371: Meesa in the Matrix!
View episode on the publisher’s site
The publisher’s audio length has changed since transcription. Ads may differ, so timestamps may be offset.
Summary
In this episode of Grumpy Old Geeks, the hosts discuss technology company leadership, worker concerns, consumer products, and personal data security. They also cover iPhone jailbreaking, a VLC security update, a planned Matrix sequel, and a robot sent toward the International Space Station.
- Patrick Byrne’s resignation, an Oracle lawsuit involving Larry Ellison, and concerns about Facebook’s Libra project.
- Technology company growth in Toronto and the spread of unwanted text messages.
- A false Instagram copyright notice, a Palantir employee petition, and a planned protest by Uber and Lyft drivers.
- DoorDash’s acquisition of Scotty Labs, delayed changes to driver tipping, and the Apple Card.
- Exposed user data at Luscious and MoviePass, password breach alerts, and license plate tracking.
- Privacy concerns about consumer DNA testing and law enforcement access to genetic information.
- A newly released iPhone jailbreak, employee discussions on Blind, and VLC security fixes.
- A planned fourth Matrix film, Russia’s robot Fedor, and dynamic advertising in podcasts.
Key moments
-
CEOs and Libra
The hosts discuss Patrick Byrne’s resignation, an Oracle lawsuit involving Larry Ellison, and concerns among Facebook’s Libra partners.
-
Technology Companies and Workers
The conversation covers Toronto’s technology sector, unwanted texts, Instagram, Palantir employees, driver protests, and DoorDash.
-
The Apple Card
The hosts discuss the Apple Card’s rewards, payment experience, and care instructions.
-
Security and Personal Data
Joe Kerrigan joins a discussion of exposed data, password alerts, location tracking, and access to genetic information.
-
Genetic Testing and Privacy
The speakers discuss access to DNA data, judicial review, and identifying relatives through testing services.
-
Workplace Discussions on Blind
The speakers discuss anonymous employee conversations about major technology companies on Blind.
-
VLC Security Update
The speakers discuss VLC fixes for vulnerabilities involving a crafted MKV file.
-
The Matrix and Robots in Space
The speakers discuss a planned Matrix sequel, a Russian robot sent toward the International Space Station, and dynamic advertising in podcasts.
Full transcript
-
Grumpy Old Geeks. A weekly talk show hosted by Brian Schulmeister and Jason DeFilippo, discussing the finer points of what went wrong on the internet and who's to blame. Welcome to Grumpy Old Geeks. I'm Jason DeFilippo.
-
And I'm Brian Schulmeister. Schulmeister. I'm in the mood this morning. Sure, y'all. So, we have a bit of follow-up. Overstock CEO Patrick Byrne has resigned from his role. Shocking. Yeah. Another board member, Jonathan Johnson. Can you get a whiter name?
-
Seriously. Hello, Mr. Whiterson. How are you doing? Welcome to be the CEO seat. Yeah, so this is coming after he made all these comments about the deep state. You know, he was basically, one can only imagine he will get to his role as working for the CIA as a mole, since he will have more time on his hands these days.
-
He did state that in starting in 2015, he was operating under the belief that he was helping legitimate law enforcement efforts and assisted in what is now known as the Clinton investigation and the Russian investigation. In fact, he said, he's the notorious missing chapter one of the Russian investigation, he wrote, going on to say that this was the third time in his life he had helped the men in black.
-
Well, how about that? Well, he did date a Russian spy. Yes, he had a romantic relationship with Maria Butina, who has been accused of working as a Russian agent and is currently in prison after pleading guilty to a lesser charge. So, something weird was going on with this dude, but can't do that and be a CEO these days.
-
Guess not. Guess not. Gotta keep your mouth shut, man. Gotta keep your mouth shut. Yeah. And speaking of the CEOs, we talked on the last episode about the grandiose statement that came out about how shareholder value is not the top priority anymore. We want to be loving, huggable entities where everyone will enjoy us and we are very nice people and because, you know, companies are people, according to the law, sadly.
-
So, yes, they're trying to overturn their image before we basically run into the streets with pitchforks and kill them. And there's a good article over on Slate. It's basically saying, OK, great. Awesome. You said that. Now you got to show us proofs in the pudding, buddy.
-
And the article runs through a number of ways that companies can show that softer, gentler side, such as, you know, paying the employees and other things of that nature. So, we shall see what happens. We'll be waiting for it. Yes, we will.
-
But somebody who's not waiting on the other side of the supervillain, you know, bell curve here. It's got a Larry Ellison. Oh, yeah. You know? Yeah. This guy is just a character. Well, he's a character so much that he's being sued by his own company.
-
Yay, Oracle. Yeah. Apparently, he did a little dirty dealing with the NetSuite deal a long time ago. And they spent like over $100 per share when the, you know, the average cost should have been closer to $70. Right.
-
So, and he was a 40% owner in NetSuite. So, he made a lot of money on that deal. So, lots of shenanigans going on, but a judge has seen fit to let this course proceed. So, we'll see how this goes. But, yeah, it couldn't happen to a nicer guy.
-
That guy is crazy. And he wants all the monies. I mean, there's just no backing down from that. He wants all your money. That's true. He is very much about making all the monies in the world. Speaking of all the monies in the world, Libra is not doing so well already.
-
I thought that the headline was interesting. Facebook's cryptocurrency Libra may be in more trouble than we thought. I thought it was basically dead in the water already. Well, they're still trying to push it through. But the interesting thing here is a couple of the people who signed on at the beginning, I don't know how they got to this point in their career, not have thought of this.
-
Oh, no, regulators might actually be looking into us as well for joining up onto a product that needs regulatory oversight. We didn't think the regulators were going to come. And now they're like, oh, well, this might actually be bad for our business because the regulators might look at our business and, you know, put us under a microscope.
-
Should have thought of that earlier. Shouldn't you, big time CEO guy with the big brains? Yeah. Dumb, dumb, dumb. Yeah, I know. I know. It's just it's these people are going to, like, jump like rats from a ship soon. Yeah, I like this bit where we're almost made made to feel bad for Facebook.
-
Facebook is said to be growing repeatedly tired of the lack of public support from the cryptocurrency founding partners. They are tired of being the only people putting their neck out. One of Libra supporters added. Well, it's their project. Why should I know their network? I know.
-
Like, squeeze me. This is your project, buddy. Mm hmm. In the news. We've talked a bit in the past about the growing, growing, basically Silicon Valley nature of Toronto, about how all these companies are in tech giants are starting to move there for numerous reasons, not least of which might be our severely misguided policies about immigrants.
-
But, you know. Also, Google might be wanting to just find a town where they can surveil everyone, which is what they're moving in for. But also AI. Also AI, yes. Intel has now announced plans to build a graphics chip design lab in Canada's largest city, Toronto. Uber Technologies will be opening an engineering hub.
-
Google obviously has their crazy smart city, also known as a... I drove past it. I'm not going to get anywhere near it. That's as close as I'm going to get around there. You're like me going to a church. You just want to drive by as fast as you can. Yeah, I drive by as fast as I can and I look at the Apple billboard and I laugh.
-
Microsoft Corporation has also decided to expand its Canadian workforce by more than 20%. So there's so much going on that the Silicon Valley Bank, the Santa Clara, California financier for some of the world's largest venture capital firms and startups, has opened an office in Toronto as well because, you know, that's where all the business is right now.
-
And this all sounds great, but Canadians are starting to get a little bit worried about this because these are U.S. businesses crowding out domestic companies and taking some of the country's most valuable intellectual assets. And Canada's kind of starting to look around and go, huh, well, wait, hold on a second.
-
We were doing this too. Why are we just going to let all these foreign companies come in and take all the monies and all our people? So we'll see what happens with that. But I don't see much stopping it because these are the tech giants. These are the biggies. So I would say to you Canadians, embrace it. You can still have your little companies too and hopefully get bought out like everybody else does.
-
Also, buy real estate now because if San Francisco is a bellwether on real estate prices, when all these companies move into a town, you're not going to be able to afford to live there pretty soon. So buy your real estate now. Better get on that. And we've talked a lot about the robocalls, and I think you've experienced some success recently.
-
But then again, we also just talked about how there's been a resurgence in the calls coming through. I've certainly been getting a lot more than I have recently. But I've also started to get Robotex. Have you gotten any of these yet? No, thank God. Knock on wood. I don't get a lot of them. Just the other day, I got like three in one day, and I was like, oh boy, here we go.
-
Here they come. Mercifully, they've stopped again, but we'll see. But there's a good article over on the Wall Street Journal talking about how these are starting to come more and more, and we better get used to it because it's just easy for them to do it. And it's a different, they're regulated differently, calls and messaging platforms.
-
So there's a whole different set of rules. But there are some things you can do right now, and the article gets into it. So if you are starting to get Robotex, I highly recommend checking this out on the show notes because you can actually, don't reply to them ever. Never click on the links, obviously.
-
And you can actually forward the messages to the FCC. So they have a, you can text them to 7726, which is spam. So if you're getting them, forward them, and that should help. Excellent. I like that. Spam, it is. Spam all the way down. Yes. And speaking of spam and stupid shit, you like Instagram.
-
You're on it quite a bit. Or I should say your dog is as well. Dogs. Well, I'm slowly, slowly coming around to saying FU to FB, and I'll talk about that in a second. You're next. I'm sure you saw the Instagram chain letter thing that was going around the last couple of days, which is, you know, just, this happens all the time.
-
Usually it's with Facebook. This is the first time I've seen a widespread one on Instagram, which is the post of the text said, don't forget, tomorrow starts the new Instagram rule where they can use your photos, blah, blah, blah, deadline today. But all you have to do is copy and paste this photo, and you're going to be legally protected from them owning your content, which, of course, is bullshit.
-
But what surprised me is just how many people that I know that are quite smart that posted it, because everybody kind of throws their hands up in the air and says, it can't hurt. And I say, yeah, I can. You look stupid. You look dumb. That's about it. You are now insta-dumb. Yes.
-
Julia Roberts did this. Judd Apatow, Usher, Nancy Myers, Juliana Moore, Tina Knowles. Rick Perry, the United States Secretary of Energy, who's in charge of our nukes, posted this and is in the government and should know better and is also a lawyer. But yeah, tons of people have done this, and it does nothing, people.
-
It just makes you look stupid. All of the one thing I did enjoy about it was the Internet does what the Internet does, and a bunch of fake postings started to crop up from smart people. And it was all of those have been hilarious. See, that's all I got in my feed. I didn't see any of the real one. It was just people making fun of it.
-
So I at least have a fairly curated Instagram feed. There's a really good article by Casey Newton over on his newsletter. I forget what it's called, but I'll actually pull it up right now because it's easy. It's called The Interface. And he's got an article called Facebook Puts the Squeeze on Instagram.
-
And it follows some really interesting tidbits of facts about how Instagram has changed so much since the founding fathers left, like a little over a year ago. Yes, Kevin's sister of men, whoever the other guy was. Kevin's the only one I ever remember.
-
And it has been fully Facebookified. It has been zucked. It has been totally zucked. So, yeah, lots of ads. Lots and lots of ads. It's ridiculous how many ads are on there now. And, you know, I spent half my time going scam, scam, scam, scam, scam.
-
And then I'm thinking, why am I giving them any of my time? Scroll past them. Jeez. But, yeah, the culture is changing pretty much a lot, too. So it is, you know, it's Facebookistan. And that's why I'm thinking, eh, maybe there's something else out there.
-
Maybe there's some other way. And then I think about it and I go, nope, that's about it. Flickr's dead. I'm not going to snap. And I guess it's finally time for Palantir's people to have a revolt. Oh, my God, my phone. Hey, look, a robocall.
-
That's what happens when you forget to turn your phone off before a show. Yes, they have a petition going around that more than 60 workers, they've asked management to redirect the profits from ICE contracts to a nonprofit charity. You do know what company you signed up to work for, right?
-
I know. I'm just like, come on, guys. This is like if you go and work for Raytheon and then you get upset about the fact that they make weapons of war. Yeah, it's like going to work for the devil and asking for an air conditioner. Yeah, there you go. That's a good one, Jason. Look at you. Thank you. I just made that one up. Well, I'm impressed.
-
I had coffee. Someone's got his thinking cap on today. I do. I do. I have had my feels and then had my coffee and almost burnt my house down because I forgot I had a tortilla cooking on the stove. And now my house smells like crap. So maybe not that on the ball. Oh, man.
-
So, yeah, we'll see how this one rolls out. I look forward to those 60 new Facebook employees after Palantir kicks them out. Or they can go to what is it? They can go to Google because Google's right across the street, isn't it? Isn't that the where they had the banner hung up the other day? Yes, just down. Yes, it was Google. Yeah. So they can just go to Google.
-
That's right. Yeah. They're less evil. Not really. Well, the employees are revolting, Jason. They stink on ice. Just had to borrow that from Mel Brooks. Hundreds of Uber and Lyft drivers are launching a protest caravan across California. Yeah, the California-based advocacy organization Gig Workers Rising and Mobile Workers Alliance announced that a caravan of drivers will drive from Southern California through San Francisco to Sacramento next Monday, August 26th through Wednesday, August 28th.
-
Over 200 drivers and more than 75 cars plan to drive south to north, with more drivers joining along the way to take a dramatic action in advocating for California State Legislature Bill AB5 and for a driver's union. No word on whether you'll be able to pick them up and get a ride from them.
-
If you're going that way. Yeah, okay, man. I'm going to Sacramento. But it's over two days, so I want to get there a little faster than that. Yeah, a little faster. When I read this, all I could think of was the movie Convoy. And then, of course, that led to getting the theme song for Convoy stuck in my head days now.
-
Come on, man. Go away. Not a good movie. Great song, though. And DoorDash has acquired autonomous driving startup Scotty Labs. Of course, because everybody wants to fire everybody else. Oh, my God.
-
But Scotty Labs is here's what I love about Scotty Labs. Oh, Scotty Labs. Their website is Scotty.ai. Now, on their website, it reads, and I shit you not, we are a driving company. We are building a human-centric autonomy stack, which seamlessly blends the safety assurances of teleoperation with the durability of autonomy.
-
With a focus on maximizing revenue per truck and minimizing cost per mile, we are solving the biggest pain points of the trucking industry. Oh, for fuck's sake. It's people. Scotty.ai is literally people for this company. That is fantastic.
-
You know, and I was looking into buying a .ai domain today. Those things are expensive. They're like 60 to 70 bucks a year. So, not worth it for that joke. That's where all the money is right now. Yeah, not worth it for that joke. That's for damn sure. Go.ai. Trust me, I thought about it. I know. I know.
-
Yeah, but these guys are the ones, we covered a, I don't know if it was this company or it was a different one because I couldn't find the picture associated with Scotty Labs, but there was one that we showed where there was a teleoperations center where it basically was a bunch of, you know, it looked like simulators, but it was real feeds from actual cars.
-
And, you know, my point was, well, you know, just the reaction time alone is you're not going to be able to switch over to a car. The driver is not going to be able to get oriented fast enough to do anything meaningful in an emergency situation. So, I don't, I see it as a non-starter personally, but, you know.
-
Hey, they've got an AI domain. They're making their money. What do they care? What are you going to do? What are you going to do? Oh, don't work for DoorDash because they're going to fire you. Maybe you can work for Deliveroo or except in Berlin because we found out you can't do in Germany either. Well, even if you were worried about DoorDash firing you, I wouldn't recommend working with them or for them because almost a month ago, DoorDash, which is the leading food delivery app in the U.S., caved to public pressure and announced it would stop pocketing its workers tips.
-
Yes, DoorDash was taking the tips. They were not paying you well and they were keeping the tips. Just the tip, ma'am. Just the tip. Just the tip. And they said, okay, well, I guess we shouldn't do that. We should actually give the drivers their tips, but it's been 27 days and DoorDash workers tell Recode that the company's pay and tipping policies have stayed exactly the same.
-
They have made no public statements about its workers' pay and how it plans to institute the changes. It has not offered a specific date when it will fulfill its promise. As a DoorDash worker in Cleveland, Danielle Turner says they're still stealing tips. Why would you send the email out and have everyone participating and anticipating in such a major change when you don't do it?
-
So, nice. Nice work, guys. I mean, these people are paying as little as an average of $8 per hour based on fluctuating pay and tips are crucial for earning a living wage as anybody who's worked in a food service has known in the past. So, knock it off, people. The thing here, though, is if you're going to use DoorDash or any of these things, don't tip them through the app.
-
Just give them a finski when they show up. That's the way you should do it anyway so they can pocket it and not have to declare it. Exactly. I know enough waitresses and bartenders where they would like your cash. Don't put it on the card. Please. Or, you know, tip them in Bitcoin because that's not going to be...
-
Oh, wait. Wait. Tip them in Libra. Oh, wait. Oh, man. Hey, but you can use your new Apple card to tip them. Yes, the shiny Apple card. Yes, the shiny, shiny Apple card. So, there's an interesting review over at Mashable and said, the good, beautiful and practical credit card app interface, 3% cash back on purchases from Apple, gorgeous titanium Apple card, and no annual fees.
-
The bad. Other credit cards have better rewards, lower APR, and, you know, you only get 1% on non-Apple purchases with the Apple card. So, they say the Apple card is an experience unlike any other. But it'll... You're stuck in Apple land once you got it, you know?
-
Yep. Because you can't do anything. You can't pay on the web. You'd have to make a phone call and go through a rigmarole to pay unless you pay on the app, which I haven't had to do yet. But I have gotten my card. I signed up for it. Of course you did. It was, like, ridiculous. Dude, man, I'm semi-employed.
-
I need to have as much credit in the bank as I can. But I was expecting to be declined because my credit score isn't that great. I got, like, a 677, which, you know, ain't going to let me go by the Hearst Castle anytime soon. I think they tied it into your Apple purchase history, and they realized that you're one of their main clients.
-
So, they figured they got a good new card. I really thought about that. I'm like, there's no way. But then I was reading that Goldman Sachs is, you know, taking in people with lower credit scores. Right. That normally can't get a card. Because I, you know, applied for a card the other day, and I couldn't get one.
-
So, I thought this was going to be a non-starter. Huh. Does this sound like a good idea? What? Hmm. Do we remember what happened with the housing crisis when we let a bunch of people who couldn't actually board the houses get them? I know. That's why I'm going to load up that card quick. Oh, man.
-
They gave me just enough money to go buy a nice new iMac on my credit line. See, they're making money both ways on you, man. It's amazing. Exactly. It gets you coming and going. And the follow-up that everybody was going crazy about yesterday on the internet was, oh, my God, you can actually get dirt on your card if you put it in your wallet.
-
Oh, I do declare. My God. You put something in your wallet and it could get dirty and smudged like every other card in your wallet? I just love the fact that they tell you you should avoid contact with leather and denim. Yeah, OK. It's a credit card. What am I supposed to do with it?
-
I know. Does it come in like a jewel box? Does it come with its own Fabergé egg that I have to carry around in a little baby Bjorn to open up every time I want to swipe my card? I hope that they're selling little flaps like for the iPads for it. Oh, you know they are.
-
That would be amazing. You know somebody's out there doing that already if Apple's not going to do it. It comes in your own little case. I do have a protective case. I got a passport card. OK. Which has like an RFID chip in it and everything. And when they gave me that, basically the State Department gave me a little sleeve to keep it in.
-
They say, when you keep this in your wallet, keep it in this sleeve. But that's because it has like sensitive electronics in it because it's a passport, basically. Because, you know, it's got your RFID chip in it, not just the chip that you use to buy gas at the store. This gets you into a country. So I can see why that one would need a little extra protection.
-
But it's just a little Tyvek envelope. I'm thinking maybe I should get one of those for my Apple card, my titanium Apple card. But I got to say, though, it was really easy. And the app was super sweet because it just pulled your account info. Didn't have to fill out much at all. Right. It was cool. That's nice.
-
Yeah. But the whole point of this is what I really like. The only reason I cared to put it in, because I'm sure everybody's sick of hearing about it, is. OK. If and when the card gets grimy, Apple suggests wiping it gently with a soft, slightly damp, lint-free microfiber cloth. As a second step, users can moisten a microfiber cloth with isopropyl alcohol.
-
So, Brian, everything that you get from Apple, you've got to clean with rubbing alcohol. That's right. So you are ahead of the curve on that one. Rubbing alcohol fixes all Apple woes. This episode of Grumpy Old Geeks is brought to you by Feels.
-
Do you experience stress or have anxiety or chronic pain or have trouble sleeping at least once a week? You're not alone. Many of us do. And so have I. I've got a chronic anxiety disorder. I've always had it. I basically wake up feeling anxious at like 7 out of 10 every day.
-
And then I finally started to get into CBD oil, but a lot of them didn't work for me. And then I tried Feels. Feels is definitely the one that really works for me. It's a premium CBD oil delivered directly to your doorstep. Feels naturally helps reduce stress, anxiety, pain, and sleeplessness.
-
And I got to tell you, I have back pain, too, from standing here at my desk all day. And it helps me with that. It's incredible. It's like, you know, my lower back is dead by the end of the day. And I drop some CBD when I go in to relax. And then I calm down. My back stops hurting. And I can enjoy my TV time.
-
So all you got to do is place a few drops of Feels under your tongue. And you'll feel it within a couple of minutes. It works pretty quick. Just don't swallow it right away. You can swallow it a bit, but you got to let it absorb underneath your tongue. And if you're new to CBD, Feels offers a free CBD hotline and text message support to help guide your personal experience.
-
Feels works naturally to help you feel better. There's no high, no hangover, or addiction. And I can, from personal experience, tell you all three of those things are absolutely true. Join the Feels community to get Feels delivered to your door every month. You'll save on every order, and you can pause or cancel at any time.
-
Feels has me feeling my best every day, and it can help you, too. Become a member today by going to feels.com slash gog, and you'll get 50% off your first order with free shipping. That's F-E-A-L-S dot com slash gog to become a member, and get 50% automatically taken off your first order with free shipping.
-
Feels.com slash gog. This stuff has literally changed my life. If you've noticed that I'm not as grumpy as I used to be on the show, that's why. Feels has made me feel good. Security?
-
We're back this week with Joe Kerrigan from the Johns Hopkins University Information Security Institute. Joe is also co-host of the Hacking Humans podcast, along with Dave Bittner, who decided to go on vacation this week. And they take on social engineering over there at the Hacking Humans podcast, which I totally adore.
-
I love your show, Joe. Great. I love it, too. I think it's a good mixture of social engineering, security stuff, and comedy. A lot of times it's pretty funny, especially with the catch of the day. Oh, that's really fun. Yeah. Highly recommend everybody go check out that show.
-
Link will be in the show notes. You know what's amazing about those catches of the day is that Dave usually reads those in one take. And, like, last week's episode, he read that in one take, and I couldn't get through the first sentence without having to stop. You know, he's a god among men when it comes to this stuff. He beats the crap out of all of us.
-
But he, you know, comes from the theater. Theater. That's right. We've had him sing a few songs on this show before. Yeah. He's singing a fine little ditty for us. I will spare you my singing. Excellent. Well, let's start with a little exposure. Okay. The kind you don't want. There's an adult website called Luscious, which is a great name.
-
They had a data breach of about 1.2 million users. And the data breach included the compromise of some email addresses that had full names in it. Oopsies. I don't know who I blame more for that. The website for having a breach, obviously, that's bad.
-
But it seems to me like the thing to do is to not sign up using an email with your full name in it or one that you use for anything else so that nobody could ever identify you in the event that this happens. That would, of course, require people being smart online. And having a little bit of forethought.
-
Not being smart, just being a little paranoid. I mean, I'm pretty sure everybody in that breach does not listen to our show. Probably not. Oh, I don't know. I think we definitely have a Venn diagram crossover between porn users and podcast listeners. Right, right. But people who put in their actual name, because come on, man, you can use privacy.com for your credit card.
-
You can make up a fake name because you don't have to have the same name on your privacy card. We've talked about 17,000 different ways to go get a fake email address. It's not hard to just go create an account on there and be somebody that you're not. Like everybody on a dating app. Yeah, exactly.
-
I suppose my first thought on this is I'm surprised this doesn't happen more. Having never personally worked within the adult industry, but knowing people that did on the web. These companies are pretty good at cutting corners to make some cash.
-
I disagree 100% as one of those people who used to work in the adult entertainment industry and the sort of the dating industry. It is a sweatshop over there, but they have some of the tightest security that you've ever seen because they deal with a lot of personal information and credit card numbers.
-
Right. We had an entire security division at the company I worked at, and these people were really, really good. Okay. The closest I've come is a job interview, so I didn't proceed with the interview once I found out what they were doing. Yeah, I mean, this could be a case of fresh talent.
-
Yeah, it could be. We do love our fresh talent. They got a bunch of activity logs, too, including some of the content that these people viewed. My favorite quote is, activity on adult sites like Luscious is most private in nature, and nobody ever expects it to be revealed. That's a statement of the obvious, right?
-
Yes. Yeah. I love that quote. Expects being the operative word in here. Right. It's not that many compared to how big was Ashley Madison? Man, Ashley Madison was bigger than this, wasn't it? I don't remember. I thought it was bigger by an order of magnitude. Yeah, I think so as well. It was pretty big.
-
Yeah, and slightly different. This could be embarrassing. Right. Best. Right. But, you know, Ashley Madison, that was, if you were on there, that's a bit more than just checking out some boobage. Right. My concern with the Ashley Madison breach was that they actually found, like, .gov and .mil addresses in that breach.
-
Wow. People are people. Right. Yeah, come on. I actually expect there to be a higher concentration of .gov and .mil in there. Do you remember what other breach happened around the same time? Nothing comes to mind. The OPM breach happened around the same time. So if you were able to correlate those two data sets and identify people who had clearances who were in the Ashley Madison data breach, then you had primary, those would be your primary espionage targets.
-
Yeah, that's true. But I'm sure all the data was anonymized. No. No one. Not neither of those breaches. Yeah. Well, speaking of data breaches, Google is jumping into the fray. They want to add in, basically, notifications when you log into a website if it has been part of an attack.
-
And if your login has been breached, it was going to let you know. It's kind of like how Firefox and Mozilla partnered with haveibeenpwned.com. Yep. Yes. And they're trying to basically start their own thing, and it's called the password checkup extension that you can get now, actually.
-
But they're going to bake it into Chrome, which I think is smart, personally. I just want to know where their database is coming from. Yeah, I'd like to know that, too. I don't think they're working with Have I Been Pwned, right? I mean, that's Troy Hunt's page. Yeah, I'm pretty sure he's got an exclusive deal with Mozilla.
-
But he does give the data out to other companies, because I know Have I Been Pwned is integrated into the Watchtower product on 1Password. So I can go and see. I get notifications inside of 1Password when one of my passwords has been on a site that has been basically actively exploited.
-
So it doesn't even know if it's been my username or not, but it does know that that actual website has been part of an exploit. So with Google's reach, I bet they're going to have just as much data as Troy does. Yeah, I'm sure. If not more. Yeah, they might actually be able to get a hold of more data, because not everybody knows who Troy Hunt is, but everybody knows who Google is, right?
-
I mean, everybody in the security industry knows who Troy Hunt is, right? But it's a much larger everybody when you talk about who knows who Google is. Yeah. So good idea. I think this is a great idea. Anything you can do to put usability in front of, you know, put this kind of information in front of users in a usable way, it's good.
-
It would be nice if Google had a way to force people to change their passwords and maybe turn on two-factor auth, but that might be a little bit too draconian, I guess. Right. Yes. Yes. You're not allowed. Until you read this article on cybersecurity, we're not going to let you log into this website. Right. At AshleyMadison.com.
-
Right. And MoviePass is back in the news again. This has won the award for the thing that we have been most tweeted. Oh, really? Oh, yeah. Everybody is sending us this in, because we've been crapping on MoviePass for quite some time. Right.
-
It's usually about their stupid business models, but now... Or lack thereof. Yeah. Yeah. Lack thereof business models. So, yeah, they've had this ask-to-the-win database for quite some time out there, and I'm sure it had to be on AWS, of course.
-
Of course. I'd be dollars to donuts it was on AWS, but this had real people's information with real credit cards and real billing information, as well as the stupid MasterCard numbers that MoviePass gives you. Those are actually useless. Those shouldn't have even been in the article, because they have to be activated by MoviePass when you're at the geolocated target of the movie you're going to see.
-
So, you can't actually take those numbers and use them anywhere. So, that's actually more secure than my credit card is, right? Yes. It would be like you'd have to call MasterCard and say, I'm going to the Apple Store right now, and I'm going to go buy a pair of AirPods. Would you please turn on my credit card when you see my phone show that I'm at the Apple Store?
-
That's really what it would be. Right. So, MoviePass is really looking out so that they don't lose money, right? But they're not doing the same for their customers, it looks like. Do you think this database also included the passwords that they changed for users so they couldn't use their MoviePasses? Oh, that's right. Because, yeah, they were changing their passwords before when they didn't have enough money in the bank to cover all the movie tickets that day.
-
They would just change someone's password. Maybe this is a service so you can get your changed password back. Right. Who would have thought this would be a problem? A company whose business model is losing money is, we're all surprised to find it can't afford good security, right? Yeah.
-
Right. It's not as bad as the luscious breach. It's a credit card breach and, you know, nobody's going to look at you sideways for being a member of MoviePass, right? You're just trying to get movies cheaper. Well, I don't know. If you're listening to this show, you know that. At this point, if you're still a MoviePass customer, I'm going to be looking at you.
-
Yeah. I mean, I know we have friends at the show that actually got a lot of use out of MoviePass because they're avid moviegoers. But I think those are the people that shut down MoviePass. Right. Back when it was an all-you-can-watch movie service, right? Yeah. Exactly. Now, there's less movies on MoviePass than – well, actually, I guess there always was less movies on MoviePass than Netflix.
-
But still, it's like they keep cutting down the amount of movies you can go to. You can't see 3D. You can only see it on non-peak hours. And even then, they just might say, no, your card doesn't work after you've driven all the way to the theater, which is just a dick move.
-
And then you'll just pull out your credit card and buy the ticket anyway, probably. Yeah. And then forget to cancel your MoviePass account and get dinged over and over again, which is why you should always use a privacy card. Privacy.com slash GOG. You can turn it off at the source and never give MoviePass any more of your information. The hits keep on coming with MoviePass.
-
Yeah. Wow. I hate to sit here and dump all over a company like this, but I really don't understand what their business model is. And I really don't understand – yeah, I really don't – well, of course, it's a data breach. It happens to everybody, right? That's the attitude. But why not just pile on more, I guess, right?
-
Of course. Well, you are – That's what we do here. I just want to remind you, Joe, that you are on a show called Grumpy Old Geeks, where all we do is pile on companies that screw up. Yes. Angry Old Men Yelling to Microphone. That's right. It's right there in the tagline, what went wrong on the internet and who's to blame.
-
The who's to blame part is the key. Right. And today it's MoviePass. Well, today it's also the state of California. Yeah, this is an interesting one. What they're talking about here is the EFF is calling on California to end vendor-driven training for the ALPRs, the automatic license plate readers, and not so much about the license plate readers themselves.
-
That, to me, who cares who's training you? What should concern you is that your police departments are driving around recording all your license plates, and the company that sells them drives around and just takes pictures of people's license plates and then sells that information to law enforcement.
-
And then they also sell their customers' data like malls. The mall by my house, Columbia Mall, has vehicles with license plate readers on them, and it drives around taking pictures of license plates. Yeah. Taking pictures of license plates. The reason they say is so that they can find employees who don't park in designated employee areas.
-
Bullshit. Right. But they're taking – and my son works at the mall, and he's been told not to park where he's parking. But they are offering that data up to law enforcement. Yeah, it's ridiculous. It's absolutely ridiculous.
-
Well, it's also – I mean, as we've been talking about on the show, it's not even just law enforcement. It's everyone now, the price and technology barriers have dropped so low on these things, condo owners are buying them to track the people that live in their condos.
-
It's ridiculous. Yeah, and what's the regulation on that data, right? Regulation. Exactly. What are the security – what are the privacy measures that that data that – I mean, what do I do? I can't drive around without a license plate. I'll get pulled over almost instantaneously.
-
I come to L.A. People do it all the time. They just assume you're a Kardashian. Or Adam Carolla. Does Adam drive around without a license plate? Oh, yes, he does. There are a lot of people in my neighborhood that do that. Granted, Adam lives over in Glendale, but in my neck of the woods, I literally live in the Kardashians' backyard, and everybody drives cars with no license plates.
-
But I think the real thing here that they were – the EFF is pissed off about is the fact that the training materials that these officers are being trained on is supremely out of date and doesn't take into account a lot of the court rulings that have happened and the laws that have been changed since, you know, the training was created and the company has not updated the training.
-
And also, why is a private company training law enforcement on the law? Which also is bad. Because capitalism. Yeah, they shouldn't be training them on the law. They should be training them on how to use the technology. Yeah. Right. You know what that technology is?
-
Push here, dipshit. It's a PhD program. Anyway, it's good for – yeah, I'm glad the EFF is still alive and kicking. We were wondering where they were for a while, but they seem to have gotten their – they've gotten their groove back. Yeah. You know, in New York, the ACLU was reporting that in 2014 that New York City was using EZPass transponders to track users' location.
-
Right. So they would set up these EZPass emitters, just like on the toll booth, and just turn your EZPass on and ask for the ID. They wouldn't charge you a toll, obviously, because that would drive people nuts. But that way, they could track your movement through the city, and ostensibly, that was for traffic management.
-
Yes. Yeah, sure. I'm not comfortable with that either. Yeah. The thing about those things that's really interesting is any one of us could, you know, sit in the middle of Manhattan with a backpack with one of these, you know – because it's basically an RFID chip inside of the EZPass.
-
So you can sit there with an RFID reader in a backpack and just stand there and get everybody's transponder as they go by and build your own database pretty easily, which is kind of crazy. You know, my wife thinks I'm crazy because I take my EZPass and I put it into that little antistatic bag every time and stuff it down in the car and only pull it out when I go through tolls.
-
Okay. So, yeah, you're a little more paranoid than we are. I don't know if that antistatic bag will stop the microwave emitter from activating the EZPass, the RFID inside. No, not by itself. See, what you need to do then is you get some tinfoil.
-
Tinfoil. And make a hat. And make a hat, exactly. And just keep the transponder under your hat. And then every time you go by a toll booth, you just tip your hat and expose it and put the hat back down. I'll do that next time. I'll send a picture. Okay, perfect. I know I'm going across the Bay Bridge in a couple of weekends, so I'll do it for that.
-
There you go. And I think you could probably figure out, as long as you have a secondary backup antistatic bag, you can probably put it in the microwave. And if it explodes, then it probably blocks. Then you know that there's metal in it, and it probably blocks the RFID. Yeah, otherwise, it's probably just a static pouch and not a Faraday cage because you need a Faraday cage around that.
-
Maybe I'll use a Faraday bag. I think I'll get one of those. Yeah. And the Wall Street Journal today has an article about a company called Family Tree DNA that shared their customers' data with the FBI or actually let the FBI search the database of their customers' data.
-
So this is a guy named Bennett Greenspan, who's the president of it, a CEO, rather. And the company has 1.5 million people in its database records of DNA. These are people who have submitted DNA, like the spit-in-the-tube DNA things. And then the FBI's Steve Kramer, who I think is an attorney with them, called up Mr. Greenspan to ask him for help with two particularly difficult cases, or horrible cases, rather.
-
And Kramer wanted to upload DNA from these two cases to see if there were any matches or any relatives. Now, one of them was for a deceased child whose body had never been claimed, and they were looking for possible relatives to the child. And the other one was for a rape case, which was later linked to the Golden State murderer, who was a serial killer.
-
These cases were so bad that Greenspan agreed on the spot to let Kramer search through the database using the DNA that he had. Now, there's a woman named Natalie Ram down at the University of Maryland. She's an associate professor of law there, and she makes a very good point, saying that taking DNA tests does not just tell a story about me.
-
DNA tests inevitably reveal information about many other people, too, without their consent. Yes, that's why we've been arguing on this show that there's no point in not doing it anymore, because probably enough people related to you have already done it, that all your data is out there.
-
Right. Yeah, that you're already exposed as it is. Yep. When the DNA was uploaded by the FBI, if they had a match, they would see the same information that a paying customer would see. They'd get the name of the person if the customer had provided it, the name of the match, the amount of DNA that was shared in common, and the contact information if the customer had provided that as well.
-
Here's what strikes me as most, I guess, chilling about this article, and I don't know, it's kind of buried in the middle of the article, not really a lot is made of it, but after the second case that Greenspan investigated, this FBI attorney pressured him to cooperate with the agency regularly.
-
And he said, Greenspan said, the FBI let him know that if I didn't find a way to work with him, I would perpetually be dealing with a subpoena. Right. Well, that's the way it should be. He should have to get subpoenas over and over again for every case that comes in the door. That's how it works.
-
That's cost of doing business for these people. Yes. That should be anyways. Yeah. It should be. But the idea here is that I'm not sure how comfortable I am with the FBI going, listen, if you don't give me the information, I'm just going to have to subpoena you for it over and over again.
-
I talked to a lawyer friend of mine about this this morning, and he was telling me, yeah, attorneys can issue subpoenas. But I didn't get enough time to chat with him because, as you can imagine, he's very busy. You can fight these subpoenas. You don't have to immediately comply with them. Right. Right. So you can take that before a judge and go, yeah, this is way too broad.
-
He's looking to search way too much information and essentially just doing a phishing campaign here with an F, phishing with an F. Yeah. Yeah. I'm not really comfortable with this. Now, the FBI didn't make Mr. Kramer available for comment, but they issued a statement that said, it is important to note that investigative genealogy is for lead purposes only.
-
All arrests should be based on independent criminal forensic DNA testing. Right. I came up with a free $1 million idea for anybody out there listening. Do tell. An anonymous DNA testing service. So you go and you buy a kit in the store. That kit has a number. You log on to a website.
-
You sign up with that number. You register the kit. You pay with either a prepaid gift card or maybe some currency, cryptocurrency rather, and then you can log back in and get your results when they're ready. And no data is ever linked back to you. Well, your credit card purchase is linked back to you for when you bought the actual kit.
-
And also, you can be profiled with your – or your cell phone can be pinging from the store, so you'd have to leave your cell phone at home. But they also might read your license plate when you're coming into the store from the security cameras. So I'm pretty much saying there's nothing is anonymous anymore. Privacy is dead. Get over it.
-
Yeah. I mean, it's a – you know. What are you going to do? I mean, come on. What are you going to do? And again, like we said, there's so many people have already done this DNA testing that it almost doesn't matter anymore. Right. That's the really sad part about this. So, you know, it's – I feel that most of this is working kind of the way it should.
-
But I think that if you are – if you are Family Tree DNA or you are – what's the super big one called? 23andMe. 23andMe, yeah. If you are any of these companies right now, you better have a bunch of lawyers on staff because that is now part of your business model.
-
Right. And you should be protecting your clients, which are the people. And, you know, the FBI should subpoena these places if they want to get this information. And they should fight the subpoenas and make sure that it goes in front of a judge and preferably a judge that is knowledgeable in these sorts of things.
-
Do we have those? I don't know. I'm sure that it's becoming a legal specialty, though, very quickly. And so if it all goes that way, then I don't have a problem. That seems to me to be the way that it should be working. You know, one of the big problems in this whole situation legally is that we have a situation where we have such complexity in our lives that, for example, to be a judge,
-
you have to spend a lot of time learning stuff about being a judge. You have to be an attorney. You have to know case precedent. You have to – I mean, there's just a ton of stuff you have to know. It's not an easy job. Right. To then cram on top of that genetics, which is its own field where you have to spend years and years becoming an expert in it,
-
or even cybersecurity where you have to spend years and years becoming an expert in that, or software engineering that makes these cases very difficult to try. Well, I mean, it does and it doesn't. I mean, yes, things have certainly gotten more complex, but it hasn't always been this way.
-
It's the same conversation that we tend to have on the show a lot about our politicians. Boy, we wish our politicians understood technology better, but they're too busy being politicians. Right. You convene expert panels, and part of these subpoenas, and when you're fighting these subpoenas, is you have the experts come in and explain it to them.
-
Right. And that's what needs to happen. Obviously, I don't need to – I don't expect my judge to be a part-time geneticist, but I do expect them to have some geneticists on hand to tell them about this stuff. Yes, but this is fairly recent in terms of finding these experts. I mean, if you go back 80 to 100 years ago, did we need them?
-
Now we do. Yeah, we do. Yep. There's an interesting angle here that I was thinking of while you guys were talking about that. And I've been getting a lot of hits recently on 23andMe about people who are relatives that, you know, I've got new relatives.
-
I'm like, okay, and then I start to think about it, and I don't hit, you know, connect or anything like that because I don't need any more relatives. Hey, man, when you think about it, Jason, we're all connected. We are all connected, yes. So, anyway, I have family members that I actually actively don't want to connect with.
-
Right. So, this could be a way for somebody to say, hey, I want to get in touch with this person. Let me go spit in the tube and see if 23andMe will connect me, and then I can actually put in a different name and be a different family member. But it's going to say that I'm related to you, but I could be the person that I'm just trying to, you know, get in touch with this person and get some information about them.
-
Right. To find out what they're doing nowadays or how I can, like, track them down or stuff like that. You know, there are some angles that you could be pretty nefarious with some of this data. I mean, there's lots of ways it could be nefarious. Let's not joke about that. But the one you're outlining here is particularly clever.
-
Yeah, I thought it was clever. I pat myself on the back. I need to go write a short story about it and sell it to Netflix and make a billion dollars. But, yeah, I mean, you could easily, if there's a family member that you're trying to find who you know has done some of these genetic testing kits. Or maybe you just think they've done it.
-
Yeah, yeah. I mean, and it's also, it's a pretty easy bet to try. It's like, okay, yeah, I put in my name as Cousin Vicky from South Carolina. Like, I have a Cousin Vicky? No, it's actually the guy who you owe money to that wants to kill you. Right. You know? And then you just run a scam on them and try and figure out where they're located and where they live.
-
And then you can backtrace it, find them, and, you know. So you know somebody shows up that you don't want. Exactly. I would just state, if you feel that you have a whole bunch of family members that you don't ever want to find you, don't spit in a tube. Right. That's true. That's true, too. Privacy starts at the source, people.
-
Yeah, it does. It does. Nobody in my family has done it. Nobody in my immediate family, my wife or my parents or her parents or my children have done it. Yeah, I've done it. My dad's done it. I don't think my brother's going to do it because he's the smart one of the group.
-
Right. And you are. Well, you two have done it, so it doesn't matter too much for your brother. That's the thing, yeah. That's the thing. He's implicated already. Sorry, Greg. I hate to do that to you. Okay, moving on. Hackers have released their first public jailbreak for up-to-date iPhones in years, all because somebody decided to roll back a bug fix.
-
What could go wrong? I'm so happy that I can jailbreak my now $1,000 phone. Yes, seriously. Well, just go buy an Android if you want to jailbreak your phone. Come on. Yeah, you can get a Google Pixel 3 and still jailbreak a $1,000 phone.
-
That's true. Yeah. I just thought this was funny that somebody definitely stepped on their dick at Apple on this one. Oops. This is remarkable that they rolled it back. What's interesting is it's been out for a couple of releases, hasn't it? Yeah. And just got discovered now, so people have assumed that it's patched.
-
Only recently has some security researcher gone out and tried old hacks on a new updated iPhone. Which is really smart, unless you just hit it by accident and just ran some old code. You just missed the version number and ran an old exploit and wasn't expecting it.
-
And it's like, oh, happy accident. No, I think you probably did that deliberately. I can see a point where that's the case. The good news is this will happen every single time Apple updates their operating system anymore. That somebody will go out and try all the old exploits that they know to see if it works.
-
Yeah, it makes sense. Why not? I mean, it's only time. You're not going to really. Right. It's free. You've got the exploit. Let's just run it on the test suite. Yep. I just thought it was funny. I'm not going to jailbreak my iPhone. Please, dear God, no. I've done that before. It never ends well.
-
Yeah. Yeah. I've done the same with rooting Android phones and it doesn't end well anymore. I mean, it used to be okay. Now it's not. So have you guys heard of blind? I had not until I was reading the show notes for today, but this is interesting. Same.
-
Yeah. Yeah. This is an anonymous website forum where you can go and bitch about your boss. And the thing about it is it's the people who work at the companies that are the most fascinating part. Because let's just go through the top five. Uber, Facebook, Microsoft, Google, and Amazon.
-
Now you can sign up for a free account. You can get full access if you actually verify using your work email address. And why the hell would you ever do that? I have no idea. Some people will do it, though. You know that because I've seen them.
-
They will. I've seen them. And somebody is right now setting up an email rule that looks for the validation emails from Team Blind so they know who's on blind. Oh, this is already set up. Trust me. I'm sure this is already out there because there are a lot of messages out there.
-
I spent two hours going down the rabbit hole in the Facebook groups. And, oh, boy, people don't like working at Facebook. Wow. Man, it's crazy. I haven't done Uber yet. Uber's on my list when I have a few spare hours because you can't stop once you start.
-
It's just too much fun. I looked at Netflix for a couple of minutes. That was interesting. Apparently, Netflix wants you to work hard. But what company doesn't want you to work hard? I was going to say, that's table stakes. Yeah, it's just that they pay you to work hard. And if you don't work hard, they will fire you.
-
Well, you know, I just found a super exciting one. Yeah. Do you guys poop at the office? That's a good question that's being discussed in here. Why are guys so subpar in appearance? And this is at Google rant. Tech jobs make so much money. Why not spend some of it on health and appearance? Get a gym membership.
-
Personal trainer. Nutritionist. Lose the weight. Chubby. The thing about it, you have to look and see if the questions or the answers are from people at Google. The best questions are from people that are inside the organizations or claimed to be from inside the organizations, because then it's just like, hey, does your division suck as much as mine does?
-
Because my manager's a tool. Well, here's something I particularly enjoy is what's in your wallet. If you happen to have a Capital One card, somebody at Capital One said, fuck ethics, money is everything. Well, that's good. Oh, nice. Nice. Sweet. Yeah.
-
Awesome. Look at the Capital One one. Where is it? It's not listed here. No, yeah. No, this is just the top 20. Yeah, we're just going through the top 20 here, because it's pretty interesting. So yeah, Uber, Facebook, Microsoft, Google, Amazon. Amazon is particularly, there's a split in Amazon from people who work in the main office and people who work in the warehouse.
-
The people who work in the warehouse. People in the warehouse are doing their PR on Twitter, aren't they? They're saying how wonderful everything is. Oh, yeah. They're on the FC team. But yeah. And the people that are in the main office are like, I love my life. It's great working at Amazon.
-
And the other people are like, yeah, but you don't have to pee in a jug. It's like, oh, a little class warfare going on on the Amazon one. Yeah. But it's just so much fun. It's at teamblind.com. And I highly recommend if you just need some entertainment and want to see how these tech bros live and the not tech bros, you're going to love it.
-
You're going to love it. And if you work at one of these places, just keep writing because, man, it's fun. It's better than daytime soaps. It's pretty interesting stuff. Here's somebody who says they're about to quit Amazon and there's a chance they could get walked out. Hmm. Okay. That's interesting.
-
Live webcam, please. Right. Yeah. Well, no, because Facebook has shut down all those live webcams because he's probably being walked out because he's going to shoot the place up. God, I hope not. We'll see. We'll see. And finally, I use VLC.
-
Do you guys use VLC? Yes. Yeah, you know me. Yeah. Exactly. That was a very good one, Brian. I like it. Thank you. Brian's down with VLC. I am. Yeah. Well, they just closed, I think, 15 open bugs.
-
Yep. Which came back to being able to run MKV files with actual code execution in them, which is a little scary. Yeah. A little scary. I don't even know how that works. I'm not familiar with video. Especially if you might be getting some of your files from, oh, I don't know, Sweden. Exactly. Most of my files I get are MKVs.
-
I don't know what the difference is between PCs and Macs on this one, but I'm sure probably I'm sure there were, you know, targeted MKVs for both. But fortunately, you know, here's your antivirus when you get an MKV file from, say, Sweden.
-
Run it through Handbrake. And that's it. Handbrake.fr, I believe. Run it through Handbrake and, you know, transcode it and that'll get rid of any code. So that's how you have to use antivirus on your MKVs now. Just transcode it and go about your day. But man, it's scary that I always thought I'm like, okay, video files.
-
Nobody's, you can't put executable code in a video file. It's just a file. Oh, well, if you hack the player or know how to break the player and break the codec and like, you know, throw, throw some buffer overflows in there and then just throw the code into the kernel. Well, Bob's your uncle.
-
Yeah. So everybody update, update your VLC. I know nobody thinks about that one, but since I just made a new computer the other day, so I had to install everything from scratch. Right. And I got the latest one and I'm like, oh, okay, let me check this out.
-
And then I looked at the version number and then I'm just like, okay. And because I had to up, I downloaded it and then like instantly there was an update for it. That's what brought my eye. So then I went back and checked my other ones and updated all of those. I will tell you this. I opened VLC today because I generally keep it here for videos that I'm working on, but this morning when I opened it up, it said, hey, there's a new update available and in red letters in that dialogue box, it says security, right?
-
So some of them are a security update and then you can just click there and update right from the application. So it's easy to do. The people who are developing VLC are doing a good job of making sure that their users are protected from these vulnerabilities.
-
Now it's on the users to go ahead and actually click the update button and go, no, no, I'll do that later. Don't do that. Just click the update button. I did it this morning. It took about two minutes and I was done. Yeah. Some people don't have two minutes because they're busy. Right. Busy. Just updated.
-
I was just blown away by the fact that you could actually put executable code in an MKV. Yeah. Damn girl. I'm not familiar enough with movie file formats, with video formats or anything to even begin to understand how it works. You said it was a buffer overflow attack inside of one of those?
-
It's a buffer overflow and it's not in the file. I mean, the flaw isn't in the MKV format. The file, the demuxer, as they call it, in the codec is where the flaw lies. Okay. So you can put a payload in the actual MKV file that when the demuxer reads it, to turn it into a video for you to watch.
-
It crashes the demuxer and gives you a shell or something? Well, it basically just, you can inject code in from that point. Well, then you can do anything, right? Mm-hmm. Once you have a remote code execution, or actually a code execution, you can immediately turn that into a remote code execution with a reverse shell.
-
Mm-hmm. So. There you go. Yeah. That's a lot of fun. Fubs, your uncle. Right. All right, Joe. Well, thanks for stopping by today. We really appreciate it. And keep going with Hacking Humans. That's such a fun show. I will. Thank you. As long as Dave will have me, I'll be there. Brick-a-brick.
-
I just didn't feel like we could wait for our Media Candy segment on the next show for this one, because this is big news, and I'm curious to see how you feel about it. We are getting a new Matrix movie, and it's not going to be a reboot, which is what we kind of heard was going to happen for quite some time, but that's gone away.
-
We have, it's been reported by Variety that the Matrix 4, which will be a sequel, is an official greenlit project to be directed by Lana Wachowski and starring Keanu Reeves and Carrie-Anne Moss, both of which have signed on board. So we shall see what happens.
-
This will be the first movie to be directed by only one of the Winklevice sisters, I'm sorry, Wachowski sisters, who worked as a team until the second season of the Netflix series Sense8, which I kind of watched, but kind of didn't. I never really got into it. I couldn't get past 10 minutes of the first episode on that one.
-
Yeah. So I'm curious what you think about this. The Matrix 4. I really want the Matrix 4, said no one ever. So. A lot of people I know are cautiously optimistic that they're hoping that they learned from the mistakes of 2 and 3, and we'll get back to the feel of the 4 of the first one, but the prevailing theory about really the only storyline that they could possibly do is, in this one, Keanu, Neo becomes Orpheus, basically, and they find a new generation, which would suck
-
if that's what it's going to be. Yeah, we'll see. I mean, they didn't learn on the Matrix 3 from their lessons on the Matrix 2, but I guess you could give them a bit of slack for that because they were filmed like at the same time. Yeah, they shot them at the exact same time. So the story is just, they didn't, they thought, wow, everybody's going to love this.
-
And after the second one came out, they went, oh shit, they're really not going to like the third one. Yeah, wait till they see the third one. Oh my God. See, now that's a project for the future. Somebody should go back and fix 2 and 3. At least fix the CGI on those fights. I've got just the guy. Lucas.
-
George Lucas does a great job going back in and fixing things. Oh my God. I want Agent Smith as Jar Jar Binks. They just replaced it. Somebody out there, go do a deep fake of Jar Jar Binks as Agent Smith.
-
Oh my God. That would be great. That would be great. So I don't know. What I really want more is a John Wick 4. I don't want Keanu dicking around with this. I want him on John Wick 4 because John Wick 3 was great. Now I need number 4. I'll stick with Bill and Ted's. Yeah, yeah, he's too busy, damn it.
-
You better not screw up Bill and Ted's for this thing. So who knows? Well, I mean, if any Matrix movie is going to be, you know, a case in point for the next one, it's going to be six years and they're going to be in pre-production for five of those years and then shoot or actually pre-production for four years, shoot for one year and then post for maybe two or three years.
-
So maybe seven, eight years. Maybe, maybe. I mean, I've got to say everybody goes on and on about James Cameron's stupid Avatar series and how that moved the four, you know, the technology of movies so far forward. The Matrix movies hold up. They still look cutting edge, amazing visually and tech with the technology.
-
So one thing that I could possibly be excited about this is if they push technology technology again for movies like they did with the first one. That'd be pretty cool. Yeah, I'm sure they will, too, because I'm sure James Cameron has come up with a thousand new technologies while he's doing Avatar two through ten that, you know.
-
Speaking of which, speaking of movies, nobody's asked for. Yeah. And probably we'll never see. Who knows? And also speaking of something else that nobody ever asked for robots in space. Russia has launched their test.
-
Well, first, they're testing a new replacement for the Soyuz engines. Right. So they had to shoot one up to the space station. So, hey, let's do that. And while we're at it, let's put a robot on board. You've seen the robot before. It's the one that we used to arm and shoot guns.
-
What could possibly go wrong? Well, and it's named Fedor and it stands for Final Experimental Demonstration Object Research. Now, I'm sorry, but if you're sending a robot into space, I don't want the word final on it anywhere.
-
Hold on a second. If you're a Russian creating a robot, why is your acronym in English? Oh, good point. Good point. I'm just saying. I want to keep an eye on this to see how it goes. It's only going to be up there for a week because that's all it needs to eradicate humanity on the ISS.
-
Didn't we already have that stupid smiley face robot up there? Yeah, the floaty ball robot that was like, you know, $10 million. I think it's still up there, but it got into trouble and like the AI broke on it. Remember? It was like getting lippy with the crewmate because the crewmate wanted to listen to one song and he said, no, you would like this song better.
-
Well, let's let's let's battle it out up there. Oh, that would be good. That would be good. We could. You know, it's kind of like Luke with the little lightsaber ball. The little ball could be zipping around while the other robot tries to shoot it. But it'll be like Rocky versus Drago. It'll be great. Well, I don't know, man, because the wasn't the ball French.
-
Was it French or German? Oh, that's right. It wasn't American. OK. Yeah. Hitler versus Stalin. There we go. There's Hitler versus Stalin. Nobody wants. I don't know, man. That could actually be kind of fun. I don't know. Somebody pitched that.
-
Closing shout outs. Big thank you to my friend Eric Hundley for letting James Cridland and I use his podcast for a debate on dynamic ad insertion in podcasting. Exactly.
-
Exactly. I figured that would be your your take on that. Shockingly, I have not listened to this yet, Jason. But oh, surprise. Big surprise. Brian wants to hear about the business that he's in. Oh, dear. OK. We had a good debate.
-
I thought we had a good debate. He didn't understand my A.B. testing bit because he just kept saying, no, no, no. And I'm like, well, I tested it and it works. That's what testing is for. He's like, you know, just stuck his head in the sand and said, no, no, no, no, it doesn't work that way. You cannot bumper ads. I'm like, well, I hate to break it to you.
-
We tested it and it fucking works. So but for the rest of it, we were very civil. And James is a great guy. I support his newsletter. You know, he runs the pod news newsletter. I've been a patron supporter forever. So it was a fun it was a fun talk. So if you're into the, you know, the the bit about dynamic ads and podcasting and why I can't stand certain aspects of them, feel free to give it a listen or, Brian, go for a bike ride and play some more.
-
I will. I will listen to it. Actually, I will. Because, you know, coming soon on our show. Dynamically inserted. Dynamically inserted. I have to eat some crow on that one. Until next time, I'm Brian Schulmeister. And I'm Jason DeFillippo. Thanks for listening to Grumpy Old Geeks.
-
To support the show and keep us on the air, go to patreon.com slash GOG. Toss us a few bucks a month and we'll love you forever. If you don't like Patreon but still want to support the show, you can give a one time or recurring donation by just going to GOG.show and click that PayPal button. Your support really keeps us going. And we really, really, really, really honestly appreciate it.
-
Show notes for this episode are at GOG.show slash 371. From there, you can find links to old episodes, leave feedback, ask questions, and get links to stuff we like. Stay grumpy.
-
At QVC, fall shopping is more than just checking out. It's discovering the brands you love across beauty, fashion, home, and culinary all in one place. Whether you're getting ready for crisp mornings, cozy nights, or everyday moments, QVC has what you need for the season ahead.
-
With brands like Laura Geller, Philosophy, Ninja, and so many more. Shop now at QVC.com.