Whitestrake

> They will happily redirect the request

Doesn't HSTS thwart this? Unless paypal.com were omitted from the preload list, AND you had never browsed to paypal.com before with that browser, it should refuse to connect over HTTP and the attacker won't be able to issue their redirect. It will try HTTPS instead and immediately fail out of certificate validation.

> The current generation of Americans

Which generation would you be referring to? Boomers, X, Y, or Z - or some other defined generation?

> Many people (me included) would argue that the scale of these companies definitely makes a difference

Many people would then be arguing sideways past the GP comment, which made no claim to the extent of the difference, rather that it was not a positive one.

As you say, though, it's definitely objectively clear from an economical standpoint.

Aye, and you'd be well within your rights to do so, but I am doubtful that this approach will preempt the majority of people assuming rudeness on your part.

Kinda like they don't work on multiple chat apps simultaneously - that would be too silly of them to be believable, right?

Hey, that seems pretty cool. What'd you build it with? Any chance there's a repo I could check out? I'd love to try replicate something similar.

Edit: Nevermind, found it - seems like I wasn't looking very hard! https://github.com/j3parker/f6oclock

I'm very glad Firefox for Android supports the same extensions as the desktop version.

Then you get a reputation as a rude developer, whether or not that's fair or warranted.

Are you asking how useful fingerprinting is, or are you asking how effective it is?

For the former, any amount of fingerprinting lets ad companies make the case that their ads are better or worth more money. For the latter, the EFF Panopticlick research project seems to be pretty good at giving you an idea:

https://panopticlick.eff.org/

I don't have an iPad/iPhone etc. to test Safari with; seems like they'd be amongst the most homogeneous of devices. Perhaps someone with one of those devices could tell us if the EFF can uniquely identify their device. It was able to uniquely identify all of my devices.

I've been told by a few people that it's my own fault, that I should have used something else like .test, etc.

I wasn't even aware of the fact that .dev was going into the preload list and was quite surprised when my browser started erroring out on my dev sites. Had to spend time figuring out what was even happening, then I had to reconfigure my web server and DNS resolution.

Was I wrong to use .dev? Debatable. Pretty rude way to find out, though.

IANAL, but I could set my own completely custom user agent - I don't even need much technical expertise, a simple browser add-on would suffice - and by logging that string, I could be (depending on how unique I made my own user agent) uniquely identified.

Out of all the metrics Caddy plans to collect, it's the only one I think has some merit to its complainants. It might be simpler to only keep user agents that conform to common browser standards. But this has all been discussed in the Caddy forum thread itself, and we'd welcome your input there!

Burnie Burns of Rooster Teeth phrased it as, "the internet demands progress, but hates change." I like that because it succinctly draws attention to the juxtaposition of ideals and emotional reaction.

Likewise.

I'd go so far even as to say that IRE's MUDs made me who I am today. A commitment to integrity of role-playing my characters helped shape my identity while I was growing up, particularly as a social exercise. And my first exposure to scripting in the form of simple aliases and triggers led to the pursuit of programming skills. Without MUDs, I'd be a different person entirely, I have no doubt.

A person who attempts to shoot an active shooter therefore satisfies the definition of an active shooter.

Ahh, I wasn't aware of that.

What about heavy machinery, like construction plant? Or power tools? Or common kitchen utensils? Would they satisfy the analogy?

An equally fair comparison. I'm not a lawyer, this is not legal advice, and I'm really just spit-balling for discussion's sake and because I consider it interesting; please do poke holes in my reasoning.

Presumably the developer in this scenario is not responsible for guaranteeing to and/or misleading a customer that his code adequately renders a deadly weapon safe, more likely that responsibility falls on the managers whose project it was to implement such a digital "safety" and instructed the developer to write the code in the first place.

Assuming the developer did not write the code with the intent of bringing about a person's death, which might involve fooling his superiors as to the efficacy of his work, I'd wager he can't be guilty of a crime. Outside of that, I believe vicarious liability applies.

Perhaps he was a one-man department of this hypothetical gun manufacturer, implementing, deploying, and marketing his product himself and of his own initiative; I don't think there's any doubt he'd be liable in this case, the extent of which is dependent on his intention.

Perhaps our developer was self-employed as a contractor, and warranted to his client (the hypothetical gun manufacturer) that the code was safe; assuming the manufacturer used it as warranted, and it failed, I'd assume the developer would be mostly liable for the result.

I'd argue that prosecuting a developer because his employer used his code to kill someone would be comparable to prosecuting a gun manufacturer because a customer used their weapon to kill someone.

Using "in-band" here doesn't really follow from a technical understanding of the term; the TCP connection is the channel, and anything sent over it (such as an entire HTTP request/response, including headers) is "in-band".

Out-of-band would be a phone call, or perhaps an email - an entirely alternate method of communication.

Transparency to a user (via the client, i.e. browser) isn't really relevant, from a communications standpoint, to whether or not data is considered "out-of-band". Given the subject (APIs), you're not likely to be browsing to these anyway.

Your comment calls into question the anecdotal evidence used to dismiss a claim made with no evidence whatsoever.

I have a similar anecdote, but mine does not match the mitigating circumstance you ventured.

Regardless, even a less-than-credible personal account clears the bar of required evidence to dismiss the above claim, since that requirement is currently zero.

Try `-site:pinterest.com` to remove any results from the website, rather than any results that contain the text "pinterest.com". A minor distinction, but one that could change your results slightly.

Hoping against hope that we get a similar result when NBN rolls around to my neighbourhood. It would be absolutely awful for them to "upgrade" our system, after waiting so long for this, to the exact same or worse speeds as the ADSL we've been stuck with all this time.

> our internet speeds are 0.8 mbs up and 8 mbs down. So 800 KILObytes up.

Your conversions might be mistaken.

For example, at my place of work, on ADSL2:

Down Stream : 6696Kbps / Up Stream : 736Kbps

So slightly worse than you. Converting directly to kilobytes, we've got 837 KB/sec down and 92 KB/sec up. Shave off around 20% to get real-world speed, because those are sync rates, not actual throughput.

Unless you actually have 8/0.8 MBytes down/up, equivalent to 64/6.4 Mbps down/up, which is quite decent! (Still maybe not quite €100 good).

I doubt he got them mixed up; myki is a pre-loaded NFC smart card payment system for public transport in Victoria, Australia. go cards are another similar system.

NBN is a completely different beast, being an internet carrier and service wholesaler with ambitious and expensive last-mile infrastructure concerns, for one thing.

Especially distinguishable words, and especially names.

Domains are a great example of this, too. I recently reached out, out of curiosity, and learned that the owner of the .net domain for my own four-letter name wants a quarter of a million dollars for it.

A shame, really. They're not doing anything with it, best I can tell. But if that's what someone would pay for it... You can bet someone would try to steal it.

I use Fastmail in exactly the same manner (catch-all, I use "yourdomain.example@mydomain.example" as the email address for signups). Also, anyone could put a cheap domain name on Migadu with a catch-all for this purpose.

Services need a better way to figure out fraudulent or abusive behaviour than guessing based on the email account's domain name.

At the risk of venturing off the topic of the main thread... Could that behaviour possibly be explained by timing rather than location? My Android gives me commute data around 7:30AM, regardless of where I am or whether I'm moving. Perhaps they simply guessed you'd be at home.

Looks like it's not quite official yet - at the time of writing this comment, their changelog page and main website / download links still indicate 12.05 as the latest stable.

Does Wix optimize its images between upload and delivery?

I'd be inclined to believe that this is a side effect of Wix's target market not being aware of how to optimally compress their images for web delivery.

> I never claimed a bad lane change is probable cause for a search.

Perhaps not in so many words...

tptacek states that a bad lane change can be given as an excuse for a stop, but not a search, because it is not probable cause. In the following comment, you reject that claim:

> Bad lane change is explicitly probable cause -- it's direct witnessing of a traffic code violation.

A reasonable interpretation of your comment would be an argument that a bad lane change is probable cause for a search. It makes no sense to differentiate "probable cause for a stop", because there is either no such test, or it should otherwise be the same standard as for a search.

On the other hand, I don't think tptacek has tried to give any advice as to whether a person should be worried about this or not.

Most news sites, yes. They want Google's crawler to crawl their full text, and Google responds poorly to sites that treat their crawler differently than real search users, so if your Referer (sic) header is Google, news sites will often give you the whole article.