@nprofile1q...

Can these children please move to a playground so the adults can work? Thanks!

@nprofile1q... Can someone or some cooperation please step in?

All we need is a Fediverse server like mastodon on a domain, with the stated idea you'll be in that part of the network as your work self.

Maybe suggest/ enforce the rel=me link trick, for verification at or shortly after on-boarding.

We could even run multiple servers with different flavors on a subdomain, so people know they are all in their work-avatar-space.

Anyway, let's destroy that network effect from the inside out.

@nprofile1q... that is certainly an option.

Although, if you already have access to the servers to bypass validation etc., I'm sure there would be easier ways to compromise Telegram endpoints.

Or did this presumed RCE include privesc/sandbox escape?

@nprofile1q...

From my translation:

"The vendor states that each sticker loaded on the platform undergoes a mandatory validation procedure on its servers before being deployed to client applications. According to this official location, the centralized filtering process prevents the use of corrupt stickers as an attack vector, making it technically impossible to execute malicious code via that method."

Just a gentle reminder, by their own admission, that everything you say or send on Telegram goes trough their servers in plain text.

This means that anyone with (bought or enforced) access to Telegram servers can read anything you say or send to anyone.

@nprofile1q...

if:

Files get synced externally,

And/or get changed in bulk,

And/or get deleted in bulk.

Stop transactions, contact owner, re-authenticate, and provide rollback from archive.

And Google, with the freaking BEST telemetry in the world, decided to throw in AI?!

What. The. Fuck.

Google used to employ engineers. People capable of solving problems. I can see why those all left.

@nprofile1q... we’re gonna need another cyber sticker groupbuy, don’t we? 😉

@nprofile1q...

I did mean to imply at least partial intent.

I’m sure people better equipped than me have been studying this and probably have better explanations, but the response of developers to the use of LLMs in software development reminds me of the attitude of guild members of old.

Sharing is caring my friends, and the democratisation of development is a good thing.

Not that I think LLMs are in any way contributing to that democratisation; I’d say genAI is just breaking the dependency on developers, to be replaced with an even worse dependency on big tech, with cognitive decline as a bonus.

@nprofile1q... @nprofile1q...

"It is not a problem for me, so it is not a problem."

Lather, rinse, repeat.

@nprofile1q...

Define "private".

If they were calling over normal telephone networks, that's only private as long as no one bothers to listen in.

If they were calling over Signal, someone has bothered quite a lot to listen in, and from one of the used devices.

If POLITICO confirms this was a Signal call, at least one end of the call was targeted.

If it was a regular phone call, anyone anywhere in between could have done this with a little effort. Side note: being a non-democratic state does reduce the amount of effort significantly.

That's a lot of "if"s, so I hope there will be follow-up from POLITICO.