profmonocle

> we will introduce additional controls to ensure that users who genuinely wish to grant an app this extraordinary level of access can only do so

"Extraordinary" is a funny word choice. It was completely ordinary for most of the history of personal computing that any app you ran under your normal user account could see everything you had.

(I'm not saying this is a bad thing. As long as they allow informed users to continue to do whatever they please, I'm all for it.)

The federal renamings of the Gulf of Mexico and Lake Ontario are absolutely dumb culture war moves.

But referring to the US simply as "America" domestically isn't - politicians across the political spectrum do that. If a democratic administration had launched a chatbot, I would be unsurprised to see it called America.gov

Does this actually cause any meaningful confusion?

In English there isn't a singular place called "America". As you mention, there's North/South/Cebtral, and together they're referred to as "the Americas". When someone refers simply "America" with no other qualifier, it's clear what they mean.

(Of course in Spanish "America" refers to the whole thing because North and South America aren't considered separate continents. But they have a different demonym for the US in Spanish)

A federal court, sure. But this was a state court ruling on a state law.

> It operates in Texas if it is serving Texas users.

What do you mean "serves"? Does that just mean not actively blocking users from Texas? Allowing your web site to be accessible regardless of user location is, and always has been, the default way to run a web site. Your assertion would mean that web site operators are beholden to the laws of all jurisdictions on the planet if they don't actively block those users.

Think about what a bad precedent that would be. Some countries criminalize promotion of pro-LGBT+ content. What if those countries suddenly demand extradition of people who run pro-LGBT+ blogs because the web sites are available there?

Also, keep in mind that geolocation isn't actually part of the Internet - it's an overlay that private companies have cobbled together that usually works. But it's not perfect, especially at the subnational level. Many times I've connected to public Wi-Fi and I get an alert that I've signed into something from across the country, because that's where the Wi-Fi provider's IPs are located. Are you sure that every jurisdiction in the world will accept that if gelocation gets it wrong, you're off the hook? Utah has already claimed that companies are responsible for complying with their laws even if the user masks their location with VPN. https://www.privacyguides.org/news/2026/05/11/utah-targets-v...

Replace "climb the social ladder and have power and influence" with "be able to afford a home, have kids, and go on vacation occasionally."

It's become very difficult to have even a middle class lifestyle without a college degree. Obviously a huge percentage of people there don't want to be.

Even if example.com is unsigned, the delegation from .com to example.com will still be signed (including an attestation that example.com is unsigned). So lack of DNSSEC adoption by users of the TLD wouldn't save them here.

It's not like the long-haul fiber not owned by FAANG is a public utility, at least not in most places.

Traffic that goes over "the Internet" traverses some mix of your ISP's fiber, fiber belonging to some other ISP they have a deal with, then fiber belong to some ISP they have a deal with, etc.

All those ISPs are being paid to provide service, they can invest in their own networks.

Possibly naive question, why should Wikimedia do anything at all? Do they have a legal presence in the UK?

If not, why not just say "we aren't a UK based organization so we have no obligations under this law"

Let the UK block Wikipedia.

Assuming that RFC1918 addresses mean "local" network is wrong. It means "private". Many large enterprises use RFC1918 for private, internal web sites.

One internal site I spend hours a day using has a 10.x.x.x IP address. The servers for that site are on the other side of the country and are many network hops away. It's a big company, our corporate network is very very large.

A better definition of "local IP" would be whether the IP is in the same subnet as the client, i.e. look up the client's own IP and subnet mask and determine if a packet to a given IP would need to be routed through the default gateway.

I don't think OP was specifically stating we need to save these specific jobs, rather they were pointing out the interconnected nature of the economy. Less importing hurts the workers in those industries. Taking that further, it will hurt businesses near the ports where the workers may have gotten lunch, etc. etc. etc. That's how recessions look at a microeconomic scale.

I'm fine with this as long as they include the tariff in the listed price.

I'm worried businesses are going to use tariffs as an excuse to have a fake list price, then hit you with massive hidden fees at the point of sale. Some sectors have been doing this for years - "service fees" at restaurants, "regulatory response fees" in the telecom industry, all sorts of nonsense in event ticketing.

Physical goods have mostly been spared this type of fake pricing - aside from sales tax not being included, but that's been universally true in the US forever so everyone is used to it.

Tariffs could be the end of that if businesses see sales plummet. Especially because these scams actually work - the reason restaurants give for not just increasing their menu prices is because higher listed prices drive people away.

> 4Chan's "Not your personal army" mentality vs. the widespread doxxing/"call their place of employment!" witch hunts

That's too generous. "Not your personal army" started because 4chan had a well-earned reputation for harassment - usually raiding other web sites, but often targeting individual people who caught their attention for one reason or another.

The "not your personal army" slogan came about because people who were very aware of this reputation were showing up, hoping to make a web site or person they disliked the next target. That got annoying fast, hence they told those people to go away.

It wasn't a moral stance against target harassment - far from it. It was a stance that the group mind will choose the next target when they feel like it - not because some rando is mad at their ex or something

When the first-gen iPhone was out there was a TIFF vulnerability so bad that you could jailbreak an iPhone just by visiting a specific web site. I remember going to Best Buy and seeing all of the display phones had been jailbroken. (It was easy to tell - this was before the App Store, so having extra app icons on the home screen wasn't normal.)

This was a user-empowering application of the vulnerability. Obviously, a bug that allows root-level arbitrary code execution just by getting the user to load a single image could be used for some pretty bad stuff. (And perhaps was.)

I would also say don't run ghostscript with the same permissions as the web server, especially not if you can just hand it your PDF through stdin and take a PNG through stdout. Sandbox it as much as possible. PDF is a really complex format which means lots of opportunities for buffer overruns and the like. (Edit: Actually, reading through Arch-TK's post above, it sounds like it was much dummer than something like a buffer overrun.)

There are portable SCIFs, basically specially designed trailers, to allow senior staff to communicate securely on the road. It's very likely Vance had one of these nearby.

In the early days of the iPhone, there was a vulnerability that allowed you to jailbreak your phone by visiting a specific web site. IIRC it was some vulnerability in the TIFF handling code. The same vulnerability could have been used to silently install spyware with root level access. No need to break signal's crypto if you can just silently capture screenshots.

It's not hard to imagine some foreign intelligence agency is sitting on some severe zero-day vulnerability, waiting to use it on very high value targets, such as senior administration staff.

Endpoint integrity is also critical. If Apple or Google were compromised, they could silently push an update that replaces the real Signal app with a modified version that forwards everything to an adversary.

Any system where the government doesn't have total control over software deployment will never be viable for handling claasified information.

Treating a proprietary API as a standard is risky - this is a good example of why. From Amazon's point of view there's no reason to keep the S3 SDK backwards compatible with old versions of the S3 service, because they control the S3 service. Once this feature was rolled out in all regions, it was safe to update the SDK to expect it.

Amazon may not be actively hostile to using their SDK with third party services, but they never promised to support that use case.

(disclaimer: I work for AWS but not on the S3 team, I have no non-public knowledge of this and am speaking personally)

Who is this actually for? It seems like most people who need private security need it on an ongoing basis, not just for a one-off thing. Even if the need arises suddenly (i.e. a stalker starts threatening a celebrity), it still seems like someone who needs that would have it arranged via their management / assistant, and wouldn't have any need (or desire) to arrange it themselves.

I actually can see some situations where on-demand private security would be useful. Say you need to retrieve your belongings from your abusive ex-partner's place (and imagine you're on the lease/deed so you have the right to enter without their permission) - having an escort could be useful if the person is violent.

However... situations like that don't seem to be what this app is going for?

> Every booking comes with a motorcade and users get to select the number of Escalades that’ll be joining them as well as the uniforms their hired goons will wear.

It honestly seems like it's for people wanting to LARP as being powerful and important. Which is fine (as long as no one gets hurt), but how big of a market is there for that?

Chrome launched their own root program a couple years ago: https://blog.chromium.org/2022/09/announcing-launch-of-chrom...

And it's worth noting that you can't just ignore this problem if you're using websockets - websockets disconnect sometimes for a variety of reasons. It may be less frequent than a long-polling timeout, but if you don't have some mechanism of detecting that messages weren't ack'd and retransmitting them the next time the user connects, messages will get lost eventually.

The next long-polling request can include a list of the ID(s) returned in the previous request. You keep the messages in the queue until you get the next request ack'ing them.

The problem is people don't really see wage increases and inflation as things that balance each other out. They think of raises as something earned that will improve their lifestyle - when inflation cancels that out, it can feel like you were cheated out of that reward.

Even if you understand intellectually that a pay increase is a cost of living adjustment, that doesn't mean it isn't disheartening to see your new earnings being eaten up by inflation.

> if LLM training involves merely reading a dataset, but it is not strictly necessary to copy, or even store it verbatim to be useful, then does it even fall under copyright protection at all?

Copyright includes the creation of derivative works, not just literally copying the source material.

For instance, imagine I read a novel, then I decide to write my own, unauthorized sequel to it. It's not a literal "copy" of the original material - it's my own original text, but obviously a derivative work of the original material. Under copyright law, that would be infringement - I would be sued if I tried to sell that. (Yes, that means fanfiction is infringing, but most rights holders have wisely decided to look the other way on that, as long as it's non-commercial.)

This is what people who claim AI is infringing are worried about. Not that the AI has a literal copy of the source material in its training data, but that the training data can be used to produce a derivative work.

I could write a (crappy) fanfic of the Lord of the Rings without directly referencing the books/movies. And that doesn't mean I have a complete copy of the books/movies in my head - that isn't how memory works. Until now, creating a derivative work without directly using the source material was something only humans could do. This is completely uncharted legal territory.

Would that matter if the company wants to do business in countries with more restrictive laws?

I.E. if I wrote my own spin-off of a popular book series, which was somehow considered fair use in country A, but considered infringing in country B, the publisher could get it removed from stores in country B.

By the same logic, if AI training is ruled as copyright infringement in the US, it won't matter if the company trains their model somewhere else - if they open a US division to sell service using that model, they'd get sued.

Granted I'm not an IP lawyer and AI IP law is in its infancy - maybe I'm missing something?

I'm honestly surprised that the US doesn't have a legal framework to force ISPs to block IPs / DNS hostnames. I've been expecting that for 10+ years now, but it hasn't happened.

`sudo tcpdump port 53` says yes, they do use unencrypted DNS.

AFAIK Chrome has a hardcoded list of DNS servers which offer encrypted DNS. I.E. if your DHCP server tells your PC to use 8.8.8.8, 1.1.1.1, 9.9.9.9, (or the IPv6 equivalents) it will instead connect to the equivalent DNS-over-HTTPS endpoint for that DNS provider. This is a compromise to avoid breaking network-level DNS overrides such as filtering or split-horizon DNS. It's not limited to public DNS providers either, ISP DNS servers are in there. (I've seen it Chrome connect to Comcast's DNS-over-HTTPS service when Comcast's DNS was advertised via DHCP.)

Of course, this is pretty limited. Chrome obviously can't hardcode ever DNS server, and tons of networks use private IPs for DNS even though they don't do any sort of filtering / split-horizon at all. (My Eero router has a local DNS cache, so even if my ISP's DNS servers were in Google's hardcoded list, it wouldn't use DNS-over-HTTPS, because all Chrome can see is that my DNS server is 192.168.4.1)

> As much hassle as things like DoH can be for securing and enforcing policy on a network, it’s about time it became ubiquitous enough that governments can’t leverage DNS for their own purposes anymore.

A caveat of encrypted DNS is that it has to be bootstrapped via traditional, unencrypted DNS or via a well-known set of IPs. Currently, most clients using DoH/DoT use one of a small handful of providers. Cloudflare, Google, Quad9, etc. A motivated government could block those endpoints pretty easily.

Of course, a client using encrypted DNS could just refuse to work when encryption is blocked, rather than falling back to traditional DNS. But that could mean the client is unusable in the country implementing the block.

This sort of reminds me of when Kazakhstan announced they were going to MITM all TLS sessions within the country, and all citizens would need to manually install a root cert. Google, Apple, and Mozilla chose to completely block their root cert, so it would be unusable even if users chose to go along with it. https://en.wikipedia.org/wiki/Kazakhstan_man-in-the-middle_a... Seems like the browser devs won that political standoff, but would they fight the same battle if DoH/DoT was blocked?

I used Jira at my old job and didn't care for it. At my new job I have to use Procore half the time. I can't tell you how much I miss Jira.