drain bamage (broken ai)

On the internet, not everyone knows you’re an idiot.

But goddamnit, I’m trying to get the word out.

Please feel free to downvote every comment I’ve ever posted, if it will bring you joy.

  • 0 Posts
  • 21 Comments
Joined 2 years ago
cake
Cake day: July 5th, 2023

help-circle





  • Signed by whom? The CA.

    The CA is the certificate authority.

    You can create your own CA and sign your own certs for free, but people would need to have your CA root cert in their browser for them to be able to trust your signed certs.

    Let’s Encrypt is a real CA bundled with browsers, and it signs free cert signing requests when specific criteria is met. This is done because TLS is an important privacy mechanism that works best if many certs are in use and not just a few wildcard certs.

    Why not trust self-signed certs? Because there are no checks. When miicrosoft.com (the people who make the miis on your wii) gets a free cert signing from Let’s Encrypt, its because the owner of miicrosoft.com proved that they owned the domain miicrosoft.com by means of a lets encrypt / acme challenge. When you create your own CA and sign your own certs you are beholden to your own rules. You could sign a free cert for microsoft.com (the people who make minecraft) but then you would also need to convince users to install your CA, and then you can steal their blocks and grief their builds.


  • Gang, I hate to tell you this but this is what we mean when we say “you are the product” especially with free offerings.

    But if you hate that I have a worse thing to introduce you to: the internet. If you respond to this comment, or any comment on any lemmy instance or other federated service or website or blog… your words can be consumed, copied and used to train whatever anyone wants. It is trivially easy to create web scrapers with just a bit of coding knowledge. These days it’s pretty easy to then use that data to train AI models. To a computer, it’s just data.

    Grammarly is a product where you give it bad grammar and it gives you good grammar. Grammarly, like many products, gets better over time when it can understand what went wrong so its teams can make it right. This can often include any text entered into the program. I don’t know the specifics but they should be outlined in the privacy policy. A company using data it already has to train AI makes sense, especially if it anonymizes that data. It may not be ethical given that users weren’t aware of AI at the time they accepted the privacy policy, but with american capitalism a company can change a privacy policy and you can opt out if you don’t like it.

    That’s why we all have lawyers on retainer to read and translate all privacy policies for all websites and applications we interact with in a daily basis. Right? That’s normal, right?

    I will say, could this support person have meant that an organization with 500+ employees get a custom AI model trained on only the organization’s 500+ accounts? Because that would be better, and likely more ethical too.

    If that’s not the case and any content you have put into grammarly is being used to train AI, then I guess it’s time to stop using grammarly then huh? But it’s also time to stop posting anything on the web, too. Oh, and don’t publish anything, ever.

    Or, you could go with the flow. This data is mixed with millions of other accounts… sort of like what happened when chatgpt trained on anything you’ve already put out there. The only real concern I could see is if you discussed a very specific thing or invented your own personal coded style of writing and used it so much that, among the millions of other users, dominated the corpus and skewed the training model. Say there are only 5 grammarly users and you are number 5… you keep talking about “procorpia” being “mass sledge”, generating hundreds of entries with thousands of tokens “words”. By contrast let’s say the other 4 grammarly users only used it a few times a month to send short emails. Now, after training, the 6th grammarly user mispells a word as “procorpia” and grammarly generares “procorpia is totes mass sledge brah”. Suddenly, your secret is out.

    If, on the other hand you speak the same broken english as the rest of us, you are probably fine.









  • +1 for nginx, although there has been some concern because nginx is developed by a group of russians though it is open source and appears to still be widely used. If this worries you, look into traefik.

    Otherwise does your ProxMox setup run docker containers? If so you can use NginxProxyManager which has a web gui for configuring your virtual hosts.

    At a high level what you need is this:

    • all domains routed to your host (or home if self hosting) IP.
    • that IP needs to have a reverse proxy server like traefik or nginx listening on port 80 and port 443 if you want ssl/tls.
    • your app servers which run lemmy, nextcloud, etc can be anywhere on your network where your reverse proxy can access. You’ll need to create vhosts for each. The server uses the Host header to determine which IP to reverse proxy to, eithe lemmy.moorefam.net or nextcloud.moorefam.net
    • the reverse proxy will get the content from lemmy or nextcloud and serve it via that IP and port.
    • ensure your home router is port forwarded on 80 (and 443 if you want ssl/tls) if you want to access these instances from the public internet but beware, you might want to add a firewall in-between if you aren’t confident in your router’s firewall.

  • The browser stores the cookies, so if it is a system browser then the system browser stores the cookies even if embedded in the app. It also means that the app isn’t likely aware of those cookies as it’s part of a separate app.

    Also, generally speaking, few developers want to build their own browser. It is far easier to just ask the OS to put a browser in a space provided by the app, than to build a browser that works well to be used on the greater internet and the actual app itself. I say this because “the browser stores the cookies” so if app xyz doesn’t use a system browser then app xyz is the browser. Like, any app can ask you for your reddit username and password, store that, make HTTP calls that login with your username and password, parse the HTML it gets from reddit, and report it back to you. This is essentially how lemmy apps work at a high level with one big difference: these apps and the server are both aware of each other, which is the same sort of situation where a company like google or reddit gives API access as a sort of contract between how the apps and servers with better security and full consent of all involved.

    Basically if you see reddit apps pop up which don’t use the official API, you should be wary. Doubtful they would make it onto the app stores but it’s always possible. It doesn’t mean they are nefarious, just that they could be.

    The good news is it’s pretty easy to tell what you are using.

    Logged into example.com somewhere on your device, then you open a freshly installed app, click a link to example.com and you are already logged in? System browser.

    Logged into example.com somewhere on your device, then you open a freshly installed app, click a link to example.com and you aren’t logged in? This could be another browser if you have more than one installed on your device. So the ask… does it look and function like shit? This isn’t a great test but again, building a browser that actually renders html css and js is difficult, so it’s likely to not work or look very well if it’s something built with the purpose of stealing data specifically.


  • Ok so if application xyz has a browser, assuming that browser isn’t just an embedded copy of a system browser (something that I am not sure is possible with android or ios development, i am just a web dev), it won’t know your reddit cookies unless you gave it. Or, more correctly, it may save your cookies for every site you visit, but that’s just normal browser behavior. If you visit reddit, your cookies are saved but if you didn’t login the cookies just identify you as a unique but otherwise unknown user. If you login, then your cookies are saved if you load up the in-app browser again and find that you are still logged into reddit.

    The only time where you could expect to be logged into reddit already via an in-app browser which you didn’t log in with previously is if that in-app browser is just an embedded system web browser where you are logged in.