Kelvin Meeks

California Governor Vetoes Bill Requiring Opt-Out Signals For Sale of User Data: An anonymous reader quotes a report from Ars Technica: California Gov. Gavin Newsom vetoed a bill that would have required makers of web browsers and mobile operating systems to let consumers send opt-out preference signals that could limit businesses' use of personal information. The bill approved by the State Legislature last month would have required an opt-out signal "that communicates the consumer's choice to opt out of the sale and sharing of the consumer's personal information or to limit the use of the consumer's sensitive personal information." It would have made it illegal for a business to offer a web browser or mobile operating system without a setting that lets consumers "send an opt-out preference signal to businesses with which the consumer interacts." In a veto message (PDF) sent to the Legislature Friday, Newsom said he would not sign the bill. Newsom wrote that he shares the "desire to enhance consumer privacy," noting that he previously signed a bill "requir[ing] the California Privacy Protection Agency to establish an accessible deletion mechanism allowing consumers to request that data brokers delete all of their personal information." But Newsom said he is opposed to the new bill's mandate on operating systems. "I am concerned, however, about placing a mandate on operating system (OS) developers at this time," the governor wrote. "No major mobile OS incorporates an option for an opt-out signal. By contrast, most Internet browsers either include such an option or, if users choose, they can download a plug-in with the same functionality. To ensure the ongoing usability of mobile devices, it's best if design questions are first addressed by developers, rather than by regulators. For this reason, I cannot sign this bill." Vetoes can be overridden with a two-thirds vote in each chamber. The bill was approved 59-12 in the Assembly and 31-7 in the Senate. But the State Legislature hasn't overridden a veto in decades. "It's troubling the power that companies such as Google appear to have over the governor's office," said Justin Kloczko, tech and privacy advocate for Consumer Watchdog, a nonprofit group in California. "What the governor didn't mention is that Google Chrome, Apple Safari and Microsoft Edge don't offer a global opt-out and they make up for nearly 90 percent of the browser market share. That's what matters. And people don't want to install plug-ins. Safari, which is the default browsers on iPhones, doesn't even accept a plug-in." Read more of this story at Slashdot.

1

USB MFA SCA😱: #Infineon hardware and software blamed for timing side-channel attack on popular auth tokens. The most widely used #FIDO2 authentication device has a nasty flaw: It can be cloned. Other uses of YubiKey’s vulnerable Infineon Technologies embedded chip might also be at risk—such as passports and credit cards. But is the sky really falling? In #SBBlogwatch, we dig into the nuance. At Techstrong Group⁠’s Security Boulevard: https://lnkd.in/duUSPThj #EUCLEAK #YubiKey

5

1 Comment

Hey SBOM fans - this is something to keep an eye on. The US Army is going to require SBOMs next year for most software it buys or builds, including open source adopted. But it doesn't apply to cloud services. Honestly, I've been expecting this. There have been conversations dancing around SBOM requirements for over a year now. One concern as I read this article: it states that bills of materials are preferred over attestations. While I get that an SBOM is more factual than a generic statement of compliance, it doesn't guarantee secure software development standards. There are other factors in play. I'd love to suggest that any SBOM is accompanied by an attestation of the SBOM as well as some other kind of basic attestation for the NIST SSDF's software security scanning callouts. I think we can move past picking one supply chain security item over another. At this point, between CISA's Secure by Demand initiative, Secure by Design attestations, SBOM requests and DOD mandates, let's just put our best foot forward on software development and attestation of that software. Read the article here: https://lnkd.in/gGVA7q6h PS - if you can't attest to your SBOM or your software supply chain today, it's time to check out GitLab again. #sbom #dod #ssdf #gitlab

41

1 Comment

I'll share some thoughts on this as there is some confusion. "The federal government has spent $22 billion in recent years on technology from the top 100 national-security startups, a paltry portion of overall contract spending and less than half of what venture capitalists have invested in those same companies." While VCs are obviously concerned about revenue, the reporter ignores the most important issue. Valuations in young private companies are something like one part guesswork, one part aspiration, two parts salesmanship, and three parts milestones, with a fair amount of fraud mixed in particularly in bubbles, but even in more mature growth companies a 10x multiple is conservative. That $22 billion in DOD contracts probably represents something like $300-400 billion in valuations claimed by the ventures and VCs, if not more. Even if the realized valuation is less than that for DOD contractor ventures, it would still represent an attractive ROI over a decade. If total invested is $50 billion and the realized value for VCs is $150 billion over 10 years, it's still 3x, and within that there would be likely be several 10X ++. That's not much different than the rest of the markets VCs invest in. My guess is it's more on track to be 5x or more for the entire portfolio, which is much better than most investments, though needs to be due to the risk involved. The more troubling statistic is that only 1% of total DOD contracts are going to VC-backed startups. That is a terrible failing grade for the DOD with regard to favoritism for incumbents, and explains most of the problem about unhealthy relationships and insufficient innovation. Given the size of the DOD budget, it may not be quite as bad as it seems as they can and should act as their own investors as a proactive customer, and they do some of that, but the reality is that the bureaucracy is so expensive to navigate that it usually requires significant capital. In fact, the most successful DOD startups in recent years were founded or co-founded by billionaires, which pretty well tells the entire story. Quote: “Startups are either purposely being kept out, or the DOD has just not figured out how to take advantage of them,” said Tara Murphy Dougherty, chief executive of defense software company Govini. Venture-backed companies have consistently received around 1% of total Defense Department award spending annually going back through 2018, despite throngs of new companies joining the defense-tech field, according to Govini data. https://lnkd.in/gK7emEqT

2

3 Comments

Read how changing "False" to "True" earned me a bounty from Google $$$ https://lnkd.in/gZgw5QHW . #CyberSecurity #AccessControl #hackerone #bugcrowd #WebSecurity #bugbounty #bugbountytips

110

4 Comments