In what regard is it incorrect that a single, larger entity that is at least notionally committed to avoiding the existence of any specific type of content on their platform is more likely to successfully avoid the existence of that type of content on their platform than smaller entities with less resources?

Now consider that some of those smaller entities might not be even notionally interested in avoiding the existence of that specific type of content on their platform, and are small enough for regulators to be unaware of its existence?

Trying so hard not to say child porn.

The problem generalizes, so there's no need to focus on this specific type of content.

Care to address the actual issue?

They created the concept of CSAM?

No, being so large that it's such a problem for them.

Seems like your blame is quite misplaced.

It certainly is not.

Yeah, I agree with you. Of course, it’s not Meta’s blame that the CSAM actually exists, but calling the problem of filtering it extremely difficult at Meta’s scale is a problem that is easily solvable but fundamentally requires changing how the platform works, and would likely require a lot more money to be spent.

Exactly, no one put a gun to Meta's head and ordered them to make Facebook.

So what would satisfy you?

Them to actually undertake meaningful efforts to reduce the child porn on their platform. Crazy, I know.

Define meaningful then? It's quite odd how you seem to be adamant that there is a perfect solution available yet seem to be talking around it.

It's probably why this "vulnerability" feels like the type of defects you'd see in Windows or desktop applications 20+ years ago.

The root cause was and a complete lack of effort to even attempt to secure things because no one had thought to do so, and now we're starting all over again at a new computing layer. Cloud was somewhat similar, but not nearly as bad.

It's bizarre to me since presumably someone who learned the lessons before is still working, but also great for my job security.

What about this is a vulnerability, let alone one that requires responsible disclosure?

Untrusted data sources can provide data that causes bad things to occur. If that's a vulnerability, then any application that ingests data is riddled with vulnerabilities.

I agree that the behavior should change from a default of allowing external network requests to denying them, but this "report" reads like overly dramatic marketing BS.

> Untrusted data sources can provide data that causes bad things to occur. If that's a vulnerability, then any application that ingests data is riddled with vulnerabilities.

There's an important difference between "the import had bad numbers so the report is wrong" versus "the import had a virus and now our network is compromised."

They are not the same kind of failure, they don't have the same impacts, and they don't involve the same mechanisms for prevention, detection, or remediation.

This is a permissions issue with the spreadsheet.

It's not all that different from people realizing that several popular model servers didn't support access control and could execute commands. It's an inherent part of the design that was rather naive from a security perspective, not something that requires coordinated disclosure or the rest of the security theater described in this marketing release.

Can be cheap fix here is whitelisting the output? If the AI can only emit a known set of formulas, you can't inject IMAGE() with arbitrary URLs cuz the output channel doesn't support it. You can't inject what the emitter can't produce. Doesn't fix all prompt injection but kills the exfiltration class.

Exfiltration is merely one of the issues.

The other is that an attacker can sneak something in that arbitrarily rewrites your spreadsheet. Triggers could be on content, or on a pre-planned attack time across many instances. Impacts could be subtly-flawed conclusions, or coarser "it stopped working and the deadline is looming" sabotage.

"Yeah boss, I sent out the checks to every vendor listed in the spreadsheet, what's wrong?"

The potential issues are innumerable, which is why this breathless "vulnerability" report is pointless.

It's like someone writing a threat report on a car about an individual crash. Did you know cars can cause damage if you're not careful using them?

Yes, stamping out file format vulnerabilities is indeed a Sisyphean task

For example https://en.wikipedia.org/wiki/Melissa_(computer_virus)

You can assume good faith initially without having to tolerate a bad actor who invalidates that assumption.

It seems like your company leadership missed that part of the lesson.

I would argue that there's an incentive to "miss" that part of the lesson.

For people who abuse the concept, sure. Again, that's just evidence that you're clear to drop the initial assumption.

3 down, thousands to go.

This will continue until Elsevier and their 3 or 4 peers are removed from the academic publishing process entirely.

What troubling language and slurs are you referring to exactly?

I didn't see anything "troubling" (let alone "extremely troubling") or anything that would indicate that anyone other than the implicated authors have an integrity issue.

I think GP was referring to https://www.chrisbrunet.com/s/politics/archive?sort=new and https://www.theamericanconservative.com/author/christopher-b...

I didn't immediately see a red flag that would make me discount all of their work. It's clear what the author's general opinions are. They're entitled to them of course.

The point of the line is not that they aren't going to try, it's an acknowledgement of the extreme challenge in diversifying in the short term and incentivizing the next generations who are very, very comfortable with the status quo to build other income streams in the long term.

If that's your standard, you basically can't interact with any entity other than megacorps, which you obviously disdain.

What is the benefit of that perspective? It's just social media. If it goes away tomorrow, no real loss. Use it accordingly.

It is good to point out this alternative is 90% likely going to be a rugpull on "nice cosy 90s style social network" by systemic factors. Regardless of the intent of the owner.

I just realised federated helps re. censorship but not privacy/secrecy needs.

It's not a rugpull, because there's nothing invested by users.

Again, there's no alternative that meets your original criteria let alone your additional ones.

I mean.. yeah. That's why no "Facebook like 2007" social networks have happened since. It would have to be run by someone with a lot of built up trust in order for people to trust it in the way that people did with Facebook. The world has been burnt.

If say, Valve started a social network I would consider using it because they've had decades to screw up Steam and they haven't. It is a bit outside their wheelhouse though.

This random guy though?

Steam friends chat is already my primary method of contact for certain people, having very little to do with playing games together.

I think LLMs would do a better job.

I was about to respond saying what a terrible article it was, as it reads as if the author has no idea what he was talking about. Attempting to paraphrase the original article would explain it.