Update (2020-04-29): Twitter has fixed their oversight.

{ "errors": [{ "code": 356, "message": "preferences.gender_preferences.gender_override: Must provide a non-empty custom value 30 characters or less in length." }]}

Anyone who set their custom gender to a long volume of text, should still have it set to a long volume of text.

The original article follows after the separator.

I was recently made aware of a change to Twitter, which exposes a new Gender field. If you’ve never specified your gender before, they guessed what it was (which is a really shitty thing to do, especially towards trans folks!).

https://twitter.com/leemandelo/status/1254179716451438592

Slightly annoyed, I went to go see what Twitter thinks my gender is.

Curses! They know I’m a guy. This won’t do at all.

But what’s this? An “Add your gender” option?

That’s at least, something, I guess? Defaulting to [whatever the algorithm guesses] is sucky, but at least nonbinary folks can still self-identify however they want.

But 30 characters isn’t a lot. What if I want to drop in, say, 68 characters? Do I need to do some crazy Unicode fuckery to pull that off?

Nope, Inspect Element + set maxlength="255" and now Twitter thinks my gender is the EICAR test file. Wonderful!

Which means: If someone downloads my Twitter data without my consent onto a workstation running antivirus software, the file will delete itself and all will be right in the marketing world.

https://twitter.com/SoatokDhole/status/1254635753319079937

(Okay but seriously, a lot of downstream systemic failures would have to exist for any damage to occur from me deciding to self-identify to marketers this way.)

Lessons to Learn

Twitter enforced a maxlength of 30 in the HTML element of the “Add your gender” text input, but they didn’t enforce this requirement server-side. The takeaway here is pretty obvious.

Also, don’t try to automatically[b] guess people’s gender at scale[/b]. It’s insulting when you get it wrong, and it’s creepy when you get it right.

(This sticker is tongue-in-cheek.)

What’s the Upper Limit for the Field?

I don’t know, but this indicates it has a larger upper bound than a tweet.

https://twitter.com/txlon5/status/1254648412261228545

If anyone has success dropping an entire thesis on gender identity and culture in the Gender field, let me know.

Update: The Best Genders

Everyone is having a lot of fun with the Gender field. Here’s some of the best tweets I’ve seen since publishing this stupid bug.

https://twitter.com/TecraFox/status/1254653500887310337

https://twitter.com/everlasting1der/status/1254652388713082880

https://twitter.com/hedgehog_emoji/status/1254650551473594368

https://twitter.com/Neybulot/status/1254659048886210563

A fox in Furry Technologists suggested building genderfs, which is a lot like redditfs but hoists the entire filesystem into the Gender field.

While I have your attention, trans rights are human rights and biology disagrees with the simple notion of “two sexes”. Thank you and good night.

https://soatok.blog/2020/04/27/why-server-side-input-validation-matters/

#furry #infosec #inputValidation #LGBTQIA_ #security #softwareDevelopment #Twitter

Dhole Moments

2020-04-27 05:22:30

Update (2020-04-29): Twitter has fixed their oversight.

{ "errors": [{ "code": 356, "message": "preferences.gender_preferences.gender_override: Must provide a non-empty custom value 30 characters or less in length." }]}

Anyone who set their custom gender to a long volume of text, should still have it set to a long volume of text.

The original article follows after the separator.

---

I was recently made aware of a change to Twitter, which exposes a new Gender field. If you’ve never specified your gender before, they guessed what it was (which is a really shitty thing to do, especially towards trans folks!).

https://twitter.com/leemandelo/status/1254179716451438592

Slightly annoyed, I went to go see what Twitter thinks my gender is.

Curses! They know I’m a guy. This won’t do at all.

But what’s this? An “Add your gender” option?

That’s at least, something, I guess? Defaulting to [whatever the algorithm guesses] is sucky, but at least nonbinary folks can still self-identify however they want.

But 30 characters isn’t a lot. What if I want to drop in, say, 68 characters? Do I need to do some crazy Unicode fuckery to pull that off?

Nope, Inspect Element + set maxlength="255" and now Twitter thinks my gender is the EICAR test file. Wonderful!

Which means: If someone downloads my Twitter data without my consent onto a workstation running antivirus software, the file will delete itself and all will be right in the marketing world.

https://twitter.com/SoatokDhole/status/1254635753319079937

(Okay but seriously, a lot of downstream systemic failures would have to exist for any damage to occur from me deciding to self-identify to marketers this way.)

Lessons to Learn

Twitter enforced a maxlength of 30 in the HTML element of the “Add your gender” text input, but they didn’t enforce this requirement server-side. The takeaway here is pretty obvious.

Also, don’t try to automatically[b] guess people’s gender at scale[/b]. It’s insulting when you get it wrong, and it’s creepy when you get it right.

(This sticker is tongue-in-cheek.)

What’s the Upper Limit for the Field?

I don’t know, but this indicates it has a larger upper bound than a tweet.

https://twitter.com/txlon5/status/1254648412261228545

If anyone has success dropping an entire thesis on gender identity and culture in the Gender field, let me know.

Update: The Best Genders

Everyone is having a lot of fun with the Gender field. Here’s some of the best tweets I’ve seen since publishing this stupid bug.

https://twitter.com/TecraFox/status/1254653500887310337

https://twitter.com/everlasting1der/status/1254652388713082880

https://twitter.com/hedgehog_emoji/status/1254650551473594368

https://twitter.com/Neybulot/status/1254659048886210563

A fox in Furry Technologists suggested building genderfs, which is a lot like redditfs but hoists the entire filesystem into the Gender field.

While I have your attention, trans rights are human rights and biology disagrees with the simple notion of “two sexes”. Thank you and good night.

https://soatok.blog/2020/04/27/why-server-side-input-validation-matters/

#furry #infosec #inputValidation #LGBTQIA_ #security #softwareDevelopment #Twitter

So I've been writing #Rust code for roughly 4-8 hours a day for a contract I'm working on. It has _massively_ increased my understanding and fluency of the language. I am far from an expert, but I've gone from a relative novice to a fairly competent Rust developer in a pretty short period of time. Here are some things I've learned:

- Yes you will wrestle with the compiler. Some of the things you wrestle over seem silly/unnecessary/annoying. What you'll realize, though, as you reason with the compiler is that what you're wrestling with your compiler over is an incredibly important issue. For example, you'll run into issues where you find yourself constantly .clone()'ing a struct. If that struct contains 3 vectors that contain a shit ton of data, every time you clone that struct... you're cloning all of the underlying data. You're going to find yourself eating up RAM for no reason. So when your compiler complains telling you that you need to clone... you should probably look into your implementation.

- Yes, multi-threaded/concurrent Rust is _hard_. This is because multi-threaded/concurrent approaches _should be hard_ because you're talking about tossing a ton of CPU power against a complicated problem set, very fast. Sharing memory resources between threads _should be complicated_, because if the interface is simple, you're probably going to footgun yourself somewhere.

- Rust makes you think about your implementations far more than you otherwise would. Should your function work on the object, or a pointer to an object? This matters. Should that field be public? Should it be mutable? Are you trying to work on an iterator? Should you expect the result of a function to always be the type you expect it to be (so you can just .unwrap()) or should you do error handling? These are problems you _should_ have to think about.

In all, what you realize after writing a lot of Rust is that the compiler is complex for a reason, and your wrestling with it can be incredibly productive, not just as a Rust dev but as an engineer in general.

#softwaredevelopment #softwareengineering #Rust #Rustlang #computerscience