BC POLITICS
Saved by @ThomassRichards

Last talk about Securing Democracy at #enigma2021: @jackhcable speaking about "THE FULL STACK PROBLEM OF ELECTION

 Let's imagine that elections use all the security measures security people have been advocating: risk-limiting audits, paper ballots, etc. Would people trust the elections more?
Jack would argue no. Most people don't understand this stuff and most of the claims people are making can't be disproven. And are massively bogus already.

Georgia did a full recount on paper ballots and it very much didn't stop people from doubting the election!
Are election security results in vain? The point of election security is to convince the loser they lost.

No! Have to focus on the whole stack, from election infrastructure to campaigns to people and mis/dis-informaton
One takeaway from the talk: the parts of the stack must work in tandem. Can't fight misinformation in a vacuum, but must build on other election security measures.
The voting process
* significant advances in recent years (e.g. paper ballots, risk-limiting audits, end-to-end verifiability)
* research needed in integrating these technologies
* expanding to mail-in voting?
But there's also internet voting
* we can't do it securely today [oh no voatz reference]
* we have to combat malware, authentication etc.
* if we could solve them, that would be great. But in the meantime voting has to be successful for everyone
* can improve accessibility through things like getting ballot online, filling it out, then returning through the mail
Election support systems
* less researched. Probably because they look boring
* Voter registration databases aren't working. Russians breached at least 2 states, targeted all 50 states
* little to no public scrutiny of these systems
* election night reporting -- this is a picture of one where there was a bug in reporting. [It was fixed but freaked a lot of people out]
A lot of the trouble with the security of election support systems is not that we don't know how to do it -- it's that we have to do it
Campaign security
* biggest unknown (see Sunny Consolvo's talk!)
* we must view campaign security as non-partisan and increase resources and services available
Public confidence
* major damage from domestic actors
* widespread mis/dis-information
* technical election security measures helps to debunk rumours floating around
Misinformation-fighting supply measures:
* platforms: downranking and deplatforming
* trusted institutions
* debunking & fact checks
Misinformation-fighting demand measures:
* media literacy
* increased civics education

[ Also note that @katestarbird will be giving a talk on misinformation don't miss it: https://t.co/a0PutRnHaI]
Let's fix election support systems!
* Much of this is applying security things we already know
[ Note: a lot of organizations have this problem 😭 ]
* engage in public research. Have a vuln disclosure policy so people can confidently help
Election security is a problem that can only be solved by working together: elections officials, security people, everyone

[end of talk]

More from Lea Kissner

Lea Kissner
Lea Kissner
@LeaKissner
Next up in Privacy Technology at #enigma2021, Kelly Huang from @ethyca speaking about "GONE, BUT NOT "FORGOTTEN"—TECHNICAL & PRACTICAL CHALLENGES IN OPERATIONALIZING MODERN PRIVACY

Just imagine there's a global pandemic forcing everyone to stay home and buy their stuff over the internet. And you've been working on your sanitization-on-demand startup. You've got more users than you can count! ... literally, because your data's all over.

Now you're a multi-national international country with privacy issues because your information is all over the place.

Now a user writes to request you delete their data. Where is it? How do you do that? Who's responsible for privacy in your business.

How do you operationalize privacy rights?

Primary stakeholders:
* Legal
* Business
* Engineering

We spend a lot of time on Twitter analyzing the legal rulings, but it's harder where the "rubber meets the code" 🥁
TECH
Lea Kissner
Lea Kissner
@LeaKissner
Next up at #enigma2021, Sanghyun Hong will be speaking about "A SOUND MIND IN A VULNERABLE BODY: PRACTICAL HARDWARE ATTACKS ON DEEP LEARNING"

(Hint: speaker is on the

In recent years ML models have worked from research labs to production, which makes ML security important. Adversarial ML research studies how to mess with ML

For example by messing with the training data (c.f. Tay which became super-racist super-fast) or by foiling ML models by changing inputs in ways humans can't see.


Prior work considers ML models in a standalone, mathematical way
* looks at the robustness in an isolated manner
* doesn't look at the whole ecosystem and how the model is used -- ML models are running in real hardware with real software which has real vulns!


This talk focuses on hardware-level vulnerabilities. This is particularly interesting because these can break cryptographic guarantees (because those are outside of their threat models)
e.g. fault injection attacks, side-channel attacks
SCIENCE
Advertisement
Lea Kissner
Lea Kissner
@LeaKissner
We're kicking off the Privacy Tech session at #enigma2021 with Mitch Negus speaking about "NO DATA, NO PROBLEM—GIVING NUCLEAR INSPECTORS BETTER TOOLS WITHOUT REVEALING STATE

A nuclear catastrophe hasn't occurred... yet. So we need to stay vigilant. Nuclear inspectors go in according to treaties to check what's going on and check compliance with treaty rules.

But as sophisticated analytics become more common, states will only want to share the minimum amount of information necessary under the treaty.

But perhaps we can use MPC -- secure multi-party computation

Yao's garbled circuits were first demonstrated on the millionaire's problem -- figuring out who's richer without revealing actual amounts.

Used for other things like cryptocurrency these days.

Can we use this for nuclear inspection?

MPC can be used to compute anything computed by a computer [but it's expensive!]
TECH
Lea Kissner
Lea Kissner
@LeaKissner
Last up in Privacy Tech for #enigma2021, @xchatty speaking about "IMPLEMENTING DIFFERENTIAL PRIVACY FOR THE 2020

Differential privacy was invented in 2006. Seems like a long time but it's not a long time since a fundamental scientific invention. It took longer than that between the invention of public key cryptography and even the first version of SSL.


But even in 2020, we still can't meet user expectations.
* Data users expect consistent data releases
* Some people call synthetic data "fake data" like
"fake news"
* It's not clear what "quality assurance" and "data exploration" means in a DP framework


We just did the 2020 US census
* required to collect it by the constitution
* but required to maintain privacy by law

But that's hard! What if there were 10 people on the block and all the same sex and age? If you posted something like that, then you would know what everyone's sex and age was on the block.
TECH , TEACH
Lea Kissner
Lea Kissner
@LeaKissner
In more Securing Democracy at #enigma2021, @ChrFolini talking about "THE ADVENTUROUS TALE OF ONLINE VOTING IN

Switzerland is a direct democracy where citizens get to vote at least 4x/year, with a lot of mail-in voting. We have a long history of online voting.

Disclaimer: THIS IS NOT SWEDEN.

[I get the picture that @ChrFolini has had to explain the difference several times.]


Process around mail-in ballots.

[tl;dr it's very complicated and wasn't threat-modeled until recently]


But the in-person ballots are complicated, too!


Most security folks don't think that we can't make a secure online voting system.

@ChrFolini says this is because of encryption
[Note: this is not the main reason that a lot of people cite -- we're more worried about things like malware but it's complicated]
WORLD

More from Politics

Melissa (she/her)
Melissa (she/her)
@LiteraryMouse
In regards to the #CapitolCoup, I’m in a unique position. I monitored forums ahead of time and then was present for the coup itself.

These are my observations based on what I saw and the evidence that’s been collected so far. I reserve the right to adjust my analysis as needed.

Let’s talk about the organization of the coup first. Seeing some people insist that the coup must have been highly planned and coordinated.

Yes and no. This was a #StochasticCoup. We’ll see little evidence of direct communication between Trump and the insurrectionists.

Within the insurrectionists, there was not one group that executed the storming of the Capitol.

Rather, there were a number of smaller groups working independently towards the same goal. I expect you’ll see little evidence that these various groups communicated with each other.

What you will see is detailed planning and coordination within these small groups.

Then there were the joyriders, those Trump supporters who weren’t directly involved in any plotting but who were more than happy to go along for the ride once the coup was in motion.

After four years, the insurrectionists were carefully attuned to Trump’s messaging.

Every tweet and statement of his was treated as marching orders and carefully dissected for meaning.

It’s why shutting down Trump’s Twitter account was so important.
POLITICS , INSURRECTIONISTS
Spies Like Us
Spies Like Us
@RealStealthSpy
THREAD: CCP vs US Military, on home soil.

1. I watched the Executive Orders and I watched the media panic. I watched the MSM lies and I watched the treason. I watched the fake Russia narrative. I watched the calls for impeachment. I watched a stolen election, in full view.
POLITICS
Advertisement
Palmer Report
Palmer Report
@PalmerReport
That new attack piece about Seth Abramson is full of easily debunked false claims. Whenever the mainstream media gets annoyed at an indie pundit like Seth, it just publishes a bunch of bullshit about him, and most people mistakenly believe it. They've done the same thing to me.

The sad part is that when the author of that piece tried to smear a bunch of mainstream media journalists for daring to compare notes with him, they all responded by lying and said they've never compared notes with him. Even though Abramson has proof that they have.

This is the EXACT same strategy that certain mainstream media outlets used against me in 2017-2018. First they lied about me. Then they attacked my mainstream media associates for associating with a "fake news" pundit like me. Then some in the media felt compelled to disown me.

Sadly, it didn't matter that I had overwhelming proof that everything said about me in those attack pieces was false. When you defend yourself, no matter how factually, the average observer merely decides you're being "defensive" and therefore guilty as charged.

Ask yourself why the mainstream media is choosing now to dishonestly attack Abramson. The media's ratings are way down now that Trump is gone. Abramson presumably still has his entire niche audience intact. So the media gets jealous and takes it out on him.
POLITICS
Mangy Jay
Mangy Jay
@magi_jay
A central tension in our politics is this we have 1 political party that cares about upholding democracy, whereas the other party's aims can only be achieved thru undermining democracy. This is coupled w/ the fact that 1 party cares about people's well-being & the other does not

These 2 facts lead to a situation in which, in order to both uphold democracy & advance well-being, 1 party is dedicated to a functional gov't & the other party is well-served by a dysfunctional government. Such dysfunction is both instrumental & ideological (anti-government)

And then, of course, we have gerrymandering + a cap on the House of reps, 2 Senators per state, & the electoral college. A set of circumstances that gives massively disproportionate power to the anti-democracy & anti-well-being party.

Taken together, the structural issues in our electoral system, deep ideological divides about government/democracy, & the differential investment in advancing citizens' well-being does leave Democrats at a perpetual disadvantage.

A firefighter who is looking at a burning house & trying to decide whether to concentrate on stopping the fire from spreading or to save a child at the expense of a grandmother is facing a fundamentally different set of choices than the person who lit the fire in the first place
POLITICS
Jennifer Taub
Jennifer Taub
@jentaub
✔️ We have begun. It's Day 4 of the Trump Impeachment Trial 2.0. The defense is putting on their case. The first lawyer is Van Der Veen.

1/


Already this is wackadoodle. Seems like the defense is trying to tell us not to believe what we saw. This lawyer has the audacity to say that the people assembled at Trump's speech were peaceful patriots

2/

This lawyer is claiming that Trump's speech on the ellipse on January 6th was was a policy speech about "turning out strong in the next primaries" and how this was about working on voting law reform.

A mere civics lesson.

3/

The lawyer is lying. The Clinton campaign never "declared that the election was stolen by Russia."

Also, this Trump lawyer is trying to claim that democrats objecting to some of the electoral votes is equivalent to Trump's incitement of violence.

4/

As we expected, Trump's lawyers are not going to address the merits. Instead this is what-about-ism

5/
POLITICS

You May Also Like

SK
SK
@sk_diary1
Margatha Natarajar murthi - Uthirakosamangai temple near Ramanathapuram,TN
#ArudraDarisanam
Unique Natarajar made of emerlad is abt 6 feet tall.
It is always covered with sandal paste.Only on Thriuvadhirai Star in month Margazhi-Nataraja can be worshipped without sandal paste.


After removing the sandal paste,day long rituals & various abhishekam will be https://t.co/e1Ye8DrNWb day Maragatha Nataraja sannandhi will be closed after anointing the murthi with fresh sandal paste.Maragatha Natarajar is covered with sandal paste throughout the year


as Emerald has scientific property of its molecules getting disturbed when exposed to light/water/sound.This is an ancient Shiva temple considered to be 3000 years old -believed to be where Bhagwan Shiva gave Veda gyaana to Parvati Devi.This temple has some stunning sculptures.
ALL
Jaya_Upadhyaya
Jaya_Upadhyaya
@Jayalko1
SRI KUMARIAMMAN, KANYAKUMARI (TN)
#bharatmandir #navratri2021

Created by Maharshi Parasurama and also one among the 108 Shakthi Peethas in the world. The name Kanyakumari stands for Kanya(Virgin) and Kumari(girl).
Devi took this form to vanquish the demon Banasura
@GunduHuDuGa


Once, Banasura(grand son of Mahabali) obtained a boon from Shiva that he could be vanquished only by a virgin.
So, Devi took the form of a kumari and started meditating with the desire to marry Shiva at Suchindram.
Pleased Shiva fixed the midnight hour for marriage with Devi.


Devarshi Narada knew that the marriage would end the chance of killing Banasura. So, he assumed the form of a cock and crowed. Shiva returned back to Suchindram thinking that it was dawn.
Angered, Devi cursed that all food and articles meant for wedding turn into sand and shells


When Banasura heard about Devi’s beauty, he tried to take her by force. Devi, then, killed him and granted the wish of Devas to remain there always protecting them.
The murti of Devi stands with a rosary in hand. Her diamond nose-ring is said to be visible even from the sea.


Once an ancient mariner mistook it for a lighthouse and sailing towards it, his ship wrecked upon the Kanya Kumari rocks. In order to prevent such a tragedy from happening again, the eastern door of the shrine is opened only on five special occasions throughout the year.
ALL
Advertisement
Tinker \u274e
Tinker ❎
@TinkerSec
Singing the Blues:
Taking Down an Insider Threat

"I had all of the advantages. I was already inside the network. No one suspected me. But they found my hack, kicked me off the network...

...and physically hunted me down."


Many pentests start from the outside, wanting to see how the perimeter might be breached.

This pentest started from the inside. My client wanted to assume they had already been breached, and, if breached, how far could an attacker go.

Could they stop me once I was inside?

So they snuck me in. Disguised me as a new employee. Gave me a work computer, an ID badge, an account in their system... hell, I even had a cubicle w/my assumed name on it.

The only person who knew who I really was was their CISO. Everyone else thought I was Jeremy in Marketing.

During most of the first morning, I completed onboarding, made introductions, and completed menial tasks.

But I had to act quick. I only had a week onsite. I had to hack their network while not raising suspicion.

So I set about it.

You have to understand... most "Internal Pentests" are straight forward. The hard part is breaching the network, but once you're inside, it's a target rich environment. End of Life computers, default passwords, everyone a Local Administrator...
TECH
Jaya_Upadhyaya
Jaya_Upadhyaya
@Jayalko1
SRI SWETHA VINAYAGAR, THIRUVALANCHUZHI, KUMBAKONAM
(TN)
#bharatmandir

While main deity is Shiva as Kapartheeswarar, the kshetram is famous for Ganesha, known as Swetha/Vellai Vinayagar (white Vinayak)

During samudra manthan, Vasuki snake (used as rope) started spewing venom.


Unable to bear the intense heat, Devas rushed to Siva. He told them that this was because the task was started without getting Ganesha’s approval.
So the Devas created a Ganesha murti from white sea foam and worshipped it.
It was later taken by Indra to Indralok.
@GunduHuDuGa


But once Indra had to come to Earth to pray to Shiva to seek relief from a curse inflicted on him. So he brought the murti of Ganesha with him. When he came here, he wanted to take bath before puja. So he gave the murti to a boy to hold for sometime. The boy was actually Shiva.


He kept the murti down and vanished. Indra could not lift it again and a divine voice told him to let Vinayagar stay there and visit every Ganesh Chaturthi to pray.
Since Vinayagar is made of foam, no abhishekam is done here. Only punugu is applied n camphor powder is sprinkled
ALL
Nikita Poojary
Nikita Poojary
@niki_poojary
Catch me if you can @Mitesh_Engr

Time for a🧵
Mitesh Sir's EXPIRY Option Selling 101:
• What to look for?
• Strike Selection & Ratios
• SL mgmt
• Avoiding freezes
• Monthy Expiry
• Event days
• How he would have traded last expiry?

In collaboration with @AdityaTodmal


Edward de Bono says intelligence is like a🚗 Automobile

“A powerful car may be driven badly. A less powerful car may be driven well. The skill of the car driver determines how the power of the car is used.”


What @Mitesh_Engr Sir looks at for Expiry Trading:

• Technicals of BNF
• Individual Heavyweight stocks of BNF
• Support/Resistance of BNF on weekly TF
• Also has Superb SL management
• When it comes to adjustments, he is always on toes


How to Select Strikes to Sell?

• You can't sell based on premium
• Follow only trend
• Price action is best to sell on expiry day
• Never wait for the options to go to zero


Using Ratios to Sell:

• If BNF is in a range then strangles
• If breakout/ breakdown from a range then directional
• Selling 70/30 or 80/20 ratios
• 2 examples on how he used ratios
ALL , MITESH PATEL OPTIONS STRAT , MITESH PATEL EXPIRY GUIDE