Reading [entries|reading|network|archive]
simont

[ userinfo | dreamwidth userinfo ]
[ archive | journal archive ]

[syndicated profile] schneier_no_tracking_feed Wed 2025-11-19 12:04
Legal Restrictions on Vulnerability Disclosure

Posted by Bruce Schneier

Kendra Albert gave an excellent talk at USENIX Security this year, pointing out that the legal agreements surrounding vulnerability disclosure muzzle researchers while allowing companies to not fix the vulnerabilities—exactly the opposite of what the responsible disclosure movement of the early 2000s was supposed to prevent. This is the talk.

Thirty years ago, a debate raged over whether vulnerability disclosure was good for computer security. On one side, full disclosure advocates argued that software bugs weren’t getting fixed and wouldn’t get fixed if companies that made insecure software wasn’t called out publicly. On the other side, companies argued that full disclosure led to exploitation of unpatched vulnerabilities, especially if they were hard to fix. After blog posts, public debates, and countless mailing list flame wars, there emerged a compromise solution: coordinated vulnerability disclosure, where vulnerabilities were disclosed after a period of confidentiality where vendors can attempt to fix things. Although full disclosure fell out of fashion, disclosure won and security through obscurity lost. We’ve lived happily ever after since.

Or have we? The move towards paid bug bounties and the rise of platforms that manage bug bounty programs for security teams has changed the reality of disclosure significantly. In certain cases, these programs require agreement to contractual restrictions. Under the status quo, that means that software companies sometimes funnel vulnerabilities into bug bounty management platforms and then condition submission on confidentiality agreements that can prohibit researchers from ever sharing their findings.

In this talk, I’ll explain how confidentiality requirements for managed bug bounty programs restrict the ability of those who attempt to report vulnerabilities to share their findings publicly, compromising the bargain at the center of the CVD process. I’ll discuss what contract law can tell us about how and when these restrictions are enforceable, and more importantly, when they aren’t, providing advice to hackers around how to understand their legal rights when submitting. Finally, I’ll call upon platforms and companies to adapt their practices to be more in line with the original bargain of coordinated vulnerability disclosure, including by banning agreements that require non-disclosure.

And this is me from 2007, talking about “responsible disclosure”:

This was a good idea—and these days it’s normal procedure—but one that was possible only because full disclosure was the norm. And it remains a good idea only as long as full disclosure is the threat.

LinkReply
[personal profile] andrewducker Wed 2025-11-19 12:00
Interesting Links for 19-11-2025
LinkReply
[syndicated profile] questionable_content_feed Tue 2025-11-18 21:56
Another Mortifying Ordeal

beep beep dumpling car beep beep

LinkReply
[syndicated profile] hacker_news_daily_feed Wed 2025-11-19 00:00
Daily Hacker News for 2025-11-18

The 10 highest-rated articles on Hacker News on November 18, 2025 which have not appeared on any previous Hacker News Daily are:

LinkReply
[personal profile] kaberett Tue 2025-11-18 22:52
[embodiment] ... ha

"Ugh," I thought, "why am I feeling weirdly migrainey? My Next Phase Of The Menstrual Cycle is very much not due for like another week? I've been weirdly super regular basically since it reasserted itself post-surgery?"

... TURNS OUT that I had lost track of time a bit and I'm not a solid week early at all, it's a whole two days. This Means Some Things:

  1. ... still super regular by my pre-surgical standards,
  2. I will not be at the worst stage of my cycle during Significant Travel next week, and LAST BUT VERY MUCH NOT LEAST
  3. the migraine is still in fact very clearly associated with hormonal changes even when I'm not expecting them, take THAT Headache Is The Second Most Common Form Of Psychosomatic Pain ~statistics~ (and ongoing anxiety).
LinkReply
[personal profile] ewx Tue 2025-11-18 20:21
Badgers in the garden
Two Videos )
Link1 comment | Reply
[syndicated profile] schneier_no_tracking_feed Tue 2025-11-18 12:01
AI and Voter Engagement

Posted by Bruce Schneier

Social media has been a familiar, even mundane, part of life for nearly two decades. It can be easy to forget it was not always that way.

In 2008, social media was just emerging into the mainstream. Facebook reached 100 million users that summer. And a singular candidate was integrating social media into his political campaign: Barack Obama. His campaign’s use of social media was so bracingly innovative, so impactful, that it was viewed by journalist David Talbot and others as the strategy that enabled the first term Senator to win the White House.

Over the past few years, a new technology has become mainstream: AI. But still, no candidate has unlocked AI’s potential to revolutionize political campaigns. Americans have three more years to wait before casting their ballots in another Presidential election, but we can look at the 2026 midterms and examples from around the globe for signs of how that breakthrough might occur.

How Obama Did It

Rereading the contemporaneous reflections of the New York Times’ late media critic, David Carr, on Obama’s campaign reminds us of just how new social media felt in 2008. Carr positions it within a now-familiar lineage of revolutionary communications technologies from newspapers to radio to television to the internet.

The Obama campaign and administration demonstrated that social media was different from those earlier communications technologies, including the pre-social internet. Yes, increasing numbers of voters were getting their news from the internet, and content about the then-Senator sometimes made a splash by going viral. But those were still broadcast communications: one voice reaching many. Obama found ways to connect voters to each other.

In describing what social media revolutionized in campaigning, Carr quotes campaign vendor Blue State Digital’s Thomas Gensemer: “People will continue to expect a conversation, a two-way relationship that is a give and take.”

The Obama team made some earnest efforts to realize this vision. His transition team launched change.gov, the website where the campaign collected a “Citizen’s Briefing Book” of public comment. Later, his administration built We the People, an online petitioning platform.

But the lasting legacy of Obama’s 2008 campaign, as political scientists Hahrie Han and Elizabeth McKenna chronicled, was pioneering online “relational organizing.” This technique enlisted individuals as organizers to activate their friends in a self-perpetuating web of relationships.

Perhaps because of the Obama campaign’s close association with the method, relational organizing has been touted repeatedly as the linchpin of Democratic campaigns: in 2020, 2024, and today. But research by non-partisan groups like Turnout Nation and right-aligned groups like the Center for Campaign Innovation has also empirically validated the effectiveness of the technique for inspiring voter turnout within connected groups.

The Facebook of 2008 worked well for relational organizing. It gave users tools to connect and promote ideas to the people they know: college classmates, neighbors, friends from work or church. But the nature of social networking has changed since then.

For the past decade, according to Pew Research, Facebook use has stalled and lagged behind YouTube, while Reddit and TikTok have surged. These platforms are less useful for relational organizing, at least in the traditional sense. YouTube is organized more like broadcast television, where content creators produce content disseminated on their own channels in a largely one-way communication to their fans. Reddit gathers users worldwide in forums (subreddits) organized primarily on topical interest. The endless feed of TikTok’s “For You” page disseminates engaging content with little ideological or social commonality. None of these platforms shares the essential feature of Facebook c. 2008: an organizational structure that emphasizes direct connection to people that users have direct social influence over.

AI and Relational Organizing

Ideas and messages might spread virally through modern social channels, but they are not where you convince your friends to show up at a campaign rally. Today’s platforms are spaces for political hobbyism, where you express your political feelings and see others express theirs.

Relational organizing works when one person’s action inspires others to do this same. That’s inherently a chain of human-to-human connection. If my AI assistant inspires your AI assistant, no human notices and one’s vote changes. But key steps in the human chain can be assisted by AI. Tell your phone’s AI assistant to craft a personal message to one friend—or a hundred—and it can do it.

So if a campaign hits you at the right time with the right message, they might persuade you to task your AI assistant to ask your friends to donate or volunteer. The result can be something more than a form letter; it could be automatically drafted based on the entirety of your email or text correspondence with that friend. It could include references to your discussions of recent events, or past campaigns, or shared personal experiences. It could sound as authentic as if you’d written it from the heart, but scaled to everyone in your address book.

Research suggests that AI can generate and perform written political messaging about as well as humans. AI will surely play a tactical role in the 2026 midterm campaigns, and some candidates may even use it for relational organizing in this way.

(Artificial) Identity Politics

For AI to be truly transformative of politics, it must change the way campaigns work. And we are starting to see that in the US.

The earliest uses of AI in American political campaigns are, to be polite, uninspiring. Candidates viewed them as just another tool to optimize an endless stream of email and text message appeals, to ramp up political vitriol, to harvest data on voters and donors, or merely as a stunt.

Of course, we have seen the rampant production and spread of AI-powered deepfakes and misinformation. This is already impacting the key 2026 Senate races, which are likely to attract hundreds of millions of dollars in financing. Roy Cooper, Democratic candidate for US Senate from North Carolina, and Abdul El-Sayed, Democratic candidate for Senate from Michigan, were both targeted by viral deepfake attacks in recent months. This may reflect a growing trend in Donald Trump’s Republican party in the use of AI-generated imagery to build up GOP candidates and assail the opposition.

And yet, in the global elections of 2024, AI was used more memetically than deceptively. So far, conservative and far right parties seem to have adopted this most aggressively. The ongoing rise of Germany’s far-right populist AfD party has been credited to its use of AI to generate nostalgic and evocative (and, to many, offensive) campaign images, videos, and music and, seemingly as a result, they have dominated TikTok. Because most social platforms’ algorithms are tuned to reward media that generates an emotional response, this counts as a double use of AI: to generate content and to manipulate its distribution.

AI can also be used to generate politically useful, though artificial, identities. These identities can fulfill different roles than humans in campaigning and governance because they have differentiated traits. They can’t be imprisoned for speaking out against the state, can be positioned (legitimately or not) as unsusceptible to bribery, and can be forced to show up when humans will not.

In Venezuela, journalists have turned to AI avatars—artificial newsreaders—to report anonymously on issues that would otherwise elicit government retaliation. Albania recently “appointed” an AI to a ministerial post responsible for procurement, claiming that it would be less vulnerable to bribery than a human. In Virginia, both in 2024 and again this year, candidates have used AI avatars as artificial stand-ins for opponents that refused to debate them.

And yet, none of these examples, whether positive or negative, pursue the promise of the Obama campaign: to make voter engagement a “two-way conversation” on a massive scale.

The closest so far to fulfilling that vision anywhere in the world may be Japan’s new political party, Team Mirai. It started in 2024, when an independent Tokyo gubernatorial candidate, Anno Takahiro, used an AI avatar on YouTube to respond to 8,600 constituent questions over a seventeen-day continuous livestream. He collated hundreds of comments on his campaign manifesto into a revised policy platform. While he didn’t win his race, he shot up to a fifth place finish among a record 56 candidates.

Anno was RECENTLY elected to the upper house of the federal legislature as the founder of a new party with a 100 day plan to bring his vision of a “public listening AI” to the whole country. In the early stages of that plan, they’ve invested their share of Japan’s 32 billion yen in party grants—public subsidies for political parties—to hire engineers building digital civic infrastructure for Japan. They’ve already created platforms to provide transparency for party expenditures, and to use AI to make legislation in the Diet easy, and are meeting with engineers from US-based Jigsaw Labs (a Google company) to learn from international examples of how AI can be used to power participatory democracy.

Team Mirai has yet to prove that it can get a second member elected to the Japanese Diet, let alone to win substantial power, but they’re innovating and demonstrating new ways of using AI to give people a way to participate in politics that we believe is likely to spread.

Organizing with AI

AI could be used in the US in similar ways. Following American federalism’s longstanding model of “laboratories of democracy,” we expect the most aggressive campaign innovation to happen at the state and local level.

D.C. Mayor Muriel Bowser is partnering with MIT and Stanford labs to use the AI-based tool deliberation.io to capture wide scale public feedback in city policymaking about AI. Her administration said that using AI in this process allows “the District to better solicit public input to ensure a broad range of perspectives, identify common ground, and cultivate solutions that align with the public interest.”

It remains to be seen how central this will become to Bowser’s expected re-election campaign in 2026, but the technology has legitimate potential to be a prominent part of a broader program to rebuild trust in government. This is a trail blazed by Taiwan a decade ago. The vTaiwan initiative showed how digital tools like Pol.is, which uses machine learning to make sense of real time constituent feedback, can scale participation in democratic processes and radically improve trust in government. Similar AI listening processes have been used in Kentucky, France, and Germany.

Even if campaigns like Bowser’s don’t adopt this kind of AI-facilitated listening and dialog, expect it to be an increasingly prominent part of American public debate. Through a partnership with Jigsaw, Scott Rasmussen’s Napolitan Institute will use AI to elicit and synthesize the views of at least five Americans from every Congressional district in a project called “We the People.” Timed to coincide with the country’s 250th anniversary in 2026, expect the results to be promoted during the heat of the midterm campaign and to stoke interest in this kind of AI-assisted political sensemaking.

In the year where we celebrate the American republic’s semiquincentennial and continue a decade-long debate about whether or not Donald Trump and the Republican party remade in his image is fighting for the interests of the working class, representation will be on the ballot in 2026. Midterm election candidates will look for any way they can get an edge. For all the risks it poses to democracy, AI presents a real opportunity, too, for politicians to engage voters en masse while factoring their input into their platform and message. Technology isn’t going to turn an uninspiring candidate into Barack Obama, but it gives any aspirant to office the capability to try to realize the promise that swept him into office.

This essay was written with Nathan E. Sanders, and originally appeared in The Fulcrum.

LinkReply
[personal profile] andrewducker Tue 2025-11-18 12:00
Interesting Links for 18-11-2025
Link7 comments | Reply
[syndicated profile] questionable_content_feed Mon 2025-11-17 21:29
Keeping It Together

she's got one hell of a poker face

LinkReply
[syndicated profile] hacker_news_daily_feed Tue 2025-11-18 00:00
Daily Hacker News for 2025-11-17

The 10 highest-rated articles on Hacker News on November 17, 2025 which have not appeared on any previous Hacker News Daily are:

LinkReply
[syndicated profile] xkcd_feed Mon 2025-11-17 05:00
EPIRBs
'Oh no, the box is drifting out into the harbor!' 'Yeah, I wouldn't worry about losing it.'
Link1 comment | Reply
[syndicated profile] schneier_no_tracking_feed Mon 2025-11-17 12:05
More Prompt||GTFO

Posted by Bruce Schneier

The next three in this series on online events highlighting interesting uses of AI in cybersecurity are online: #4, #5, and #6. Well worth watching.

LinkReply
[personal profile] andrewducker Mon 2025-11-17 12:00
Interesting Links for 17-11-2025
Link9 comments | Reply
[syndicated profile] questionable_content_feed Sun 2025-11-16 22:00
Taint One, Taint The Other

could be both a ponzi scheme AND a sex cult

Link1 comment | Reply
[syndicated profile] hacker_news_daily_feed Mon 2025-11-17 00:00
Daily Hacker News for 2025-11-16

The 10 highest-rated articles on Hacker News on November 16, 2025 which have not appeared on any previous Hacker News Daily are:

LinkReply
[personal profile] kaberett Sun 2025-11-16 22:36
vital functions

... has done so many things and is Going To Bed and will fill in this placeholder Tomorrow.

Reading. Descartes, Gouldercourt et al., Clifford )

Forgotten Fruits (Christopher Stocks) got auto-returned to the library for a second time while I was still, like, a third of the way into it. I am going to try to take the DNF with grace this time, but the Completionist Itch is still there...

Writing. Grumpy e-mails to HMPO. Grumpy e-mails to uk.bookshop.org (on the plus side, the book I bought from them now has a shiny wee DRM-free tag! on the downside, I can download it in neither of the browsers I've tried so far.) Mental drafting of context-setting on movement and sleep, which really need to get out of my head and onto the page.

Playing. Inkulinati! We have Completed All Three Journeys. In the second stage we achieved an absolutely bullshit strategy that made things astonishingly easy; the third stage (with SEAL) was much harder work.

Little bit more I Love Hue.

Cooking. Two things of particular note, of which the first was ridiculous parsnip risotto with thyme pesto from The Modern Vegetarian, extremely good, would very happily eat again but I'm more dubious about the prospect of cooking it again, though I will concede it would probably go faster now I know what I'm doing.

Item the second was THE MEDLAR STICKY TOFFEE PUDDING. I am not entirely convinced I can actually detect the, you know, medlar, but it is very tasty.

Elsewise I have two batches of medlar jelly on the go (first batch did not set properly, BAH, I have not made enough jam recently, so I'm going to need to redecant and reboil that before I move on to the spiced) and some ridiculous quince sorbet that needs forcing through the sieve before churning.

And I have still not touched the apples.

Eating. Saturday lunch at Holtwhites Bakery :)

Exploring. Stupid little walk on Sunday revealed unto us, among other things: a pair of cyclamen in a bit of the verge outside our house we don't normally walk past; a discarded fork; a local bush of Purple Metallic Berries; a secret holly hedge.

Growing. SEEDS arrived. Jalapeños (at least at home) turning red.

LinkReply
[personal profile] andrewducker Sun 2025-11-16 12:13
Photo cross-post


After several hours of hammering and some excellent assistance from Sophia, we have constructed a child-stacking device.

(Side-pieces to be constructed tomorrow)
Original is here on Pixelfed.scot.

Link10 comments | Reply
[personal profile] andrewducker Sun 2025-11-16 12:00
Interesting Links for 16-11-2025
Link4 comments | Reply
[syndicated profile] hacker_news_daily_feed Sun 2025-11-16 00:00
Daily Hacker News for 2025-11-15

The 10 highest-rated articles on Hacker News on November 15, 2025 which have not appeared on any previous Hacker News Daily are:

LinkReply
[personal profile] kaberett Sat 2025-11-15 23:30
[food] medlar jelly recipe

Irritatingly, the medlar jelly recipe I used last time I made the stuff, over at the RHS, is no longer extant (web.archive.org link!). Herewith my own readily findable copy of the thing, plus my notes on what I'm actually doing this time around.

(For amusement: I apparently first found the medlar sticky toffee pudding recipe in 2023...)

Recipe as written )

Notes )

Link1 comment | Reply
navigation
[ viewing | most recent entries ]
[ go | earlier ]