120391583

If you can order the ice cream and take possession of it before paying, you've incurred a debt. At that point, the store must be willing to accept cash (or forgive the debt altogether). End result: you've got ice cream.

If you order the ice cream but don't take possession of it until you pay, the store is free to reject your cash payment and not give you the ice cream. End result: no ice cream. If this occurs frequently enough, the waste from the store having to prepare and throw out ice cream might prompt them to change their policy, but that's not an immediate solution.

Some anti-cheats like BattlEye try to detect if they're running in a VM.

Right, but if you've taken possession, you've definitely incurred a debt. If they've scooped the ice cream but haven't handed it to you, while there may technically be a debt at that point, I expect most stores would just throw the ice cream out if you insisted on paying with a payment method they don't accept.

It's a very real and terrifying threat. A standard PC has numerous components with their own firmware that can potentially be flashed. Some of those components may have integrity checking schemes that are supposed to ensure only vendor-signed code can be flashed or executed, but don't rely on those measures actually working as intended (and not being exploitable themselves). Hardware vendors are notoriously bad at this.

This is one of the reasons I'm so enthusiastic about the T2 and M1: a hardware root of trust designed by a competent vendor. (Yes, there is a flaw in the T2, but it requires physical access to exploit.) In my opinion, those are the only trustworthy desktops or laptops on the market right now. You'll notice AWS (Nitro) and Google (Titan) also have their own proprietary hardware security chips for the same reason.

Do they actually give you the ice cream before you pay?

I don't know if that employer has been prosecuted yet, but I don't think it was legal. At minimum, it should qualify as illegal dumping under [GA Code § 16-7-52](https://law.justia.com/codes/georgia/2019/title-16/chapter-7...). [GA Code § 16-7-51](https://law.justia.com/codes/georgia/2019/title-16/chapter-7...) defines "egregious litter" to include "any substance or material dumped for commercial purposes."

> What about the IP address used to communicate with the app’s server?

Yes. I've been wanting Apple to launch a VPN service for a long time.

A commercial VPN service can aid privacy by aggregating thousands of users behind a single IP address. The problem is that you have to trust the VPN provider. Commercial VPN providers are inherently shady -- after all, their entire business model is aiding and abetting copyright infringement or perhaps even worse activities. (No logging, wink wink!) I see no reason to trust them.

By contrast, Apple has a valuable brand (i.e., a reputation) and has made privacy a core part of their sales pitch. Unlike the inherently fly-by-night commercial VPN industry, Apple would have billions of reasons not to betray their customers by selling VPN usage data.

I think there's a market for an existing, known, reputable business to come in and offer a VPN service that explicitly does keep traffic flow logs for a short time, in the same way that ISPs retain dynamic IP assignment logs for a short time. By retaining logs, you avoid the shady elements that are otherwise attracted to no-logging VPN services.

If not Apple, I think one of the few remaining reputable independent ISPs would be a great fit. Sonic.net comes to mind. Sonic makes [clear, explicit claims](https://www.sonic.com/privacy-policy) that they do not sell usage data, but they do retain IP assignment logs for up to 14 days and will provide that data to law enforcement with an appropriate court order. That's exactly what I want: my adversary is P&G and their ilk, not law enforcement with a court order.