Log in
Click here to go see the bonus panel!
Hovertext:
I do check to see what became of the PLiF guys every six months or so.
Today's News:
|
Resident of the world, traveling the road of life
|
Click here to go see the bonus panel!
Today's News:
iPhone: 49.287476,-123.142136
The AI hype in the media obscures the fact that we're clearly in another goddamn venture capital bubble right now.
As the Wall Street Journal said earlier this month (article is paywalled), "... In a presentation earlier this month, the venture-capital firm Sequoia estimated that the AI industry spent $50 billion on the Nvidia chips used to train advanced AI models last year, but brought in only $3 billion in revenue."
On top of that, the industry is running at a loss on power consumption alone, never mind labour costs (which are quite high: those generative LLMs require extensive human curation of the input data they require for training).
So, we've been here before. Most recently with cryptocurrency/blockchain (which is still going on, albeit much less prominently as governments and police go after the most obvious thieves and con men like Sam Bankman Fried).
But there've been other internet-related bubbles before.
I was in on the ground floor of the dot-com boom from 1995-2000, and the hype back then was absolutely bonkers: that may be part of why I'm so thoroughly soured on the current wave of bilge and bullshit. (That, and it's clearly being pumped up by fascist-adjacent straight white males with an unadmitted political agenda, namely to shore up the structures of privilege and entitlement that keep them wealthy.)
The common feature of these bubbles is a shitload of hype and promises from hucksters who fail to deliver a viable product but suck up as much investment capital as they can. A handful of them survive: from dot-com 1.0, the stand-outs are Amazon and Google (Facebook, Twitter, Reddit, et al came along much later—social media was a later, smaller bubble). Other survivors include Paypal, eBay, and Doubleclick (the latter being merged with Google to form a monstrous global advertising monopoly). The survivors tend to leave behind infrastructure: the failures leave behind t-shirts, second hand Aeron chairs, and motivational posters.
If I had more energy I'd be writing a snarky, satirical, 21st century Jetson's style short story right now to highlight the way this plays out. It'd be set in a future where all the dot-com 1.0 hype and promises actually delivered and laid the bedrock of our lives in 2025.
But of course, that's not the story. Instead, the story would explore the unanticipated drawbacks. Starting with "oops, the Amazon drone delivering your neighbour's new dishwasher just fell through your roof; but trades.com only shows you roofers who live in Boston, England, not Boston, MA".
In this shiny dotcom 1.0 future, shoppers always carry their laptop to the supermarket so they can use their CueCat scanner to scan product discount coupon codes off the packaging: they collect the money off vouchers using internet delivered over the supermarket wifi (which blasts them with ads they're forced to click through in return for bandwidth).
The Teledesic satellite network got funded and built out, so you now have 9600 baud global roaming data on your Microsoft Windows CE phone. Which has a fold-out QWERTY keyboard because nobody likes writing on a touch-sensitive screen with a stylus and multitouch was still-born. But your phone calls are secure, thanks to the mandatory built-in Clipper chip.
But Pets dot com just mailed you the third dead and decomposing Rottweiler of the month, instead of the cat food subscription you ordered: the SKUs for Rottie pups and Whiskas are cross-linked in their database, and freight shipping from China takes weeks.
In this gleaming, chromed, Jetsons style future, the Intel Itanium didn't fail, Macs still run on Power architecture, and Microsoft OS/2 4.0 runs everywhere on MIPS, Alpha, and SPARC workstations. Linux is nearly extinct thanks to restrictive embrace-and-extinguish commercial bootloader licensing terms ...
But don't ask about Apple. Oh dear. Oh no. You asked about Apple, didn't you? And why are all those workstations running OS/2?
Solaris never really took over the workstation market; NeXT ate Sun's lunch in the 90s. Today, UNIX research workstations are all featureless black cubes or monoliths and come bundled with Mathematica and FrameMaker. Cheaper RISC-based workstations are all the domain of Microsoft, as are PCs. Apple lives on in a strange twilight: Steve Jobs was unavailable in 1998 (he was tied up buying Oracle), and Apple was not-exactly-saved by buying Be and hiring on Jean-Louis Gassée as their CEO. He staunched the bleeding through strategic alliances, but in the end Gassée had no alternative but to sell Apple to IBM as Big Blue tried to push their Power Architecture down into the realm of business personal computing.
Macintosh® Powerbook™ is all that's left of the glory that was Apple: a range of black plastic PowerPC business laptops sold by Lenovo. Main value proposition: they run COBOL business applications real good. Meanwhile, the UK's Acorn Computers bought what was left of the NewtonOS intellectual property and continues to market the Newton Messagepad series as ruggedized retail and industrial data capture terminals in Europe, using the unique Graffiti text entry system from Palm Computing).
The world of MP3 music players is dominated by Archos. Video is ... well, video as such isn't allowed on the public internet because the MPAA hooked up with the cable TV corporations to force legislation mandating blockers inside all ISPs. Napster does not exist. Bittorrent does not exist. YouTube does not exist. But what passes for video on the internet today is 100% Macromedia Flash, so things could be worse.
So. What survivors from the glorious-future-that-wasn't would you like to memorialize in this shared fictional nightmare?
iPhone: 49.287476,-123.142136
Ach gucke mal, hier ist noch ein bedauerlicher Verrechner bei der AWS-Trafficrechnung. Da hat jemand 3TB Daten übertragen aber Amazon hat 130TB berechnet.
Schau an. Auch dieser Softwarefehler ging zu Gunsten von Amazon, nicht der Kunden. Bemerkenswerte Zufälle gibt es manchmal!
Da willste doch Kunde werden, wa?
iPhone: 49.287476,-123.142136
If you publicly host large data files on AWS S3 and pay for AWS transfer costs, you may be vulnerable to a “Denial of Wallet” amplification attack. Even if you are not hosting data publicly, you may be exposed to a malicious third-party attack or even a programming error, that can cause major costs within a short time frame.
Introduction
Cloud computing enables companies to build fast-scaling applications. This allows for new ways of analyzing data, especially in medicine or bioinformatics. But with the ease of resource scaling up and down, the way of cost control changes significantly for the cloud customers.
By design, resources are scaling in cloud environments, and this results in rising costs at the same time. Having control of the costs is a difficult job. Even though AWS offers its own pricing calculator, it is so difficult that many companies have products to assist in cost control or cost overview, see for example “AWS Costs: Surprise, Surprise? It Shouldn’t Be!”
Because of the large variety of cloud services and their cost models, it is very important for customers that they can rely on certain assumptions. A simple assumption is that downloading of some S3 data (via the Internet) costs an amount of money that is proportional to the amount of data downloaded (see S3 pricing structure). With such an assumption people build software and have some rough idea about the costs a certain service may incur.
Since cloud resources scale so easily, cloud users must take certain precautions to prevent malicious attacks that may incur unintended costs. For example, if you experience a DDoS attack on your specific application, the costs may rise significantly because your cloud resources can be configured to scale according to demand. You need to implement multiple mechanisms to prevent this. Cloud providers even create tools to reduce the attack surface (see here for AWS best practices on this topic).
The Denial of Wallet amplification attack
Here, we will provide a previously unknown example of a potential attack on cloud resources where the assumed costs differ significantly from the real costs. This is about how costs for AWS S3 egress (transfer into the Internet) are calculated. With a very small number of special requests, it is possible to generate costs that differ from the actually downloaded data by a factor of 50. We coined this scenario a “’Denial of Wallet’ Amplification Attack”. It is not an attack against your service but against your wallet.
We publish this information in a blog post because we ourselves were caught unaware of this situation and we feel the need to raise awareness about this issue, as it could be exploited by malicious third parties.
Data sets in health care may be large
In the healthcare industry, many other large companies and organizations use AWS S3 and similar cloud platforms for data storage or processing. For example, there are many public bioinformatics data repositories, also from government agencies, that provide large files on S3 publicly (e. g. NCBI SRA or gnomAD). Even cloud-computing platforms of large sequencing instrument manufacturers are affected. Having cost control of data storage and data transfer is very important if your data volume is increasing that much.
Attack amplifying S3 egress costs
One day we experienced an anomaly of S3 egress costs. We analyzed this anomaly and found that the amount of data actually downloaded did not match the amount on our invoice. With our partners’ help, we reproduced this behavior and identified a minor bug in a bioinformatics library. It was an accident. Unfortunately, this accidental behavior could also have been ‘weaponized’ in an attack.
After contacting the AWS Support we were directed to the following details of the S3 pricing page (highlighting by us):
Data Transfer Out may be different from the data received by your application in case the connection is prematurely terminated by you, for example, if you make a request for a 10 GB object and terminate the connection after receiving the first 2 GB of data. Amazon S3 attempts to stop the streaming of data, but it does not happen instantaneously. In this example, the Data Transfer Out may be 3 GB (1 GB more than 2 GB you received). As a result, you will be billed for 3 GB of Data Transfer Out.
Okay, this is half the explanation. AWS customers are not billed for the data actually transferred to the Internet but instead for some amount of data that is cached internally.
The main problem is the potential difference between the amount of data received by an entity outside of AWS and the amount of data on your bill. In the example above from the AWS documentation, the difference is a factor of 1.5 (2GB sent, 3GB billed). In our real-world example, the difference was almost a factor of 50. This means 3TB sent and 130TB billed. That can make a difference between “we do not care” and “whaaat”?
The extent of the problem
It may be even worse: we were able to reproduce the scenario where we downloaded 300MB of data in 30sec from AWS S3 and were billed for more than 6GB by AWS. If an attacker can induce costs for 6GB in 30sec how much costs can be generated in a day, or on the weekend when running many threads in parallel? Note that AWS S3 is highly available, and you may never reach any bandwidth limits in real-world scenarios. That should scare anyone who hosts large files on a public S3 bucket, because the egress costs can skyrocket in this scenario.
The good news: we only observed this behavior for large files (>1GB), when software clients download them via HTTP(S) RANGE requests. With range requests, the client can request to retrieve a part of a file, but not the entire file. By quickly canceling such requests, a client can request parts of a file without downloading all the data. Due to the way AWS calculates egress costs the transfer of the entire file is billed. There may also be dependencies on access patterns and timing, but we were able to reproduce it across different buckets and files and over several weeks (so this is not a fluke).
This means that everybody who hosts large files on S3 is at risk, especially if these files are publicly accessible.
Potential remedies
Can I prevent this attack?
Do not host large files on S3 if they can be accessed by range requests in a way that you cannot control. If you are relying on hosting large S3 data sets publicly, then you cannot prevent this attack. AWS best practice guidelines recommend restricting data access to S3 buckets.
What does AWS recommend?
We do not exactly know what the recommendation of AWS is for companies relying on hosting data publicly, but we did not find any official documentation that has any recommendations in that regard for files in public S3 buckets.
For example, the “Security best practices for Amazon S3” state:
Unless you explicitly require anyone on the internet to be able to read or write to your S3 bucket, make sure that your S3 bucket is not public.
But AWS does not say anything about those cases where you do need public access (at least we did not find any under the AWS best practices for storage).
By the way: restricting access to your S3 buckets may not prevent you from incurring costs for unauthorized requests as @maciej.pocwierz found out: https://medium.com/@maciej.pocwierz/how-an-empty-s3-bucket-can-make-your-aws-bill-explode-934a383cb8b1.
Are there workarounds to mitigate the attack?
Yes. As the first and most important step you should create cost alerts. We suggest to activate AWS Cost Anomaly Detection. When activating this tool and configuring it correctly you will be informed about abnormal billing events. At least in our case, this helped us to identify such an adverse event after a short time frame limiting its financial impact.
Sadly, preventing such an attack is no easy task because of the design of AWS S3. The service is designed to serve large amounts of data as fast as possible. You could monitor HTTP API requests to your S3 buckets which is possible with a delay of a few hours. If you see an unusually high amount of API requests, you could prohibit access to the resource. But this solution is a brutal last resort, potentially disrupting your service entirely.
So, if I’m not hosting public S3 files I’m safe?
Unfortunately, no, as we observed a similar behavior when serving S3 files via pre-signed URLs, for example.
Acknowledgement
We thank Stephan Drukewitz from the Institute for Human Genetics, Leipzig, for his help in troubleshooting the issue. Also thanks to Martin Garbe and Roland Ewald who substantially researched and authored this article.
We thank the AWS Security team for their feedback on earlier drafts of this post.
iPhone: 49.287476,-123.142136
Today's links
- Live Nation/Ticketmaster is buying Congress: The other gig economy.
- Hey look at this: Delights to delectate.
- This day in history: 2004, 2009, 2014, 2019, 2023
- Upcoming appearances: Where to find me.
- Recent appearances: Where I've been.
- Latest books: You keep readin' em, I'll keep writin' 'em.
- Upcoming books: Like I said, I'll keep writin' 'em.
- Colophon: All the rest.
Live Nation/Ticketmaster is buying Congress (permalink)
Anything that can't go on forever eventually stops. Monopolies are intrinsically destabilizing and inevitably implode…eventually. Guessing which of the loathsome monopolies that make us all miserable will be the first domino is a hard call, but Ticketmaster is definitely high on my list.
It's not that event tickets are the most consequential aspect of our lives. The monopolies over pharma, fuel, finance, tech, and even beer are all more important to our day-to-day. But while Ticketmaster – and its many ramified tentacles, like Live Nation – may not be the most destructive monopoly in our world, its monopoly pisses off people with giant megaphones and armies of rabid fans.
It's been a minute since Ticketmaster was last in the news, so let's recap. Ticketmaster bought out most of its ticketing rivals, then merged with Live Nation, the country's largest concert promoter, and bought out many of the country's largest music, stage, and sports venues. They used this iron grip on the entire supply chain for performances and events to pile innumerable junk fees on every ticket sold, while drastically eroding the wages of the creative workers they nominally represented. They created a secret secondary market for tickets and worked with ticket-touts to help them run bots that bought every ticket within an instant of the opening of ticket sales, then ran an auction marketplace that made them gigantic fees on every re-sold ticket – fees the performers were not entitled to share in.
The Ticketmaster/Live Nation/venue octopus is nearly impossible to escape. Independent venues can't book Live Nation acts unless they use Ticketmaster for their tickets. Acts can't get into the large venues owned by Ticketmaster unless they sign up to have Live Nation book their tour. And when Ticketmaster buys a venue, it creams off the most successful acts, starving competing venues of blockbuster shows. They also illegally colluded with their vendors to jack up the price of concerts across the board:
https://pascrell.house.gov/uploadedfiles/ful.pdf
When Rebecca Giblin and I were writing Chokepoint Capitalism, our book about how tech and entertainment monopolies impoverish all kinds of creative workers, we were able to get insiders to go on record about every kind of monopoly, from the labels to Spotify, Kindle to the Big Five publishers and the Google-Meta ad-tech duopoly. The only exception was Ticketmaster/Live Nation: everyone involved in live performance – performers, bookers, club owners – was palpably terrified about speaking out on the record about the conglomerate:
https://chokepointcapitalism.com/
No wonder. The company has a long and notorious history of using its market power to ruin anyone who challenges it. Remember Pearl Jam?
https://www.rollingstone.com/music/music-news/pearl-jam-taking-on-ticketmaster-67440/
But anything that can't go on forever eventually stops. Not only is Ticketmaster a rapacious, vindictive monopolist – it's also an incompetent monopolist, whose IT systems are optimized for rent-extraction first, with ticket sales as a distant afterthought. This is bad no matter which artist it affects, but when Ticketmaster totally, utterly fucked up Taylor Swift's first post-lockdown tour, they incurred the wrath of the Swifties:
https://www.vox.com/culture/2022/11/21/23471763/taylor-swift-ticketmaster-monopoly
All of which explains why I've always given good odds that Ticketmaster would be first up against the wall come the antitrust revolution. It may not be the most destructive monopolist, but it is absurdly evil, and the people who hate it most passionately are the most famous and beloved artists in the country.
For a while, it looked like I was right. Ticketmaster's colossal Taylor Swift fuckup prompted Senator Amy Klobuchar – a leading antitrust crusader – to hold hearings on the company's conduct, and led to the introduction of a raft of bills to rein in predatory ticketing practices. But as David Dayen writes for The American Prospect, Ticketmaster/Live Nation is spreading a fortune around on the Hill, hiring a deep bench of ex-Congressmen and ex-senior staffers (including Klobuchar's former chief of staff) and they've found a way to create the appearance of justice without having to suffer any consequences for their decades-long campaign of fraud and abuse:
https://prospect.org/power/2024-04-30-live-nation-strikes-up-band-washington/
Dayen opens his article with the White House Correspondents’ Dinner, which is always bracketed by a week's worth of lavish parties for Congress and hill staffers. One of the fanciest of these parties was thrown by Axios – and sponsored by Live Nation, with a performance by Jelly Roll (whose touring contract is owned by Live Nation). Attendees at the Axios/Live Nation event were bombarded with messages about the essential goodness of Live Nation (they were even printed on the cocktail napkins) and exhortations to support the Fans First Act, co-sponsored by Klobuchar and Sen John Cornyn (R-TX):
https://www.nytimes.com/2023/12/08/arts/music/fans-first-act-ticket-bill.html
Ticketmaster/Live Nation loves the Fans First Act, because – unlike other bills – it focuses primarily on the secondary market for tickets, and its main measure is a requirement for ticketing companies to disclose their junk fees upfront. Neither of these represents a major challenge to Ticketmaster/Live Nation's control over the market, which gives it the ability to slash performers' wages while jacking up prices for fans.
Fans First represents the triumph of Ticketmaster/Live Nation's media strategy, which is to blame the entire problem on bottom-feeding ticket-touts (who are mostly scum!) instead of on the single monopoly that controls the entire industry and can't stop committing financial crimes.
Axios isn't Live Nation's only partner in selling this distraction tactic. Over the past five years, the company has flushed gigantic sums of money through Washington. Its lobbying spend rose from $240k in 2018 to $1.1m in 2022, and $2.38m in 2023:
The company has 37 paid lobbyists selling Congress on its behalf. 25 of them are former congressional staffers. Two are former Congressmen: Ed Whitfield (R-KY), a 21 year veteran of the House, and Mark Pryor (D-AR), a two-term senator:
https://www.bhfs.com/people/attorneys/p-s/mark-pryor
But perhaps the most galling celebrant in this lavish hymn to Citizen United is Jonathan Becker, Amy Klobuchar's former chief of staff. Becker jumped ship to lobby Congress on behalf of monopolists like Live Nation, who paid him $120k last year to sell their story to the Hill:
https://www.opensecrets.org/federal-lobbying/clients/lobbyists?cycle=2023&id=D000053134
Not everyone hates Fans First: it's been endorsed by the Nix the Tix coalition, largely on the strength of its regulation of secondary ticket sales. But the largest secondary seller in America by far is Live Nation itself, with a $4.5b market in reselling the tickets it sold in the first place. Fans First shifts focus from this sleazy self-dealing to competitors like Stubhub.
Fans First can be seen as an opening salvo in the long war against Ticketmaster/Live Nation. But compared to more muscular bills – like Klobuchar's stalled-out Unlock Ticketing Markets Act, it's pretty weaksauce. The Unlocking act will "prevent exclusive contracts between ticketing services and venues" – hitting Ticketmaster/Live Nation where it hurts, right in the bank-account:
It's not all gloom. Dayen reports that Ticketmaster's active lobbying in favor of Fans First has made many in Congress more skeptical of the bill, not less. And Congress isn't the only – or even the best – way to smash Ticketmaster's criminal empire. That's something the DoJ's antitrust division could power through with a lot less exposure to the legalized bribery that dominates Congress.
(Image: Matt Biddulph, CC BY-SA 2.0; Flying Logos, CC BY-SA 4.0; modified)
Hey look at this (permalink)
- The Rambo Academy Wayward Wormhole – New Mexico 2024 https://www.kittywumpus.net/blog/the-wayward-wormhole-new-mexico-2024/
-
The Disenshittify Project https://deshittify.us/index.html
-
Whistleblower Laws That Protect Lawbreakers https://prospect.org/infrastructure/transportation/2024-04-30-whistleblower-laws-protect-lawbreakers/
This day in history (permalink)
#20yrsago Charlie Stross’s future-rant https://web.archive.org/web/20040515161445/http://www.antipope.org/charlie/blosxom.cgi/2004/Apr/29
#20yrsago Apple’s new DRM reneges on your purchase conditions, picks your pocket https://web.archive.org/web/20040624182851/http://lawgeek.typepad.com/lawgeek/2004/04/meet_the_new_it.html
#15yrsago Solitary confinement is torture: psych expert https://web.archive.org/web/20090501235955/https://www.wired.com/wiredscience/2009/04/solitaryconfinement/
#15yrsago The Doctor Will Sue You Now: the missing chapter of Ben Goldacre’s “Bad Science” about the selling of vitamin therapy instead of anti-virals to AIDS patients in South Africa https://www.badscience.net/2009/04/matthias-rath-steal-this-chapter/
#10yrsago Rob Ford’s mayoral career considered as a reality TV show – straining suspension of disbelief https://www.theglobeandmail.com/news/toronto/the-ford-show-is-riveting-but-soon-well-stop-believing-it/article18232290/
#10yrsago Email considered harmful https://www.motherjones.com/environment/2014/04/smartphone-addiction-research-work-email/
#10yrsago WIPO sends criminal prosecution threats over publication of internal docs about its Director General’s corruption https://www.techdirt.com/2014/04/28/shameful-wipo-threatens-blogger-with-criminal-charges-accurately-reporting-wipo-directors-alleged-misconduct/
#5yrsago Jimmy Fallon played a video game on air, meaning that streaming your own game gets you taken down as a pirate, thanks to NBC https://old.reddit.com/r/beatsaber/comments/bi9cp5/beat_saber_stream_blocked_by_jimmy_fallon_show/
#5yrsago Thanks to the 2008 foreclosure crisis, a Kuwaiti ponzi schemer was able to single-handedly blight cities across America https://buffalonews.com/news/local/how-a-kuwaitis-ponzi-scheme-left-a-trail-of-blight-in-buffalo/article_7d39e12a-495f-5bba-b7f4-87d07eefa496.html
#5yrsago Uber drivers across America are going on strike https://philly.curbed.com/2019/4/25/18516670/uber-drivers-shutdown-strike-protest-philly
#5yrsago Facebook never delivered its “Clear History” feature https://www.tomsguide.com/us/facebook-privacy-problems,news-29944.html
#1yrago The seductive, science fictional power of spreadsheets https://pluralistic.net/2023/04/29/gedankenexperimentwahn/#high-on-your-own-supply
Upcoming appearances (permalink)
- Canadian Centre for Policy Alternatives (Winnipeg), May 2
https://www.eventbrite.ca/e/cory-doctorow-tickets-798820071337 -
Wordfest (Calgary), May 3
https://wordfest.com/2024/event/wordfest-presents-cory-doctorow-2/ -
Massy Arts (Vancouver), May 4
https://www.eventbrite.ca/e/solo-reading-cory-doctorow-the-bezzle-tickets-876989167207 -
Tartu Prima Vista Literary Festival, May 5-11
https://tartu2024.ee/en/kirjandusfestival/ -
Tim O’Reilly and Cory Doctorow on “Enshittification” and the Future of AI, May 14
https://www.oreilly.com/live-events/tim-oreilly-and-cory-doctorow-on-enshittification-and-the-future-of-ai/0642572001651/ -
"Finding the Money" screening (LA), May 15
https://www.laemmle.com/film/finding-money?date=2024-05-15 -
Media Ecology Association keynote (Amherst, NY), Jun 6-9
https://media-ecology.org/convention -
American Association of Law Libraries keynote (Chicago), Jul 21
https://www.aallnet.org/conference/agenda/keynote-speaker/
Recent appearances (permalink)
- Come sfuggire al “Merdocene” e costruire un Internet migliore (Torino Biennale Tecnologia)
https://www.youtube.com/watch?v=Z5NC2EZCYBg -
Show Me The Money Club (The Rideshare Guy)
https://www.youtube.com/watch?v=ZCETi3XqSds -
NUOVO BARETTO UTOPIA
https://videoteca.kenobit.it/w/azRmQBCenVwjSRz9WCp8JS
Latest books (permalink)
- The Bezzle: a sequel to "Red Team Blues," about prison-tech and other grifts, Tor Books (US), Head of Zeus (UK), February 2024 (the-bezzle.org). Signed, personalized copies at Dark Delicacies (https://www.darkdel.com/store/p3062/Available_Feb_20th%3A_The_Bezzle_HB.html#/).
-
"The Lost Cause:" a solarpunk novel of hope in the climate emergency, Tor Books (US), Head of Zeus (UK), November 2023 (http://lost-cause.org). Signed, personalized copies at Dark Delicacies (https://www.darkdel.com/store/p3007/Pre-Order_Signed_Copies%3A_The_Lost_Cause_HB.html#/)
-
"The Internet Con": A nonfiction book about interoperability and Big Tech (Verso) September 2023 (http://seizethemeansofcomputation.org). Signed copies at Book Soup (https://www.booksoup.com/book/9781804291245).
-
"Red Team Blues": "A grabby, compulsive thriller that will leave you knowing more about how the world works than you did before." Tor Books http://redteamblues.com. Signed copies at Dark Delicacies (US): and Forbidden Planet (UK): https://forbiddenplanet.com/385004-red-team-blues-signed-edition-hardcover/.
-
"Chokepoint Capitalism: How to Beat Big Tech, Tame Big Content, and Get Artists Paid, with Rebecca Giblin", on how to unrig the markets for creative labor, Beacon Press/Scribe 2022 https://chokepointcapitalism.com
-
"Attack Surface": The third Little Brother novel, a standalone technothriller for adults. The Washington Post called it "a political cyberthriller, vigorous, bold and savvy about the limits of revolution and resistance." Order signed, personalized copies from Dark Delicacies https://www.darkdel.com/store/p1840/Available_Now%3A_Attack_Surface.html
-
"How to Destroy Surveillance Capitalism": an anti-monopoly pamphlet analyzing the true harms of surveillance capitalism and proposing a solution. https://onezero.medium.com/how-to-destroy-surveillance-capitalism-8135e6744d59?sk=f6cd10e54e20a07d4c6d0f3ac011af6b) (signed copies: https://www.darkdel.com/store/p2024/Available_Now%3A__How_to_Destroy_Surveillance_Capitalism.html)
-
"Little Brother/Homeland": A reissue omnibus edition with a new introduction by Edward Snowden: https://us.macmillan.com/books/9781250774583; personalized/signed copies here: https://www.darkdel.com/store/p1750/July%3A__Little_Brother_%26_Homeland.html
-
"Poesy the Monster Slayer" a picture book about monsters, bedtime, gender, and kicking ass. Order here: https://us.macmillan.com/books/9781626723627. Get a personalized, signed copy here: https://www.darkdel.com/store/p2682/Corey_Doctorow%3A_Poesy_the_Monster_Slayer_HB.html#/.
Upcoming books (permalink)
- Picks and Shovels: a sequel to "Red Team Blues," about the heroic era of the PC, Tor Books, February 2025
-
Unauthorized Bread: a graphic novel adapted from my novella about refugees, toasters and DRM, FirstSecond, 2025
Colophon (permalink)
Today's top sources:
Currently writing:
- A Little Brother short story about DIY insulin PLANNING
-
Picks and Shovels, a Martin Hench noir thriller about the heroic era of the PC. FORTHCOMING TOR BOOKS JAN 2025
-
Vigilant, Little Brother short story about remote invigilation. FORTHCOMING ON TOR.COM
-
Spill, a Little Brother short story about pipeline protests. FORTHCOMING ON TOR.COM
Latest podcast: Precaratize Bosses https://craphound.com/news/2024/04/28/precaratize-bosses/
This work – excluding any serialized fiction – is licensed under a Creative Commons Attribution 4.0 license. That means you can use it any way you like, including commercially, provided that you attribute it to me, Cory Doctorow, and include a link to pluralistic.net.
https://creativecommons.org/licenses/by/4.0/
Quotations and images are not included in this license; they are included either under a limitation or exception to copyright, or on the basis of a separate license. Please exercise caution.
How to get Pluralistic:
Blog (no ads, tracking, or data-collection):
Newsletter (no ads, tracking, or data-collection):
https://pluralistic.net/plura-list
Mastodon (no ads, tracking, or data-collection):
Medium (no ads, paywalled):
Twitter (mass-scale, unrestricted, third-party surveillance and advertising):
Tumblr (mass-scale, unrestricted, third-party surveillance and advertising):
https://mostlysignssomeportents.tumblr.com/tagged/pluralistic
"When life gives you SARS, you make sarsaparilla" -Joey "Accordion Guy" DeVilla
iPhone: 49.287476,-123.142136
This is very pretty! But...
- Anything claiming to be Fallout-themed that does not use a CRT is invalid.
- For both the claims of "it's a Faraday cage", and, "because of that it will survive an EMP"... Wow that is very much [citation needed].
Previously, previously, previously, previously, previously, previously, previously, previously, previously, previously.
iPhone: 49.287476,-123.142136
Next Page of Stories