#its all about transactions

[pezberrypolls]

[carnivalcarriondiscarded]

sorry im coping with aus again oopsie daisy. anyway here's my take on a fantasy au

it all started with me rewatching the D&D movie and thinking "hm. what (broad) classes would the neighbors have?"

and after much thinking i came to the conclusion: Barnaby = Bard / Eddie = Paladin / Sally = Sorcerer / Julie = fighter / Frank = monk / Howdy = Artificer / Poppy = Healer / Wally = 'Wizard'

those seem fitting! BUT i don't like restrictions or rules so in this very light worldbuilding for a casual (strongly glaring at myself here) CASUAL au, it's only dnd-esque. not actually dnd yk yk

in my head, they're not technically puppets for this au. they're flesh and blood, they've got bones, etc. they're actual Creatures, though they still look like Them! Julie's still pink w/ candy-corn-horns! Frank is still a gray tube! Barnaby is a big blue dog! they're just... not puppets. it's the same for the other beings in this fantasy world - they all keep the style, but they're all flesh n' blood if that makes sense. a cartoony fantasy world

so they have their little found family adventuring group titled, of course, The Neighborhood. because when they were first forming, Wally went "oh! are we a neighborhood? i've always wanted neighbors!" and it Stuck. so they all lovingly refer to each other as neighbors, even though the closest they get to being actual neighbors is pitching their tents next to each other & staying at an Inn in neighboring rooms

like your classic group of adventurers, they're almost constantly on the move. the longest they stay in one place is a couple of months - the rest of the time they're wandering! they take quests, get roped into general Shenanigans, etc. they adventure! and get into a lot of battles of varying severity

so Barnaby is still kiiiiind of a bard? best i can describe him is jack-of-all-trades moral support! he provides battle music, keeps the mood light, and stands off to the side to offer quips and tips. he prefers not to fight, and only Gets Involved when the others need Backup. even then, he usually takes the role of defending his neighbors. he has a good eye for whether or not physical support is needed - he never needs to be asked when there's a legitimate need for him! unless he's thoroughly distracted from the goings-on. he does have magic, but it's more for show / defense-based

Eddie's still pretty classically a paladin. healing powers, armor, there to be on the front lines and Protect! the group's sword and shield! he technically serves a god but he forgot who <3 he just makes the occasional general offering and mumbles some vague prayer. he's super friendly! super helpful! super willing to dive into the line of fire! Will disregard his own safety without a second thought! his magic is pretty much restricted to healing, and it's weak healing at that (maybe because he can't properly serve his god...), so it's mostly good for quick mid-battle heals and little wounds. temporary fixes!

Sally has innate fire/light magic, and she's very showy with it! she puts Flair and Pizazz into all of her casts and is very dramatic on the battlefield - she manages to turn her fights into a performance. She tag-teams keeping the Neighborhood entertained with Barnaby. he handles the humor/lightheartedness, she handles the escapism/encouragement. she writes scripts & stories in her off-time, and often reads them (or spins a new one) after dinner. when they have weeks / month breaks in one spot, sometimes she'll recruit local thespians to create a play

Frank is all about that hand-to-hand combat babey! he wants to feel bones break under his fists! he wants those split knuckles! he very often starts fights, and even more often finishes them - what he lacks in raw power he makes up for in vicious tenacity. he just Keeps On Going! he seconds as the group's Knowledge Guy. while his hobby is studying insects, he also catalogues/studies monsters and enemies and terrain so that the Neighborhood can always be prepared. the only time he stays out of fights is when he's researching or note-taking. he tries to micromanage the battle from afar anyway

Julie is like... put a druid, a fighter, and a barbarian in a blender. she's got a big sword! she's got seemingly endless energy in battle! she can talk to plants, especially flowers! her flora magic is very minor, so it's not like she's making giant roots burst out of the ground and strangle people. but plants can give her information, and if she asks nicely and they feel like it, sometimes they'll help her out. in battle she's a force to be reckoned with! nothing will stop her and her sword! she's usually the second (closely following Frank, with Eddie hot on her heels) Neighbor charging into battle - but she's the one with the stellar war cry! & where Sally and Barnaby tend to the Neighborhood's emotional wellbeing & entertainment, Julie keeps things fresh with Physical Activities during their downtime!

Poppy is a powerful healer! she draws on an individual's energy (often taps into her own as well) to convert it into healing power. it's draining but it's damn good healing! she also takes the role of the Neighborhood's cook (the others still like to help, especially Frank who is essentially her sous-chef) and makes sure they're all healthy. she hangs back during battles, waiting to (and hoping that she doesn't have to) heal a wounded Neighbor. if one of them is badly hit, she forces herself to run into battle and drag them to safety before working on their injury. she has a tiny bit of illusion magic, which she'll cast from afar to assist her Neighbors. she tries not to use it outside of emergencies - it takes a lot of energy, which she tries to conserve just in case.

Howdy has Zero Magic! none! four hands and none of them are magical! however, he's a damn good inventor & a whiz at potion making. he can Use magical items like there's no tomorrow - he just can't wield it himself. he supplies the group with potions, helpful items, all sorts of goodies - given that they can trade for it with anything he'd accept in-canon. the only exception is when they're mid-battle - he hands stuff out when needed without haggle. he supplies the group with their cash when they're not getting it from looting/quests - he has a magic backpack that can unfold into a fully-stocked merchant stall! he sells at towns, on the road, anywhere he can! In battle he hangs back with Poppy and, yes, supplies items, but he also uses ranged attacks - magical weapons that cast for him, magic 'bombs', that sort of thing! but there's a little secret - he's the Neighborhood's secret weapon. he invented fantasy guns! four magic revolvers that, when the 'second safety' is turned off, multiply into a giant clusterfuck of guns (with ammo ranging from magic 'bullets' to essentially rocket launchers). unfortunately he can only use this setting once & for a limited time before the guns overload & have to be manually repaired. so he either uses them off of the first safety (i.e, they're 'normal'), or not at all. you know shit is Really hitting the fan when he joins a fight

and Wally! Wally Wally Wally... you may have noticed that i put his class 'wizard' in quotes. that's because he says he's a wizard, but he's not! he just says he's one due to the automatic stigma and fear of what he really is - a Warlock! his patron is Home, an eldritch horror that many would classify as a demon. they have a very special, codependent pact that neither of them can live without - Wally wears their 'seal' as a house-shaped pendant on a choker (necklace) hidden under his clothes. Home is extraordinarily powerful, but Wally barely taps into that power. he has a grimoire that Home inscribed with a bunch of sigils that convert into spells when drawn & then cast in the air. the only other powers he uses are seeing-in-the-dark, seeing-magic, and opening teleportation doors! Wally can't sleep, but he can doze - though he's never fully unaware of his surroundings (its kind of like how dolphins only sleep with one half of their brain). he still eats with his eyes, which both feeds him & acts as a form of providing daily energy to Home, since Home can't exactly consume souls every day. If Wally uses too much magic, he has to rest inside of Home's house-form, which is the only time he actually fully sleeps. no one knows about Home, or that Wally is lying about his wizard status.

Home is a lovecraftian being with three forms. the first is the lowest power level - a cute one-room house with Eyes! i.e: Home Classic! Wally's pendant unfolds into it, and it's the main way Wally and Home physically interact & communicate. the second is possession - if Wally explicitly allows it, Home can completely take over his body and kind of 'tuck him away' to have a nice deep nap while Home takes the reins (Home can technically force this, but it's very difficult and would not go over well w/ Wally - it would also be an unstable possession). the third is Home's true form - a massive shadowy eldritch monster made of writhing darkness and nightmares that no one in their right mind would look at, let alone fight. Home has very complicated feelings about Wally & the Neighborhood. they are also, quite literally, Wally's heart - which is part of their pact.

i have some scene ideas & little Plot Concepts (most notably the times the Neighborhood learns two Very Big Secrets about Wally, one of which being the warlock/Home reveal).

but yeah that's moooostly it. basic stuff yk, not very in depth! just fun things to feed my maladaptive daydreaming & escapism

[captain-squid-knuckles]

Damn the future sucks, they made ordering takeaway soo frustrating im just not gonna bother

[ghoul-haunted]

like, this exchange isn't going to make the cut because I had to can this whole sub plot, but I get to write it for myself. for me. as a present. a little treat.

[welcometoteyvat]

read baizhu’s stories. he wins for most balanced character of all time

[love-has-a-way-ofgrowingbackward]

anyone else deeply uncomfortable about how most (generally straight) people treat having a girlfriend as something you can 'get'. like a girl is a thing you can own like you can 'get a girl'

[005mins]

/ those of u guys who write s.ervants or have f.ate s.ervant verses, would u let d.aybit be ur muses' m.aster-

[hassianlovebot]

it's actually so weird that people are treating palia like a fully released game,,, like obviously there are complaints about bugs and stuff but i saw someone complain about there being no real endgame and it's like,, yeah.. because it's still in beta... they haven't added it yet... hello?

[bicon-crange]

update on my horrendous situation btw: it is still ongoing and at this point i am considering self sabotage

[butchyena]

something i think way too much about cosplays is about how the costume interacts with the world. how do the parts that hang move in the wind or sound when they touch. what scents would that character wear. how will it feel to stand next to me for a photo or interact with me to exchange compliments. im thinking about the perfumes i hand crafted and the materials ive picked for a nice noise or the parts i made soft for a hug. hm.

[leatherbookmark]

all this time i've been covering my ears going LALALALALA pretending that ~virtual idols~ don't exist and this is what you do to me? and hongjoong and yunho? please never fucking do that again it's an insult to them and real life actual human idols in general

[ironmanstan]

so tired of seeing peoples stupid posts on my dash i dont feel like injecting this with a moral argument this aspect just fucking annoys me but anyway buying blue checkmark is a false equivalence to a tangible object theres a very easy to acknowledge difference between donating to ao3 2.0 and buying like a toy lol take that as you will but dont act like its not the truth

[subconsciousmysteries]

Competency Triad

[roast ahead be warned]

a big part of Competency in enneagram terms is wanting to be recognized for your Competency. There's a reason the center of competency is 3, also the center of the Image Triad. and the other two Competency types (1 and 5) are connected to the Image Triad.

all individuals are competent in our own ways. Even retarded 479 arteests. but what really makes you an enneagram Competency Type is identifying with this competency and seeing it as a part of your ego, and therefore expecting other people to value it in you if they wish to connect with you. Feeling like "who even am I without my Competency? What else can I be seen for and loved for if not my unique skills and talents?" to the point where the notion that you can be someone without your Competency, is scary and anger-inducing.

Beneath every Competency Type is a sense that they are inherently less loveable and inherently less valuable than others, so they need to overcompensate with all of these skills. Believing in Competency is a way of levelling the playing field when you feel inferior.

even 5s, those mega introverts who claim they don't care about the world, are Competency types because they are trying to find something niche that they can emerge from the shadows with and use to force the world into caring (5 -> 8). 5s need to be seen for their Competency; they feel like if you don't value their Competency to the same extent they do, then you have rejected them as a person. lmao this is why you get 5 men who think its intimacy when they buy me with their money and get angry @ me for saying "I'd love you even if you were broke". these 5s don't see that they are not their money. their money / possessions is their Competency thing that they have confused with their ego. When I tell them that these things aren't so important to me, they feel personally rejected.

The idea of being loved simply for existing as a pretty angel who rolled out of bed being perfect for their beloved is the dream of Optimist types -- in fact, Optimist types won't settle for any less. and it is lowkey the dream of Reactive types too, shown by how Reactive types are always grumbling "the world is too cruel for a love like this to exist :(".

but it seems to make Competency types REEEEEEEEEEEE to hear that someone might love you for you, instead of loving you in this "you are the sum of your parts" way. It threatens them to be exposed to this reality because in their brains, "I AM MY WORK." this worldview that love can be earned with Competency, is a farce that exists to cover their underlying sense of being inherently less loveable than others. When you feel like you started at a fatal disadvantage, the idea that life is a game or a competition and you can earn your way to love, is comforting. And the idea that love is something inherent, either given or not given and no amount of Competency can change that, is very scary.

[woahajimes]

stoppp a costumer snitched on me wtf

[supatroopa]

I try not to be a hater because I like have some moral objections and whatever to haterism and also I just don’t really enjoy being a hater but actually try not to have the worst possible misinterpretation of Sisyphus challenge (impossible).

Like you guys know it’s an eternal punishment for trying to cheat death and live forever right? And that the punishment is endless toiling for an impossible task right because death is an inevitability? Not just some guy pushing up a rock?

For the record I think the “one must imagine Sisyphus happy” thing isn’t included in this it is an intentional reimagining and utilization of the myth for a purpose (which is the purpose of myth and fables and whatnot, I do have some grievances but like that’s all me). I mean like people saying Sisyphus can or has or will get the boulder up the hill the point of it is he can’t or that like it isn’t meant as a punishment.

Like it’s a cool story and like yes yes yes use and examine the story and retell it and resuit it to what you want to say but like know what you’re talking about please I will cry

[mostlysignssomeportents]

How I got scammed

If you'd like an essay-formatted version of this post to read or share, here's a link to it on pluralistic.net, my surveillance-free, ad-free, tracker-free blog:

https://pluralistic.net/2024/02/05/cyber-dunning-kruger/#swiss-cheese-security

I wuz robbed.

More specifically, I was tricked by a phone-phisher pretending to be from my bank, and he convinced me to hand over my credit-card number, then did $8,000+ worth of fraud with it before I figured out what happened. And then he tried to do it again, a week later!

Here's what happened. Over the Christmas holiday, I traveled to New Orleans. The day we landed, I hit a Chase ATM in the French Quarter for some cash, but the machine declined the transaction. Later in the day, we passed a little credit-union's ATM and I used that one instead (I bank with a one-branch credit union and generally there's no fee to use another CU's ATM).

A couple days later, I got a call from my credit union. It was a weekend, during the holiday, and the guy who called was obviously working for my little CU's after-hours fraud contractor. I'd dealt with these folks before – they service a ton of little credit unions, and generally the call quality isn't great and the staff will often make mistakes like mispronouncing my credit union's name.

That's what happened here – the guy was on a terrible VOIP line and I had to ask him to readjust his mic before I could even understand him. He mispronounced my bank's name and then asked if I'd attempted to spend $1,000 at an Apple Store in NYC that day. No, I said, and groaned inwardly. What a pain in the ass. Obviously, I'd had my ATM card skimmed – either at the Chase ATM (maybe that was why the transaction failed), or at the other credit union's ATM (it had been a very cheap looking system).

I told the guy to block my card and we started going through the tedious business of running through recent transactions, verifying my identity, and so on. It dragged on and on. These were my last hours in New Orleans, and I'd left my family at home and gone out to see some of the pre-Mardi Gras krewe celebrations and get a muffalata, and I could tell that I was going to run out of time before I finished talking to this guy.

"Look," I said, "you've got all my details, you've frozen the card. I gotta go home and meet my family and head to the airport. I'll call you back on the after-hours number once I'm through security, all right?"

He was frustrated, but that was his problem. I hung up, got my sandwich, went to the airport, and we checked in. It was total chaos: an Alaska Air 737 Max had just lost its door-plug in mid-air and every Max in every airline's fleet had been grounded, so the check in was crammed with people trying to rebook. We got through to the gate and I sat down to call the CU's after-hours line. The person on the other end told me that she could only handle lost and stolen cards, not fraud, and given that I'd already frozen the card, I should just drop by the branch on Monday to get a new card.

We flew home, and later the next day, I logged into my account and made a list of all the fraudulent transactions and printed them out, and on Monday morning, I drove to the bank to deal with all the paperwork. The folks at the CU were even more pissed than I was. The fraud that run up to more than $8,000, and if Visa refused to take it out of the merchants where the card had been used, my little credit union would have to eat the loss.

I agreed and commiserated. I also pointed out that their outsource, after-hours fraud center bore some blame here: I'd canceled the card on Saturday but most of the fraud had taken place on Sunday. Something had gone wrong.

One cool thing about banking at a tiny credit-union is that you end up talking to people who have actual authority, responsibility and agency. It turned out the the woman who was processing my fraud paperwork was a VP, and she decided to look into it. A few minutes later she came back and told me that the fraud center had no record of having called me on Saturday.

"That was the fraudster," she said.

Oh, shit. I frantically rewound my conversation, trying to figure out if this could possibly be true. I hadn't given him anything apart from some very anodyne info, like what city I live in (which is in my Wikipedia entry), my date of birth (ditto), and the last four digits of my card.

Wait a sec.

He hadn't asked for the last four digits. He'd asked for the last seven digits. At the time, I'd found that very frustrating, but now – "The first nine digits are the same for every card you issue, right?" I asked the VP.

I'd given him my entire card number.

Goddammit.

The thing is, I know a lot about fraud. I'm writing an entire series of novels about this kind of scam:

https://us.macmillan.com/books/9781250865878/thebezzle

And most summers, I go to Defcon, and I always go to the "social engineering" competitions where an audience listens as a hacker in a soundproof booth cold-calls merchants (with the owner's permission) and tries to con whoever answers the phone into giving up important information.

But I'd been conned.

Now look, I knew I could be conned. I'd been conned before, 13 years ago, by a Twitter worm that successfully phished out of my password via DM:

https://locusmag.com/2010/05/cory-doctorow-persistence-pays-parasites/

That scam had required a miracle of timing. It started the day before, when I'd reset my phone to factory defaults and reinstalled all my apps. That same day, I'd published two big online features that a lot of people were talking about. The next morning, we were late getting out of the house, so by the time my wife and I dropped the kid at daycare and went to the coffee shop, it had a long line. Rather than wait in line with me, my wife sat down to read a newspaper, and so I pulled out my phone and found a Twitter DM from a friend asking "is this you?" with a URL.

Assuming this was something to do with those articles I'd published the day before, I clicked the link and got prompted for my Twitter login again. This had been happening all day because I'd done that mobile reinstall the day before and all my stored passwords had been wiped. I entered it but the page timed out. By that time, the coffees were ready. We sat and chatted for a bit, then went our own ways.

I was on my way to the office when I checked my phone again. I had a whole string of DMs from other friends. Each one read "is this you?" and had a URL.

Oh, shit, I'd been phished.

If I hadn't reinstalled my mobile OS the day before. If I hadn't published a pair of big articles the day before. If we hadn't been late getting out the door. If we had been a little more late getting out the door (so that I'd have seen the multiple DMs, which would have tipped me off).

There's a name for this in security circles: "Swiss-cheese security." Imagine multiple slices of Swiss cheese all stacked up, the holes in one slice blocked by the slice below it. All the slices move around and every now and again, a hole opens up that goes all the way through the stack. Zap!

The fraudster who tricked me out of my credit card number had Swiss cheese security on his side. Yes, he spoofed my bank's caller ID, but that wouldn't have been enough to fool me if I hadn't been on vacation, having just used a pair of dodgy ATMs, in a hurry and distracted. If the 737 Max disaster hadn't happened that day and I'd had more time at the gate, I'd have called my bank back. If my bank didn't use a slightly crappy outsource/out-of-hours fraud center that I'd already had sub-par experiences with. If, if, if.

The next Friday night, at 5:30PM, the fraudster called me back, pretending to be the bank's after-hours center. He told me my card had been compromised again. But: I hadn't removed my card from my wallet since I'd had it replaced. Also, it was half an hour after the bank closed for the long weekend, a very fraud-friendly time. And when I told him I'd call him back and asked for the after-hours fraud number, he got very threatening and warned me that because I'd now been notified about the fraud that any losses the bank suffered after I hung up the phone without completing the fraud protocol would be billed to me. I hung up on him. He called me back immediately. I hung up on him again and put my phone into do-not-disturb.

The following Tuesday, I called my bank and spoke to their head of risk-management. I went through everything I'd figured out about the fraudsters, and she told me that credit unions across America were being hit by this scam, by fraudsters who somehow knew CU customers' phone numbers and names, and which CU they banked at. This was key: my phone number is a reasonably well-kept secret. You can get it by spending money with Equifax or another nonconsensual doxing giant, but you can't just google it or get it at any of the free services. The fact that the fraudsters knew where I banked, knew my name, and had my phone number had really caused me to let down my guard.

The risk management person and I talked about how the credit union could mitigate this attack: for example, by better-training the after-hours card-loss staff to be on the alert for calls from people who had been contacted about supposed card fraud. We also went through the confusing phone-menu that had funneled me to the wrong department when I called in, and worked through alternate wording for the menu system that would be clearer (this is the best part about banking with a small CU – you can talk directly to the responsible person and have a productive discussion!). I even convinced her to buy a ticket to next summer's Defcon to attend the social engineering competitions.

There's a leak somewhere in the CU systems' supply chain. Maybe it's Zelle, or the small number of corresponding banks that CUs rely on for SWIFT transaction forwarding. Maybe it's even those after-hours fraud/card-loss centers. But all across the USA, CU customers are getting calls with spoofed caller IDs from fraudsters who know their registered phone numbers and where they bank.

I've been mulling this over for most of a month now, and one thing has really been eating at me: the way that AI is going to make this kind of problem much worse.

Not because AI is going to commit fraud, though.

One of the truest things I know about AI is: "we're nowhere near a place where bots can steal your job, we're certainly at the point where your boss can be suckered into firing you and replacing you with a bot that fails at doing your job":

https://pluralistic.net/2024/01/15/passive-income-brainworms/#four-hour-work-week

I trusted this fraudster specifically because I knew that the outsource, out-of-hours contractors my bank uses have crummy headsets, don't know how to pronounce my bank's name, and have long-ass, tedious, and pointless standardized questionnaires they run through when taking fraud reports. All of this created cover for the fraudster, whose plausibility was enhanced by the rough edges in his pitch - they didn't raise red flags.

As this kind of fraud reporting and fraud contacting is increasingly outsourced to AI, bank customers will be conditioned to dealing with semi-automated systems that make stupid mistakes, force you to repeat yourself, ask you questions they should already know the answers to, and so on. In other words, AI will groom bank customers to be phishing victims.

This is a mistake the finance sector keeps making. 15 years ago, Ben Laurie excoriated the UK banks for their "Verified By Visa" system, which validated credit card transactions by taking users to a third party site and requiring them to re-enter parts of their password there:

https://web.archive.org/web/20090331094020/http://www.links.org/?p=591

This is exactly how a phishing attack works. As Laurie pointed out, this was the banks training their customers to be phished.

I came close to getting phished again today, as it happens. I got back from Berlin on Friday and my suitcase was damaged in transit. I've been dealing with the airline, which means I've really been dealing with their third-party, outsource luggage-damage service. They have a terrible website, their emails are incoherent, and they officiously demand the same information over and over again.

This morning, I got a scam email asking me for more information to complete my damaged luggage claim. It was a terrible email, from a noreply@ email address, and it was vague, officious, and dishearteningly bureaucratic. For just a moment, my finger hovered over the phishing link, and then I looked a little closer.

On any other day, it wouldn't have had a chance. Today – right after I had my luggage wrecked, while I'm still jetlagged, and after days of dealing with my airline's terrible outsource partner – it almost worked.

So much fraud is a Swiss-cheese attack, and while companies can't close all the holes, they can stop creating new ones.

Meanwhile, I'll continue to post about it whenever I get scammed. I find the inner workings of scams to be fascinating, and it's also important to remind people that everyone is vulnerable sometimes, and scammers are willing to try endless variations until an attack lands at just the right place, at just the right time, in just the right way. If you think you can't get scammed, that makes you especially vulnerable:

https://pluralistic.net/2023/02/24/passive-income/#swiss-cheese-security

Image: Cryteria (modified) https://commons.wikimedia.org/wiki/File:HAL9000.svg

CC BY 3.0 https://creativecommons.org/licenses/by/3.0/deed.en