Posts in Data (20 found)
Unsung Today

“No standard format for writing data to these tapes”

An 11-minute video from MattKC documenting huge effort to revive a backup tape from a 2000 game Frogger 2: Swampy’s Revenge: = 2x) and (width >= 700px)" srcset="https://unsung.aresluna.org/_media/no-standard-format-for-writing-data-to-these-tapes/yt1-play.2096w.avif" type="image/avif"> = 3x) or (width >= 700px)" srcset="https://unsung.aresluna.org/_media/no-standard-format-for-writing-data-to-these-tapes/yt1-play.1600w.avif" type="image/avif"> This is a pretty harrowing story of restoration, including an extremely obscure backup tape made by a short-lived Dutch company, attempts to reverse engineer a poorly documented data format, a data recovery company that damaged the tape instead of restoring it, and a mad hack to trick the drive into reading it anyway.

0 views
Simon Willison 1 weeks ago

Claude Haiku 5.5

As previously promised , here's Anthropic's new fast, low cost model: Introducing Claude Haiku 5.5 . The previous Haiku, 4.5, was very much showing its age. It came out almost a year ago , and was priced at $1/million input and $5/million output - relatively expensive even back then, and a full 10x the price of OpenAI's GPT-6 Luna , released last month. The new Haiku exactly matches the price of GPT-6 Luna - $0.10/$0.50 - up to 100,000 tokens. Beyond 100,000 tokens the price increases 5x to $0.50/$2.50. Luna itself has a price increase at 272,000 tokens but only to $0.20/$0.75. Haiku 5.5 also uses a new, less generous tokenizer. My Claude Token Counter tool shows that the same long prompt uses around 1.25x as many tokens with Haiku 5.5 compared to Haiku 4.5, so there's a hidden price increase there. If your workloads fit in 100,000 tokens, Haiku is the same price as Luna and reports higher benchmark scores. Above 100,000 tokens, Luna looks like a much better deal. The most recent release of llm-anthropic finally fixed it so I don't need to ship a new version of that plugin for every new model. I tested the new model like this: Here are pelicans for low, medium, high, xhigh, and max . The new Haiku doesn't let you disable reasoning, and defaults to . I got a good bicycle frame for everything beyond . The low effort pelican cost 0.0936 cents and took 7 seconds. This effort pelican (with a reasoning trace that starts "This is the classic pelican-on-bicycle SVG test...") took 5 minutes 9 seconds to generate, but still only cost me 3.3826 cents : (Since the reasoning trace exhibits awareness of the benchmark, here's Generate an SVG of an armadillo in fishnet tights jaywalking on Mars (on xhigh) , and the same prompt against some other recent models . Background on that .) For comparison, here's the pelican I got a year ago from Haiku 4.5 (for 0.7583 cents - Haiku 4.5 did not support reasoning levels). It sucked at drawing pelicans: In addition to Haiku 5.5, Anthropic announced today that they are halving the price of cache reads for Sonnet 5.5. They've also added API credits to subscription plans: Second, this week, we’ll roll out a new monthly API credit to all Max and Team subscribers for use on the Claude Platform . Max 5x users will get $100 in credits per month, Max 20x users will get $200, and Team subscribers will receive up to $500, pooled across their users. Claiming this is pleasantly easy: navigate to Settings -> Billing and select the API organization that should benefit from the credits every month: The API credits exactly match the cost of the subscription itself. This is really generous - it makes it much easier for subscribers to use the API. Anthropic also let you disable auto-reload for the API, with the consequence that "API requests will stop when your balance runs out" - exactly what you want if you're planning to burn through those API credits without risk of a nasty billing surprise . Note that the monthly credits do not roll over - use them or lose them. OpenAI still allow you to use your Codex subscription for personal API use, which works out as a better deal for heavy API users. This new credit scheme goes at least some way to overcoming that difference. You are only seeing the long-form articles from my blog. Subscribe to /atom/everything/ to get all of my posts, or take a look at my other subscription options .

0 views
Evan Schwartz 1 weeks ago

Scour - September Update

Hi friends, In September, Scour scoured 1.2 million articles (up from ~880,000 in August) from 28,568 feeds . Also, welcome to the 116 new users who signed up since my last product update email! Here's what's new in the product: You can now find all of your saved, loved, and liked posts, as well as your full reading history, in the Library section. Also, if you click Read on Scour for any article, that page now has tabs for the article's content, other posts that it cites and that cite it, and the feeds it was found in. Here's an example for a widely cited post. Scour now tries to determine the level of expertise each post assumes and infers the level of expertise you have per topic (based on the wording of your interest is and the types of articles you click on or like). At least for me, this means I'm seeing far fewer beginner Rust questions from Reddit showing up in my feed. (For those in tech, this is powered by Jev.) Scour's Search will now show you results for feeds and authors, in addition to posts that match your query. Relatedly, you can now follow individual authors as sources and Scour will try to show you their posts from any website they publish on. Scour now detects and hides more junk, ranging from sales pages and SEO garbage to uninformative link roundups and low-value discussion threads. You should see more high-quality content in your feeds. By my current count, about 1 in 10 posts being shown before was some kind of junk that Scour now hides. I continue to obsess over making Scour feel super fast and snappy. In September the slowest feed loads got about 7x faster (p99 went from 2.1 seconds to 282 milliseconds) and the median feed load time got 2x faster (p50 went from 90 ms to 40 ms). This is also while ranking about 1.4x as much content as the month before. Unfortunately Reddit announced their plan to turn off RSS feeds on November 13th . This is how Scour checks which discussions are happening on Reddit and finds articles posted on different subreddits. After November 13th you'll no longer see links to the Reddit discussions from Scour 😢. Here are some of my favorite articles I found on Scour in September: Happy Scouring! - Evan The biggest news in the tech / AI world was the release of TypeSafe's Jev model . These were some of the related articles that I found interesting: The Latent Space interview with TypeSafe's CEO, Jev: System One models for Prod, not God — with Diogo Almeida, CEO, TypeSafe AI . Fingerprints of Jev and Jev's Architecture Unmasked were interesting black box investigations into Jev's base model using the tokenizer and other externally visible properties. Sixteen Models Walk Into a Storefront gives a very nice breakdown of techniques that can be used to manipulate LLMs' assessments of which products to buy and how much to pay for products. Logo Design Trends in 2027 Favor Marks Someone Can Prove They Made . In the age of AI-generated glossy slop, this is no surprise, but it's a nice write-up. The engineering behind the US Strategic Petroleum Reserve . Quite random but an interesting read. I Judged My Mum for Overusing AI, Until I Caught Myself Doing Worse . I continue to appreciate Sid's commentary on the age of AI. This is very relatable.

0 views
Robin Moffatt 2 weeks ago

Interesting links - September 2026

I’m going to try to avoid falling into the trap of making a bad pun about the season…damnit! ;-) Welcome to the September edition of Interesting Links in the Data and AI World . It’s a bumper edition (aren’t they always), with lots and lots about Kafka and related technologies in particular this month. Oh, and AI. Obvs.

0 views
Stratechery 3 weeks ago

2026.38: Doomforce

Welcome back to This Week in Stratechery! As a reminder, each week, every Friday, we’re sending out this overview of content in the Stratechery bundle; highlighted links are free for everyone . Additionally, you have complete control over what we send to you. If you don’t want to receive This Week in Stratechery emails (there is no podcast), please uncheck the box in your delivery settings . On that note, here were a few of our favorites this week. This week’s Stratechery video is on Write Things Down . The View From Anywhere But San Francisco . It is exciting to talk about AI because there are so many unknowns; it is incredibly frustrating to talk about AI doom…because there are so many unknowns. Indeed, that’s the pushback I had on Stratechery and Sharp Tech to the debates of the last week: viewpoints that don’t harbor dissent inevitably lead to bad outcomes. The best read on the matter, however, was Andrew’s Sharp Text article Some of All Fears , that had a simple request: let’s actually solve real problems when they are, in fact, real. — Ben Thompson The Limited Potential for a Pacing Deal.  After a week of speculation over whether China would ever agree to a deal with the U.S. to slow down AI development, Bill and I discussed that question at length on this week’s episode of Sharp China , as well as why the CCP’s past successes controlling technology (they did in fact nail jello to the wall ) may inform its apparent confidence in its ability to manage AI risk. At the end, I also found it interesting to learn that rising discontent across Chinese social media is not necessarily a reflection of the limits of that aforementioned censorship, but possibly a window into how the Party manages social malaise.  — AS The Salesforce Zag. We didn’t get a chance to discuss this on Sharp Tech this week (we had too much existential dread to address), but I loved Wednesday’s Update on Dreamforce and Salesforce’s integration with Anthropic. In what appears to be a climbdown from his colorful commitment to AgentForce in 2024 , CEO Marc Benioff is now going the opposite direction from other enterprise AI players and leaning into Anthropic and OpenAI chatbots as the preferred UI of his customers. Rather than fight the AI tide, Salesforce will swim with it and charge a premium for it (with the caveat that these particular currents may lead to a world in which the SaaS beachhead is eroded for everyone). — Andrew Sharp Pacing the Frontier, AI’s Digital Limits, AI Commissars — Dario Amodei wants to pace the frontier; it’s an unrealistic proposal that seems mostly geared to political control of AI. OpenAI Ads, Amazon Ads in ChatGPT, Walmart to Accept Apple Pay — ChatGPT ads are working, and solve Amazon’s biggest problem with chatbots. Then, Walmart finally gives in to Apple Pay, because fighting the status quo is hard. Salesforce AI Force, Agents as UI, The Race to Headless — Salesforce is abandoning UI as a moat, which is a very smart move because it’s disappearing for everyone. An Interview with Joanna Stern About the iPhone Duo and AI for Normal People Some of All Fears — AI anxiety is rational, but the conversation over the past 10 days has been absurd and irresponsible. Football and the Frontier iPhone 18 Pro Silicon Valley’s Got That Energy (But No Compute) Exxon’s Office Fling The Limited Potential for a Pacing Deal; MSS on PRC AI Risks; Distillation and Data Security; The Party’s Approach to Social Media Searching for the 2026 Protagonists, The Six Most Confusing Teams This Season, Surveying the Southwest Division Doom Debates Go Mainstream, AI Religion and the Economic Future, Several Vectors of the China Question

0 views

Data Broker Radaris Loses Domains in Privacy Fight

The consumer data broker Radaris.com has long had a reputation for ignoring requests to remove personal information from its vast empire of people-search services online. That reputation caught up with the company recently in a lawsuit alleging Radaris violated a New Jersey privacy law that provides for hefty fines against data brokers that publish personal information on state law enforcement officials. In the face of repeated stonewalling and prevarication by attorneys for Radaris, the judge in the case ordered that radaris.com and more than a dozen other data broker domains be transferred to the plaintiffs. The radaris.com website, prior to the domain transfer to Atlas. In February 2024, Radaris was sued by Atlas Data Privacy Corp , a company that has been pursuing data brokers alleged to be violating a New Jersey statute called Daniel’s Law . The statute allows state law enforcement officials, government personnel, judges and their families to have their information completely removed from commercial data brokers and people-search services, and provides for fines of $1,000 per violation against companies that ignore removal requests. Less than a month after Atlas sued Radaris, KrebsOnSecurity published a deep dive into the Radaris co-founders — Igor and Dmitry Lubarsky (also spelled Lybarsky) — Russian-born brothers living in Massachusetts who operate a dizzying array of people-search companies as well as a number of Russian language dating services and affiliate programs. Attorneys for the Lubarsky brothers threatened to sue for defamation if the story wasn’t removed and an apology issued. Their attorney asserted that our reporting was wildly inaccurate, and that the true owners of the company were Ukrainians living in Ukraine. The Lubarsky brothers Dmitry or “Dan” (left) and Gary/Igor. KrebsOnSecurity doubled down and showed how the Lubarsky brothers built and operated Radaris and other data broker companies using a fictitious CEO’s name . Our follow-up story noted that Radaris’s attorney — a lawyer with the Boston Law Group named Val Gurvits — admitted his clients had invented the CEO pseudonym “ Gary Norden ,” and that Radaris also had issued multiple press releases over the years that quoted the fake CEO while seeking money from potential investors. Attorneys for Radaris waited until the last minute to appear in court and contest what was all but certain to be a default judgment in favor of the plaintiffs, and then told the court that Atlas had failed to serve the real owners and operators of Radaris and several of its sister data broker companies. Atlas re-filed the lawsuit in June 2025, this time dramatically expanding the number of Radaris family data brokers accused of violating Daniel’s Law. Matt Adkisson , president and CEO of Atlas, said Radaris turned to a tried-and-true playbook: Delaying in court until the last possible minute, and playing shell games with Radaris’s true country of origin and the individuals listed as owners and operators of these sites. “We refer to this period as their island-hopping phase. Privacy policies changed constantly, and new entities kept appearing from places like the Marshall Islands, the British Virgin Islands, and Seychelles,” Adkisson told KrebsOnSecurity. “Behind the scenes, it felt like a shell game. Defense lawyers told the court that certain entities merely operated the domains and were the proper parties to sue. But by the time a judgment neared, those entities would be discarded and new entities would appear. Meanwhile, the lawyers claimed the other entities that actually owned the domains should not be held responsible.” Adkisson said when the defendants updated their terms of service to state that Radaris was suddenly managed by a company in the Marshall Islands, Atlas hired an investigator in that country and soon learned the brand new entity that Radaris claimed was managing the company didn’t even exist yet. Mr. Gurvits stepped forward as Radaris’s attorney in a class action lawsuit the company temporarily lost in 2017 because it never contested the claim in court. When the plaintiffs told the judge they couldn’t collect on the $7.5 million default judgment, the court ordered the domain registry Verisign to transfer the radaris.com domain name to the plaintiffs. Mr. Gurvits appealed that verdict, arguing the lawsuit hadn’t named the actual owners of the Radaris domain name — a Cyprus company called Bitseller Expert Limited  — and thus taking the domain away would be a violation of their due process rights. The judge in the 2017 case ruled in Radaris’ favor — halting the domain transfer — and told the plaintiffs they could refile their complaint. Soon after, the operator of Radaris changed from Bitseller to Andtop Company , an entity  formed  (PDF) in the  Marshall Islands in Oct. 2020. The plaintiffs never re-filed their lawsuit. A mind map of various entities tied to Radaris and the company’s co-founders. Click to enlarge. “That seemed to be their modus operandi,” said Raj Parikh , a partner at PEM Law in New Jersey who handles most of the Daniel’s Law litigation for Atlas. “In the past, they won by attrition. Plaintiffs’ attorneys tired of the procedural games and just gave up. That strategy worked for a decade, and it probably would have worked in this case too, since any financial recovery from foreign actors will be difficult. But we were acutely aware of the threat this website posed to law enforcement officers and other public officials in New Jersey, and decided early on to commit whatever time and resources were necessary to remove that threat.” On August 26, the judge in the New Jersey case found the defendants were given multiple chances to appear and defend the claims against them but had failed to do so. Mr. Gurvits declined to comment on the case, saying it had been assigned to another attorney, a Mr. Victor Worms . In response to questions, Mr. Worms asserted the New Jersey court transferred Radaris.com to Atlas as part of a default judgment against Radaris.com, which is not a legal entity. “We have made a motion to vacate that default judgment on the grounds that it is void since a non-entity has no legal capacity to sue or be sued,” Worms replied. “We also intend to pursue all appropriate appeals because we believe the transfer of Radaris.com amounts to a forfeiture in violation of various constitutional principles.” While radaris.com still comes up prominently in results when searching online for U.S. residents by name, the domain no longer sells detailed personal dossiers on millions of Americans. Its homepage now displays a notice from Atlas, as well as links to our previous reporting on Radaris. Atlas told KrebsOnSecurity that it has obtained more than 10,000 emails and documents in the course of litigation, and that those messages confirm our previous reporting on the owners and operators of Radaris and its myriad companies. Atlas said the emails clearly establish that the nominal legal vehicles — Radaris America, Inc. ; Bitseller Expert Limited ; Digital Orbit Corp ; Core Solutions Group Inc ; Lucky Solutions Inc ; Virtura Corp ; Veripages Inc. ; Nuform Solutions Inc. ; Growth Data Advisors Inc. ; Property Experts, Inc — are all administered by the same three or four people from the same mailboxes, share one bank or payment card set, and are all managed from one virtual office address. “The corpus establishes, with documentary evidence generated independently by banks, payment processors, hosting providers, registrars, software-as-a-service vendors and the operators’ own systems, that radaris.com and at least twenty-five other people-search websites are one operation run by a small Boston-area group whose administrative, financial and technical functions sit on the difive.com mail domain and its successors (centerex.com, scienteco.com, eprofit.com, realmo.com, pub360.com),” reads a summary shared by Atlas. Atlas said the emails show Radaris.com earns approximately $42,000 a month, while Veripages.com earns around $45,000 monthly via its partnership with the Lifetime Value Company , a marketing and advertising firm whose brands include PeopleLooker , PeopleSmart , NumberGuru , and Bumper , a car history site. According to Atlas, the emails also showed the Radaris family of websites earns as much as $25,000 each month from their partnership with Onerep , a company that claims to help people remove their information from people-search sites. In March 2024, KrebsOnSecurity revealed how the Belarusian founder of Onerep had launched and operated dozens of people-search sites over the years and was continuing to operate one of them (Nuwber), effectively spreading the disease and selling the cure. The domain radaris.com now redirects to this notice from Atlas about the court-ordered domain transfer. All told, the New Jersey court has so far transferred 14 domain names from the Radaris family of companies to Atlas. Radaris.com now redirects to a notice of the court-ordered domain transfer. The Radaris family of companies is still potentially facing fines of $1,000 per alleged violation of Daniel’s Law. For the time being, however, Daniel’s Law is facing a constitutional challenge from virtually all of the 150 other consumer data broker firms being sued by Atlas. The data broker industry responded by having at least 70 of the Atlas lawsuits moved to federal court, challenging the New Jersey statute as overly broad and a violation of the First Amendment. The U.S. Court of Appeals for the Third Circuit has not yet issued a decision on the constitutional challenge, but either way the case is widely expected to be appealed all the way to the U.S. Supreme Court. Meanwhile, at least 14 other states have now passed laws modeled after the New Jersey statute, with more states considering similar measures. However, West Virginia’s Daniel’s Law was ruled facially unconstitutional under the First Amendment by a federal district court in August 2025. Justin Sherman is a privacy expert and author of the forthcoming book “The Middlemen,” which examines how the data broker industry powers modern surveillance. Sherman said federal lawmakers have long faced intense lobbying by the technology industry against more restrictive U.S. data privacy laws, but that many powerful industries are now working against passing comprehensive data privacy legislation. “These days at the federal level, add in the intense amount of lobbying against these laws from social media companies, big tech, cryptocurrency firms, and now AI proponents in the mix who claim that limiting their data scraping is somehow going to collapse the whole U.S. economy under Chinese rule,” he said. Sherman said people-search companies will continue to thrive unless and until Congress enacts meaningful consumer privacy and data protection laws that are relevant to life in the 21st century. That’s because virtually all state privacy laws exempt records that might be considered “public” or “government” documents, including voting registries, property filings, marriage certificates, motor vehicle records, criminal records, court documents, death records, professional licenses, bankruptcy filings, and more. At least 25 states have passed or implemented laws requiring age verification for residents seeking to access adult content online, but there is no federal law that limits how the companies that are scanning everyone’s drivers license can use, share or keep the data provided. Had such restrictions been enshrined in law, we may have avoided the recent breach at IDScan.net , which exposed the drivers license information on more than 153 million Americans when the records were briefly turned into a point-and-click identity theft service on the dark web. “The average person can look at Daniel’s Law and have a perfectly normal reaction, which is that everyone should be covered, not just police and judges,” Sherman said. “But we don’t need more wake-up calls. We’ve had eight million wake-up calls already on the need for better privacy laws. The lack of comprehensive federal privacy law is not for a lack of knowledge, and anyone claiming otherwise is either not reading the news or kidding themselves.”

0 views
ava's blog 1 months ago

health data and broad consent

Health data is my biggest interest within data protection law. If my health would permit it, I would work in a hospital or pharmacy. I even originally set out to complete my traineeship in medical documentation at a hospital! It fell through because I would have had to move to another state. Alas, now I don't work in any medical settings, but I still work with health data in a boring building instead. Under Article 9 GDPR, health data is considered a special category of data (often called "sensitive data"), and processing is by default prohibited. Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation shall be prohibited. This data can be vast and overlap in practice - some medical information is biometric or genetic, some might refer to your ethnicity or the color of your skin, some will be sexual and cover sexual activity, orientation, or gender. Some is just plain diagnoses, or values, tests, prescriptions, or otherwise documented treatment for something. Health data is in this weird spot where most people do not wish to share it, but on the other hand, most of us are supportive of research and new scientific discoveries that could help prevent, treat or cure disease. This doesn't immediately seem like a contradiction, because after all, we have clinical trials. Unfortunately, they only get us so far, as they are limited in scope, population, and variables. That is also why there is a period of time after market authorization (in EU at least) where a drug is additionally monitored as the general population starts to use it for the first time, and more trials are needed. The risk-benefit analysis might switch or new discoveries are made, like new side effects or drug interactions that need to be included in the package leaflet and the SmPC (Summary of Product Characteristics). You can spot these medications by looking for a black triangle, or check out the list on the EMA website. Not only practical reasons speak for more use of data; the promotion of scientific research is an objective in the EU’s founding treaties, and the EU Charter of Fundamental Rights mentions unconstrained scientific research and academic freedom. So it makes sense that there is a growing interest in getting the health data of the general population, for example through their health insurance. We can do clinical trials, and we can analyze reported cases in pharmacovigilance systems or do journal reviews, but these are only small parts of the population, in very controlled environments, and the reporting isn't as good as it could be - lots of doctors simply do not report much or with too little information. Trends across populations are more difficult to detect that way or different causes and effects are never seen as connected. Examples for moves to combine health data across different registries, biobanks, organizations or countries for scientific purposes are for example the German Medizinregistergesetz to combine different national medical registries, the DARWIN EU project, and the secondary use option of the European Health Data Space regulation, whose infrastructure is currently being established across the EU (and is something I aim to work with). But how is health data handled under GDPR, for not just clinical trials but all kinds of scientific research? That is where the exceptions of Article 9 and the concept of Broad Consent comes in. The aforementioned Article 9 also contains exceptions to the total processing ban, and one of them is the purpose of scientific research. A controller needs to meet at least one Article 6 legal basis (like for example your explicit consent, a task in the public interest, legitimate interest etc.), and then it can base its processing on Article 9(2)(j) GDPR together with any Member State law that may apply. Member States are allowed to introduce further conditions and limitations for the processing of genetic data, biometric data or data concerning health, so each EU member might have additional laws to what I am about to describe; Germany, for example, has made use of this. On top of that, Recital 33 of the GDPR introduces the option of Broad Consent , saying It is often not possible to fully identify the purpose of personal data processing for scientific research purposes at the time of data collection. Therefore, data subjects should be allowed to give their consent to certain areas of scientific research when in keeping with recognised ethical standards for scientific research. Data subjects should have the opportunity to give their consent only to certain areas of research or parts of research projects to the extent allowed by the intended purpose. That means that in case of scientific research, it is possible to move away from the otherwise very granular and specific consent required by the GDPR, and agree more broadly, and most importantly, agree before the specific purpose of the processing is already set. This makes sense in practice: You technically need to be informed at the time of recording the data, but that may not be at a time where the purpose or scope of the research project is already set or it even already exists. This doesn't free controllers from specifying no purpose at all, or making it too broad. They cannot make you agree to simply all kinds of research, even if you want to do that. Instead, you might opt into, for example, "oncology research", and then later on, your data can be used for more specific purposes and studies within that bigger purpose. It's important that the purpose is within the defined research area and within the reasonable expectations of you as the data subject. Aside from this Broad Consent , controllers can also ask you to consent to different individual research projects separately, as soon as the purposes of those projects become known. This is called Dynamic Consent , and avoids some of the issues Broad Consent can pose. It's especially handy when future projects can be identified progressively or research continues over long periods and researchers maintain an ongoing relationship with participants, maybe because they need ongoing care or control. It can be difficult to fulfill the standard GDPR rights under Broad Consent in practice; you might not be reliably informed who specifically is currently (still) using your data for what purpose, especially years or decades later. It can be harder to withdraw consent and make it reach all parties that need to know about the withdrawal. Enforcement is harder because of how the data might have spread. Who makes sure to remove the data when you request so, or when the storage limitation is reached? And: While your data might be anonymized later on or pseudonymized in one dataset, multiple can be combined, which makes re-identification more likely. Of course, there are also reasons to be scared of health data being shared at all, with or without consent. Some illnesses, like HIV, herpes and more are still stigmatized. If this is revealed, the affected people could be seen as unsafe, dirty and promiscuous. Some are scared that it could lead to employers having access to databases where they can check an applicant's health status, which could prevent people who are sick often, or chronically ill and disabled people from getting and keeping employment. Trans people who wish to live stealth can be outed by the sharing of their medical data. Others see a risk in the data being used for racist and eugenicist reasons, especially via racial information and genetic data, or to detect specific populations the government wants to get rid of, like ethnic minorities, queer people, disabled people and more. In the wrong hands, health data could be used to deem you life unworthy of life . Plus, what if there's a data leak to third parties? With these risks in mind, I still wanna encourage people to check whether their discomfort around sharing their health data for scientific research is at a reasonable level and based on a likely concern, or a learned behavior because of the shame and stigma around discussing your health in social settings. It's hard to keep those apart! Many of us have learned not to share our illnesses because it makes others uncomfortable or because of bad experiences of others close to us using that information against us. The fears we usually have around discussing our diagnoses are often based on an information imbalance with our surroundings. That could mean: Your diagnosis of a stigmatized illness is revealed to people who have direct access to you, and now you are afraid that this changes how people view and treat you. You might be scared of being excluded, of being seen as a burden or being infantilized; fears of not finding sexual or romantic partners, and so on. But all of this usually requires a "leak" that exposes only you in your direct environment, and the other people around you aren't exposed and can use this power imbalance against you. On the other hand, if a data leak happens and strangers elsewhere have it in a dataset, there are different consequences; it doesn't give the people around you easy and immediate access, and they might be affected as well, leveling the playing field. What I am trying to point out with this is: Concern around leaked health data is often less focused on the actual outcome, each person's specific risk factors and what's technically possible, and moreso informed by general stigma in society and fears of interpersonal issues. People mix up the learned fears around admitting illness in their surroundings with the risks in a data leak, even if they barely have any overlap. For what it's worth, look around you: It is a false premise that we have a small amount of sick people, as if we were a minuscule minority. A lot of people are permanently sick or disabled in some way, needing medication for life, and this also increases the older the population gets. It's time for visibility and solidarity, and that only works if we don't pretend 90% of people are healthy and/or not reliant on medication or other assistance, or don't mentally "count" certain ones (or our own diagnoses) so people can feel above others and punch down. In your social circle and family, how many people are on antidepressants, how many people have rheumatoid arthritis or endometriosis or PMOS, how many have an Inflammatory Bowel Disease, how many people are on some heart medication, how many are diabetic, how many have epilepsy or have asthma or osteoporosis, who is fighting the effects of surviving cancer, who's on opioids for chronic pain etc., and who's simply dealing with age-related symptoms? That's just the most popular ones and isn't even including traditional physical disability. We all got something to lose and something to gain, and being open about being ill is easier when you realize the people around you are not exempt (forever). It is an inevitability of life. This perspective gives me the courage to be really open with my illnesses; of course no one else has to do the same. For Broad Consent to work well and not undermine your rights, there should be a clear understanding of what even counts as scientific research so there is no abuse of this privilege, and practices should be in place that keep the data secure and foster genuine attempts at informing patients and giving them the option to easily withdraw or keep updated about the use of their data. Helpfully, the European Data Protection Board (EDPB) has released guidelines for the processing of personal data for scientific research purposes. They set some standards for what qualifies as scientific research. The six key indicative factors they describe, next to just the nature, scope, contexts and purpose of the processing, are the methodical and systematic approach , the adherence to ethical standards , the verifiability and transparency of the methods and results, autonomy and independence , the objectives of the research (" the aim of contributing to the growth of society's general knowledge and wellbeing "), and the potential to contribute to existing scientific knowledge . They also clarify: " If the research activities under assessment meet all of the factors [...], they can be presumed to constitute scientific research. If the research activities do not meet all factors, the controller needs to justify and be able to demonstrate why the activities should nonetheless be considered scientific research, within the meaning of the GDPR." Additionally, they discuss that even private entities can rely on the legal basis of performing a task carried out in the public interest, and scientific research can , in their eyes, be a legitimate interest under Art. 6(f) GDPR. And they also explicitly do not exclude commercial interests from falling well-within the scope of scientific research. What they suggest needs to be ensured is All these are supposed to "compensate" for the Broad Consent . These are not the only guidelines out there; the German Datenschutzkonferenz and others have also published their own, and while they tend to differ in some points (especially around what can and cannot be considered scientific research), they largely suggest the same safety standards and patient rights to consider. I felt like writing about this for a while now because not many people I ask tend to know about the general movement towards health data sharing and combining of datasets that is increasingly being prepared and legislated, or at least have a broad idea of how consent is handled in these cases. There's a lot I could go more in-depth on, but this is an overview for now. I am sure the processing of health data digitally as well as the ease of sharing will become more visible in the future as more milestones are hit for the European Health Data Space , and as health insurance providers and healthcare facilities all over the EU make changes in how they offer and organize the digital patient file, digital prescriptions and referrals, opt-ins to data collection or enrollment in studies via app, and so on. Published 07 Sep, 2026 further processing for scientific research purposes that are compatible with the initial purpose(s) of when the data was collected, storage limitations or criteria to determine the period of storage must be set before the processing; it may be okay to store the data for longer, even after the conclusion of a research project, if it is needed within peer review or similar things, data subjects understanding the consequences of their choice, and having access to information on how their data is processed, for example on a website or a via a newsletter, and where they can withdraw their consent possibly via a privacy dashboard or other offline means, reassessment when the circumstances change (purpose change, controller change, third country transfer etc.), possible extra involvement of independent data trustees, time-limited consent, independent oversight, ethics committees, and patient groups for participant representation, and proper technical safeguards (as usually required by GDPR and other laws anyway).

0 views
ava's blog 1 months ago

rationalizations about ring, flock, etc.

I have talked to multiple people using Ring cameras and similar surveillance tech at or around their home over the last few years, usually from the US. The reasons are mostly the same: Most of them have only started using these cameras after 2020, which is pretty odd if these are really the true reasons. Cameras and surveillance systems have been around since the 1940s, and have only become more and more affordable and easy to set up, even pre-Ring. Crime rates have existed before, as did the need to prove things to police or an insurance. Yet, the purchase of a private surveillance camera only came up in the recent years for them. Why? It really is the perfect proof that fear-based marketing works. Social media and the 24/7 global news cycle have us all hyper-aware of terrible events everywhere, and have blown things completely out of proportion. The constant recurring reminders that something bad happened just near you that you would have otherwise not known about is skyrocketing your anxiety. You could be next! Ragebait and other recorded rude behavior popping into your feed colors your perception of strangers and humanity as a whole. Everyone is out to get you! People have lost their minds, and now you have to protect yourself! It gets so bad that anyone walking on the street, being near your home, delivering your package is a suspect, a threat, before they are a human. They first have to prove they have nothing to hide, or prove they are doing their job correctly, all pressured by the presence of a camera (and the threat of this being shared with police or uploaded online and going viral), before they are seen as someone with rights. And maybe they even serve as content opportunity - fair game of course, as your camera yelled out that they're being recorded and by not immediately running away (as they have a job to do or wanna visit you), they consent, right? It's no wonder all that intensified during and after the lockdowns for Covid where everyone was extremely online, and that companies have found ways to capitalize on this fear. Because that's what it is: You fell for the marketing that promised to calm your worst fears and anxiety with more tech, and pretends it gives you some sort of control or a magic device that makes it all turn out okay. That's why you suddenly only need it now, after being able to live without it just fine. Overtly or covertly, the marketing tries to tell you: You can prevent all bad things from happening. You will spot bad things happening in time before any damage is done, or we will send a notification. Burglars and package stealers will be deterred. Due to the video footage, police will actually do something, and even catch the perp! You can find missing people and pets. Insurance will stop fighting with you! Your spouse will be too scared from bringing someone home while you're at work, and the kids will not do something forbidden while you're out of the house, and the dogs will not tear anything up because you can just yell at them to stop via a camera. You'll see if someone in the home has a medical emergency. But this is legit insane! You have smoke detectors and gas detectors for this. Criminals are not deterred by cameras. People everywhere are still getting their insurance claims approved and their lost package refunded. Police solved case rates are still embarrassingly low, despite almost all stores, and many streets claimed to be crime spots, being surveilled for a decade or longer now. People living with you or being in your home deserve privacy instead of suffering from your extreme insecurities. They deserve to not being judged all the time, especially children and teens. Knowing you are constantly recorded and watched and that it all can be played back or checked later (and possibly posted online) is completely damaging to any sort of character development and sense of safety, especially around trying new things and making mistakes. The chilling effects this has cannot be overstated, even for your guests! Your desire to see your pets all the time or be prepared for a possible unconscious person at home overrides none of this, and none of the risks like Life is unpredictable, and these things just appeal to a very scared part of us that we need to deal with differently than "arming up". Your trauma about your previous break-in is understandable, yet needs more substantial treatment than this clown show of a bandaid solution. I think any Ring user deep down is actually aware it is all outside of their control, and that this doesn't even make a dent and is just a farce, but it makes them feel better, and that's all that counts. It's a completely accepted delusion that the rest of us are expected to dance around and tolerate, which is ridiculous and I won't do. Realistically, you all know that there are no reliable stats, no actual proof any of this works, or does something to prevent anything, or help someone. You also know that the wholesome feel-good reasons are nothing compared to the risks. The chances are good that crime rates in your area have lowered since before you even had a camera, and it's not due to it existing. It's hard to prove something didn't happen , of course, but we have had store and street surveillance for quite a while now and it has not deterred crime from taking place. It has not even led to a meaningful amount of recorded crime actually being resolved. It's not in the police's interest to solve your petty bike theft because they are here to secure the property of wealthy people, not yours. Crime is best fought with resources like housing, food, money and education, but that costs more than a few thousand cameras and cannot be used for fascism, racial profiling, non-consensual recording and spying and doesn't supply the prison industrial complex, so of course it is unpopular with governments. What every Ring user is saying is basically: " Fuck society, fuck the political environment this is happening in, fuck you; my feelings matter more than the effect this has on society as a whole. I want the normalization of constant surveillance because I crave control and safety! I love the law and order appeal of literally any piece of media depicting fascism ! " It also hinges on this extremely individualist mindset I see emerge more and more where everyone is just fending for themselves, securing their own resources, and going "I got mine, fuck you." or " Doesn't affect me negatively, so why should I care? ". Everyone is seeking to buy their own McMansion, the further away from others and the higher the fence, the better. They're relying as little as possible on others, paying some stranger for things that usually a family member, friend or neighbor would do for free and have them drop it off without contact on the doorstep. They only interact with others online, and build up an impenetrable fortress together with surveillance everywhere, as if a horde of peasants could come and take away everything you have hoarded and worked for. And in the US of course, with a variety of guns in the home, and a ChildKillerTank5000 SUV in front, because the safety and comfort of the driver is top priority and your goal with driving is to win and survive, not to drive defensively and respectfully in a reasonably sized car. It's ridiculous to see from the outside, because you're building this insular allegedly hypersecure prison for yourself in which you are willing to hand over any piece of possible evidence as a loyal neighborhood spy and as proof you're a good behaved citizen, just because media tells you your biggest threat is other people; yet the biggest threat of our lifetime is climate change, and there is nothing that protects you from it in your fortress, and no one you can bootlick enough to be safe from it. Nothing you can do about the rising heat, dying wildlife, ruined crops, water scarcity, the upcoming climate refugee movements, the floodings, tornadoes and earth quakes that intensify, and so on. You think you can separate yourself from society and from your own choices and its effects and secure yourself, and it's not working. It will never work. And you are also capable of having blood on your hands. But in the meantime, you can make unethical companies like Ring and Flock a little richer, and you can help police and ICE and alike organizations do their kidnapping, killing, discrimination and intimidation more effectively, you can help train AI on people just existing in public, and you can help normalize being recorded everywhere to make a Nazi's wet dream come true. And please, spare me the replies about how everyone else using it is just evil and misusing it while you are an angel using it for good, that you totally agree with all of this yet sadly you just have to do this , reiterating the same tired Ring propaganda I listed above, and yapping some more of why they're actually good and justified in your specific situation and how everyone you know also does it and your grandma just doesn't know any better. I do not care. You have to seek absolution from someone else because I will not read it. That's not me ignoring the other side of the argument, it's me not wasting my time on hearing the same garbage I have heard from several people and online content before. There is nothing you could tell me to change my mind, and I don't care if it's worded nicely or rudely or by a friend or a stranger. God herself could come down and hand me a letter saying all this is good and justified and it would not change. This is something I have an ethically-informed fixed stance on, something you would also have if you had a backbone. Published 02 Sep, 2026 We live in an area with a high crime rate. We had a break-in before. We wanna have proof for insurance/police, or when the delivery isn't delivered or my packages get stolen. I wanna see what my pets/kids/spouse are doing. I wanna check for fires, cheating, make sure things get done around the home etc. Police or undisclosed third parties using the video stream without your knowledge or consent ... or with your consent, to harass people of color and other marginalized groups Hackers gaining access to the video stream and watching you, even in private moments you would not want anyone to see An abusive partner or parent exerting more control via the cameras, and forcing cameras to be hung up even in private rooms Partners recording you during sex or other private moments against your will or without your knowledge, and possibly even disseminating it

0 views
Krebs on Security 1 months ago

FBI Probes Service Selling 153M+ Drivers Licenses

A new identity theft service launched on the dark web this week is selling digital scans of more than 153 million drivers licenses from people in the United States and Canada. Based on interviews with individuals whose licenses are available for purchase on this service, it appears to be siphoning images collected by a widely-used identity verification company based in Louisiana. KrebsOnSecurity also has learned that the New Orleans field office of the Federal Bureau of Investigation (FBI) today launched an official inquiry into the source of the images. A record available at this identity theft service that includes the drivers license for U.S. Defense Secretary Pete Hegseth, one of several high-ranking U.S. government officials whose drivers licenses can be found for sale. On Monday, Aug. 31, a source alerted KrebsOnSecurity to a service advertised by a new user on the Russian cybercrime forum Exploit , offering access to digital scans of identity documents on more than 170 million people in North America. The source brought it to my attention because the proprietor of this identity theft service offered my Virginia drivers license as a free sample in their initial sales thread on Exploit. The service, dubbed Nexus , claims to have more than 153 million drivers licenses for people in the United States and Canada, as well as more than 10 million identification cards; more than three million travel documents and/or international IDs; and at least 579,000 medical cards. A quick look around Nexus finds they are likely not exaggerating about that 153 million number: Running a blank search in Nexus (with no search parameters entered) returns approximately 11.5 million pages of results, with roughly 15 results displayed per page. It includes documents from people in both Canada and the United States, but the bulk of these records are on Americans: searching for just Canadian drivers licenses returns approximately 1.1 million results, with the largest concentration from Ontario (473,673 records). Curiously, the identity records include not only drivers licenses but also marijuana dispensary cards. Some of the records list their “source” as “CDL,” presumably short for “commercial drivers license.” Other records carry the source notation of “CAC,” which may refer to Common Access Cards, government issued identity cards that grant physical access to government buildings and secure rooms. The people behind Nexus claim the license images are coming from an active breach at “a major identity verification company” whose customers include multiple Fortune 500 companies. The record totals listed by the Nexus identity theft service. The number of drivers license records increased by nearly 400,000 in the span of just 24 hours. “We have been continuously exfiltrating new data for over a year into our private database,” the service enthused in its introductory post on Exploit. “Records are available to preview before purchase with pertinent information redacted. Customer photos are displayed if available.” Indeed, over the past 24 hours, the number of drivers license records listed as available in Nexus has increased by nearly 400,000, suggesting that freshly stolen license data is being harvested and uploaded to this service on a semi-regular basis. The record that features my drivers license includes six image files — three pairs of photos of the license’s front and back — a basic image scan — as well as infrared and ultraviolet versions of the same images. A date and timestamp is appended to each image file, and the timestamp on my license scan corresponds to a date in June 2025 when I took a flight to the midwest United States to attend a family funeral. Some of the 153 million+ license scans — including mine — feature six image files with date and timestamps appended to the filenames. Not all records include photos, and some that do feature photos do not display the associated filenames. Intent on discovering the source of this data, KrebsOnSecurity asked more than a dozen friends and family members for permission to search for their licenses in this service. Each person whose license could be found (nine of them) confirmed having traveled on or very close to the dates in the timestamps attached to their images. It is unclear what timezone these timestamps are in, but from reviewing car rental records shared by several people who helped with this research, it appears the timezone is set to Greenwich Mean Time (GMT). At first, I thought the source of the data might have something to do with airports. However, that theory went out the window when it became apparent there were no passports in this data set. Also, only some of those who helped with this research said they showed their drivers license at the airport on the day of their travel. One person whose license was in Nexus hadn’t flown at all recently, but was renting a car from Hertz for several months around the date of their timestamp. Two of those who agreed to help are federal employees who said they shared other forms of government identification when passing through airport security. However, those individuals each said they shared their state-issued drivers licenses later that day when renting vehicles at their respective destinations, and that both rented their cars from Hertz. After finding a note in my calendar for the day of my June 2025 flight reminding me to bring my passport, I remembered that I also never actually shared my drivers license when I went through security at Reagan National Airport on that day because I did not yet have a Real ID, a security-enhanced drivers license that is now required by the Transportation Security Administration (TSA) for all domestic travel. Instead, I showed the TSA agent my government-issued U.S. passport. Here’s where it gets interesting: I was able to find my mother’s drivers license in this service as well, and the timestamps for her images are just a few seconds apart from mine. That’s notable because we both handed our licenses to the Hertz rental car representative at the same time. According to my mom, the only place she gave her drivers license to that day was the rental car company, and if memory serves that is also true for me. I don’t recall if the rental car representative inserted our licenses into any kind of machine, but I remember they held onto them for several minutes behind the counter while we were signing various forms. KrebsOnSecurity sought comment from Hertz and will update this story in the event they reply. Zach Edwards is a well-known security and privacy researcher who recently launched a service called DecryptAds to help people better understand how online advertisers are tracking them. A scan of Edwards’s drivers license is available for purchase on this identity theft service, and Edwards said the timestamp on his record corresponds to the middle of a trip last month to Las Vegas for the annual DEFCON security conference. Edwards told KrebsOnSecurity that although he did not rent a car in Vegas, he did hand over his license at the TSA checkpoint, at a marijuana dispensary in Vegas, and at his hotel (the Aria). But he said the only one of those three that for sure scanned his ID in some kind of device was the dispensary. To enter Planet13’s weed dispensary in Las Vegas, one must pass through a red telephone booth. Image: Zach Edwards. Edwards said the dispensary he visited that day was Planet13 , a multi-state chain with stores in California, Florida, Illinois and Nevada. In 2022, the New Orleans-based identity provider idscan.net published a press release announcing an exclusive identity verification agreement with Planet13’s dispensaries nationally. IDScan says it processes ID verification for more than 1,000 marijuana dispensaries in 19 U.S. states. The “trust” page of idscan.net states that the company provides identity verification services for numerous big brands, including Hertz, Target , Fedex , Motorola Solutions , the financial services giant Jack Henry , and Caesars Entertainment . And as idscan.net’s own documentation states , the technology scans IDs with both infrared and ultraviolet light. Idscan.net says the company’s systems and technology perform more than 21 million verifications monthly, at more than 20,000 locations around the world. Image: idscan.net. Contacted by KrebsOnSecurity, idscan.net said it was investigating the matter, but the company has not yet shared an official statement or a substantive reply to specific questions sent via email. “At this point I’m not able to share any additional information, but the updates you have provided have been welcome, and helpful to our team’s investigation,” wrote Jillian Kossman , a marketing and operations leader at idscan.net. During the course of my research for this story, word got around to the FBI that I was poking at the apparent source of this new identity theft service’s data. Probably they were tipped off when I shared with a trusted source that Nexus also is selling the drivers license information for the assistant director of the FBI (I did not find FBI Director Kash Patel’s license in Nexus). Earlier this afternoon, I was added to a conference call with a half-dozen FBI agents, including senior leaders from the agency’s cyber division. During that call, the FBI shared that earlier today their New Orleans field office opened an official investigation into an apparent breach involving idscan.net. Edwards said that as more in-person and online experiences require sharing drivers licenses, vendors who collect this sensitive data need to be held to a higher standard. “This episode should further strengthen the resolve for people who are fighting back against online ID schemes which are requiring countless providers to ask for drivers licenses in order to access services under the guise of protecting kids,” Edwards told KrebsOnSecurity. “These systems are putting sensitive data into more and more 3rd party vendors, and we don’t have nearly the oversight to ensure they are safe.” Larry Baldwin is principal intelligence researcher at the cybersecurity firm Cybera . Baldwin said a front and back scan of his drivers license available at Nexus contains timestamps that correspond to the date of a car rental from Hertz on a recent vacation. Baldwin said the Nexus identity theft service presents multiple serious security and privacy threats, noting that state-issued drivers licenses are commonly used as proof of one’s identity when opening new lines of credit. Baldwin said the service could also dangerously expose many people who do not wish to be found but who cannot meaningfully change their appearance (or at least not enough to fool today’s AI-based image matching tools). This category of people, he said, includes those fleeing domestic violence, and even people who have been assigned a whole new life and identity as part of the federal government’s witness protection program, which is generally reserved for criminal defendants in racketeering and conspiracy investigations who agree to cooperate with federal authorities. “Just when it seems like we’re making some headway in improving authentication controls through drivers license verification systems, this happens and the very thing those improvements are dependent on are compromised,” Baldwin said. Update, 8:56 p.m. ET: Shortly after this story was published, the Nexus identity theft service website vanished from the darkweb, replacing its login page with a plain text message that reads, “This service is no longer available.” This is a potentially fast-moving story. Any changes or updates will be noted here along with a timestamp.

0 views
ava's blog 1 months ago

link dump - catching up on my online reading

While I am slowly getting back up on my feet after a tough time, I am catching up on emails (will still take a bit!), my RSS feed reader, and several newsletters that have accumulated in my inbox. Here's what I picked out to read and share: This Is Capitalism: Apple's Hidden Data Workers at the Shadows of the AI Boom - 19 page paper detailing what data workers actually do and what problems they deal with, written anonymously by a data worker interviewing their colleagues. Parts of the work descriptions remind me of the work in Severance . Is this really a good reason to triple datacentre capacity in Europe? - online blog post tracing where the idea to triple the EU's data centers comes from that is mentioned in several EU AI strategies. Turns out it's from be a blog post from Savills, a commercial real estate firm who profit off of data centers being built. Fake US thinktank set up and funded by Israel sought to game AI for propaganda - AI slop meant to absolutely flood the web to be included in AI training funded by the Israel government to spread disinformation in AI answers. A new force is increasing inequality in America - WaPo article about how AI is not leveling the playing field or bridging the gap between poor and rich, but instead worsening the gap. People making the most use of AI are concentrated in richer urban areas and are already often rather wealthy, while the AI data centers are in poorer neighborhoods and the data workers are often migrants or in the Global South. Rich people can invest into AI and its stock, therefore profiting off of the hype and concentrating even more wealth. An operational framework for AI literacy in the workplace - 15 page paper from Interface EU addressing the vagueness of "sufficient AI literacy" that is often mentioned in EU AI legislation. It proposes a cumulative three-tier framework based on the nature and consequences of a worker's interaction with AI which then dictates the level of literacy required and how to attain/ensure it and measure it. The Quiet Erosion of Collective Action Under Digital Surveillance - article on chilling effects of permanent surveillance and the feeling of constant suspicion which continues to erode activism. Flipping the kill switch: I survived 72 hours without US tech - online article about an experiment to live without reliance on US tech. The US has such a strong monopoly that almost all online services and tech are unusable with this rule. Gone in one click - assessing the socio-economic impact of browser-level consent in Europe - small informative flyer style PDF by the Implement Group showing figures about cookie consent rates and ad industry revenues depending on the mode of consent. Inside the growing vigilante movement to knock out Flock surveillance cameras - online article by The Guardian. I admire these people, and we need more civil disobedience now, everywhere. Not just against Flock; against Meta glasses wearers, against Ring camera owners (Yes, you too! None of you are the "good ones" with "valid" reasons!) and more. There's many ways to affect these devices that you can find online or just get creative with it. Keep yourself safe, don't write about it, don't record yourself doing it, don't discuss it via digital means, leave your devices at home, and leave no fingerprints. Did someone wearing Meta Glasses film you today? Are you sure? - another Guardian online article, this time about the spy glasses and the people who enable hiding the recording light on them. The man behind GhostMeta is actually so vile and disgusting; anything else I could say would violate the Code of Conduct this blog is hosted on. German links: HeißeLuft.org - German website with interactive map showing where AI data centers are planned, in development, and paused, together with information on protests. Made me discover that they are planning on building one not too far away from me... Deutsche Post trainiert ihre KI mit Ausweisfotos - article about how Deutsche Post is training their AI with ID pictures they get via digital identification procedures. It's not voluntary as they claim, as you need to give permission before being allowed to proceed. Verhaltensscanner in Berlin: Harte Kritik an der KI-Überwachung - online article about the new camera installed in Berlin that will analyze all people in that area via AI surveillance software by Adesso, with more cameras to follow. They want to put them up in high crime rate areas , but keep secret what the standards for this are, which enables a mass roll-out of them if they wanted to without any oversight or control. There has already been one mix-up leading to higher crime reported in an area than actually happened. These cameras already also exist in Hamburg and Mannheim. Möglicher AfD-Sieg in Sachsen-Anhalt - online article detailing the fear of queer people and people of color of an upcoming potential win of the AfD in their state. Afd-Gutachten.de - website containing some stats and a PDF report of a legal assessment on the chances of a successful AfD ban. „Gipfel gegen Linksextremismus“: Mit Trump gegen die Antifa - online article about the cooperation of Germany with the US on its fight against antifascism. Unfortunately it has continued, with the German government realigning to focus more on supposed "leftist extremism" and even re-distributing money away from leftist projects, which mostly hits projects aimed at helping queer people and migrants. Wie weit ist Deutschland beim digitalen Gewaltschutz? - an online article about the really embarrassingly low standards of protection against digital violence, especially image-based ones like deepfake nudes and revenge porn, in Germany. Lots needs to be done in general, but especially to even meet the new EU standards. Wer ist für Straftaten der KI verantwortlich? - legal article about the criminal liability of autonomous AI in Germany, and how crimes done by AI agents are pushing the legal system to its limit as we only legislate for humans. Published 29 Aug, 2026 This Is Capitalism: Apple's Hidden Data Workers at the Shadows of the AI Boom - 19 page paper detailing what data workers actually do and what problems they deal with, written anonymously by a data worker interviewing their colleagues. Parts of the work descriptions remind me of the work in Severance . Is this really a good reason to triple datacentre capacity in Europe? - online blog post tracing where the idea to triple the EU's data centers comes from that is mentioned in several EU AI strategies. Turns out it's from be a blog post from Savills, a commercial real estate firm who profit off of data centers being built. Fake US thinktank set up and funded by Israel sought to game AI for propaganda - AI slop meant to absolutely flood the web to be included in AI training funded by the Israel government to spread disinformation in AI answers. A new force is increasing inequality in America - WaPo article about how AI is not leveling the playing field or bridging the gap between poor and rich, but instead worsening the gap. People making the most use of AI are concentrated in richer urban areas and are already often rather wealthy, while the AI data centers are in poorer neighborhoods and the data workers are often migrants or in the Global South. Rich people can invest into AI and its stock, therefore profiting off of the hype and concentrating even more wealth. An operational framework for AI literacy in the workplace - 15 page paper from Interface EU addressing the vagueness of "sufficient AI literacy" that is often mentioned in EU AI legislation. It proposes a cumulative three-tier framework based on the nature and consequences of a worker's interaction with AI which then dictates the level of literacy required and how to attain/ensure it and measure it. Great quote from it: "No evidence yet shows that these trainings work, and three gaps might explain the reason. The first is motive. Corporate training aims at productivity and teaches people to use the tools well, whereas the law cares whether operators understand how systems fail and cause harm. A workforce fluent in prompting can still be illiterate in the sense a regulator means: trained to produce good output, but not to recognise when a model misleads or to know its duties under data-protection and risk rules." The Quiet Erosion of Collective Action Under Digital Surveillance - article on chilling effects of permanent surveillance and the feeling of constant suspicion which continues to erode activism. Flipping the kill switch: I survived 72 hours without US tech - online article about an experiment to live without reliance on US tech. The US has such a strong monopoly that almost all online services and tech are unusable with this rule. Gone in one click - assessing the socio-economic impact of browser-level consent in Europe - small informative flyer style PDF by the Implement Group showing figures about cookie consent rates and ad industry revenues depending on the mode of consent. Inside the growing vigilante movement to knock out Flock surveillance cameras - online article by The Guardian. I admire these people, and we need more civil disobedience now, everywhere. Not just against Flock; against Meta glasses wearers, against Ring camera owners (Yes, you too! None of you are the "good ones" with "valid" reasons!) and more. There's many ways to affect these devices that you can find online or just get creative with it. Keep yourself safe, don't write about it, don't record yourself doing it, don't discuss it via digital means, leave your devices at home, and leave no fingerprints. Did someone wearing Meta Glasses film you today? Are you sure? - another Guardian online article, this time about the spy glasses and the people who enable hiding the recording light on them. The man behind GhostMeta is actually so vile and disgusting; anything else I could say would violate the Code of Conduct this blog is hosted on. HeißeLuft.org - German website with interactive map showing where AI data centers are planned, in development, and paused, together with information on protests. Made me discover that they are planning on building one not too far away from me... Deutsche Post trainiert ihre KI mit Ausweisfotos - article about how Deutsche Post is training their AI with ID pictures they get via digital identification procedures. It's not voluntary as they claim, as you need to give permission before being allowed to proceed. Verhaltensscanner in Berlin: Harte Kritik an der KI-Überwachung - online article about the new camera installed in Berlin that will analyze all people in that area via AI surveillance software by Adesso, with more cameras to follow. They want to put them up in high crime rate areas , but keep secret what the standards for this are, which enables a mass roll-out of them if they wanted to without any oversight or control. There has already been one mix-up leading to higher crime reported in an area than actually happened. These cameras already also exist in Hamburg and Mannheim. Möglicher AfD-Sieg in Sachsen-Anhalt - online article detailing the fear of queer people and people of color of an upcoming potential win of the AfD in their state. Afd-Gutachten.de - website containing some stats and a PDF report of a legal assessment on the chances of a successful AfD ban. „Gipfel gegen Linksextremismus“: Mit Trump gegen die Antifa - online article about the cooperation of Germany with the US on its fight against antifascism. Unfortunately it has continued, with the German government realigning to focus more on supposed "leftist extremism" and even re-distributing money away from leftist projects, which mostly hits projects aimed at helping queer people and migrants. Wie weit ist Deutschland beim digitalen Gewaltschutz? - an online article about the really embarrassingly low standards of protection against digital violence, especially image-based ones like deepfake nudes and revenge porn, in Germany. Lots needs to be done in general, but especially to even meet the new EU standards. Wer ist für Straftaten der KI verantwortlich? - legal article about the criminal liability of autonomous AI in Germany, and how crimes done by AI agents are pushing the legal system to its limit as we only legislate for humans.

0 views
matduggan.com 1 months ago

You Know GDPR Is Good Based on Who Hates It

FDR has always been one of my favorite presidents, second maybe to Lincoln. Both were men the establishment assumed were one of them until, to their horror, they governed like they weren't. Both could trash the opposition in one breath and take the moral high ground in the next. One of my favorite Roosevelt lines growing up came from Madison Square Garden, October 1936, standing before a crowd that included plenty of people who wanted him dead: What I love is that he doesn't argue with the hate. He doesn't say they're wrong to hate him, or that the hate is unfair. He says the hate is evidence. The process is working. I've always treated it as a metric: if you're doing something hard and nobody hates it, you probably aren't doing it. If the right people hate it and those people happen to be some of the worst people alive, so much the better. By that standard, the GDPR (Europe's General Data Protection Regulation) is doing beautifully. It is impossible to go anywhere in a technology space online without hitting a wave of commentary about how stupid GDPR is. It was written by bureaucrats who don't understand the amazing potential of unrestricted technology. These US-based critiques almost always lean on the oldest trick in cyberlibertarianism: we don't have time to regulate, we must simply adapt and ride the wave. Nobody has time for government. Of all GDPR's consequences, none gets more attention than the cookie banner, which critics present as the inevitable result of government meddling. Blaming GDPR for the cookie banner is like blaming the health inspector for the roaches. The banner is deliberate vandalism, a dark pattern engineered to exhaust you before you can learn anything about the surveillance apparatus humming behind the "OK." Ironically the banner designed to hide the machine has taught the public more about the machine than a thousand podcasts ever will. Even non-technical people stop at "your data is shared with 996 partners." "For a sports score website?" So why is the tech commentary community so loud about this? Because they understand what's at stake. If consent must be freely given and easy to refuse, the industry's power shrinks exponentially. People might decide who has their data, how long it's kept, and what it was collected for. You can only imagine how that thought keeps a Meta executive up at night when he's not eating endangered animals, or ignoring calls from his children whose names he has forgotten while on a tacky yacht. Consider the following example. Did you know Google was doing this every single time you searched on Google ? Did your dad? So even in the most maliciously compliant form the regulation does provide value and information. Remember the hatred is the metric. How did we get here, where US tech companies end up regulated by Brussels? Why isn't the US government regulating US corporations anymore? If the rules are so terrible, why did nobody choose market exit? Has the EU become the world's "privacy cop" or, in the inverse, the biggest player to protect a fundamental human right to privacy? Ah who doesn't remember where they were on GDPR Day. Since we're all socialists in the EU, we stood up from our government issued desks and gave the required three cheers for regulation, then resumed being on vacation for 6 weeks. Obviously after stopping by my free doctor on my way to the airport. On May 25th, 2018, GDPR took effect to the sound of American commentary, the way fireworks take effect to the sound of dogs. You can tell American CEOs were aware of the regulation based on the speed by which they copied the language from it. Right before it took effect Brad Smith, the president of Microsoft, tweeted "We believe privacy is a human right." Tim Cook was right behind, telling CNN that "privacy is a fundamental human right". The framing of privacy as a human right is one of the key elements of the EU approach with GDPR. This is in stark contract with the US legal system which views information privacy as more of a market problem. You are all informed individuals in the wide marketplace of data exchanges and are left mostly to your own devices. In theory there should be regulations by the US of things like unfairness, deceptions and other market failures but in practice that doesn't happen. Europe is no stranger to this fight. The German state of Hesse passed the world's first data protection law in 1970, also known as the year the Beatles broke up, and set a standard we still fail to meet today: At the launch of GDPR there were 126 countries with data privacy laws of some sort. What you see with this sea of legislation is an overwhelming consensus that what GDPR was attempting to do was correct. In fact you see a pretty high level of global convergence of standards. All 126 laws descend from the same commandments the OECD carved in 1980: collect only what you need, say what it's for, keep it safe, let people see and correct it, and don't be a creep about any of this. Fifty years later, the American internet industry is still stuck on commandment one. So first the often-repeated sentiment that this is a flight of EU fancy is straight up incorrect. Something you could describe as the "European standard" for data privacy quickly became a global standard. Anu Bradford calls it the Brussels Effect: Europe regulates, the world complies, because despite American bluster, Europe is a market nobody can leave. In the US financial market, companies who surrendered the EU market would have quickly found themselves with new CEOs as their previous leaders suddenly discovered health problems or a deep love of their families that they had ignored for years. Especially given the increasingly frosty relationship between the US and China, companies that were pushed out of China due to regulation and increased domestic competition cannot lose the EU market. It's also difficult to screen a lot of services for EU customers, especially because the laws follow the personal data of EU residents whenever and wherever the information is transferred outside of the EU. Think of it like trying to sort luggage based on what stickers are on the outside. The EU is also set up in such a way where enforcement of such a law becomes possible. Every member state has a Data Protection Authority, who are charged with assisting individuals in protecting their rights, advising domestic legislatures on the functioning of existing regulation and finally enforcing the law. The EU is also different from the US in that it is open to exploring precautionary regulatory action. We see this with the EU Artifical Intelligence Act which tried almost immediately to get some controls on the industry right at the beginning. Link So the combination of a robust option for enforcement combined with an increased appetite for regulation in general and a high level of respect for personal privacy made the EU the logical source for this legislation. Want to know what the teeth look like? In 2011, an Austrian law student named Max Schrems asked Facebook for everything it had on him and got back 1,200 pages, much of it stuff he'd never volunteered. He filed a complaint from a dorm room. Four years later, the Court of Justice of the EU had voided Safe Harbor, the transatlantic data treaty, on the strength of it. A college student complaint killed an international agreement signed by presidents and prime ministers....multiple times. The best proof of GDPR's power is what it did to Japan. On January 23rd, 2019 the EU and Japan reached a deal which allowed for the free flow of personal data between the two economies. It established an overarching privacy law with a core set of individual rights and enforcement by independent supervisory authorities. The process took 2 years, which isn't a surprise because before this process Japan had very weak, swiss-cheese regulations. In 2014 Graham Greenleaf chose the title "The Illusion of Protection" for his chapter about Japan in an overview of Asian privacy laws. The private sector was basically unregulated, it has "easily manipulated exceptions" to its rules concerning the use and disclose of personal data, its absence of provisions for sentivie information and had no restrictions on data exports. It was nowhere near the level of protections that the EU would expect for information sharing. You can draw a straight line from a bargaining table in Brussels to new rights for a retiree in Osaka. Japanese data brokers hate it, which again is the point . Why hasn't the US sought the same arrangement? Because everyone involved knows the application would be denied. Which raises the real question: why can't the country that invented most of this technology produce a rule for it? Why is the US stuck pretending there's no reason to regulate while the rest of the world moves on? There's no better text on what has happened in the US with the data economy than The Age of Surveillance Capitalism by Shoshana Zuboff. It's a good read and I won't ruin it for you. First, the definition of Surveillance Capitalism from the book. Didn't read that? I don't blame you. In English they found oil and the oil was us. And as us Americans love to do, we immediately discovered a sudden love of freedom in the presence of oil. Effectively here's what happened. The 9/11 terrorist attacks had a ripple effect in US regulations, effectively derailing the momentum that the domestic US regulatory organizations had about starting to build frameworks around personal data. The focus became on security and not privacy. Quickly public intelligence agencies and the fledgling surveillance capitalist business in Silicon Valley found each other and carved out the concept of "surveillance exceptionalism". If you were spying to keep us safe, then it's not spying it's public service. As time went on, the corruption of American politics rendered the possibility of regulation less and less feasible at the federal level. Google and Facebook poured tens of millions into lobbying (for non-US readers, lobbying is a nice way of saying bribery that is legal). There also became an "open door" between government and tech, with 197 people moving back and forth from Washington to the Googleplex. What these companies learned is that by studying our behavioral data during periods of relaxation or play was the most value, allowing them to accurately and reliably push people towards profitable outcomes. US consumers were aware of this to some extent, often repeating phrases like "If it's free, then you are the product". That was true before, but in the new digital economy it is no longer true. We're not even the product anymore, which is why all these companies no longer give a solitary shit about whether their stuff is good or fun to use. We're the raw material that they mine. They know every single thing about us and we don't know anything about them. They accumulate all the data from us but not for us or for our benefit. Behavioral modification though the accumulation and manipulation of this data is now the wealth engine of the United States. Now we are in a market failure scenario. No individual company will disarm first, and any regulator can be captured for what these companies spend on catering. Only law with real enforcement teeth changes the math. And the US cannot pass laws with teeth anymore, not because voters don't want them (polling says they do), but because the pipeline is purchased. When someone says America "can't" regulate tech, they mean it the way a hostage "can't" reach the phone. GDPR didn't spread because Europe is heroic. GDPR spread because Brussels is what fills the room when Washington leaves it. Thanks to the amazing https://decryptads.com you can see what it looks like in real time. Let's take The Verge. This is a relatively straightforward tech commentary website that has a paywall. It should have a very simple supply chain in terms of advertising. What we see is the opposite. There is a giant network of companies trading, selling and bidding on the information from this website. This isn't the fault of The Verge, this is just how the machine operates. Your data is like fish at a fish market. Everyone gets to inspect the merchandise and decide whether they want to buy without you being involved. Ironically we only get this information because of the and which exist to combat advertising fraud. Even a well-run website operated by technologically literate people geared towards tech enthusiasts behind a paywall is not immune to this system. What you see here is that there is no fucking escape . If you want to have a large web presence and have bills to pay, you need to participate. And The Verge is doing it right! 59 declared partners and none of them are actively preparing for war with the US. In the US though this is not a new problem. The economic historian Karl Polanyi came up with the concept of "Double Movement". You can read it here. Think of it like this. Imagine you strip American Capitalism down to a tug of war. In the first round, the businesses go first. This is the "let the invisible hand decide" part. Everything becomes a product you can buy and sell including land, work, even money itself. Think of this like removing all the referees from a game and letting players do whatever they want. Then there is round 2, which is "wait this is hurting people". People demand protections like minimum wage laws, workers rights and trade regulations because the "free market" never seems to regulate itself but is causing real harm. The referees come back, but now with a rulebook written by the players who got hurt. His argument is that a totally free market is a fantasy. It's a fantasy because markets need government support to operate. Even people who pretend they despise government interference rely on them. Copyright and trademark doesn't matter when you need to train an LLM, but it matters a whole lot when I start marketing my iWatch smart watch. That rhythm of abuse, then correction governed American capitalism for a century. For surveillance capitalism, round two never comes. There is no functional federal counterweight as I write this in 2026. Some states are trying, and good for them, but regulating the internet state by state isn't progress it's just stopping the bleeding. Meanwhile the brokers buying and selling your life exist entirely outside your scrutiny, have no fear of comprehensive reform, and can swing a statehouse election for what they spend on a quarter's catered lunches. Entities this powerful cannot coexist with a functional democracy — a fact they seem to have considered, given the rise of the "Nerd Reich". https://www.npr.org/2026/08/10/nx-s1-5925350/the-nerd-reich-tracks-the-unmasking-of-silicon-valleys-true-politics So the order of operations is simple. Washington can't act, so Brussels does. Brussels acts, and the world follows, because the market is too big to leave. That is the whole story of GDPR: not European ambition, but American absence. A sign of the declining empire if you will. Roosevelt gave that speech at Madison Square Garden on the last night of October 1936, and a week later he won forty-six states. The people who hated him got Maine, Vermont, and the next ninety years of being wrong about everything they hated. That's the thing about being hated by the right people which is it is a currency and a valuable one. Privacy regulation will get there too. Not because the industry repents because industries don't, but because this is how every one of these stories ends: seatbelts, smoking sections, lead paint. Normal, then scandalous, then unthinkable. Someday someone will ask what an ad network for children was and refuse to believe the answer. And the executives who fought this will be on a boat somewhere, explaining that they were for it all along. Accept all.

0 views
Martin Fowler 1 months ago

Making Your Data Ready for Agentic AI

Lots of organizations are excited about what AI can do to streamline their processes, save money, and juice margins. But AI's capabilities are founded on the data that AI accesses, and for many organizations that foundation is little more than sand. Pramod Sadalage and Prem Chandrasekaran write about how to build a reliable foundation of data that can be accurate and trusted.

0 views
マリウス 1 months ago

The Cables that Connect the World

At the northeastern edge of La Línea de la Concepción , on a scrubby Mediterranean beach called El Burgo–Torrenueva , there is an old battlement-tower, La Torre Nueva , and not much else. It was part of the system of coastal watchtowers during the 16th century that would defend the area against the incursion of the Barbary corsairs . The coordinates are . Walk the tideline and you would never know that buried two metres beneath the sand, a fibre-optic cable comes out of the sea here and turns into the internet. It’s the start of a line that runs across the Strait of Gibraltar to Ceuta , on the African coast, and on toward two continents. Nearly everything you do online that crosses an ocean passes through a cable like this, ending, in most cases, underneath a similarly unremarkable patch of coast. Note: Ceuta is an interesting place by itself, that has recently gained some attention and that would also make for an interesting write-up of its own. However, the tl;dr is that it is an autonomous Spanish city of some 85,000 people sitting on the North African coast, bordering Morocco , which means the European Union has one of its very few land borders with the African continent running straight through a peninsula most people could probably not even point to on a map. It has been held by the Spanish crown since 1668, it had been Portuguese before that, and Morocco seemingly never stopped claiming it. For our purposes, though, what matters is that the small enclave, until very recently, hung off the mainland’s network by a single ageing link. When we talk about the internet we do so as if it were air. Ambient, ownerless, and everywhere. In reality, however, it is the exact opposite, because international data doesn’t (normally) travel by, let’s say, satellite, despite what most people might assume. It travels through roughly 1.5 million kilometres of very real (and very owned) fibre-optic cable lying on the seabed, surfacing at a small number of carefully chosen landing points. For these landing points you normally need a gently sloping seabed, mild currents, and little marine traffic, so that anchors and trawlers don’t sever the line. Suitable spots are scarce enough that the same beach usually becomes the shared landfall for several cable systems at once. Unlike what you might be thinking of at first, submarine cables aren’t your run-of-the-mill Ethernet or fibre cable. The hardware that does the heavy lifting out in the deep ocean is about as thick as a garden hose with roughly 25mm across and weighing in at around 1.4 tonnes for every kilometre. The part that carries your data is a small bundle of glass fibres, each one around the same thickness as human hair, sitting in the very middle. Everything else wrapped around those fibres is there to keep them alive in a deeply hostile environment. Working outward from the core, the fibres sit in a water-blocking gel inside a thin copper or aluminium tube, which is sheathed in polycarbonate, then an aluminium water barrier, then a layer of stranded steel wires that give the cable its tensile strength, then a wrap of mylar tape, and finally an outer skin of polyethylene. The copper is for power, because the cable doubles as a very long extension lead, which we will get to in a moment. Closer to shore, where trawlers and anchors roam, the whole thing gets one or two further jackets of galvanised steel armour wire, swelling it to 50mm or more in diameter and several times the weight. Hence, the cable that surfaces on our Spanish beach is buried a couple of metres down and not simply left lying on the sand. The reason a copper conductor runs the entire length is that light, no matter how pure the glass, slowly fades as it travels, and so every 50 to 80 kilometres the cable is interrupted by a repeater , which is an optical amplifier that boosts the signal back up before passing it along. Each repeater needs electricity, and because the fish sadly still didn’t manage to install power sockets on the ocean floor, the shore stations at either end have to feed a direct current of anywhere between 3,000 and 15,000 volts down that copper core, to literally power the cable from both ends at once. On top of the amplification, modern systems lean on a stack of clever tricks to keep the signal intelligible across thousands of kilometres of glass, including wavelength-division multiplexing to cram many separate colours of light down a single fibre, coherent detection to read them back out, and forward error correction to repair whatever gets garbled along the way. Length, then, is mostly a question of power and amplification rather than of the glass itself. Shorter hops can dispense with repeaters entirely, hence an unrepeatered span will happily run to around 250 kilometres on amplifiers at each end alone, which is roughly the length of the line we started this post with. At the other extreme, a single system can stretch across an ocean, and the longest of them, like the 2Africa cable encircling the continent it is named after, run to tens of thousands of kilometres. The actual manufacturing and laying of these cables is, perhaps a little surprising for something the entire global economy rests on, the business of only a small handful of companies. The bulk of the world’s submarine cable is built and installed by just four suppliers, namely the American SubCom , the French Alcatel Submarine Networks , the Japanese NEC , and the Chinese HMN Technologies . They own and operate the specialised fleet of cable-laying ships, which aren’t exactly the kind of boat you would recognise from a harbour, but more like a purpose-built vessel carrying thousands of kilometres of cable coiled in enormous tanks below deck, rolling it out over the stern at a steady walking pace as they crawl across the ocean. Deploying a new system is a multi-year effort that begins long before any ship leaves port. First somebody, these days increasingly a content giant rather than a phone company, decides a route is worth having and assembles the money for it, either alone or as a consortium of several owners sharing the bill. Then comes a marine survey, in which a ship maps the intended path along the seabed to find the gentlest, safest route around wrecks, trenches, and other people’s cables, followed by the permitting, which is the paperwork of securing landing rights and concessions from every jurisdiction the cable so much as touches. As we are about to see on the Spanish beach, this can generate a remarkable quantity of bureaucracy . Only once all that is settled does the cable get manufactured to length, loaded onto the ship, and laid, with the vessel simply lowering it onto the seabed in deep water and a sea plough burying it a metre or two beneath the sediment closer to shore, where the danger from fishing and anchors is greatest. A working ship covers somewhere in the region of 100 to 200 kilometres a day, so an ocean crossing takes several weeks at sea. A transatlantic system running some 7,000 kilometres typically costs in the order of 250 million USD, while a longer trans-Pacific route can easily climb towards 400 million, and the cable itself runs anywhere from roughly 6,000 to 20,000 dollars per kilometre, depending on how many fibre pairs it carries and how heavily it is armoured. Keep in mind that the spending does not stop once the cable is lit, because a submarine cable has a design life of only around 20 to 25 years and on top of that there are somewhere between 150 and 200 faults occurring across the world’s cables in a typical year. The overwhelming majority of them are not caused by sabotage or sharks, but by the combination of fishing gear and dragged ship anchors. Each break has to be mended by sending out one of a small number of dedicated repair ships, that are on permanent standby under regional maintenance agreements, to grapple the cable up off the seabed, haul both severed ends to the surface, splice them back together, and lower the repaired thing back down. This is slow and weather-dependent work that is quite expensive. With the data provided by TeleGeography ’s Submarine Cable Map I have put together a list of the (co-)owners of undersea cables and sorted it by the number of cables each individual company has a stake in. The full dataset runs to some 473 distinct owners, the overwhelming majority of which are obscure national and regional carriers you will never have heard of, so rather than just dumping the entire list here, I limited it to the hundred most prolific (co-)owners: Note: These figures are derived from the public Submarine Cable Map data, counting both, systems already in service, and those still planned or under construction (603 of the former, 91 of the latter, at the time of writing). The field is free-form text, so a few owners turn up under more than one spelling, and I had to do a little manual untangling of company names. What jumps out, at least to me, is the name sitting right at the top. For most of the history of this infrastructure the owners were telephone companies, the BTs and AT&Ts and NTTs of the world, laying cables to carry one another’s calls and, later, traffic. Google now has a stake in more submarine cables than any traditional carrier on the planet, with Meta not far behind, and Microsoft and Amazon both slowly accumulating their own share. The companies that fill those cables with traffic have, over the past decade or so, decided that they would rather own the pipes than rent them. The other thing the numbers tell you is just how long the tail is. Of those 473 owners, some 260 appear on exactly one cable, and more than 340 of them, north of seventy percent, on no more than two. These are the world’s national telecoms, each one buying a slice of the handful of consortium cables that happen to land on its particular stretch of coast, which is also why so many of the big international systems list a dozen or more co-owners apiece. The internet, seen from this angle, is less of a single network and more of a mix of local operators, all chipping in for a share of the same few very expensive ropes across the ocean. To see what it looks like where the cable actually meets the land, let’s head back to that beach in La Línea . The cable that surfaces there is called Dos Continentes , it belongs to GTD , a Chilean telecoms group , and it’s a relatively small regional system consisting of two armoured fibre cables looping across the Strait of Gibraltar to Ceuta , the Spanish enclave on the African coast that depended on a single ageing link before this one was built. I went looking for exactly where it comes ashore, and the paper trail gives an idea about how invisible this infrastructure actually is. The cable lands in Spain, but the public Spanish government map of coastal concessions doesn’t seem to show it, because it looks like coastal permits in Andalusia are devolved to the regional government. The landfall instead shows in a regional registry , in a signed resolution buried under an expediente number. That document pinpoints where the cable enters the public maritime domain, at grid reference , just seaward of the beach manhole. The cable then runs inland, buried as the permit insists ( “no exterior element above ground level” ) to what is presumably a network node, where traffic is fed into GTD ’s pre-existing terrestrial dark-fibre network, from where it’ll eventually travel to one of the actual GTD data centres in Madrid , Barcelona , Bilbao/Sopelana , and Sevilla . On its way out to sea it crosses three older cables already lying on the seabed, namely Europe India Gateway , ATLAS , and FLAG . As can be seen (or, well, actually not) even an empty-looking patch of water off a Spanish beach is layered with other people’s infrastructure. Note: When GTD applied, it seems that the town council of La Línea formally objected and asked them to drop the project. The cable, the council said, cut straight through the main local fishing ground, “splitting it literally in two” , threatening the small shellfish and trasmallo boats that work those waters, and a protected limpet that lives on the rocks, in a town whose fleet was already squeezed by run-ins with Gibraltar over fishing rights. However, they were overruled and the concession was granted anyway, with mitigation conditions attached, for an initial fifteen years. The Dos Continentes cable ( Segment I , La Línea - Ceuta Sur ramal ), owned by GTD Cableado de Redes Inteligentes, S.L.U. , the Spanish arm of the Chilean GTD group , has a total length of ~105 km and is in service since 2020 under the signed concession resolution from the Junta de Andalucía ( Dirección General de Calidad Ambiental y Cambio Climático ), expediente , dated 14 January 2020. The two key points, as given in the resolution’s coordinate table are: Note: The resolution’s prose text gives a slightly different value that disagrees with its own table by approximately 140m. To convert the UTM coordinates I used the official Instituto Geográfico Nacional ( IGN ) Calculadora Geodésica with the following settings: and differ by only centimetres in practice, so the resulting coordinates (WGS84-equivalent) can be dropped straight into any consumer map or GPS app: Both points sit on Playa de El Burgo–Torrenueva , beside the Punta de Torrenueva tower, at the northeastern ( Levante / Mediterranean-facing) edge of La Línea de la Concepción , against the municipal boundary. The resolution describes the route as passing “muy cerca de la torre-faro existente en la Punta de Torre Nueva” . As you can see, however, you see nothing. :-) The permit requires the whole installation to be subterranean ( “no exterior element above ground level: No manholes, splices, connections or terminals.” ), hence you can stand exactly on the landfall, but it’s a point in the sand by a tower, and not a structure. On the afternoon I was there, a couple of dozen people were spread out on that stretch of sand under parasols, probably not even knowing that somewhere underneath them the link that carries an entire enclave’s traffic to another continent came out of the sea. It is interesting to see that what has changed most over the past decade isn’t the technology itself, but who pays for it. For a century these systems were built by carriers selling capacity to one another, which made the network something close to a shared utility with many owners. Today, however, the largest (co-)owner of submarine cable on the planet is an advertising company. It probably makes sense in their position, however it is a change in how the network is governed, and, more importantly, it seems to have happened almost entirely out of public view, which is worrying. If you live anywhere near a coast, there is a decent chance one of these things lands within driving distance of you, and the TeleGeography map will get you to roughly the right bay. Getting from there to the actual patch of sand takes some amount of digging through concession resolutions, planning registers, environmental reports, and sometimes the local newspaper archive. It took me an evening of reading to narrow it down, but I can recommend to do this exercise if you’re curious about the world that you’re living in and, more importantly, the hidden infrastructure surrounding you. PS: Maybe we picked the wrong word and should have called it the trench rather than the cloud ? Transformation type: Transformación de Datum Reference system: ETRS89 Input coordinates: UTM Huso (zone): 30

0 views
Krebs on Security 2 months ago

Who’s Tracking You? Use This New Service to Find Out

It can be daunting to determine who’s responsible for showing ads on the websites we visit, or who’s harvesting data from the mobile apps we use every day. That information is already semi-public, but it is not easily parsed and traditionally much of it has remained walled away in the hands of large advertising platforms. Not anymore: A powerful and free new service called DecryptAds scrapes and correlates this adtech data and makes it simple to quickly learn a great deal about the entities that are tracking you. A Decryptads summary of the advertising partnerships declared by espn.com. The newly launched decryptads.com says it is constantly scraping the files that websites and apps make publicly available to disclose the companies that are permitted to run ads or collect user data. These files include: – ads.txt : all of the adtech companies and data brokers that may run ads or harvest data from the site; – app-ads.txt : entities that can harvest data from or display ads on mobile and smart TV apps; – buyers.json/sellers.json : the entities buying, selling or reselling ad inventory for a given site or app. Zach Edwards is chief research officer for DecryptAds and a threat researcher at the security company Infoblox . Edwards said he and two other founders decided the service was needed because the adtech data in these files is generally only useful when it can be cross-referenced to build a more complete picture of the advertising ecosystem for each website or app. “It’s an adtech tool but we’re trying to approach adtech from a security perspective,” Edwards said. “It’s really built for a lot of privacy and security use cases that have been dramatically underserved.” Those use cases, he said, include tracking down the source of malicious ads that try to foist malware on targeted users, identifying ad networks located in adversarial nations, and detecting the fast growing swarms of AI-generated slop websites and apps. And as decryptads.com demonstrates, these potential security and privacy threats are near impossible to detect just by viewing a single apps.txt or app-ads.txt file. “Supply-chain integrity issues rarely live in a single file,” the site explains . “They show up as broken cross-references between ads.txt, app-ads.txt, and sellers.json files; as cloned declaration sets across unrelated domains; as seller removals that only make sense when viewed across exchanges; and even as supply paths in bid logs that never actually appear in any given publisher’s authorized-seller list.” A search in DecryptAds for the hugely popular sports network espn.com reveals 143 ad partners and 19 registered data broker domains are listed within its ads.txt and app-ads.txt files. That data broker information is gradually becoming available because four states — California, Oregon, Texas and Vermont — have recently passed laws requiring data brokers to register if they buy or sell data on consumers from those states. DecryptAds reports that almost half of those data brokers are collecting geolocation data from espn.com visitors who aren’t blocking ads, while another three disclose that they collect device fingerprints and sensitive personal information. A visual representation of the complex ad supply chain declared by espn.com. Image: decryptads.com. DecryptAds also makes it easy to learn the beneficiaries and national origins of the advertising firms lurking in apps and websites, displaying a conspicuous warning when adtech partners of an app or website are based in “geo-risk” areas like China and Russia, or in countries with strong financial and political ties to both — such as Cyprus and the United Arab Emirates (UAE). According to DecryptAds, espn.com works with four different advertising entities that are based in either Russia, China or the UAE, including the adtech firm Between Digital , which lists a New York address. However, the dossier on Between Digital flags them as a Russian firm, showing that their publisher offers (PDF) are processed through Alfa Bank , Russia’s largest private commercial bank and one of several financial institutions placed under U.S. sanctions in 2022 after Russia invaded Ukraine. KrebsOnSecurity sought comment from both Between Digital and the company’s founder, and will update this story in the event that either replies. A search for several top U.S. military news websites — including armytimes.com , airforcetimes.com , defensenews.com , navytimes.com , marinecorpstimes.com and federaltimes.com — shows they all allow Between Digital to serve ads and track users, as well as two entities in the UAE and another in the ownership secrecy haven of Panama. DecryptAds reports that Between Digital is collecting ad data on approximately 55,000 partner websites. The “Geo Risk” section of decryptads.com. Pivoting on Between Digital’s app-ads.txt file reveals hundreds of domains featuring simple web-based games that are frequently interrupted by ads. Edwards said Between Digital’s own declarations show the company is listed as both a publisher and a reseller on approximately two-thirds of their portfolio. “It means they are basically playing both sides of the bidding equation, which creates opportunities to direct client spend at your owned and operated properties or client infrastructure, essentially creating opportunities for conflicts of interest,” Edwards told KrebsOnSecurity. “The problem we have right now is that for years we’ve had almost no one policing these ads.txt and app-ads.txt files.” The Opera Web browser remains quite popular, and probably many users are unaware that since 2016 it has been majority owned and controlled by the Chinese company Kunlun Tech (the operational headquarters of Opera remain in Oslo, Norway). Opera.com’s profile at DecryptAds identifies 27 registered data brokers collecting information, including 15 adtech partners in the UAE, six in China, three in Cyprus, two in Russia and one each in Hong Kong and Ukraine. DecryptAds makes clear, however, that these companies represent just seven percent of the adtech partners specified in Opera.com’s ads.txt and app-ads.txt files. One feature of DecryptAds that sent this author down multiple hours-long research rabbit holes is its Legal Dossier lookup , which takes several minutes for each search but eventually churns out oodles of useful information about who owns a particular domain or app, when it was registered, and any aliases or relationships it may have to adtech companies and other websites or apps. For example, last month KrebsOnSecurity wrote about researchers from Bitsight who found that an extremely popular line of TV streaming sticks called H96 quietly rent out each user’s Internet connection to strangers. Bitsight also discovered that when these devices aren’t being used to stream pirated video content, they are spoofing themselves as mobile phones clicking ads on AI-generated slop websites . Bitsight concluded that the same Chinese company that made several of the malicious apps common to all of these H96 streaming sticks — the Fengwo Group — also also ran the network of ads and AI slop websites being clicked on by tens of thousands of these devices that are pretending to be mobile phones. Examples of ad landing pages linked to the Fengwo Group. These sites were designed to show ads only to H96 devices that were spoofing their device type as mobile phones. Image: Bitsight. A DecryptAds legal dossier on the (now dormant) Fengwo Group domain name for the AI slop website pictured on the left in the screenshot above ( medicalbeautyhub dot com ) shows it shares a seller ID ( 1674071 ) with a gaming website — giacoloredstones[.]com — which features yet another seller ID ( 103488000 ). Pivoting on that latter seller ID reveals hundreds of active websites within Russia’s Yandex ad system featuring extremely low-quality games or simple utilities that pepper visitors with ads. Edwards said that when advertising networks suspect a given advertiser is engaged in unauthentic clicks or displaying malicious ads, very often those networks will quietly remove the offender from their list of approved partners without letting anyone else know about their suspicions. This practice, he said, makes it easier for dodgy adtech firms to avoid accountability and continue victimizing others. To address that visibility gap, DecryptAds features a quiet removals feed that records and correlates all of the sellers.json removals across ad exchanges for the same seller domain or name. A screenshot of the Quiet Removals Feed at decryptads.com. “The way the adtech industry works, someone will write a report about ad fraud and only share it with their own clients and they won’t make it public,” Edwards said. “The ban is just removing them from the sellers.json file, but they told nobody. One day it was there, the next it was gone. So if you’re trying to navigate who is suspicious, that’s usually tough to do because there are a lot of adtech companies removing things all at once.” Malvertising, the term given to the practice of inserting malicious ads that foist malware or redirect visitors to phishing pages, remains an all-too-frequent occurrence in the modern adtech industry. But Edwards said these malicious ads are far more commonly found now on newly generated AI slop websites than on high traffic destinations that typically employ a variety of technologies and third party tools to quickly flag bad ads. “None of these slop AI content farms are paying for that kind of protection,” he said. “They’re just signing up the lowest quality partners, and it essentially becomes a greased rail to target the users of those sites with malicious ads. Most malvertising attacks don’t happen on espn.com or huffpost.com, but rather [on] some lower quality content farm and someone just went there because it came up in a search.” Edwards said the AI slop websites are populated with machine-generated blog posts and images, and cover a wide array of themes from home improvement and decorating to food recipes, hunting, cars and consumer technology. He said organizations that get hit with malicious ads are often at a loss for what to do next, unaware that in most cases the answer is one of the entities listed inside the website’s ads.txt or app-ads.txt file. “A lot of serious organizations are starting to understand that if we’re not breaking down this ad data, we’re not going to know who’s targeting government people with zero-click payloads on an almost daily basis,” he said. Edwards maintains that truly getting a handle on the malvertising and AI slop problems will require more data-sharing by the major ad networks. Specifically, he says those platforms do not broadly share what’s known as the “supply chain object” or SCO, structured data attached to each advertising bid request that lets buyers see every seller, reseller and intermediary involved in passing an ad impression from the publisher to the final buyer. “That SCO tells you who sold it or resold it, and who was the final entity that bought the impression that served that malware payload,” Edwards explained. “You may see the malicious zero-click redirection, but without the supply chain object — which is only served server side — you won’t know who targeted your people with malware and won’t have a way to try and prevent it properly. But if we can encourage the adtech industry to expose that SCO, it will get easier to find the culprit behind any one bad ad.” DecryptAds also offers an application programming interface (API) that allows researchers to automate queries and integrate the site’s functionality into popular AI platforms. The only sane reaction to the examples described above is to block all online ads outright. This approach is broadly endorsed by security experts because it also makes it more difficult for adtech firms and data brokers to build detailed profiles on you and track your movements around the web and in the real world. However, much depends on how you normally prefer to browse the Internet, and how much trust you place in third party browser plugins and extensions. For those primarily surfing via a regular desktop or laptop Web browser, uBlock Origin Lite is an excellent free and well-maintained open source option. uBlock Origin also should work with mobile browsers like Firefox, but apparently only on Android-based devices. Adblock Plus is a decent option for iPhone and iPad users. For power users, Adblock and uBlock Origin both support custom blocking rules from easylist.to , which publishes a frequently updated list that removes most advertisements from webpages. The well established browser extension NoScript blocks all non-approved Javascript code, and it generally does a fine job blocking most ads from loading. However, script blockers like NoScript may not be suitable for average users who don’t enjoy constantly having to referee which scripts should be allowed to load so that each site displays properly. More technically inclined/adventuresome readers should strongly consider a hardware approach to blocking ads at the local network level, because that is easily the cheapest, most secure and scalable way to do it. A tiny, low-cost and broadly available computer known as a Raspberry Pi can be turned into a powerful ad blocker for all devices on a local network when fitted with a microSD memory card and a free program called Pi-hole . Once you’ve set it up properly and changed your router’s network settings to use the Pi-hole’s DNS sinkhole and DHCP servers, it should prevent ads from displaying on any devices connected to that network. Bear in mind that ad blockers often do little to block ads and/or tracking that occurs from within mobile apps that users have chosen to install on their devices. Many websites now push users to install a mobile app, supposedly in order to more fully access and enjoy the site’s services and content. But in my experience, they’re not doing this because the user experience is somehow way better on the app (as LinkedIn tries to convince us non-app users several times a week via email). On the contrary, I find most mobile apps to be horribly designed, annoying, and/or completely unnecessary, and when given the option I will almost always choose to interact with a website or service directly in a Web browser. No, the cold truth is that big web destinations tend to get pushy with their apps because they make it easier for these companies to keep you on their platforms longer and to collect (and in many cases resell) far more precise data about who, what and where their users are. Also, companies pushing customers the hardest to install mobile apps always seem to liberally opt everyone in to having their data used to train large language models these days. So be cautious about the apps you install on your mobile devices ( including any smart TVs! ), and poke around their listings at DecryptAds if you want to learn more about their privacy practices and any relationships they may have to adtech firms.

0 views
iDiallo 2 months ago

Where Did the Productivity Gains Go?

There is a machine called Productivity, and on this machine there is a knob and a button. The knob increases productivity, and the button is labeled "reset." My job was data entry at a non-profit. It was my first job in the US where I didn't have to lift heavy objects. My main task was entering collected donations into a database. The data source was email attachments, which came in various formats. Excel files, Word files, and some directly embedded in the email body. The database itself was FileMaker Pro. Every part of the process was wasteful. To receive the emails in the first place, I had to call the person who collected the donation, argue with them, and guide them through the process of emailing me the information. The donations were collected at events, and the data was often just handwritten on a note. Once I got the email, I would extract the content from the attachment and organize it into an Excel file. Then I would manually enter it into the FileMaker database, one row at a time. In a full workday, I could process no more than a dozen entries. So I decided to improve the process. I started from the end. Entering data into the database was error-prone. I had to enter the name, address, donation amount, and a plethora of other information into a single row of a database viewer, and I often put the wrong data in the wrong column. So instead, I created a form with validation. I built a standardized Excel file where the people collecting donations could enter data directly into the correct columns and send it to me. This turned out to be too much to ask. Several people didn't know how to use Excel, and it became a nightmare of technical support. Eventually, I switched to a formatted Word document. Annoying, but it worked. Lastly, I created a process. Every Monday, I would email everyone to remind them to send me their donations by Wednesday, so I would have plenty of time to enter them on schedule. The deadline was arbitrary, but it slowly hardened into policy. My system was a success. I was entering hundreds of donations every day. In terms of productivity, I had more than 10x'd my output, which I thought was a good thing, until I started getting noticed. What have you done for me lately? My productivity machine's knob had been dialed to 11. But I had also set the new standard for how much needed to get done in a day. So my manager hit the reset button. The dial went back to zero, but the expectation stayed exactly where it was. It's funny how that always happens. Increased output never turns into more free time. Instead, it becomes the new normal. Anything less looks like a drop in productivity. These days, with AI common in the workplace, every semi-technical manager has started building apps themselves instead of taking requests to the dev team. They get a rush from how much code they can produce, and they enjoy that high for a while. But they fail to see that the productivity gain only exists at the very beginning, before the app is actually in use. Once people start using it, you don't get to regenerate the app from scratch every time you want to add a feature. Instead, you have to add things slowly and carefully, without breaking what already works. All fields start green, but they brown eventually. When you get an extremely productive teammate, you start looking at the rest of the team as time-wasters. In fact, once you get used to what that teammate produces, you start treating it as the baseline and eventually you ask, "What have you done for me lately?" I was let go from that job in a little celebration, right after I'd trained my replacement. One morning, my manager simply announced that it had only ever been a summer job, and summer was ending. So my last day was set. I was too green to point out that this had never come up during hiring, and that I'd actually started well before summer began. They brought cake on my last day. What they failed to see was that my process was still very much manual. My replacement was let go when she couldn't manage more than a dozen entries a day. So much for productivity gains.

0 views
Tara's Website 2 months ago

Cobolito/400: a tiny data appliance in the IBM 5280 lineage

Cobolito/400: a tiny data appliance in the IBM 5280 lineage I wrote an essay about Cobolito/400, a tiny data appliance built as a tribute to the IBM 5280 and to a style of computing where records, screens, media, and operators still had visible relationships with each other. At the beginning, it was meant to be a blog post. But somewhere between Scottish biscuits and a cup of tea, I got carried away and wrote almost 90 pages instead.

0 views
Stratechery 3 months ago

Muse Image, Grok 4.5, Alex Karp on CNBC

The batter for verifiable data is increasingly defining the AI race, from Meta to Grok to the frontier labs.

0 views
iDiallo 3 months ago

Amazon Basics, but for intellectual property.

Amazon has been accused several times for ripping off merchants on its platform. And every single time they denied any wrongdoing. A merchant, or anyone really, can create a product (or source it from China), then resell it on amazon. Amazon is the service provider, and hosts all the metrics concerning the products. If Amazon themselves were in the business of creating and selling products, then that creates a potential of conflict of interest. Because they have the data of all products that sell and sell well. They could replicate that success without doing any further research since the merchant has already confirmed the existence of demand. It's not surprising that Amazon Basics quickly became the best selling "private-label brand" on Amazon. They already know what sells because they have access to the data. Yet they continued to deny it, and state that they only ever use publicly available data from sellers . An Amazon spokesperson said the company believes the allegations are "factually incorrect and unsubstantiated," adding that Amazon strictly prohibits the "use or sharing of non-public, seller-specific data for the benefit of any seller, including sellers of private brands." Yet the results are right there for all to see . If you sell any product through Amazon, you are exposing your company's operations to them. If you want to keep that information to yourself, then you don't get to reach your customers, which in reality are Amazon's customers . If you want to buy something online, and get it shipped as quickly as possible, then Amazon is a blessing. Most often than not, you are not buying the product directly from Amazon. An independent store or vendor with a presence on Amazon will fulfill your order. The seller only has minor identifying characteristics on the platform. On the search result page, the space designated to the seller is small and insignificant. The customer has very few reminders that products are offered by anyone but Amazon. (Although if you want to dispute a sale, you are starkly reminded that the item is from a 3rd party vendor.) So there is no surprise when companies embrace AI internally, they are putting themselves at the risk of sharing their product with their competitors. Maybe the most obvious example is when Antropic came up with Claude Design. A tool to help users generate designs, wireframes, etc. Kinda like Figma. That's not a problem on its own, but when Antropic's chief product officer sits on Figma's board of directors, you can't say that there isn't a conflict of interest there. In fact, the chief product officer resigned from the board merely days before Claude Design was announced. He basically extracted all value from Figma then resigned. Figma's AI features are built on top of Claude. So Anthropic literally pulled an Amazon Basic on Figma . When companies force their own employees to use AI to do their day to day work, they are basically asking employees to upload company data to a 3rd party that may become a competitor. Sure something in the contract clause says that the AI company won't train on enterprise customer data, but nothing stops them from peaking at successful product data. Whenever someone tells me that they used AI to build an app and boast of its values or uniqueness, I want to remind them that if you can just prompt-create a product, so can the AI provider. In fact, they might have better resources to create a competing product if it displays any sign of success (see Figma). While it looks like plenty of people are benefitting from AI today, all this information is being shared with AI providers. We are giving them full access to our thought process. When you include them in your workflow, you are basically providing them with a step by step approach on how to do your job. Don’t be surprised when you see a native Antropic/OpenAi project management application suite. Or a CRM, or any software that is trying to integrate with AI and may experience success. A few years back, when I worked in Customer Service Automation, we discovered that most companies used Zendesk to manage their customer service. Since customers mainly contacted support via email, an intentional database had been built that tracked users through their shopping experience throughout the web. While so much could be done with that data, like identifying “problematic” customers, or recommending products based on their history, we ended up finding something more helpful. We could easily detect a pattern of issues for certain shipping carriers. We could see when UPS was having delays in certain cities, or when Fedex was having technical issues when updating the last mile status. None of these things were features designed or provided by anyone. However, having access to businesses’ data gave us insight where we had none before. That became a feature for us, only because we were not competitors to all these online retailers. When you expose your company's internal data to a potential competitor, don’t be surprised when they build a competing business to rival you.

0 views
The Jolly Teapot 3 months ago

Unfinished, part deux

Two years ago, I published a post entitled Unfinished . It was a way for me to share some thoughts without having to work on them as much as I do on regular posts. As I wasn’t sure if these “lesser thoughts” were worth my efforts and my time, I compiled them in a different post format, inspired by a song: This post is inspired by the excellent track entitled Lamb’s Garbage (Unfinished) , from the classic album and one of my favourites, Mr Oizo’s Lambs Anger . The concept of the song, as its title suggests, is to regroup bits of songs that were never completed to be full tracks. Well, here we are again. The text file where I jot down all my ideas, quick thoughts, and potential topics for blog articles is starting to get a bit too long for my liking, so I think it’s time for a little clean-up. What you will see below is what was saved from the big flush, and what I don’t share on social media since I am no longer participating . Think of this as a list of intros, tweets, and blurbs of what was going on in my head recently. I believe some of these themes can be used later for a full post; in the meantime, feel free to use them for your own blog. And if you don’t have a blog, please, start a blog . I love spreadsheets. This is something I find a bit difficult to admit, but I do like working in spreadsheets. I even firmly believe that Google Sheets is their best product. I already like lists, but a spreadsheet is on another level. I like to make my spreadsheets look pretty, I like to plan how they will look, I like to build, I like to make them functional, legible, easy to read. For me, it’s a very pleasing and interesting thing to do at work: there are so many possibilities. When I create a spreadsheet, I feel like an app developer. I feel like I’m a graphic designer. I had a co-worker once whose job included the creation and design of very complex spreadsheets for other teams, using Microsoft Excel, Microsoft Power BI, and such. The resulting spreadsheets were glorious: fully featured and interactive dashboards, gathering data from different sources in real-time. Works of art. Are answers from A.I. chatbots recycled for other users asking the exact same thing, or are answers always generated from scratch? Wouldn’t it be cheaper and more energy-efficient ? If I ask “ explain the difference between irony and happenstance ”, will the A.I. chatbot just paste an existing, perfectly fine answer (one that received positive feedback in previous chats), or will it work to generate a brand new answer? Why do so many people keep saying “Samsung charger” or “iPhone charger” instead of USB-C, USB Type C, or just USB? I mean, despite these cables and connectors being ubiquitous in our lives, I see a lot of people completely ignoring what they are called. I wonder why. Don't brag so much about using A.I. It’s great that you used A.I. to do this thing you’re presenting. I can see how it has been useful and how much faster it helped you reach your goals. I understand that without A.I. you could never have pulled this off. I know it’s a way to show how you are part of the A.I. revolution, that you’re not left behind. No shame in that. I work with A.I. a lot too, I’m not judging you for that. But please, don’t present your use of A.I. as a skill. It’s just a tool. Your skills are elsewhere. Having access to tokens is a weird flex. The tools you use and how you use them may interest a few of your peers, but what you create with these tools is what truly matters. Do you know what type of video cameras were used in your favourite film? Do you care? By the way, the same piece of advice applies to air fryers. If we work so hard on automating our current tasks and projects with A.I. agents, how will we tell which ones are worth doing at all? Does everything need to be A.I.-enabled and optimised? Are we reproducing the same mistake that we made with social media, shoving it everywhere we could? On that topic, I highly recommend this excellent article on The Verge . Efficiency is not the ultimate goal for most people: efficiency for what? For whom? Besides, friction is not always a problem : sometimes friction is how new ideas spark to life. If you are like me, an avid consumer of Techmeme , you will have noticed that A.I. companies get a huge part of the coverage these days. I don’t know if it’s an editorial choice of Techmeme or if it’s just a reflection of the public reception of said news, but my gosh it seems that Gemini or ChatGPT or Claude gets an incremental update every day, and they float on top of the site’s homepage seemingly forever. I wouldn’t mind a new site just for A.I. news, just like Mediagazer does what Techmeme does but for everything media-related. I’d call it Datacenter and it would make Techmeme a bit more interesting. I recently discovered that something I immensely dislike has a name: the Rae Dunn style for household items. Billionaires cannot stand the idea of a democracy where their individual vote is, technically, worth exactly as much as the vote from the person who takes care of their laundry. They hate that. So what do they do? They buy media or social media companies to try to influence thousands to vote like them. Side note on the ridiculous LinkedIn habit that consists of putting a link in the comments of a post, and writing in the post “Link in the comments”. Just put the link in the post, as you’re supposed to, so we can have a nice preview of the post, and we don’t have to look at the even more ridiculous comments of every LinkedIn post. How messed up is that? I know it’s for better “reach” and to trick the algorithm, but you just look thirsty for likes. Isn’t that link the thing you wanted to share? Do you prefer a click or a like? What’s a like good for if nobody visits your link? Thankfully, I don’t have a LinkedIn account, and I can ignore this nonsense most of the time, but I do check on a few LinkedIn posts for work and this is making me both sad and angry. On Instagram, the whole “Link in bio” was necessary because that was the only way to share links back then. But LinkedIn? No excuse. Yes, it sucks that their algorithm prefers posts that won’t send users out of their precious, shitty platform. I’m with you. But you don’t have to play their silly little game. You’re better than this.

0 views
Aran Wilkinson 3 months ago

Headcode started as a project to learn UK rail data

It now has eight live endpoints , a tiered pricing page and an alpha banner warning people the schemas might still move under them. None of that was the plan. The plan was to understand how UK rail data actually fits together, and to work out how to use an LLM properly on something real instead of a toy. The product is just what happened while I was doing that. I'm still not sure it becomes a business. I'm completely sure the way I learned to work on it was worth the time, and that part I now use every day on everything else. One station has more names than you'd believe, and that's the whole problem. King's Cross is KGX to the fares system, KNGX to the timetable and 54311 to the movement feeds, with a handful more codes besides (NLC, ATCO, UIC), each from a different corner of the railway. You don't need to hold those in your head. Nobody ever agreed on one name, so every feed brought its own. It gets worse with size: a big terminus like London Bridge doesn't have one timetable code, it has a cluster of them, roughly one per platform group, so even "which code is the station" isn't a clean question. Then there's the live side. Darwin (the real-time running feed) pushes updates at you as a stream, while the reference data turns up separately, each source on its own schedule and in its own shape. Before you can render a single departure board you've written a reconciliation layer and a code-mapping table, and now you own both of them. That mess is exactly why it was good to learn on. Bounded enough that you can actually finish it, awkward enough that you can't bluff your way through. You either understand how the feeds relate or your departure board quietly shows the wrong train. The workflow I use now didn't arrive fully formed. It evolved, and the project is where each step earned its place. I started where most people start: a prompt and a plan. Ask for a thing, get a plan back, let it build. That's fine for small, self-contained work. It fell apart the moment a task touched code the model hadn't really looked at. It would produce something plausible and confidently wrong, and then I'd spend longer unpicking it than the thing was worth, either fixing it by hand or trying to prompt my way back out, which sometimes just dug the hole deeper. The failure wasn't the model being bad. It was me asking it to act on intent it didn't have. So the requirement moved to the front. Before any code, I'd work up a proper PRD with the model: I'd set the direction and push back, it would draft and fill in. These weren't a paragraph of good intentions. They grew into real documents, with the goals stated plainly and the out-of-scope list stated just as plainly, functional requirements (what it does) sitting next to non-functional ones (how fast, how reliable, what the limits are), a sketch of the technical architecture, the phases it would be built in, how it would be tested and what might go wrong along the way. Then I'd break that down into tasks small enough to review one at a time. The output got noticeably better, because the model was working to a brief instead of filling in the gaps itself. It stayed focused on the thing in front of it, and it had helped write the thing that kept it there. The step that changed the most came later, and it wasn't obvious to me at the start. A PRD is only as good as your understanding of the code it lands in. So before writing the PRD, I'd have the model research the existing codebase and write up how the relevant part actually works, what's already there, which patterns to follow. The thing that made the research useful was a hard rule: document the codebase as it exists today, and nothing else. No suggested improvements, no root cause analysis, no critique, no refactoring proposals, no architecture it wished were there. Only what exists, where it lives, how it works and how the parts connect. Left to its own instincts a model will reach for the fix, because pointing out problems reads as helpful. Forbidding all of that kept the output objective, a technical map of the system as built with the opinion stripped out. Adding that step changed the relationship. The model stopped being the author and became something that I directed, sent to find things out and report back rather than left to decide what to build. The research feeds the PRD, the PRD feeds the tasks, and I'm steering at every handoff. Review runs through all of it. I read the research, the PRD, the tasks, the plans, not just the final diff. That order matters more than it sounds. If the research is wrong, the PRD inherits the error and every task underneath it inherits it again, and by the time you're reviewing code you're three layers downstream of the actual mistake. The review at the top is worth far more than the review at the bottom. That's the honest line between this and vibecoding. It was never about whether I used the AI. It was about whether I ever let go of understanding what it was doing, and I made a point of not letting go. It wasn't all done this way from the start. The early parts of Headcode were built the way most things get built with an LLM, by prompting, getting something working and moving on. The discipline came later. As the research-into-PRD-into-tasks process settled, designing before implementing became the default, and the project quietly split into a scrappy first phase and a deliberate second one. You can see the join. The later work, the bulk of the API surface, the endpoint groups, the schema as it stands now, was designed before any of it was written, the spec settled while the code was still hypothetical. The early prompted bits I've mostly gone back and rebuilt to the same standard, because once you've felt the difference the scrappy version nags at you. What fell out of that patience is an API where the schema is the contract. It's OpenAPI-first, with a downloadable spec you can point a client generator or contract tests at. Identifiers resolve cleanly: hand it any code system and it gives you back all of them, so the reconciliation table that would normally be a thing you maintain becomes a field you read. Vibecoding the same idea would have got me a convincing departure board demo and a wall the moment the identifier resolution got hard. Rail data punishes building before thinking, which is precisely what made it a good teacher. Headcode is in alpha. There's no self-serve signup. Access is by request, you email me with what you're building and I send a token. That's deliberate while the data and the schemas are still settling. I genuinely don't know whether there's external demand for it. It might just stay a personal project, something I experiment with and build other things on top of, now that I've got the rail data in a clean format to start from. That alone was worth doing. I want to build visualisations on top of it, possibly a small app, and a clean API I control is reason enough to have built the thing. If people turn up actually wanting the data, it might grow into a small SaaS. What I'm not going to do is manufacture a roadmap I don't believe in, or pretend there's urgency around a project I started in order to learn. Whatever Headcode turns into, the workflow has already paid for itself. I went in wanting to learn how to use an LLM well on a real codebase, and the research into PRD into tasks pipeline, with review at every layer, is now simply how I work with one. The product is a maybe. The method, I kept. If you want to see what came out of it, Headcode lives at headcode.dev , and the API docs — endpoints, schemas and the OpenAPI spec — are open to browse at docs.headcode.dev .

0 views