We hear a lot about Facebook as a platform for manipulation - using machine learning to bypass our critical faculties and trick us into believing things that are bad for us - but the real show is in Facebook's ability to target, not manipulate.

1/

It's been twenty years, to the day, since I published my first blog-post.

I'm a blogger.

Blogging - publicly breaking down the things that seem significant, then synthesizing them in longer pieces - is the defining activity of my days.

https://t.co/lksXhU6HKM

1/

Over the years, I've been lauded, threatened, sued (more than once). I've met many people who read my work and have made connections with many more whose work I wrote about. Combing through my old posts every morning is a journey through my intellectual development.

2/

It's been almost exactly a year I left Boing Boing, after 19 years. It wasn't planned, and it wasn't fun, but it was definitely time. I still own a chunk of the business and wish them well. But after 19 years, it was time for a change.

3/

A few weeks after I quit Boing Boing, I started a solo project. It's called Pluralistic: it's a blog that is published simultaneously on Twitter, Mastodon, Tumblr, a newsletter and the web. It's got no tracking or ads. Here's the very first

I don't often do "process posts" but this merits it. Here's how I built Pluralistic and here's how it works today, after nearly a year.

I get up at 5AM and make coffee. Then I sit down on the sofa and open a huge tab-group, and scroll through my RSS feeds using @newsblur.

5/

Surveillance companies assure us that they employ safeguards to ensure that their customers aren't abusing their products to engage in unlawful or unethical surveillance. And yet, inevitably, these companies abuse their tools THEMSELVES.

1/

It's almost as though being the kind of person who dreams of achieving incredible wealthy by spying on people makes you kind of an asshole.

2/

Like the people at @VerkadaHQ, "a fast-growing Silicon Valley surveillance startup" whose male employees used its own products to sexually harass their female colleagues and received the barest wrist-slaps for

Male Verkada employees maintained a private Slack channel where executives posted photos of female employees - captured with the company's own surveillance tools - and made sexually explicit remarks about them.

4/

When this came to light, the company's founder and CEO Filip Kaliszan called an all-hands meeting, expressed disappointment in the harassers, and told them that they could either quit...or lose some stock options. They chose the latter and remain employed there to this day.

5/

It's been eight years since @aaronsw took his own life. Aaron had been charged with 13 felonies under the Computer Fraud and Abuse Act (#CFAA) for violating the terms of service on the @JSTOR database of scholarly articles.

1/

Prosecutors Stephen Heymann and Carmen Ortiz didn't dispute that Aaron was allowed to access the articles he retrieved. Rather, they said that the WAY he accessed them (using a script instead of clicking on links) was a terms-of-service violation and hence a crime.

2/

In other words: any business could conjure a felony out of thin air by making you click through an unreadable garbage-novella of legalese proscribing the use of a service they granted you access to. Violate any of those terms and you face a prison sentence.

3/

This isn't law as we know it, it's Felony Contempt of Business Model, and the most alarming thing was that this interpretation of the CFAA wasn't completely ridiculous, given how badly drafted that law is.

4/

Ronald Reagan signed CFAA into law. Fed prosecutors had been seeking broad authority to punish "hacking" and had drawn up an absurdly broad definition of cybercrime that would give them latitude to go after anyone they didn't like.

5/

There is no shortage of takes about what's going on with Gamestop (and other surging stocks), Robinhood and Reddit's r/wallstreetbets, many of them contradictory - at least on the face of them. But I think it's possible for most of these takes to be right. Here's how.

1/

First you need to understand the underlying mechanics of the story. Stock markets are fundamentally a way of making bets, including bets on the outcome of other peoples' bets, and bets on the outcomes of THOSE bets.

2/

All this complexity creates lots of exploitable opportunities. Some of these opportunities are considered legitimate and are given respectable names like "arbitrage." Others are considered illegitimate, and are called disreputable things like "stock manipulation."

3/

A hypothetical Martian observing all this through a telescope could not tell you which kinds of bets were honest and which were dishonest, because the difference isn't about any objective standard, but rather, about power.

4/

The strategies of powerful people are legit, while the strategies of their would-be dethroners are not legit. Sometimes, even outright frauds are OK if they're done by people with enough power.

5/

The remix culture of the early 2000s left an indelible impression on me, an enduring delight in the power of whimsy, juxtaposition, virtuosity and ingenuity - and the ability of strangers all over the world to collaborate without any explicit coordination.

1/

The recent Bernie-mittens meme was a sterling example of this, tickling me right to my core, and I just happened on an especially delightful apex example of the form: @ToastedShoes's video of Sanders incorporated into eight AAA

Toasted Shoes got @JoeMashups to create a 3D model of Sanders, then tapped a bunch of different mashup artists to turn the Sanders sprite into playable characters in the games, showing them off in a narrated video.

3/

I'm not much of a fan of video-game streamers' narration, and I confess that I found the video more entertaining without the narration, but to each their own - Shoes was clearly enjoying himself, as were the commenters on the video.

4/

They had a lot to be pleased by.

Sanders as a Sith Lord in Star Wars Battlefront 2:

5/

Okay, doing my first baby steps with r2frida (which combines the power of @radareorg and @fridadotre).

Gonna share my progress in this thread (live, so keep calm).

The goal: Runtime inspection of data sent out by TikTok !!before!! it gets encrypted

1/many

First of all, we do not start from zero. I got some prior knowledge from past reversing attempts and want to share some important facts.

TikTok's (log data) encryption is accomplished by a native library. The Android Java code just serves as proxy function to the native function

The decompiled code for the respective native JNI function of an older TikTok version looks something like this, but in this example I use the most current TT version (no statical analysis done, yet)

In case you never reversed native libraries which were build to interface with Android Java layer via JNI, I highly suggest the entry level introduction on the topic by @maddiestone

Before we start, I want to pinpoint some important aspects (which are also covered by Maddie's videos).

1) Unlike raw C-functions, JNI functions like the one showcased above, receive pointers to complex Java objects .

F.e. a function receiving a String on the Java layer...

1/ @werat asked about whether the debugger was using the C# compiler or language service in VS 2002. It was not. The debugger has a component called an ‘expression evaluator’ that is provided per language and is responsible for parsing and evaluating expressions when stopped at a

2/ breakpoint. For example, if you type into the immediate window, hover over a variable, type into the watch window, etc. the expression evaluator is involved. The debugger and the language service are actually deeply integrated in a number of scenarios in VS, which may

3/ initially seem surprising. I may talk about more of these scenarios in the future, but to give a flavor, when you set a breakpoint at design time the language service is involved, when you are using Edit and Continue the LS is involved, the range of what is being evaluated

4/ when you get a debugger data tip, completion lists when typing in the data windows or immediate window, etc. Prior to VS 2002, there were distinct debug environments tailored to each target customer (VB/VBA, C++, VJ, VBScript, TSQL, FoxPro, Fortran, etc.). The goals of the

5/ VS 2002 debugger included unifying the debugger backend components and providing a single UI stack that would enable new scenarios (for example, a callstack across languages). Expression evaluators are the architecture that separate the language specific pieces from the