garrett

joined 1 year ago
[–] garrett@infosec.pub 5 points 1 month ago

Will this stand up to the death of Chevron deference? Or are we 3 weeks away from a judge throwing the rule out unless congress passes a specific law.

I think this is squarely in the charter of the FTC but who knows with the courts any longer. We just saw them strike down a ruling by the EPA to enact health measures under the requirements of the Civil Rights Act.

[–] garrett@infosec.pub 1 points 1 month ago* (last edited 1 month ago)

There's a balance to be struck here but Cloudflare is truly the most miserable entity I have to work with from an abuse perspective. They're not necessarily "ignoring" warrants but most phishing doesn't get reported with a legal takedown request. In those cases, Cloudflare will be almost intentionally obtuse. I'm happy to outline the misery of a host working with Cloudflare but it's not necessarily important to this. TLDR; Cloudflare takes steps that don't make sense for its "we're not responsible" stance while also having zero automation in the year of our lord 2024.

I suppose everything could be a legal request but that just makes the whole process so infinitely worse for NGOs like Spamhaus and only serves to make lawyers excited that their consultation fees are going up. I see that the laziest pathway is "Youtube-like strikes" which is misery as well but they could just shift to investigating accounts receiving a high volume of reports as potential fraud or abuse actors since it is a drag on their services and these accounts are not paying or are paying with stolen credit cards.

Ultimately, I don't disagree with you that much but there's a lot of room for CF to improve their management of fraud & abuse without becoming a trash platform or invalidating legal protections. Happy to get into the weeds on this a bit more since it's a lil' bit close to home. 😅

[–] garrett@infosec.pub 6 points 1 month ago

People who don’t work in fraud or abuse don’t understand how miserable Cloudflare is to work with. They have a single email box I can send to for identifying if I host a website that takes them days to respond to, no automation by the year of our lord 2024.

[–] garrett@infosec.pub 2 points 1 month ago (2 children)

It’s a bit more about how miserable it is to work with Cloudflare and their unwillingness to remove abuse in general, opting to say they’re “not the host” and that they cannot tell you where it is but they cannot do anything. It’s hardly an ethical decision to say that phishing and bulletproof hosting aren’t the bedfellows you want.

[–] garrett@infosec.pub 6 points 5 months ago (1 children)

Just started toying with Jellyfin for my media after Plex started being freaks about everything. I love PlexAmp though so anything that moves the needle on that is excellent. Tried some other players but currently, my setup only works in network and I’ll need to configure SSL somehow.

[–] garrett@infosec.pub 1 points 5 months ago (1 children)

That is a valid, nuanced take that this article and (seemingly) the legislation don’t get into.

[–] garrett@infosec.pub 1 points 5 months ago (3 children)

Of course ad-supported services are infringing on your privacy in a way but if you’re not ready to call Facebook a publicly-funded utility, it’s childish to act like it’s so essential that it should be entirely ad-free with no paid tier.

[–] garrett@infosec.pub 1 points 5 months ago (1 children)

Only cause they can’t interject ads while driving lol

[–] garrett@infosec.pub 1 points 5 months ago (5 children)

The point was that it’s apples to oranges. Monetization is kinda the key issue here unless you’re ready to declare Facebook a utility and publicly fund it. Personally, I’d rather we be rid of it entirely.

[–] garrett@infosec.pub 1 points 5 months ago (1 children)

And that is totally unreasonable collection, of course. It’s also completely incomparable to pretending that Facebook is as necessary as a car (at least in America).

[–] garrett@infosec.pub 2 points 5 months ago (13 children)

But there’s also no ad-supported cars.

[–] garrett@infosec.pub 3 points 7 months ago (3 children)

I don’t really disagree with you at all but repeatedly reminding us all that you’re “not surprised” isn’t the savvy commentary you think it is. Especially since it’s historically been the case that any service you pay money to has said “no, you own your content”.

The marker has just moved gradually on this with companies slowly adding more ownership clauses to their Terms of Service in ways that aren’t legible to average consumers. Now they’re cashing in on that ownership.

view more: next ›