Earlier quoted context omitted.
Just a side note, I found the name sad sre funny and blursed at the same time
Whats’ blursed mean?
Simultaneously blessed and cursed.
Abusing Go's Infrastructure
51–60 of 80 posts
Re: Abusing Go's Infrastructure
#52Earlier quoted context omitted.
An algorithm that processes private user data is by itself not invading anyone's privacy. It's clear to me that invasion of privacy only happens when humans look at private user data directly, or look at user data that's not sufficiently processed by an algorithm. Otherwise, something as simple as a spell checker would be an invasion of privacy because it literally looks at every word in an email you write. That's ab…
At least in my opinion, there's a big difference with where the data lives and where the checking algorithm is run. I don't think a spell checker would fall into what I'd consider a privacy concern as long as the spell checker is running locally on my device.
I don't work in the area of email nor Google but I see two problems.
1) you need to constantly update the spell checker so each time you say this is word or something like that most likely the data is send the problem is part of the data, I assume Google do something similar whit data send to span and mark as not spam. This is full email redirect and analysis not partial like old word processing.
2)I feel ai make this even more harder so now you can't simply check patterns as simply as before, and you need to check the whole content constantly
Re: Abusing Go's Infrastructure
#53W3C laid the groundwork for everything on the Web to be heavily cacheable, so it's weird that there are so few general-purpose proxy caches. Are publishers sending short "Cache-Control: max-age" or "Vary: Cookie" responses when they didn't need to? Are too many ISPs paying for transit rather than peering?
In general there's no way to ensure the cache hasn't tampered with the contents (e.g. ISP proxy ad injection on non HTTPS sites). For software downloads usually there are signatures and checksums. Arbitrary content, not so much.
Re: Abusing Go's Infrastructure
#54Earlier quoted context omitted.
Question, how would you know without invading the user's privacy?
Companies are legally obligated to scan for CSAM in the US.
I don't think that's accurate... Do you have a link?
I do think there is an obligation to report if any is found, but I don't think they need to look.
Re: Abusing Go's Infrastructure
#55Any online service that lets users upload material that is then publicly visible will eventually be used for command-and-control, copyright infringement and hosting CSAM. This is especially true for services that have other important uses besides file hosting and hence are hard to block. This already happened to Twitter[1], Telegram[2], and even the PGP key infrastructure[3], not to mention obvious suspects like GitH…
And Gmail and Google groups, and Google drive, and Gchat, on and on. The data you store doesn't even have to be public. With Gmail they would distribute credentials to log in and read attachments that they uploaded via imap. (I am a former Google SAD-SRE [Spam, Abuse, Delivery])
> I am a former Google SAD-SRE
From long enough ago that I should apologize to you for libgmail: https://libgmail.sourceforge.net ? :D
Re: Abusing Go's Infrastructure
#56W3C laid the groundwork for everything on the Web to be heavily cacheable, so it's weird that there are so few general-purpose proxy caches. Are publishers sending short "Cache-Control: max-age" or "Vary: Cookie" responses when they didn't need to? Are too many ISPs paying for transit rather than peering?
In general there's no way to ensure the cache hasn't tampered with the contents (e.g. ISP proxy ad injection on non HTTPS sites). For software downloads usually there are signatures and checksums. Arbitrary content, not so much.
There was HTTP SXG (signed exchanges) but it never seemed to get any traction https://web.dev/articles/signed-exchanges
Re: Abusing Go's Infrastructure
#57Off topic: took a look at the domain, had a foreboding on the innuendo, found mostly what I expected on put.as …
Yes, it is a spanish plural word. But....
Re: Abusing Go's Infrastructure
#58Earlier quoted context omitted.
I guess that was much more useful as a use case before pip started requiring you to be in a venv/virtualenv/pipenv/pyenv/whatever to download packages
I've never encountered this requirement in many years of daily use - pip for me has always happily installed anything if it can. Now I've definitely seen customized distributions of python from package managers that have taken steps to prevent you from using pip. IIRC, the python you get from `apt-get install python` in Debian does this? I.e., it's designed to support system utilities, not as a user's general purpose…
I'm not sure if that is upstream or an ununtu or debian patch, but that is the case on Ubuntu 24.04, at least unless you pass the --break-system-packages option.
Re: Abusing Go's Infrastructure
#59W3C laid the groundwork for everything on the Web to be heavily cacheable, so it's weird that there are so few general-purpose proxy caches. Are publishers sending short "Cache-Control: max-age" or "Vary: Cookie" responses when they didn't need to? Are too many ISPs paying for transit rather than peering?
In general there's no way to ensure the cache hasn't tampered with the contents (e.g. ISP proxy ad injection on non HTTPS sites). For software downloads usually there are signatures and checksums. Arbitrary content, not so much.
Maybe use cache only when Subresource Integrity is present.
https://developer.mozilla.org/en-US/docs/Web/Security/Subres...
Re: Abusing Go's Infrastructure
#60Earlier quoted context omitted.
I guess that was much more useful as a use case before pip started requiring you to be in a venv/virtualenv/pipenv/pyenv/whatever to download packages
I've never encountered this requirement in many years of daily use - pip for me has always happily installed anything if it can. Now I've definitely seen customized distributions of python from package managers that have taken steps to prevent you from using pip. IIRC, the python you get from `apt-get install python` in Debian does this? I.e., it's designed to support system utilities, not as a user's general purpose…
Sorta, although it is a Python feature for distros to use: installations can be marked as externally managed and pip will refuse (without being forced) to make changes unless in a venv[1][2]
1: PEP 668 https://peps.python.org/pep-0668/
2: https://packaging.python.org/en/latest/specifications/extern...