• 0 Posts
  • 93 Comments
Joined 1 year ago
cake
Cake day: August 4th, 2023

help-circle


  • I bet if such a law existed in less than a month all those AI developers would very quickly abandon the “oh no you see it’s impossible to completely avoid hallucinations for you see the math is just too complex tee hee” and would actually fix this.

    Nah, this problem is actually too hard to solve with LLMs. They don’t have any structure or understanding of what they’re saying so there’s no way to write better guardrails… Unless you build some other system that tries to make sense of what the LLM says, but that approaches the difficulty of just building an intelligent agent in the first place.

    So no, if this law came into effect, people would just stop using AI. It’s too cavalier. And imo, they probably should stop for cases like this unless it has direct human oversight of everything coming out of it. Which also, probably just wouldn’t happen.


  • so do some folks use opp as “opponent”? Sure, that’s believable. But I feel fairly confident…

    Bro, it doesn’t even have the right number of P’s for your reasoning to make any sense.

    It comes from “opponent,” that’s why there are two P’s. It comes from video games/chess/card games/etc where you refer to the person or persons you’re playing against as the “opponent”. It’s been happening for many years but has made it’s way into gen z slang.








  • And coincidentally YouTube, Spotify, and Amazon Music, all of Apple Musics competition, just all happened to not implement this? All of Apples competition just decided to not add a pretty critical function to the people of that ecosystem? When they all do it in Google’s?

    Yeah, I don’t buy that. At all. Sure the API might be there, but you know who gatekeeps those APIs? Apple. This smells a lot more like Apples fued with Google over turn by turn directions bullshit. Especially when we can see how blatantly hostile to Spotify Apple is willing to be.

    It seems a lot more likely that Apple is holding that API over their heads and refusing to allow access to it, than it does that all their Apple Music competition just happens to have all conveniently forgotten to implement a pretty core feature in Apple’s ecosystem, while remembering to do it in Googles.








  • No, this does actually sound like a solution. But it’s a solution that should be scattered all throughout the process, and checked at multiple steps along the way. The fact that this wasn’t here to begin with is a bigger problem than the “client library failure” as it shows Wyze’s security practices are fucking garbage. And adding “one layer” is not enough. There should be several.

    To give a bit better context, which I can only be guessing at by reading between the lines of their vague descriptions and my first hand experience with these types of systems…

    Essentially your devices all have unique ids. And your account has an account/user ID. They’re essentially “random numbers” that are unique within each set, but there appear to be devices that have the same ID as a some user’s user ID.

    When the app wants to query for video feeds it’s going to ask the server “hey, get me the feed for devices A, B, and C. And my user ID is X”. The server should receive this, check if that user has access to those devices. But that server is just the first external facing step. It then likely delegates the request through multiple internal services which go look up the feed for those device IDs and return them.

    The problem that happened is somewhere in there, they had an “oopsie” and they passed along “get me device X, X, X for user ID X”. And for whatever reason, all the remaining steps were like “yup, device X for user X, here you go”. At MULTIPLE points along that chain, they should be rechecking this and saying “woah, user X only has access to devices A, B, and C, not X. Access denied.”

    The fact that they checked this ZERO times, and now adding “a layer” of verification is a huge issue imo. This should never have been running in production without multiple steps in the chain validating this. Otherwise, they’re prone to both bugs and hacks.

    But no, they clearly weren’t verified to view the events. Their description implies that somewhere in the chain they scrambled what was being requested and there were no further verifications after that point. Which is a massive issue.


  • It doesn’t even need to go that far. If some cache mixes up user ids and device ids, those user ids should go to request a video feed and the serving authority should be like “woah, YOU don’t have access to that device/user”. Even when you fucking mix these things up, there should be multiple places in the chain where this gets checked and denied. This is a systemic/architectural issue and not “one little oopsie in a library”. That oopsie simply exposed the problem.

    I don’t care if I was affected or how widespread this is. This just shows Wyze can’t be trusted with anything remotely “private”. This is a massive security failing.