[Plura-list] Dependency Confusion; Adam Curtis on criti-hype; Catalytic converter theft; Apple puts North Dakota on blast

[Cory Doctorow]

_,.-'~'-.,__,.-'~'-.,__,.-'~'-.,__,.-'~'-.,__,.-'~'-.,_

This weekend, I'll be participating in Boskone 58, Boston's annual sf
convention, where I'm doing panels and a reading.

https://boskone.org/

_,.-'~'-.,__,.-'~'-.,__,.-'~'-.,__,.-'~'-.,__,.-'~'-.,_

Today's links

* Dependency Confusion: A completely wild supply-chain hack.

* Adam Curtis on criti-hype: Big Tech as an epiphenomenon of sociopathic
mediocrity, not supergenius.

* Catalytic converter theft: Rhodium at $21,900/oz.

* Apple puts North Dakota on blast: Stop thinking different!

* This day in history: 2006, 2011, 2016

* Colophon: Recent publications, upcoming/recent appearances, current
writing projects, current reading

_,.-'~'-.,__,.-'~'-.,__,.-'~'-.,__,.-'~'-.,__,.-'~'-.,_

🧙🏿‍♂️ Dependency Confusion

In "Dependency Confusion," security researcher Alex Birsan describes how
he made a fortune in bug bounties by exploiting a new supply-chain
attack he calls "dependency confusion," which allowed him to compromise
"Apple, Microsoft and dozens of others."

https://medium.com/@alex.birsan/dependency-confusion-4a5d60fec610

Dependency Confusion is incredibly, delightfully clever. It is grounded
in the fact that software developers rely on "dependencies" (prebuilt,
modular code libraries) when they build new versions of their software.

The javascript files used to build new versions are often public, and by
looking inside them, you can find out the names of the libraries used to
build popular applications, from Uber to Yelp to Netflix.

Now, these libraries are a mix of widely used public libraries and
private, in-house ones, and when the software is being built, the system
checks both the canonical public archives of code libraries and private
company servers.

Birsan's insight was that if he created new, malicious libraries with
the same names as the private ones, and put them on the public servers,
then the build system might preferentially snag and incorporate his
malicious code instead of the private ones.

Some build systems have a weak security measure: if a library is found
in more than one repository, the system defaults to the one with the
higher version-number, so Birsan gave his libraries version numbers like
"9000.0.0."

Birsan was able to attack Python, Ruby and Microsoft .NET-based apps.
His reports resulted in fixes to many of the apps involved, but some of
the infrastructure tools, like Jfrog Artifactory, still default to an
insecure mode, and class his bug report as a "feature request."

And Birsan thinks there's plenty more bug bounties out there waiting to
be claimed for attacks like this: "finding new and clever ways to leak
internal package names will expose even more vulnerable systems, and
looking into alternate programming languages and repositories to target
will reveal some additional attack surface for dependency confusion bugs"

_,.-'~'-.,__,.-'~'-.,__,.-'~'-.,__,.-'~'-.,__,.-'~'-.,_

🧙🏿‍♂️ Adam Curtis on criti-hype

Adam Curtis is a brilliant documentarian, and films like
Hypernormalization and series like All Watched Over by Machines of
Loving Grace had a profound effect on my thinking about politics,
technology and human thriving.

In this interview with The Idler's Tom Hodgkinson, Curtis lays out a
compact, incisive and important critique of the big social media
platforms - and of their critics, who give these companies far too much
credit.

https://www.idler.co.uk/article/adam-curtis-social-media-is-a-scam/

Curtis puts Big Tech's self-serving boasts about how good it is at
manipulating public opinion in the same bucket as other outlandish
claims of secret, astounding accomplishments, such as those made by
British spy agencies.

When the Snowden leaks came to light, Curtis published an absolutely
brilliant, jaw-dropping article on the BBC about his own investigations
into spy agencies,

https://www.bbc.co.uk/blogs/adamcurtis/entries/3662a707-0af9-3149-963f-47bea720b460

He concluded that spy agencies are filled with unhinged, unreliable
sociopaths whose claims of competence only survive because everything
they do is secret, so we have to take their word for it.

Once you understand this, you have to rethink the problem with
intelligence agencies - not that they use surveillance effectively, but
rather that they use it indiscriminately, to justify all kinds of dirty
tricks against the targets of their paranoid prejudice.

The mainstream critique of spy agencies - the one that accepts their
claims to hypercompetence at face value - is doing the spy agencies a
favor, affirming these baseless claims. It's a species of what Lee
Vinsel calls "criti-hype":

https://pluralistic.net/2021/02/02/euthanize-rentiers/#dont-believe-the-hype

Curtis agrees with Vinsel: the critique of social media centered on the
industry's claims of devastating efficacy gives the industry far too
much credit. He points out that advertisers are coming to the conclusion
that ad-tech is a swindle, a bezzle:

https://pluralistic.net/2021/01/04/how-to-truth/#adfraud

If tech doesn't make money by being good at advertising, how to account
for its riches? Curtis says it's monopoly: "four giant corporations who
don’t produce anything, contribute nothing to the wealth of the country,
hoard their billions of dollars in order to pounce on anything that
appears to be a competitor and buy it out immediately."

Curtis says that dark, irrational political movements aren't the result
of Big Tech's algorithmic radicalization, but rather the material
conditions created by a corrupt system:

"For 20 years, they’ve been offered no choice between the political
parties. They’ve been given this enormous button that says 'Fuck off'
and they’ve pressed it. That’s a rational thing to do."

This nihilistic conduct is the inevitable product of the "high
individualism" doctrine: "in a period of high individualism, the one
thing you don’t notice is power. You’re supposed to be an empowered
individual yourself."

Think of how climate change debates have been dominated by "personal
responsibility" as though the emergency stems from your personal
recycling habits or your choice not to use underfunded transit.

When we're offered solutions, they turn on criti-hyped fields like "AI,"
which is actually just machine learning, which, in turn, is just
statistical inference, with no path to producing anything like intelligence:

https://locusmag.com/2020/07/cory-doctorow-full-employment/

Curtis talks about how corruption has made us suspicious of science, and
that vacuum gets filled with a kind of individualistic religion - citing
Ayn Rand's claim not to fear death "because I won’t die, the world will
die."

Curtis says the path forward is to "square the circle" between
individualism and collective action - to find ways that individuals can
become part of a collective, a movement, grounded in science that is
liberated from industrial corruption.

"The internet is the thing that could do it, except the bastards got
hold of it and isolated us even more. We are being made to do this work
for free for them and they feed us stuff and we remain in our little
bubbles...I would argue for the nationalisation of the internet."

I'm not sure about nationalization (though a publicly owned part of the
internet is an intriguing idea), but so much of this resonated with me,
and got a the points I tried to make with my 2020 book HOW TO DESTROY
SURVEILLANCE CAPITALISM.

https://onezero.medium.com/how-to-destroy-surveillance-capitalism-8135e6744d59

_,.-'~'-.,__,.-'~'-.,__,.-'~'-.,__,.-'~'-.,__,.-'~'-.,_

🧙🏿‍♂️ Catalytic converter theft

Back in the early 2010s, people started falling into open sewer
entrances in New York City and other large metros - because a
China-driven spike in the price of scrap metal, combined with post-2008
unemployment, gave rise to an army of metal-thieves.

https://www.reuters.com/article/instant-article/idUSBRE84210I20120503

A decade later, there's a new precarity- and bubble-fuelled metal-theft
epidemic: stealing catalytic converters out of parked cars to harvest
their palladium and rhodium for re-use in the global auto-sector, which
is facing strict emissions controls.

https://www.nytimes.com/2021/02/09/climate/catalytic-converter-theft.html

Palladium and rhodium prices are soaring: palladium is up from $500/oz
in 2016 to $2000-$2500/oz; rhodium rose from $640/oz to $21,900/oz (!).
This puts a serious dent in auto profits - in 2019, the industry spent
an extra $18b on metals (it was higher in 2020).

2021 will see the auto industry buying $40b worth of catalytic converter
metals, and this has driven a secondary market where scrappers are using
targeted ads exhorting people to bring in old converters for recycling.

Catalytic converters are pretty easy to harvest from cars: it just takes
a few minutes' work under the car to detach a compact, fungible source
of wealth, and even if your state has rules requiring ID to make the
sale, chances are the next state over doesn't.

In the New York Times, Hiroko Tabuchi talks to people at the center of
the phenomenon, like the tow-yard operator who deflates the tires of
cars "so they can’t slither underneath" and who has had to repeatedly
tow the same vehicle after it had it converter stolen and re-stolen.

Converters can be sold to scrappers by mail, and you can learn how to
boost one in any of several Youtube videos. Cops suggest engraving your
VIN into your converter, and people are homebrewing CC armor.


_,.-'~'-.,__,.-'~'-.,__,.-'~'-.,__,.-'~'-.,__,.-'~'-.,_

🧙🏿‍♂️ Apple puts North Dakota on blast

Republican North Dakota legislators have introduced SB2333, a bill that
prohibits large tech companies from locking their users into a single
app store or payment processor.

https://www.legis.nd.gov/assembly/67-2021/documents/21-1044-01000.pdf

While his has implications for Android and other large tech platforms,
its most immediate and far-reaching effects with be on Apple, whose Ios
platform uses lock-in to monopolize both apps and payments (and another
domain, not mentioned in the bill: repairs).

Predictably, this has thrown Apple into a fury, with Apple's privacy
chief Erik Neuenschwander telling the SD legislature that Apple uses its
monopoly over the app store to protect its users' privacy and security.

https://www.macrumors.com/2021/02/10/apple-privacy-chief-slams-north-dakota-bill/

Neuenschwander makes a good, but incomplete, point. To the extent that
Apple has the same interests as its users, it uses its app store
monopoly to lock out bad apps (to the best of its ability).

But when Apple's interests diverge from its users' interests, the
prohibition on sideloading apps actively harms those users' privacy and
security. Think of how Apple caved to Chinese state demands to remove
working VPNs from the Ios app store to facilitate mass surveillance.

This security model - surrendering your autonomy to a large company in
exchange for promises of protection - is what Bruce Schneier calls
"feudal security," though it should really be thought of as "manorial
security."

https://locusmag.com/2021/01/cory-doctorow-neofeudalism-and-the-digital-manor/

In manorial security, a small elite of mercantalist warlords get all the
property rights - the right to decide how the infrastructure is used -
and the rest of us get tenants' rights, the right to make limited use of
the warlords' property.

The warlords promise to defend us from bandits and build high walls to
keep the bandits out, but if someone suborns the warlord to acting
against us, those walls lock us *in*, leaving us helpless.

Indeed, the walls aren't just a protection, they're a temptation: anyone
who coerces or bribes a warlord into letting them inside the compound
enjoys a smorgasbord of defenseless prey - the walled garden becomes a
feedlot.

Which is why Neuenschwander is more wrong than right: Apple keeps out
the bad apps it finds, except when a powerful state makes it an offer it
can't refuse.

The fact that users are held prisoner to those judgments is an
invitation to states to make demands of Apple.

Which suggests a corollary: if Apple's users *could* sideload apps that
subverted harmful government orders, then those orders would be less
effective - and governments would be less tempted to make them in the
first place, and if they did anyway, users would have an out.

I don't know enough about North Dakota state politics to weigh the
bill's chances, but if it passes, it creates some fascinating
possibilities. ND is one of America's fiber optic powerhouses, with much
higher gigabit penetration than other states.

If moving your company to ND means that you get to retain 30% more of
your income - because you're no longer paying the app store tax - *and*
you get to save money on real-estate *and* all your employees get fiber,
well, that's pretty attractive.

To get a sense of what this could mean, check out the testimony of
Basecamp CTO David Heinemeier Hansson in support of the bill, describing
how Apple shook down his company for 30% of the revenues for Hey, its
innovative email reader.

https://m.signalvnoise.com/testimony-before-the-north-dakota-senate-industry-business-and-labor-committee/

"North Dakota has the opportunity to create this level playing field,
such that the next generation of software companies can be started
there, and if a team in Bismarck builds a better digital mouse trap,
they won’t be hampered by abusive, extortive demands for 30% of their
revenue from the existing big tech giants."

As Heinemeier Hansson points out, the bill is very short - 17 lines,
plus some recitals - and it's well-crafted...for the most part. One
thing jumps out though:

> 4. This section does not apply to a proprietor of a special-purpose
digital application distribution platform.

What's a "special-purpose digital application distribution platform?"

It's "a gaming console, music player, and other special-purpose devices
connected to the internet."

That is a seriously weird carve-out. Consoles *invented* the app store
business model, and they use it aggressively today to screw games
studios and gamers. Exempting them from this is like exempting printers
from a ban on high-priced consumables.

And all those other "special purpose" devices - smart speakers, medical
implants, home automation systems, etc - are just as prone to being
monopolized and produce just as many harms for their users through
anticompetitive app store conduct as phones do.

They're overwhelmingly made by the same companies that operate abusive
app stores for phones, which means that if this carve out was created by
lobbyists, it's weird that they didn't lobby for a carve out for phones,
too.

_,.-'~'-.,__,.-'~'-.,__,.-'~'-.,__,.-'~'-.,__,.-'~'-.,_

🧙🏿‍♂️ This day in history

#15yrsago Open Source Hardware Definition turns 1.0
https://freedomdefined.org/OSHW

#10yrsago Steampunk fetish mask with ear-horn
https://bob-basset.livejournal.com/156159.html

#5yrsago Facebook’s “Free Basics” and colonialism: an argument in six
devastating points
https://www.theatlantic.com/technology/archive/2016/02/facebook-and-the-new-colonialism/462393/

#5yrsago UK surveillance bill condemned by a Parliamentary committee,
for the third time
https://www.wired.co.uk/article/strasburger-ip-bill-rewritten

#5yrsago Disgraced ex-sheriff of LA admits he lied to FBI, will face no
more than 6 months in prison
https://www.latimes.com/local/lanow/la-me-ln-ex-l-a-county-sheriff-baca-jail-scandal-20160210-story.html

#5yrsago Celebrate V-Day like an early feminist with these Suffragist
Valentines
https://www.lwv.org/blog/votes-women-vintage-womens-suffrage-valentines

#5yrsago Haunted by a lack of young voter support, Hillary advertises on
the AOL login screen
https://www.washingtonexaminer.com/tag/hillary-clinton?source=%2Fweekly-standard%2Fhillary-reaches-base-with-aol-login-page-ad

_,.-'~'-.,__,.-'~'-.,__,.-'~'-.,__,.-'~'-.,__,.-'~'-.,_

🧙🏿‍♂️ Colophon

Today's top sources: Waxy (https://waxy.org/), Naked Capitalism
(https://www.nakedcapitalism.com/), Slashdot (https://slashdot.org/).

Currently writing:

* My next novel, "The Lost Cause," a post-GND novel about truth and
reconciliation. Yesterday's progress: 546 words (109322 total).

* A short story, "Jeffty is Five," for The Last Dangerous Visions.
Yesterday's progress: 253 words (4547 total).

Currently reading: Analogia by George Dyson.

Latest podcast: Someone Comes to Town, Someone Leaves Town (part 30)
https://craphound.com/articles/2021/01/31/someone-comes-to-town-someone-leaves-town-part-30/

Upcoming appearances:

* Boskone, 58, Feb 12-15, https://boskone.org/

* Keynote, NISO Plus, Feb 22,
https://niso.plus/cory-doctorow-to-keynote-at-niso-plus-2021/

* Technology, Self-Determination, and the Future of the Future (Purdue
CERIAS), Feb 17,
https://www.cerias.purdue.edu/news_and_events/events/security_seminar/details/index/2njk1v59j4vdc3supiespncgr6

*  Mellon Sawyer Seminar on Contemporary Political Struggle: Social
Movements, Social Surveillance, Social Media (with Zeynep Tufekci), Feb
24, https://ucdavis.zoom.us/webinar/register/WN_I99f4x8WRiKCfKUljVcYPg

* World Ethical Data Forum keynote, Mar 17-19,
https://worldethicaldataforum.org/wedf-2020

* Interop: Self-Determination vs Dystopia (FITC), Apr 19-21,
https://fitc.ca/presentation/interop/

Recent appearances:

* Chop Shop Economics
https://soundcloud.com/chopshopeconomics/unlocked-special-episode-9-cory-doctorow/s-VzUA5S25But

* Monocle Reads
https://monocle.com/radio/shows/meet-the-writers/monocle-reads-87/play/

* Hedging Bets on the Future (Motherboard Cyber):
https://play.acast.com/s/cyber/hedgingbetsonthefuturewithauthorcorydoctorow

Latest book:

* "Attack Surface": The third Little Brother novel, a standalone
technothriller for adults. The *Washington Post* called it "a political
cyberthriller, vigorous, bold and savvy about the limits of revolution
and resistance." Order signed, personalized copies from Dark Delicacies
https://www.darkdel.com/store/p1840/Available_Now%3A_Attack_Surface.html

* "How to Destroy Surveillance Capitalism": an anti-monopoly pamphlet
analyzing the true harms of surveillance capitalism and proposing a
solution.
https://onezero.medium.com/how-to-destroy-surveillance-capitalism-8135e6744d59
(print edition:
https://bookshop.org/books/how-to-destroy-surveillance-capitalism/9781736205907)

* "Little Brother/Homeland": A reissue omnibus edition with a new
introduction by Edward Snowden:
https://us.macmillan.com/books/9781250774583; personalized/signed copies
here:
https://www.darkdel.com/store/p1750/July%3A__Little_Brother_%26_Homeland.html

* "Poesy the Monster Slayer" a picture book about monsters, bedtime,
gender, and kicking ass. Order here:
https://us.macmillan.com/books/9781626723627. Get a personalized, signed
copy here:
https://www.darkdel.com/store/p1562/_Poesy_the_Monster_Slayer.html.

This work licensed under a Creative Commons Attribution 4.0 license.
That means you can use it any way you like, including commercially,
provided that you attribute it to me, Cory Doctorow, and include a link
to pluralistic.net.

https://creativecommons.org/licenses/by/4.0/

Quotations and images are not included in this license; they are
included either under a limitation or exception to copyright, or on the
basis of a separate license. Please exercise caution.

_,.-'~'-.,__,.-'~'-.,__,.-'~'-.,__,.-'~'-.,__,.-'~'-.,_

🧙🏿‍♂️ How to get Pluralistic:

Blog (no ads, tracking, or data-collection):

Pluralistic.net

Newsletter (no ads, tracking, or data-collection):

https://pluralistic.net/plura-list

Mastodon (no ads, tracking, or data-collection):

https://mamot.fr/web/accounts/303320

Twitter (mass-scale, unrestricted, third-party surveillance and
advertising):

https://twitter.com/doctorow

Tumblr (mass-scale, unrestricted, third-party surveillance and advertising):

https://mostlysignssomeportents.tumblr.com/tagged/pluralistic

"*When life gives you SARS, you make sarsaparilla*" -Joey "Accordion
Guy" DeVilla

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 195 bytes
Desc: OpenPGP digital signature
URL: <http://mail.flarn.com/pipermail/plura-list/attachments/20210211/8fb606d6/attachment.sig>