@sarahjamielewis@mastodon.social
@sarahjamielewis@mastodon.social avatar

sarahjamielewis

@sarahjamielewis@mastodon.social

Cryptography and Privacy Researcher. Executive Director @ Open Privacy Research Society (https://hachyderm.io/@openprivacy).

Founder @ Blodeuwedd Labs (https://mastodon.social/@blodeuweddlabs)

Building free and open source, privacy-enhancing, surveillance-resisting tech like Cwtch (https://fosstodon.org/@cwtch)

This profile is from a federated server and may be incomplete. Browse more on the original instance.

sarahjamielewis, to random
@sarahjamielewis@mastodon.social avatar

Was in a meeting this morning and someone asked me how I would define "Queer Privacy".

And while I gave a good answer, I added "I'm pretty sure the foreword of the book says it much better"

And it really does.

sarahjamielewis, to random
@sarahjamielewis@mastodon.social avatar

There are so many problems with the UK's Online Safety Act. But reading through the Ofcom consultation document I'm struck by a few things.

  • Every implementation cost cited is about 2-3 orders of magnitude smaller than I would have come up with if asked for a conservative estimate for the kinds of services cited.

  • The "Defences" section which explicitly carves out a defence for harassment of queer people - really underlines the type of "safety" this act provides.

sarahjamielewis,
@sarahjamielewis@mastodon.social avatar
  • The Drugs section is a whole clusterfuck of overreach. I am in Canada, where Cannabis is legal.

Annex 10 states "It is not relevant whether the drug is a controlled substance in the state or territory from which the post originated." and seems to require all dispensaries in Canada to put "offer is not extended to users
within the United Kingdom" on all social media posts that might be seen in the UK.

sarahjamielewis,
@sarahjamielewis@mastodon.social avatar

Annex 10 also appears to require service providers to censor any links to sites where 3d printer blueprints are shared as pretty much all of them have files that in someway relate to the construction of firearms.

sarahjamielewis,
@sarahjamielewis@mastodon.social avatar

Ultimately I don't think these documents or the overall act matter all that much.

Governments around the world have decided that this is the Internet they want. A highly censored, corporatized collection of services - filtered through they're own prejudice, and politics.

Any hope I have for humanity is rooted in the idea that people, on the whole, will reject that.

So it doesn't matter either way.

sarahjamielewis, to random
@sarahjamielewis@mastodon.social avatar

Feels like every single time I read about the EU it's about a proposed legislation that will end all security on the internet, and it's somehow always a different piece of legislation each time.

At some point, you have to stop caring about individual laws and articles, and focus on the system that seems determined to deprive you of fundamental rights and freedoms.

sarahjamielewis, to random
@sarahjamielewis@mastodon.social avatar

A few thoughts on AI...

A collection of blobs on my computer no larger than dual layer blue ray can already flawlessly transcribe audio, generate any image I can conceive of (in countless variations and constraints), summarize and translate text and write mediocre code.

The open source tools for combining, controlling, and hacking these models together are gaining new features and capabilities every week.

The ethics of how these models came to be is important..but..that horse has bolted.

sarahjamielewis,
@sarahjamielewis@mastodon.social avatar

It is difficult to conceive of a world where those blobs become worse...it is very easy to imagine a future where those blobs become even, more effective, smaller, and better integrated.

The part of me that has been around computers for many decades finds this all amazing and fascinating. Things I once thought impossible for a humble computer are now achieved by a matrix so small it can fit in local RAM many times over.

sarahjamielewis,
@sarahjamielewis@mastodon.social avatar

We are still in a time where it take some effort to get useful results out of the local models.

There exist a few simplified, streamlined, interfaces, but many of the more powerful features require some familiarity with the underlying concepts.

But that bar is getting lower as the months go by.

Much of the public conversation of AI has focused on the commercial offerings of large models...and there is definitely a conversation to have there...

However,I think that obscures the real story.

sarahjamielewis,
@sarahjamielewis@mastodon.social avatar

A few examples: A few years ago I had a side project that I had to stop because it was dependent upon speech-to-text and after testing 10s of solutions the quality and speed just wasn't there.

Whisper Medium (1.5 GB on disk) solves that problem. Completely. Whisper.cpp provides CPU inference.

I've also used it to transcribe and search videos I had that lacked subtitles, and a fair few other projects.

sarahjamielewis,
@sarahjamielewis@mastodon.social avatar

Another example: A few months ago I spent a good 15 minutes attempting various searches for the answer to a generic error condition with little success.

In an act of desperation I loaded up code llama and asked it the question. It solved my problem. I've also used it to generate test cases for code sketches, with variable results.

But what I've just described was basically impossible a year ago. In 6-12 months?

sarahjamielewis,
@sarahjamielewis@mastodon.social avatar

One concern I do have is that many of the more public critiques I have seen of the technical capabilities of these models are based on older iterations or the interface limitations of commercial offerings - which tends to create this effect of any mainstream criticism being months out of date.

Which creates this unfortunate position where as soon as someone attaches a technical critique to the ethical argument, they instantly lose the attention of many who are actually using the technology.

sarahjamielewis,
@sarahjamielewis@mastodon.social avatar

The point of this ramble:

When it comes to generative AI that can be run locally on your machine: many things are possible now that weren't possible a year ago.

Expect more things to be possible soon. Probably faster than you think is possible.

I don't have a good grip on exactly how impactful this trend will be, or where the progress will stop. I've been constantly amazed this year.

It might be worth grabbing some of these models and playing around.

sarahjamielewis, to random
@sarahjamielewis@mastodon.social avatar

The only person who can "protect encryption" is you.

No government, nor regulatory body, nor judiciary is going to demand that you have easy access to mathematical constructs.

They may even force some entities to only provided weak approximations.

But the math exists regardless.

At some point, at some time, the fight against encryption becomes a fight against speech, and knowledge, itself.

And like those fundamental rights, the only way to protect them, is to exercise them, continuously.

sarahjamielewis,
@sarahjamielewis@mastodon.social avatar

I didn't spend the last 6 years building open source, peer to peer metadata resistant communication applications and libraries for fun.

I did it because any secure communications that rely on a centralized service provider is forever reliant on the whims of whatever jurisdiction regulates it's existence - that is not ground on which you want to anchor your rights to communicate and associate free of surveillance.

sarahjamielewis, to random
@sarahjamielewis@mastodon.social avatar

I can only back this up with vibes and anecdotes at the moment, but getting a sense that much of the discussion and info sharing that used to happen in public/semi-public spaces a few years ago has now shifted almost entirely to private channels.

The types of stories I used to read news articles about only a few years ago, I now only really hear about through the grapevine.

sarahjamielewis, to random
@sarahjamielewis@mastodon.social avatar

Today, finally, all those media articles about me being a "Canadian" researcher are finally correct! 🇨🇦

sarahjamielewis,
@sarahjamielewis@mastodon.social avatar

@hyc yup! thank you :)

sarahjamielewis, to random
@sarahjamielewis@mastodon.social avatar

The AI safety discourse is identical to the encryption discourse resting on the fundamental assumption that some software (and by extension math) is so powerful that we must heavily restrict access to it.

The arguments are absurd on so many levels.

sarahjamielewis,
@sarahjamielewis@mastodon.social avatar

With generative AI there are at least some very real concerns, grounded in reality - and yet all I've seen the last few days are a moral panic about machines drawing pictures of copyrighted characters in R-rated situations (always on the request of a person asking for the very thing the machine created)

sarahjamielewis,
@sarahjamielewis@mastodon.social avatar

Ultimately the real threat from these technologies is that they exist at all.

Once something is shown to be possible there is no bottling the consequences back up.

But instead of having a real discussion about how society should restructure itself to best serve its needs and take advantage of these new tools - we are instead drowning in takes about how and why matrices should detect illegal numbers again.

sarahjamielewis, to infosec
@sarahjamielewis@mastodon.social avatar

Some exciting news: Over the past few months I have been working on founding a new organization: Blodeuwedd Labs (@blodeuweddlabs)

We are now in a position to offer subsidized security assessments (and other services) for open source projects.

(In addition to a whole array of analysis, development, and custom research offerings for everyone else)

Announcement (and more info): https://blodeuweddlabs.com/news/open-source-review-announce/

sarahjamielewis, to random
@sarahjamielewis@mastodon.social avatar

There is lots of discussion about Electron / webp and - as someone who would never ever use electron for anything remotely approaching a security sensitive context - I do think it misses the mark.

Electron is bad because it shares an attack surface with the most attackable surface, but then extends it with all the functionality that was deliberately removed / never implemented because security.

(While giving developers very few tools to actually lock down that context in a meaningful way)

sarahjamielewis,
@sarahjamielewis@mastodon.social avatar

I don't think I've ever seriously audited an electron app and not found a critical vulnerability related to the fact it was an electron app.

The webp vuln impacted basically anything that touched webp files - which includes a lot of things that are not browser engines.

It's an argument for stronger vetting of new file formats - especially those implemented in unsafe languages - separate from not using electron (though you should also probably not use electron)

sarahjamielewis,
@sarahjamielewis@mastodon.social avatar

Ultimately the biggest problem is there is little investment in cross-platform UI tooling that isn't coming from the the browser space.

Small teams can't afford to build an application for every given platform stack, so they pick the path of least resistance. As a result machines and people are increasingly vulnerable as applications are absorbed into the web context.

There us nothing on the horizon that changes that fundamental economic consideration.

sarahjamielewis,
@sarahjamielewis@mastodon.social avatar

@wtwagg I haven't, but I believe the very first CVE registered for Signal desktop was trivial javascript code execution because the rendering context wasn't locked down.

Since then the Signal Foundation have received a lot of funding so I imagine they have the budget and staff to very carefully audit new features to ensure the risk of those kinds of things happening is minimal.

But the thing with Electron is, it only takes a single mistake in that auditing.

  • All
  • Subscribed
  • Moderated
  • Favorites
  • •
  • JUstTest
  • kavyap
  • DreamBathrooms
  • thenastyranch
  • magazineikmin
  • tacticalgear
  • cubers
  • Youngstown
  • mdbf
  • slotface
  • rosin
  • osvaldo12
  • ngwrru68w68
  • GTA5RPClips
  • provamag3
  • InstantRegret
  • everett
  • Durango
  • cisconetworking
  • khanakhh
  • ethstaker
  • tester
  • anitta
  • Leos
  • normalnudes
  • modclub
  • megavids
  • lostlight
  • All magazines
    •