illegaldaydream - Network

If you plot the NSF grant funding Ted Cruz flagged per-state per-capita, North Dakota is the bastion of Neo-Marxist thought in America

If you plot the NSF grant funding Ted Cruz flagged per-state per-capita, North Dakota is the bastion of Neo-Marxist thought in America

Holy shit, there's a (very rough location) geographic de-anonymization attack against Signal, Discord, and a boatload of other...

Holy shit, there's a (very rough location) geographic de-anonymization attack against Signal, Discord, and a boatload of other platforms. https://gist.github.com/hackermondev/45a3cdfa52246f1d1201c1e8cdef6117

Here's the short version:

Whenever you make a request for a resource from Cloudflare (or most content distribution networks, but Cloudflare is ubiquitous), it's routed to the closest CDN datacenter to you, which fulfills the request from the origin server and caches the result.

So if I DM you a photo, on Signal, Discord, etc, and your device loads the resource, then it triggers the nearest Cloudflare data center to you to load and cache the resource.

If I then either use many proxies around the globe to load the same resource (or use a bug in Cloudflare that lets you specify which data center you want to fulfill your request, but *that* part of the attack has been patched) then I can see whether each data center has the resource cached or not. The only data center that'll have it cached already is the one closest to you. In the Eastern United States there's a Cloudflare data center within at most 100 miles of any location, so you can determine the very rough geographic location of any user behind practically any Cloudflare-backed service.

If you have push notifications on your device then this can become a zero-click attack. If I get a notification of a Signal message that includes an image, the notification includes an image preview, which triggers loading the image. Similarly, Discord notifications include the user's avatar, forcing an image load.

I'm not sure how you fix this. A primary function of CDNs is to aggressively cache resources at a local level to lower server load. Disabling caching or removing CDNs is not an option for many services. Asking all the CDN servers to cache the resource at once may be technically infeasible and will significantly increase server load. The CDN servers can't lie about whether they have a resource cached, because they pass that information on to clients so that your browser knows how long *it* should cache a resource for. This attack seems to rely on inherent functionality in how CDNs work.

Computers should only be able to speak through the animatronic faces of bound creatures. If you want to ask ChatGPT a question? You must...

Computers should only be able to speak through the animatronic faces of bound creatures. If you want to ask ChatGPT a question? You must enter a Chuck E Cheese and commune with the powerful rat, like the Oracle at Delphi

Someone DMed me on Reddit offering to pay me to find them information on the dark web about unscrupulous doctors who will perform “rib...

Someone DMed me on Reddit offering to pay me to find them information on the dark web about unscrupulous doctors who will perform “rib cage lengthening or expansion surgery” for them

I defended my dissertation!! So close to the end of my #PhD

I defended my dissertation!! So close to the end of my #PhD

They’re replacing the roof on my apartment complex this week, so the driveways are all covered in tarps and machinery and falling debris,...

They’re replacing the roof on my apartment complex this week, so the driveways are all covered in tarps and machinery and falling debris, and the workers said “wow, your landlords should have given you hard hats to get to your apartments”

"Solar storm disrupts corn production by confusing the field-roombas" was not on my disaster bingo card...

"Solar storm disrupts corn production by confusing the field-roombas" was not on my disaster bingo card https://www.404media.co/solar-storm-knocks-out-tractor-gps-systems-during-peak-planting-season/

My Reddit DMs continue to be extremely normal

My Reddit DMs continue to be extremely normal

CDs were a wild technology. “Oh yeah, there was this era where we all had high-precision lasers at home and burned data into reflective...

CDs were a wild technology. “Oh yeah, there was this era where we all had high-precision lasers at home and burned data into reflective platters, like a sci-fi reenactment of etching the early written word onto clay.”

Happy pi(e) day!

Happy pi(e) day!

The whole time I was grocery shopping I thought the vibe of the store was off, and then the person in line behind me confirmed my fears:...

The whole time I was grocery shopping I thought the vibe of the store was off, and then the person in line behind me confirmed my fears: “this hannafords is sickening. It’s dehumanizing. This is wrong.”

Recently I saw two white nationalist propaganda posters on my way to work, and while I expect they’re probably from a single misguided...

Recently I saw two white nationalist propaganda posters on my way to work, and while I expect they’re probably from a single misguided individual, it was still a downer. The sticker I saw tonight was much more uplifting

There are birds flying through the airport terminal, peering out at the planes from behind the glass. A trace of the real within the...

There are birds flying through the airport terminal, peering out at the planes from behind the glass. A trace of the real within the synthetic.

In 2021 I was a co-author on a paper analyzing leaked documents from fusion centers, cross-jurisdictional law enforcement collaborations...

In 2021 I was a co-author on a paper analyzing leaked documents from fusion centers, cross-jurisdictional law enforcement collaborations intended for counter-terrorism. The leaked memos from Maine and Massachusetts suggested that resources intended for national security were instead focused on local property crime, drug crime, and homelessness. Following our report and many others, the Maine house voted to eliminate their fusion center, but was overruled by their state senate.

Our paper just got its first academic citation, by researchers working on secure cloud computing to prevent data leaks, who reference our work as an example of a "fatal public security threat." 🙃

#ddosecrets #blueleaks

"Are you living the dream today? Remember: dreams can be nightmares."

"Are you living the dream today? Remember: dreams can be nightmares."

I've been playing with fountain pens for a few months now - I have two of my own, but most recently I restored my great-great aunt's...

I've been playing with fountain pens for a few months now - I have two of my own, but most recently I restored my great-great aunt's fountain pen, made in 1948. Still works great, just needed some cleaning and fresh ink!

New favorite piece of spam, offering to sell me lithium ore and lithium mining licenses. Immediately compelling, broad appeal, must hook a...

New favorite piece of spam, offering to sell me lithium ore and lithium mining licenses. Immediately compelling, broad appeal, must hook a lot of people

This sounds like a good use for large language models: hook them up to dial random numbers looking for fax machines, and send them bespoke...

This sounds like a good use for large language models: hook them up to dial random numbers looking for fax machines, and send them bespoke computer-poetry. Lonely little computers, looking for connection

The messages are over a minute long, so I assumed they *had* to be images, that's too long for a handshake. I did not account for...

The messages are over a minute long, so I assumed they *had* to be images, that's too long for a handshake. I did not account for "perhaps you did not hear me, allow me to sing you the song of my people once more..."

For months I've been getting voicemail of modemish noises that I assumed were from fax machines. Today I finally got some fax decoder...

For months I've been getting voicemail of modemish noises that I assumed were from fax machines. Today I finally got some fax decoder software working to see what the spam I've been getting has been about, but unfortunately the calls are just handshakes: the caller identifies that they're a fax machine, lists their capabilities, and asks my cell phone what kind of faxes it can receive, repeatedly until the end of the message. Disappointing