BC TECH
Saved by @ThomassRichards

Next up in Privacy Technology at #enigma2021, Kelly Huang from @ethyca speaking about "GONE, BUT NOT "FORGOTTEN"—TECHNICAL & PRACTICAL CHALLENGES IN OPERATIONALIZING MODERN PRIVACY

 Just imagine there's a global pandemic forcing everyone to stay home and buy their stuff over the internet. And you've been working on your sanitization-on-demand startup. You've got more users than you can count! ... literally, because your data's all over.
Now you're a multi-national international country with privacy issues because your information is all over the place.

Now a user writes to request you delete their data. Where is it? How do you do that? Who's responsible for privacy in your business.
How do you operationalize privacy rights?

Primary stakeholders:
* Legal
* Business
* Engineering
We spend a lot of time on Twitter analyzing the legal rulings, but it's harder where the "rubber meets the code" 🥁
Three rights:
* access
* rectification
* deletion

Legal's trying to uphold them, but it's a technical question!

Legal wants to decrease risk but don't know software
The business wants to stay in business and make money. They want to be able to use data for things like placing ads and analysis.
It takes a lot of time to handle these requests, too!

They need a streamlined technical solution.
Program management wants to streamline and make things efficient and predictable... but they don't understand the technical limitation
As a software engineer, you've seen technical debt. So much technical debt. All the weight of the decisions that were made in the past, especially if you scaled without a data plan.

Average SMB has data in 10 different systems.
How do we delete?
Some poor software engineer is trying to track down what data is where?
What even *is* PII? There's no real standard.
What should be returned? What should be deleted.

Make a definition and stick to it.
Some of your databases might use email addresses as a primary key, some user IDs, etc.
1. Define PII
2. Find all the PII
3. Use pseudonymization to replace PII with some kind of random value which can't be tied back to the user

[reminder I am livetweeting this is not me speaking]
How do you do this at scale?
Maybe a centralized team who can handle this?
If you're a small company, plan ahead!
Be careful when you're doing sanitization -- some databases really don't like batch processes and you can make things fall over.
Speed
* you have a timeline -- often 30 or 45 days
* but that's not enough time if you haven't planned for streamlined speed

Ideally you won't need it, but have a backup plan, in case something goes wrong with a slow data system
Plan for a solution that grows with your business, not just a hacked-together series of SQL queries, but instead a centralized portal with extensibility as the business changes and technical systems grow.

... and as new privacy laws come into place
Privacy is way, way more than compliance. But compliance needs to happen.

Let's all do our part

[ end of talk ]

More from Lea Kissner

Lea Kissner
Lea Kissner
@LeaKissner
Last up in Privacy Tech for #enigma2021, @xchatty speaking about "IMPLEMENTING DIFFERENTIAL PRIVACY FOR THE 2020

Differential privacy was invented in 2006. Seems like a long time but it's not a long time since a fundamental scientific invention. It took longer than that between the invention of public key cryptography and even the first version of SSL.


But even in 2020, we still can't meet user expectations.
* Data users expect consistent data releases
* Some people call synthetic data "fake data" like
"fake news"
* It's not clear what "quality assurance" and "data exploration" means in a DP framework


We just did the 2020 US census
* required to collect it by the constitution
* but required to maintain privacy by law

But that's hard! What if there were 10 people on the block and all the same sex and age? If you posted something like that, then you would know what everyone's sex and age was on the block.
TECH , TEACH
Lea Kissner
Lea Kissner
@LeaKissner
In more Securing Democracy at #enigma2021, @ChrFolini talking about "THE ADVENTUROUS TALE OF ONLINE VOTING IN

Switzerland is a direct democracy where citizens get to vote at least 4x/year, with a lot of mail-in voting. We have a long history of online voting.

Disclaimer: THIS IS NOT SWEDEN.

[I get the picture that @ChrFolini has had to explain the difference several times.]


Process around mail-in ballots.

[tl;dr it's very complicated and wasn't threat-modeled until recently]


But the in-person ballots are complicated, too!


Most security folks don't think that we can't make a secure online voting system.

@ChrFolini says this is because of encryption
[Note: this is not the main reason that a lot of people cite -- we're more worried about things like malware but it's complicated]
WORLD
Advertisement
Lea Kissner
Lea Kissner
@LeaKissner
We're kicking off the Privacy Tech session at #enigma2021 with Mitch Negus speaking about "NO DATA, NO PROBLEM—GIVING NUCLEAR INSPECTORS BETTER TOOLS WITHOUT REVEALING STATE

A nuclear catastrophe hasn't occurred... yet. So we need to stay vigilant. Nuclear inspectors go in according to treaties to check what's going on and check compliance with treaty rules.

But as sophisticated analytics become more common, states will only want to share the minimum amount of information necessary under the treaty.

But perhaps we can use MPC -- secure multi-party computation

Yao's garbled circuits were first demonstrated on the millionaire's problem -- figuring out who's richer without revealing actual amounts.

Used for other things like cryptocurrency these days.

Can we use this for nuclear inspection?

MPC can be used to compute anything computed by a computer [but it's expensive!]
TECH
Lea Kissner
Lea Kissner
@LeaKissner
Next up at #enigma2021, Sanghyun Hong will be speaking about "A SOUND MIND IN A VULNERABLE BODY: PRACTICAL HARDWARE ATTACKS ON DEEP LEARNING"

(Hint: speaker is on the

In recent years ML models have worked from research labs to production, which makes ML security important. Adversarial ML research studies how to mess with ML

For example by messing with the training data (c.f. Tay which became super-racist super-fast) or by foiling ML models by changing inputs in ways humans can't see.


Prior work considers ML models in a standalone, mathematical way
* looks at the robustness in an isolated manner
* doesn't look at the whole ecosystem and how the model is used -- ML models are running in real hardware with real software which has real vulns!


This talk focuses on hardware-level vulnerabilities. This is particularly interesting because these can break cryptographic guarantees (because those are outside of their threat models)
e.g. fault injection attacks, side-channel attacks
SCIENCE
Lea Kissner
Lea Kissner
@LeaKissner
Last talk about Securing Democracy at #enigma2021: @jackhcable speaking about "THE FULL STACK PROBLEM OF ELECTION

Let's imagine that elections use all the security measures security people have been advocating: risk-limiting audits, paper ballots, etc. Would people trust the elections more?

Jack would argue no. Most people don't understand this stuff and most of the claims people are making can't be disproven. And are massively bogus already.

Georgia did a full recount on paper ballots and it very much didn't stop people from doubting the election!

Are election security results in vain? The point of election security is to convince the loser they lost.

No! Have to focus on the whole stack, from election infrastructure to campaigns to people and mis/dis-informaton


One takeaway from the talk: the parts of the stack must work in tandem. Can't fight misinformation in a vacuum, but must build on other election security measures.
POLITICS

More from Tech

Nicolas
Nicolas
@necolas
A brief analysis and comparison of the CSS for Twitter's PWA vs Twitter's legacy desktop website. The difference is dramatic and I'll touch on some reasons why.

Legacy site *downloads* ~630 KB CSS per theme and writing direction.

6,769 rules
9,252 selectors
16.7k declarations
3,370 unique declarations
44 media queries
36 unique colors
50 unique background colors
46 unique font sizes
39 unique z-indices

https://t.co/qyl4Bt1i5x


PWA *incrementally generates* ~30 KB CSS that handles all themes and writing directions.

735 rules
740 selectors
757 declarations
730 unique declarations
0 media queries
11 unique colors
32 unique background colors
15 unique font sizes
7 unique z-indices

https://t.co/w7oNG5KUkJ


The legacy site's CSS is what happens when hundreds of people directly write CSS over many years. Specificity wars, redundancy, a house of cards that can't be fixed. The result is extremely inefficient and error-prone styling that punishes users and developers.

The PWA's CSS is generated on-demand by a JS framework that manages styles and outputs "atomic CSS". The framework can enforce strict constraints and perform optimisations, which is why the CSS is so much smaller and safer. Style conflicts and unbounded CSS growth are avoided.
TECH
Ferruccio Balestreri \U0001f308
Ferruccio Balestreri 🌈...
@0xferruccio
🕵️‍♂️ How Google's PageRank algorithm works

The PageRank algorithm gives each page a rating of its
importance, which is a recursively defined measure of importance, based on if important pages link to it.
It's recursive because the importance of a page refers back to the importance of other pages that link to it

Here's how it works in practice:
1⃣ We start with some pages and crawl them for links


2⃣ Each page has 1/N points (where N as the total number of pages)


3⃣ Add points to each page for the amount of links to it, divided by the number
of links emanating from the sources of these links
TECH
Advertisement
Hemant Mohapatra
Hemant Mohapatra
@MohapatraHemant
~8yrs ago (Dec’12) I got a job @Google. Those were still early days of cloud. I joined GCP @<150M ARR & left @~4B (excld GSuite). Learned from some of the smartest ppl in tech. But we also got a LOT wrong that took yrs to fix. Much of it now public, but here’s my ring-side view👇

By 2008, Google had everything going for it w.r.t. Cloud and we should’ve been the market leaders, but we were either too early to market or too late. What did we do wrong? (1) bad timing (2) worse productization & (3) worst GTM.

We were 1st to “containers” (lxc) & container management (Borg) - since '03/04. But Docker took LXC, added cluster management, & launched 1st. Mesosphere launched DCOS. A lot of chairs were thrown around re: google losing this early battle, though K8 won the war, eventually 👏

We were 1st to “serverless” (AppEngine). GAE was our beachhead -- it was the biggest revenue source early on but the world wasn’t ready for serverless primitives. We also didn’t build auxiliary products fast enough. Clients that outgrew GAE wanted “building block” IaaS offerings.

1st to hadoop (map-reduce ‘04) but our hosted Hadoop launched in ‘15. AWS EMR was ~200M ARR by then. 1st to cloud storage (GFS ’03), but didn’t offer a filestore till ‘18! Customers were asking for it since 2014. Didn’t launch archival storage or direct interconnect till v. late.
INTERNET , TECH
foone
foone
@Foone
argh chrome updated and it seems they've intentionally broken custom search engines. I have had a keyword search for "foone" which searches my own twitter, so I just type "foone BLAH" and it gives me a twitter search for when I said BLAH, right?


but now I get that option in the titlebar of "search twitter self-search" which is the name of the search"
if I just type "foone blah" now...

it ignores the search I have had defined for years and just googles it.


and this is definitely on purpose because they didn't just break it, they changed it. it's now "fooneblah"


there doesn't seem to be an option to make this stop and get the old behavior back :(
TECH
Trond Bjor\xf8y
Trond Bjorøy
@trondbjoroy
1/12 @HathorNetwork offers a unique set of features for both builders and users. Some well known ones, others not so much. Let’s look at why you might want to consider Hathor as the layer 1 solution for your project. $HTR @HTRFDT #BuildOnHathor

2/12 Easy tokenization is the obvious one. You create your own token in less than a minute, no coding required.

3/12 As opposed to ERC tokens, your custom Hathor token is a layer 1 token. It inherits the same features and security as the native token, $HTR, effectively giving your token the same level of security as the #Bitcoin $BTC blockchain.

4/12 Hathor Network also passed their security audit by @SlowMist_Team so you can feel safe knowing that your L1 token fulfills the same security requirements as $HTR.

5/12 By configuring built-in nano contracts you will be able to add logic to your token. No coding required. Native nano contracts also mitigate the risk of bugs and security issues that comes with custom smart contracts development on other platforms. $HTR
TECH

You May Also Like

AAdhira \U0001f319\U0001f1ee\U0001f1f3
AAdhira 🌙🇮🇳...
@Aadhiraspeaks
Shri Hanuman had boon to be immortal. And be present where ever there is Ram stuti.
I came across this beautiful story that I would like to share
#threadstories
#Hanuman ji is believed to live in the foothills of Himalayas. But once he spent a lot of time in Sri Lanka
1/9


Where Ravan's brother ruled for many years..
On his way back he came across tribal people from community called #Mathanga
He gave Darshan to them. The chief of the tribe asked him to keep coming back to guide their generations
Hanuman ji said that whoever recites this mantra
2/9


I will give them Darshan. But there are two conditions
1st he/she must know his relationship with me
2nd there must not be anyone around him in 950 mts radius. If present, that person must also know about my relationship with him /her.

He promised to come after every 41 yrs
3/9

The Mathangs also maintain a ‘logbook’ where they record all the words spoken and ‘leelas’ performed by Lord Hanuman.
They call him their Guru
Who teaches them how to live their lives.
A Sri Lankan organization called Setuu is studying this ‘logbook’ and also conduct
4/9

programmes for Hanuman devotees who can do ‘Sadhna‘ under the guidance of Setuu masters. Devotees who qualify all the criteria will be eligible for Hanuman’s ‘sakshaat darshan‘
The Setuu has certain conditions that need to be kept in mind which includes devoting one complete
5/9
RELIGION
Noah Smith
Noah Smith
@Noahpinion
1/People I know on the Right tend to be obsessed with the idea of "crimethink", taboos, and the (supposedly) oppressive, omnipresent enforcement of liberal cultural norms.

Why?

My new theory: A lot of it is guilt.

2/It's true that in some circles - the media, universities, many big corporations - liberal norms *are* enforced to some degree, and the enforcement has probably gotten stronger in recent years.

But I don't think this explains all of the Right's obsession.

3/The stereotype is that people on the Right tend to be more threat-sensitive. That would help explain the perception that liberal norm-enforcers are lurking everywhere, ready to pounce and anathematize anyone who makes a misstep.

But I don't think that's all of it either.

4/And of course, it's always fun - whether you're on the Right or the Left, or playing a video game, or whatever - to style yourself as the brave iconoclastic rebel fighting against the oppressive forces of blah blah blah.

But I don't think this is all of it, either.

5/The reason I think it's more than these things is that even *in private*, people on the Right express their "crimethink" ideas very gingerly and hesitantly.

I get the sense that they're not just afraid of external censure, but have also internalized liberal norms.
SOCIETY
Advertisement
Danielle \U0001f1e7\U0001f1f4
Danielle 🇧🇴...
@dinkydani21
❤✈️🌎 2 years ago today @JamesIvings and I sold all our belongings and left the UK to travel for a year. We've never been happier and we have no plans to ever return there 🙂

Thread 👇

Since then we've started a remote web dev company @SquarecatWebDev and been lucky enough to have completed several freelance projects 💻 that have kept us on the road.

In the last few months we've become a huge part of this amazing new Maker community and have found so many new friends from @makerskitchen, @women_make_ and several others! 🥰

We love travelling together (even if I'm only a glorified laptop watcher 😒) but we're both much happier being able to share our ideas outside of our own little bubble and our products have benefitted too!

Here's to another year of nomading with my favourite person and to the Maker community continuing to grow with our help! Maybe one day we'll all get to meet each other ✌️ 💛
LIFE
KrishnaLeela
KrishnaLeela
@Talesofkrishna
🌿𝑻𝒉𝒆 𝒔𝒕𝒐𝒓𝒚 𝒐𝒇 𝒂 𝑺𝒕𝒂𝒓 : 𝑫𝒉𝒓𝒖𝒗𝒂 & 𝑽𝒊𝒔𝒉𝒏𝒖

Once upon a time there was a Raja named Uttānapāda born of Svayambhuva Manu,1st man on earth.He had 2 beautiful wives - Suniti & Suruchi & two sons were born of them Dhruva & Uttama respectively.
#talesofkrishna https://t.co/E85MTPkF9W


Now Suniti was the daughter of a tribal chief while Suruchi was the daughter of a rich king. Hence Suruchi was always favored the most by Raja while Suniti was ignored. But while Suniti was gentle & kind hearted by nature Suruchi was venomous inside.
#KrishnaLeela


The story is of a time when ideally the eldest son of the king becomes the heir to the throne. Hence the sinhasan of the Raja belonged to Dhruva.This is why Suruchi who was the 2nd wife nourished poison in her heart for Dhruva as she knew her son will never get the throne.


One day when Dhruva was just 5 years old he went on to sit on his father's lap. Suruchi, the jealous queen, got enraged and shoved him away from Raja as she never wanted Raja to shower Dhruva with his fatherly affection.


Dhruva protested questioning his step mother "why can't i sit on my own father's lap?" A furious Suruchi berated him saying "only God can allow him that privilege. Go ask him"
RELIGION
Peter McCormack [Jan/3\u279e\u20bf \U0001f511\u220e]
Peter McCormack [Jan/3...
@PeterMcCormack
1/ So here is a thread on how I turned $32,000 into $1.2m and back to pretty much zero (once taxes are paid).

Just note, I am not bitter or salty in any way at all, the last 2 years have been an amazing ride - travelled the world, been wealthy, been poor.

2/ Dec '16, my advertising agency folded, I had a little bit of money left and I put $32k into Bitcoin and Ether. As it started to go up I diversified into everything, Monero, Dash, this that, any crap - even Ripplecoin. Everything just kept going up.

3/ By March I think I had around $300k and $500k by the summer. I used to take 25% out but towards the end of the summer I got greedy and put it all back in and by December it was $1.2m.

4/ Thinking I was an absolute genius I decided to start a bunch of businesses. As silly as it sounds I had this goal of making $5m as I wanted to buy Bedford Town Football Club and get them in the league, and as Crypto was going up forever I needed 6 months.

5/ So:
- Trading (income 1)
- Podcast (income 2)
- Mining (income 3)
- Mining pool (income 4)
- Consulting (income 5)

Yes - all of the above as a one-man army :)
LIFE