BenTheElder

> Unfortunately, if you've used Google Takeout or other systems that can both downsample your photos and videos, as well as actually deleting _or changing_ metadata, deduplicating becomes a big wad of heuristics.

I thought takeout exported the original files? (alongside metadata entered into the application)

Thanks!

> Uber built a remote kill switch for their tax docs in canada, this isn't unprecedented for them.

Do you have a pointer to more on this? Naive searching doesn't seem to turn up anything for me.

FWIW: That project was started as an internal tool with a playful acronym and then went from obscure to well-known enough to making renaming a somewhat regrettable concept rather quickly just due to momentum. I think we'd have named it differently if we were aiming for widespread usage :-)

We had no reason to worry about making it popular, the effort was staffed to improve developing Kubernetes itself.

As for googling, I recommend adding keywords like "kubernetes" and for issues searching the repo itself or reaching out to the community for help https://github.com/kubernetes-sigs/kind#community

That tool is written in "Go" which also somewhat famously doesn't search well without changing your terms up a bit.

Ok but the premise of physical harm in person comes from the parent comment, not mine:

"Most of those dependencies represents at least one human being who can be threatened with a crowbar and forced to ship an exploit, which can then infect vast numbers of production applications."

Good points.

I suspect for a lot of projects reproducible builds are themselves a bit of a hurdle and not being verified in the rarer case that they already exist, but the point of reproducible + signed builds as indirect source-signing stands.

Those are interesting points / possible approaches, however is there any indication that this particular project enables any of that?

This seems focused on signing binaries / build artifacts.

IMHO it seems like if you have the threat model of "crowbared maintainer forced to insert backdoor" you probably don't trust sources let alone binaries and need to vet your dependency sources and then compile your own binaries from them.

Many open source dependencies will not have a jurisdictionally diverse review team, or any review team at all (single maintainer).

Why can't they be "threatened with a crowbar" to sign the exploit?

A zero-sized type + hashmap for sets is also done in Go with a `struct{}`. [1][2]

But without generics it must be implemented again for each entry type ...

Kubernetes uses a code generator to automate this, but it's a bit kludge. [3]

[1]: https://pkg.go.dev/k8s.io/apimachinery/pkg/util/sets#Empty

[2]: https://dave.cheney.net/2014/03/25/the-empty-struct

[3]: https://github.com/kubernetes/code-generator/blob/master/cmd...

Those things don't have to be inherently slow and e.g. external IP don't need to block bring-up.

I've worked on KIND and on clusters on clouds (at Google, but on multiple clouds) and both can be very quick, if anything there's still low hanging fruit to make KIND faster that I'd expect a production service with more staffing to handle.

KIND is Kubernetes, typically on much weaker hardware :-)

Within a few minutes is a perfectly reasonable expectation even for "real"-er clusters, see e.g. under 4 minutes:

- https://kubedex.com/google-gke-vs-azure-aks-automation-and-r...

- https://stackoverflow.com/questions/53839292/is-a-3-minute-g...

`go mod vendor` will populate all dependency sources into `./vendor/` in a modules project for easy grepping.

Some projects still use this to ensure sources work airgapped as well.

https://golang.org/cmd/go/#hdr-Make_vendored_copy_of_depende...

Is what appears to be less than 2,000 lines including detailed comments etc. "quite a lot"?

This seems like a manageable amount to very carefully maintain and not at all like writing something entirely in C.

this seems like a pretty trivial amount of C, by comparison, and a pretty solved problem now.

FWIW Google did this ("letting go" of an asset) with Kubernetes / the CNCF.

I work on this at Google, but Google no longer owns this since 2015.

As I understand it they only removed these after their underlying server provider banned Epik over it ...

They also still provide DNS for 8chan/8kun, and continue to host the daily stormer ...

Seems like they are only not bulletproof because they are a reseller and their vendors have limits.

https://en.m.wikipedia.org/wiki/Epik_(company)#Hosting_of_fa...

Without commenting on the rest ...

> Then there is the always present double standard. Why did Twitter allow “Hang Mike Pence” to trend last night? Where are the suspensions and permanent bans?

Actually, they intervened and stopped it.

https://www.newsweek.com/twitter-stops-hang-mike-pence-trend...

Also note:

> Journalist Yashar Ali tweeted a screenshot of the topic trending, indicating that the phrase had been tweeted over 14,000 times. Ali noted that most people were "quot[ing] some of the insurrectionists" at the Capitol, rather than making direct threats against Pence. He wrote that the phrase "shouldn't be allowed to trend."

See also despite the URL: https://nypost.com/2021/01/09/twitter-allows-hang-mike-pence...

> “We blocked the phrase and other variations of it from trending. We want trends to promote healthy discussions on Twitter,” a company spokesperson told The Post. “There are Rules for trends — if we identify accounts that violate these rules, we’ll take enforcement action.”

This should actually finally be fixed as iOS 14 rolls out, of course there's still IE ...

https://css-tricks.com/webp-image-support-coming-to-ios-14/ https://caniuse.com/?search=webp

Can you elaborate on what you mean by link field? I've searched a bit but I'm not certain what you're referring to in this context.

Do you know if any browsers are doing this?

In practice on iOS nothing seems better than safari + the content rules for adblocking, but I admittedly didn't try every app

Shipping your own content lists seems like a tricky way to differentiate since users could install similar lists without using your browser.

aside: It also appears to just inject CSS you have to inject it via javscript now which feels a bit gross but certainly doable.

TIL, thank you :)

In this context they're more or less the same, because the relevant networking / adblocking bits are in webkit, AIUI.

It's true that safari and webkit are not the same, this comment is imprecise. But switching browsers won't net you different adblocking capability due to the restriction to use apples webkit core.

Edit: that is "safari core" is a very lazy shorthand for the webkit framework here. The impact to the user is pretty much the same in this context.

If you read my comment again you'll note the only claim I make about adblocking is that all browsers must use the same runtime.

I don't claim that it's broken, but the ability to switch browsers (finally!) doesn't seem terribly relevant given that they're all required to essentially be safari skins.

that's fair, but <center> and this post are still not equivalent at all.

But all of them are safari core, Apple does not allow other browser runtimes, they're only the custom UI around the webview. [1]

All of the core browser bits including adblocking are safari still in every iOS browser on the app store.

[1]: https://developer.apple.com/app-store/review/guidelines/

> 2.5.6 Apps that browse the web must use the appropriate WebKit framework and WebKit Javascript.

(i.e. ~safari webview)

<center> and the solutions in this post are not equivalent ...

The HTML center tag only horizontally centers the contents which you can do with the simple CSS: `text-align:center` [1]

The examples in this post center horizontally AND vertically.

[1]: https://developer.mozilla.org/en-US/docs/Web/HTML/Element/ce...

> Let's see an example of dodgy kernel drivers. How about Easy Anti-Cheat? Go to their page at https://www.easy.ac/en-us/. Guess who develops it?

Their store does not install or require this. Specific applications require it for online play (and generally only for online play...)

Microsoft does not ban this behavior on any storefront, AFAIK. Having a single storefront would not change this.

> Hypothetical monopolistic practices really? Because I vividly Facebook skirting App Store security policies to make users install a privacy invading VPN app, which they also used to gather data on competitors[1].

Amusingly this occurred under the current iOS app restrictions, which clearly didn't prevent this.

An argument could be made for certain high-risk extension point access (such as VPN) could be limited independently of general apps, but the fact that there's a bad VPN app is a silly excuse for restricting the install of simple applications.

The app sandbox should provide plenty of protection, and if the user opts to give apps permissions, that's on their choice. I really don't think users are going to install an app store that requires the usage of a sketchy VPN app ...

If this were the case, surely it would exist already on android :-)

> But I'm sure that's fine because people have alternatives to Facebook. Or perhaps not[2].

[2]: is exactly why we don't need to leave Apple's monopoly in place to "defeat other monopolies" ... we have other tools for that. Let users (and their representatives etc.) decide.

It's a pretty excellent example precisely because the operating system typically already has controls over this behavior (installing kernel drivers..)

> However, known user hostile players trying to have a go at people's personal devices under the guise of competition is something that we as consumers should be equally wary of.

Is epic user hostile? Other than offering temporarily exclusive applications their store does not seem hostile ...

> Because in the end, we won't be given much choice. Monopolies are not something exclusive to Apple, and big players will use their own monopolistic power to coerce users to install their privacy invading app store.

Defeating hypothetical monopolistic practices by denying user choice and persisting an existing monopolistic practice sure is a take.

Microsoft could block dodgy kernel drivers while still allowing game stores ... These are not inherently related.

I think OP is aware that competing music apps are allowed. They're making an analogy about banning competing app stores, just because itunes is good doesn't mean we don't want competition ... the same concept applies.

I don't understand this comment. Neither of these links are sources, one is just an installer and the other is a binary release.

If you mean the "source code" zip in the latter link, that's just github zipping the repo, which contains no useful source code.