What is Hackers' Pub?

Hackers' Pub is a place for software engineers to share their knowledge and experience with each other. It's also an ActivityPub-enabled social network, so you can follow your favorite hackers in the fediverse and get their latest posts in your feed.

0
0
0
0
0
0
0
0
0

게시글에 목차가 추가되었습니다. 게시글 안에 소제목이 있을 경우에는 목차가 보이게 됩니다. 가로로 넓은 화면에서는 오른쪽에 보이고, 모바일 환경처럼 가로로 좁은 화면에서는 제목 아래 본문 위에 보이게 됩니다.

가로로 넓은 화면에서 본 게시글. 목차가 오른쪽에 보인다.가로로 좁은 화면에서 본 게시글. 목차가 본문 바로 위에 보인다.
0
0
0
0
0
0

저의 고민이 있어요
그간 관심가지고 있던 게 NGO로의 취직인데 때마침 가까운 곳의 NGO가 계약직으로 공고를 올렸어요 ...
(종교/정치와 안 엮여있음, 국내 위주 구호임)
일단 입사지원을 해보긴 했는데... 제가 잘 할 수 있을까 자신이 없기도 한데...응원해주실 수 있나요..

0
0
0
0
0
0

We’re looking for a Senior Product Designer to work alongside our frontend and mobile devs.

Ideally:

1. You’re highly skilled in UX design, having led product strategy & design process
2. Proficient in Figma/Penpot, with interaction & usability design skills
3. Experienced in accessibility & privacy-conscious design

This remote fulltime position requires a 4-hour overlap with the CET timezone.

For more info/to apply:
jobs.ashbyhq.com/mastodon/d9e4

0
0
0
0

Surgery to correct a detached retina happened two days ago. (Fast medical response!)

I've been working hard to heal as fast as I can.

Surgeon tells me to keep my head down as much as possible, so I arrange pillows to sleep or nap on my stomach without pressing on my eye.

en.m.wikipedia.org/wiki/Retina

At the 24-hour post-op checkup, the surgeon only had to glance briefly inside my eye before he said everything looked good and said I could go go home...come back in a week for another checkup.

The surgery was performed in El Paso, and a gas bubble was deliberately left in my eye. My home in the mountains is at high elevation. Until that bubble disappears, I have to convalesce in the Tularosa Basin.

A day before surgery, my peripheral vision loss was a small black cloud. A day after surgery it was a light gray cloud. This morning, it's hard to notice the vision degradation in that area. This is encouraging progress.

After retinal detachment corrective surgery, the patient should keep their face pointed downwards as much as possible.The surgeon intentionally put a gas bubble in my eye. Until that bubble is absorbed, I will wear this warning band.

Also, I can't travel to high elevation until the bubble is gone.
0
0

We’re looking for a Senior Product Designer to work alongside our frontend and mobile devs.

Ideally:

1. You’re highly skilled in UX design, having led product strategy & design process
2. Proficient in Figma/Penpot, with interaction & usability design skills
3. Experienced in accessibility & privacy-conscious design

This remote fulltime position requires a 4-hour overlap with the CET timezone.

For more info/to apply:
jobs.ashbyhq.com/mastodon/d9e4

0
0
0

해커스펍 계정을 만들었습니다. 권유와 초청 주신 분들 감사합니다.

저는 게임 기획자로 일하고 있습니다만, 요즘 몇년은 js/react로 제품에 들어갈 코드를 짜는 일이 많습니다. 최근에는 https://guji.jjme.me/ 에서 블로그를 쓰는 데 많은 에너지를 쓰고 있습니다.

0
0
0

Content Classification System Post Mortem

The IFTAS CCS project was a pilot project to provide CSAM detection and reporting for Mastodon servers. The bulk of the project ran for 26 weeks, and while we cannot afford to maintain the service any longer, the findings below can inform future projects. All numbers are rounded for readability.

Pilot Activity

CCS received posts from eight services with roughly 450,000 hosted user accounts, 30,000 active monthly.

Our participants represented a range of service sizes from <10 to >100,000 accounts, and a range of registration options (open registration, open subject to approval, invitation only).

During the pilot period, CCS received 3.9 million posts via webhook, or 23,000 per day. These posts represent messages that were authored by or interacted with by the participating services’ active users, leading to media being stored on the host service.

Just under 40% (1.55 million) of all posts received included one or more media attachments to classify, leading to 1.86 million media files to hash and match. Posts with no media were discarded by the service.

Of the 1.86 million files, small numbers were either unsupported formats (~2,000) or no longer available when CCS attempted to retrieve the media for classification (~1,600). An additional ~3,100 media files failed to download.

In total, of the 1.86 million media files sent to IFTAS for classification, 99.665% were hashed and matched.

The hash matcher flags media for human review if it finds a match, or a near match, and after review IFTAS filed 53 reports related to 80 media files with NCMEC. This works out to 4.29 matches per 100,000 media files. An additional number of media files that matched were beyond our human review expertise to adequately classify, and therefore we elected to not report these files.

All of the matched media and subsequent reports were of real human victims, none were fictional, drawn, or AI generated. We did not receive matches for “lolicon”.

We elected to match against a broad array of databases to ascertain their effectiveness, and we found that databases maintained by child hotline NGOs (e.g. NCMEC, Arachnid) were far more effective than databases available from commercial service providers. We saw a handful of false positives, and the vast majority of them came from commercial providers. If we had continued, we would have narrowed down the databases in use.

All matched media generated a notification to the affected service provider, and IFTAS performed any necessary media retention for law enforcement.

Context

4.29 matches per 100,000 may not sound like a large number. However, to be clear, this is a higher number than many services would expect to see, and it includes a broad range of media, from “barely legal” minors posted publicly, to intimate imagery shared without consent, to the very, very worst media imaginable. In some cases, it was apparent that users were creating accounts on host services to transact or pre-sale media before moving to an encrypted platform, under the belief that Mastodon would not be able to detect the activity.

There are 1.6 billion posts on the ActivityPub network today, and if our numbers hold true, this means there are currently many tens of thousands of copies of known CSAM on the network, likely significantly more as our service adopters by definition do not include providers that are not inclined to mitigate this issue, and criminals looking for anonymous accounts are likely to target less-moderated services.

If IFTAS found it happening so brazenly on the first servers we happened to look at, no doubt this activity is still occurring on servers that have no such protections. Mastodon is – at its simplest – a form of free, anonymous web hosting. The direct messaging feature precludes moderators and administrators from being aware of illegal content (it will never be reported by potential customers), and only a hash and match system is able to find these media and flag them.

Not only does inadvertently hosting CSAM revictimise the children involved, it also serves as an attack vector for the service to be targeted by law enforcement. We are aware of several instances of CSAM being uploaded for the express purpose of causing moderator trauma or an immediate report to law enforcement, leading to a significant amount of legal issues. This is essentially a form of swatting; simply upload CSAM, report it to the authorities, sit back and watch the server get taken down and possible criminal charges for the administrator.

Responsible Shutdown

We ensured that all webhooks were disabled by the host services, and once all review and reporting was completed, we hard-deleted all remaining data on the service, excepting the metadata and media required to be held for one year for possible law enforcement action. The AWS environment was then dismantled, deleted, and removed from service.

All associated staff and consultants were removed from the relevant IT services, and IFTAS retains no data nor metadata from any of the activity other than the bare minimum required by law pertaining to the encrypted media stored for law enforcement.

Some observed services that were clearly unmoderated and/or willing to host this content to the degree that federating with them would generate legal concerns were added to the IFTAS DNI denylist.

Next Steps

Moderation Workflow

We hope that Mastodon, Pixelfed, Lemmy and other platform developers will quickly implement safeguards within moderation dashboards to minimise moderator trauma.

Content moderators commonly experience trauma similar to those suffered by first responders. Even though the development team may have never reviewed traumatic content, the app or service will at some point deliver this traumatic content to users of the moderation workflow. When presenting reported content to a service provider or moderator:

  • Always show the report classification clearly, so the moderator is aware of the type of content they are about to review,
  • Blur all media until the moderator hovers to view greyscale version (re-blur when hover not detected or mouseleave event),
  • Greyscale all media until the moderator clicks to toggle full colour (allow toggle state back to greyscale),
  • Mute all audio until the moderator requests audio, and
  • Allow the moderator to reclassify the report.

CSAM Detection

If you are a service provider, lobby your web host or CDN provider to perform this service for you, and ask them if they have resources you can use.

Cloudflare offers a free service worldwide, if you are a Cloudflare customer, consider enabling this option.

If you are a web host that hosts a large number of Fediverse providers, consider adding this safeguard at the network level.

Free Support from Tech Coalition

Tech Coalition has a program aimed at small and medium services called “Pathways“, and they are very interested to hear from Mastodon and other Fediverse service providers. While this does not offer detection, it does offer background, guidance, and access to experts. Sign up to explore these options, and to demonstrate a good faith effort to address this issue. The more providers they hear from, the more likely we are to get better options.

Ongoing Work

We are aware of noteworthy efforts to continue this work. @thisismissem is working on a prototype implementation of HMA, and Roost is exploring an open source solution for small and medium size services.

Consider following and monitoring https://mastodon.iftas.org/@sw_isac to receive alerts when services are confirmed to be sources of this content.

A range of services and resources that can help mitigate this issue are available on our CSAM Primer page in the IFTAS Connect Library. We will continue to research and share resources that can help mitigate this issue for service providers. Please let us know if you are aware of additional resources we can add to this guide.

IFTAS intends to continue its relationships with INHOPE, NCMEC, Project Arachnid, Internet Watch Foundation and other organisations to advocate for the Fediverse, and to ensure these entities understand the network and have someone to talk to if they have questions.

To everyone who participated, asked to participate, or supported this project, thank you! We are extremely sad to have to end this project, but we have safeguarded the underlying codebase and – should the opportunity arise – we will restart with this or another resource to provide this service to any who need.

0
0
0
0

One of the most impactful things that non-US people can do to protest what the US is doing is to NOT TRAVEL TO THE US. Have family meet you elsewhere. Change your vacation destination. Don’t attend conferences and conventions here (go virtual instead). Vote with your wallet and your feet: don’t bring your Euros, Yens, or Pesos here.

Passenger tallies don’t lie. Hotel occupancy numbers don’t lie. Conference attendee totals don’t lie. YOUR ABSENCE WILL BE COUNTED and you will be missed.

Your withholding of your presence and your money will motivate business owners to pressure the administration to change their tune.

onemileatatime.com/news/airlin

0
0
0
0
0
0
0
0
0

We’re looking for a Senior Product Designer to work alongside our frontend and mobile devs.

Ideally:

1. You’re highly skilled in UX design, having led product strategy & design process
2. Proficient in Figma/Penpot, with interaction & usability design skills
3. Experienced in accessibility & privacy-conscious design

This remote fulltime position requires a 4-hour overlap with the CET timezone.

For more info/to apply:
jobs.ashbyhq.com/mastodon/d9e4

0
0
0

RFK Jr. announced today that the Department of Human and Health Services would cut 10,000 employees.

If you have been impacted by the layoffs, our reporters want to hear from you. You can reach out to us on Signal at 917-512-0201 or by going to propublica.org/tips/.

0
0
0

We’re looking for a Senior Product Designer to work alongside our frontend and mobile devs.

Ideally:

1. You’re highly skilled in UX design, having led product strategy & design process
2. Proficient in Figma/Penpot, with interaction & usability design skills
3. Experienced in accessibility & privacy-conscious design

This remote fulltime position requires a 4-hour overlap with the CET timezone.

For more info/to apply:
jobs.ashbyhq.com/mastodon/d9e4

0
0
0

位置情報とか購入履歴とか、機微な情報を抵抗なく明け渡して、「見せられないのは疚しいことがあるからだ」なんて言うのは極めて特殊なことで、それを常識にしてはいけない

0

We’re looking for a Senior Product Designer to work alongside our frontend and mobile devs.

Ideally:

1. You’re highly skilled in UX design, having led product strategy & design process
2. Proficient in Figma/Penpot, with interaction & usability design skills
3. Experienced in accessibility & privacy-conscious design

This remote fulltime position requires a 4-hour overlap with the CET timezone.

For more info/to apply:
jobs.ashbyhq.com/mastodon/d9e4

0
0
0
0
0
0

Asked the PM for a project I'm on whether the difficulties we're seeing with specifications not aligning with intent, the customer not understanding the gulf between, difficulties in getting responses, etc, etc are pretty standard for a project or not, all with the intent to just calibrate my own barometer, and her earnest response started with "no i'm not really seeing any red flags on this one, all this has been pretty normal" and then proceeded to list a bunch of things that are abnormal on the project as we discussed further.

0
0
0
0