• 31 Posts
  • 88 Comments
Joined 1 year ago
cake
Cake day: June 12th, 2023

help-circle



  • The problem is that so many browsers leverage hardware acceleration and offer access to the GPUs. So yes, the browsers could fix the issue, but the underlying cause is the way GPUs handle data that the attack is leveraging. Fixing it would likely involve not using hardware acceleration.

    As these patterns are processed by the iGPU, their varying degrees of redundancy cause the lossless compression output to depend on the secret pixel. The data-dependent compression output directly translates to data-dependent DRAM traffic and data-dependent cache occupancy. Consequently, we show that, even under the most passive threat model—where an attacker can only observe coarse-grained redundancy information of a pattern using a coarse-grained timer in the browser and lacks the ability to adaptively select input—individual pixels can be leaked. Our proof-of-concept attack succeeds on a range of devices (including computers, phones) from a variety of hardware vendors with distinct GPU architectures (Intel, AMD, Apple, Nvidia). Surprisingly, our attack also succeeds on discrete GPUs, and we have preliminary results indicating the presence of software-transparent compression on those architectures as well.

    It sounds distantly similar to some of the canvas issues where the acceleration creates different artifacts which makes it possible to identify GPUs and fingerprint the browsers.



















  • That’s a decent start, but you need a browser that’s resistant to fingerprinting through some plugins and something like ublock origin that will block all embedded content. At some point, it may require you to use a phone number, and at that point you may have a problem. If you avoid that, one of the biggest threats are the facebook and related meta content placed on other pages around the internet. The pixel is one aspect, but almost any facebook content can still track you across sites. These are easily blocked with a decent adblocker and probably privacybadger too.

    I know lots of folks will disagree, but I’d care less about Facebook tracking you as they mostly only care about serving you ads and making content suggestions to keep you on the platform to view more ads. Facebook has never served me a relevant ad, and even with a lot of use still can’t recommend things I’m interested in. Data leaks and sharing is a concern, but that’s a concern with every site. I think when it comes to privacy, there’s far bigger concerns.




  • This has arguably always been the case. A century ago, it could take years to get something published and into a book form such that it could be taught, and even then it could take an expert to interpret it to a layperson.

    Today, the expert can not only share their research, they can do interviews and make tiktok videos about a topic before their research has been published. If it’s valuable, 500 news outlets will write clickbait, and students can do a report on it within a week of it happening.

    A decent education isn’t about teaching you the specifics of some process or even necessarily the state-of-the-art, it’s about teaching you how to learn and adapt. How to deal with people to get things accomplished. How to find and validate resources to learn something. Great professors at research institutions will teach you not only the state-of-the-art, but the opportunities for 10 years into the future because they know what the important questions are.




  • Many folks running instances take donations. Folks are happy to toss up a few bucks to help cover costs. Similar to how people are happy to hop on patreon and support whatever creators on a monthly basis. That’s where a lot of the core mastodon money comes from. There’s also grants from orgs and governments too to contribute.

    This isn’t a new concept, and the internet has always had services that worked like this. Usenet, mirrored file repositories, etc. It wasn’t until the early 2000s that many things started to become centralized, and we see how well that’s worked out.


  • THere were a few but they got bought (eg. tweetdeck).

    There are also 3rd party apps for mastodon that a lot of people like, and they try. But for many people, mimicking the parts of Twitter they value is difficult to do without proper backend support for supporting algorithms, and even then the way activitypub works it still makes it difficult to support for most developers.

    Two of the key features are discovering new or related content, which is hard to do in mastodon as it needs to calculate similarity across all of the profiles and their content in order to make recommendations – or collect data like your cell contacts to help you connect with people you already know. Most people don’t want contact sharing, and indexing all of the recommended profiles, especially across federated servers is challenging.

    The second is engagement based recommendations. Many social media users aren’t incredibly active. They want to open the app in specific moments to quickly catch up with everything since they last opened the app. To do this well, you need to know what they’ve engaged with and look back at content since they last logged on and rank it based on that. People may follow 1000 people, but really care about maybe 30-40 accounts the most. Friends, family, specific journalists or famous people. Mastodon just gives you like a sample of the last 50 or so items. If you follow anyone super active, you may just get a lot of noise in those updates.

    Obviously, there are times when everyone wants a linear timeline, but it depends upon their daily use.