly advertising what they're doing...

A couple years back one of the original Pokemon TCG designers was outright printing off fakes of pre-release cards and peddling them with the help of a western company, and people only found out because they decoded printer patterns and found out they were printed with a recent printer.

On Toronto's public transportation, TTC, occasionally the upcoming bus stop ticker would flash diagnostic information(?) and "64K RAM" instead of the upcoming stop name. Doesn't seem like there's a wiki page about these faults yet.