Scion9066

Then depending on the state's definition of ALPR, your work's use of that system would probably be covered by their laws. They don't necessarily require AI to do the analysis or the camera to do the work by itself. There seems to be some standardization of language with many states though:

Arkansas': https://legislature.maine.gov/statutes/29-A/title29-Asec2117... > "Automatic license plate reader system" means a system of one (1) or more mobile or fixed automated high-speed cameras used in combination with computer algorithms to convert images of license plates into computer-readable data;

Maine's: https://law.justia.com/codes/arkansas/title-12/subtitle-2/ch... > "automated license plate recognition system" means a system of one or more mobile or fixed high-speed cameras combined with computer algorithms to convert images of registration plates into computer-readable data.

Vermont: https://law.justia.com/codes/vermont/title-23/chapter-15/sec... > “Automated license plate recognition system” or “ALPR system” means a system of one or more mobile or fixed high-speed cameras combined with computer algorithms to convert images of registration number plates into computer-readable data.

California's: https://law.justia.com/codes/california/code-civ/division-3/... > “Automated license plate recognition system” or “ALPR system” means a searchable computerized database resulting from the operation of one or more mobile or fixed cameras combined with computer algorithms to read and convert images of registration plates and the characters they contain into computer-readable data.

There are actually laws against individuals doing this in a number of states.

It's already prohibited in a number of states and I'd bet that if citizens tried to do that at any scale, then laws would be quickly passed to make the state and its corporate partners the only ones allowed to do so everywhere else.

A number of states already have laws preventing individuals from setting up ALPR. I can't image state or government officials that don't lready have those restrictions in place would allow the public to set up tracking of their movements for very long if someone did try to set up something crowd-sourced or easily searchable.

e.g.:

Arkansas: https://law.justia.com/codes/arkansas/title-12/subtitle-2/ch... > Except as provided in subsection (b) of this section, it is unlawful for an individual, partnership, corporation, association, or the State of Arkansas, its agencies, and political subdivisions to use an automatic license plate reader system.

Maine: https://legislature.maine.gov/statutes/29-A/title29-Asec2117... > Except as otherwise provided in subsection 3, a person may not use an automated license plate recognition system.

I just provided a more direct link but yeah it is just proposed at this point. The age assurance part appears to be substantially similar (very similar verbiage) to the bills that have already passed in California and Colorado though so I guess we'll see it again in a few weeks or months at this point.

From the General Assembly's website: https://www.ilga.gov/Legislation/BillStatus?DocNum=3977&GAID...

There's already models specifically for things like identifying players in Counter-Strike 2, including which team they're on.

Someone has even rigged up a system like that to a TENS system to stimulate the nerves in their arm and hand to move the mouse in the correct direction and fire when the crosshair is over the enemy.

We are definitely already there.

There are some things regular distros can't/shouldn't do, like including codecs still under patents, matching proprietary Nvidia drivers with the correct kernel version, proprietary firmware for game controller adapters, the launching of Steam Big Picture mode as the default UI, etc.

I believe it's: sanm LucasArts SANM/SMUSH video

Popped in that context means hacked. Like in the same usage of pop in "popping a shell".

I do not think he meant it as any kind of physical/death threat.

The domain that the verifier (the site trying to authenticate you) is at is part of the cryptographic process. If the domain doesn't match (ie you're at a phishing site) then the results of the cryptography won't be valid for the actual correct site, only the phishing site (which gets the phishing site nothing it can use).

It's been supported by qBittorrent since 4.4.0 released in January 2022 when built with libtorrent 2.0. The official docker images still use libtorrent 1.2 though as that is the default.

Probably not a dealbreaker for most but it might be hindering Bittorrent v2 adoption.

qBittorrent put out version 5.1.2 over 2 months ago:

  > Wed Jul 02nd 2025 - qBittorrent v5.1.2 release
  > [...]
  > qBittorrent v5.1.2 was released.
  > SECURITY: It contains security fixes for the WebAPI, Rss and Search modules.

Lack of a tagged stable/release version with libtorrent 2.0 for one.

ID.me is actually a private company.

The US government does have login.gov though.

For Windows apps there's: https://en.wikipedia.org/wiki/WoW64

Bluesky feeds are still server-side (due to needing to process all of the available posts to generate the feed) but at least you can choose which ones to use and people can make their own, which is an improvement over a single app-provided algorithmic feed.

The distro package in question here is a Fedora-specific Flatpak, not the Fedora-specific RPM distro package version. From my understanding, it is missing things like patented codecs which then causes bug reports to be filed with upstream, OBS, instead of the ones responsible for the package, Fedora.

Fedora has its own Flatpak repo as the default instead of Flathub (which has the official OBS package from the upstream developers).

That's if he had gone with the delay mechanism built into the law if there was a plan to sell it in the works. This is just ignoring the law.

Google Authenticator does support exporting and syncing now:

https://security.googleblog.com/2023/04/google-authenticator...

I think their point was that it's less phishable from the perspective of needing the attacker to try logging into the site with it in realtime instead of being able to just store the password for some later time. The needed concurrency makes it more difficult (if only slightly).

I'm curious though why you don't think TOTP or similar are good against credential stuffing though, would you be able to expand upon that?

From my understanding, it didn't scan all of the files on the device, just the files that were getting uploaded to Apple's iCloud. It was set up to scan the photos on the device because the files were encrypted before they were sent to the cloud and Apple couldn't access the contents but still wanted to try to make sure that their cloud wasn't storing anything that matched various hashes for bad content.

If you never uploaded those files to the cloud, the scanning wouldn't catch any files that are only local.

A law by the government requiring proactive scanning of photos would in fact make the whole situation worse in the US because there would need to be a warrant if the government is requiring the scan. As long as it's voluntary by the company and not coerced by the government, they can proactively scan.

A passkey is a synced, discoverable WebAuthn credential. While many implementations protect the private keys with additional security measures like secure enclaves or TPMs, it's not required. If you want to use an implementation that doesn't use those types of lock-ins, even when they're there to protect your credentials, you can. Multiple software-only implementations exist.

Generally attestation is not supported outside of enterprise contexts and Apple for example doesn't support it without mobile device management policies being applied to the device.

You can make your own backups of passkeys from your password manager.

I believe you are confusing ones that are stored in software or syncable (Passkeys) with the hardware backed credentials (platform authenticators).

They do have a web page to do pairing at least:

https://logiwebconnect.com/

Matt's side wanted WP Engine to cover what seems to be the costs of running the entire wordpress.org site but the judge didn't go for that:

https://www.courtlistener.com/docket/69221176/64/wpengine-in...

> Defendants [Matt's side] counter that a bond of $1.6 million is appropriate. Opp. at 32. They assert that “the continued maintenance and operation of the Website incurs an estimated $800,000.00 in administrative, server and developer costs per year[,]” and that allowing WPEngine to access the developer resources of the Website permits WPEngine to benefit from the distribution of its products on the Website[,] which “carries with it a separate value.”

> [...]

>In reply, WPEngine argues that if the court is inclined to require a bond, “it should be a de minimus amount, not wordpress.org’s entire budget for two years.”

> [...]

> Under these circumstances, the Court finds that any harm to Defendants resulting from the issuance of preliminary injunctive relief is unlikely, as it merely requires them to revert to business as usual as of September 20, 2024. Accordingly, the Court declines to require WPEngine to post a bond.

It's a standard supported by multiple parties, not just Microsoft, including multiple open source password managers.

And it does provide some benefits: phishing protection (no shared secret that can be intercepted or given to the wrong party) and the service does not need to store as much sensitive information (don't need password hashes that could be leaked and cracked, just a public key).

Basically the same as if you had lost a physical key:

You either have an extra set up or you work around the problem through some kind of recovery method.

Or things like Web USB start getting used to provide useful features without needing to install whole apps, like mouse/keyboard dongle pairing, phone OS flashing, etc.

As far as fingerprinting/tracking goes, I have never seen a random site prompt for these features, only apps where it makes sense.