darren_

What We Do In The Shadows

(disclaimer of bias: NZer)

Assuming it's 11 years old (late 2010 model), it can run up to High Sierra, which both the most recent Chrome and Firefox will support.

If it's the Mid-2009 model (the next older model), it can still run El Capitan and therefore the newest Chrome.

It was, shouldn't be any more (IIRC it got enabled about 2 years ago?)

So this appears to be a distributed network of random people's devices, and the 'blockchain' aspect is entirely unrelated to the actually useful parts of how the tech works. It's just how people are paid for contributing their devices to the network?

Am I missing anything? Are the non-blockchain parts of this actually interesting?

I do actually feel safe getting in public transit while covid’s ongoing, and I’m in Tokyo (and taking two of the busiest lines in the world as part of my commute - Chuo and Yamanote).

At this point it seems obvious to me that having windows open, everyone wearing masks, and everyone shutting up, is sufficient to make public transit safe. Because if it wasn’t Tokyo would be in a _much_ worse situation. I fully admit I don’t have rigorous data to back this up, but I kind of can’t see how it could be otherwise.

Just a guess but maybe they want to detect domains people are looking up that don't exist so they can squat them.

> AND AND - this is truly outrageous mafia-like behavior - you can't sell your services for less outside of the App Store. That's right, if your monthly photo backup service is $9.99/mo on the App Store, you have to sell it for $9.99 on your web site, even if you want to sell it for $6.99/mo. And if you do sell it for $6.99 in your app, you have to accept the fact that 30% of your profits are just pissed away even before taxes.

>An entire subset of online businesses aren't even financially possible because the 30% Apple cut and forced pricing model would eat up profit margins that would be healthy otherwise. I would happily sell a service for $9.99 in app and $6.99 on web, and give the user a choice, but of course I can't, because the App Store is a racket.

Er, I do remember this being the case a long while ago but it seems to have been fixed in 2011? https://appleinsider.com/articles/11/06/09/apple_backs_down_...

"Apple this week revised its rules for in-app subscriptions, and no longer requires that subscriptions purchased outside of an iOS application have the same price or less."

And I don't see anything in the current guidelines that would contradict that - did it come back sometime in the last ten years?

(Definitely not a fan of the other guidelines like not being allowed to even hint to your users that they can subscribe on your website or disclose the Apple cut)

> I've heard stories that at Google, the non-engineering workers at campus may not socialize with engineers at all. What kind of society is this that Google is building?

This isn't true at all.

Nitpick but you've repeated it in another comment so maybe worth correcting - 1 million yen is about $9k. 'Super salaryman' would probably be 10 million yen, I'd guess (haven't heard the term, but that doesn't mean much).

I see a lot of comments about other book series but not many about the specific bossfightbooks ones. Has anyone read any of them other than the Spelunky one?

I read the Spelunky one and enjoyed it, and grabbed the Baldur's Gate II one because I was under the mistaken impression that all these books were by developers or people otherwise involved in the game's creation, and they'd be war stories or other interesting insights. It wasn't, it's just some guy (he's written a D&D novel but not related to BG in any way) writing general stuff about the game - nothing really in any depth - and a whole lot of stuff about himself. Not at all what I was looking for (my fault, should've read the blurb).

Some of the other books seem to have interviews with creators or serious research done - are these good?

> A really simple step in the right direction would be mandated labeling showing how many years of software updates the device will get and statistical expected lifetime.

This isn't that simple because it depends on _which_ software. This gets glossed over a lot in these discussions.

An iPhone gets ~5 years of iOS updates. Importantly, these updates are the only place where the only permitted web viewer on the platform gets updated. An android phone gets 2-3 years, if it's very lucky, of android updates. However, the _browser_ you use on that device is updated entirely independently of the OS, and while it isn't obvious how far back Chrome supports, android Firefox runs on android 5.0 devices (i.e. at least 7 years, probably more?)

These are two different security scenarios - an iOS device is fully patched against OS-level exploits for longer. True. But an android device will have a safer browser for a lot longer. In my threat model the latter is a lot more important - I don't think I'm unusual in that my web browser is by far my largest attack surface.

(disclaimer: i work at google, but i work on iOS stuff and like iOS a lot. more than android for sure. but i'm very salty that i can't have a browser updated independently from the OS)

Counterpoint: Boot time is basically irrelevant once you have a reliable sleep/hibernate/whatever mode. My PC only reboots for windows updates or if I'm troubleshooting some inexplicable behaviour.

For the actual practical use case of sitting down at the computer and starting to use it, my PC wakes up essentially instantly. I simply don't care about boot time. My 2021 experience is far, far better than my 1998 one (well, the computer bits at least).

this isn't by a google engineering director, it quotes ray kurzweil at one point and then puts 'google director' in the title presumably for clicks.

Or you could read DTP site instead of axe-grinding "DTP is an open source project centered around the idea that less-resourced companies can use and build on the common models and codebase developed by the community of contributors. All companies are welcome to participate."

https://datatransferproject.dev/faq

or you could look at the source and see such big tech oligopolists as 'mastodon' and 'rememberthemilk' https://github.com/google/data-transfer-project/tree/master/...

Yes: https://github.com/WICG/floc

> "Whether the browser sends a real FLoC or a random one is user controllable."

FLoC stuff is client side. You can send nil FLoC IDs. You can randomize them on every request. You can swap them with your friends. Whatever.

Vanilla Chrome might not let you (my money would be on an off-switch but not anything fun) but that's hardly going to be a blocker.

(googler but works on something completely unrelated)

How do you know people haven't moved on? Have you got Genshin Impact analytics that the rest of us don't? It's free and getting lots of installs as you'd expect - how do you know if people are sticking with it?

It's a perfectly fine game for the first quite-a-few-hours and then suddenly turns into an appalling grindfest (and yes, the 'quality' is clearly front-loaded, the game drops off a cliff once you get to Liyue)

Genshin Impact is an example of a game where the gameplay is intrinsically designed to facilitate the monetization though - it's taking what would be perfectly alright gameplay, and making it _really shitty_, so they can monetize.

A Genshin Impact that cost full price but had no 'original resin' garbage, no running the same boss a dozen times (but only 4 times a day unless you pay!) to 'ascend' a character, that didn't gate most of the actually effective characters behind gacha pulls, might actually be a decent game. Probably wouldn't have made as much money though.

I think the expectation is other browsers will implement by default - the intention incidentally is that FLoC isn’t a google specific tech, it enables private targeting by any ad vendor. The proposal seems to mostly to be by googlers but the association is with WICG which seems to have people from all over.

As I noted in my original message - yes, its client side, you can do whatever. (‘Whether the browser sends a real FLoC or a random one is user controllable’ https://github.com/WICG/floc)

> Make no mistake - as far as I can tell, this preserves Google's ability to track that you are, say, a new parent because you've searched for baby clothes. What it won't know is which new parent you are.

If you've searched for baby clothes in Google there's absolutely nothing in the FLoC proposal that stops Google from inferring that you're a parent from that search and, idk, storing a bit in your profile or something.

This proposal is about allowing ad targeting to interests or whatever without tracking your visits across the web - your browser generates the cohorts clientside (idk how the cohort assignment algorithms get standardised on, I guess that's where the 'tuning' would go). And yes, you could just tell your browser not to do that, or have it only use the most recent n days' data, or randomize your cohort, or freeze your cohort in time, or blocklist certain sites from ever entering your cohort, and so on.

Where this ties into tracking if you're a parent is that while it doesn't prevent tracking that, it does lessen the incentive - if you're a parent, you're likely going to wind up in a parent-y cohort. Is the signal from the original search still going to be useful enough to warrant keeping around?

(obligatory: googler, but nothing to do with ads)

> Does anyone actually prefer the experience of an integrated Smart TV compared to a separate device? If these users exist, they probably wouldn't be found around these parts.

Sure, I've got a Sony TV with built-in netflix/amazon prime/chromecast receiver in it. Works great. There's no tv-inserted ads while watching TV or streaming services or anything like that. There's a couple of rows of icons on the homescreen below the app icons that are 'recommended content' which i guess some people consider to be ads (they're not, as far as i can tell) but i pretty much never use the homescreen anyway.

I do always see a lot of negative sentiment around these TVs on this site but really, I'm not bothered by mine at all and in fact quite like not having another device to wrangle.

“Did you ever wonder what life would have been like if you’d said yes?” said Ridcully.

“No.”

“I suppose we’d have settled down, had children, grandchildren, that sort of thing…”

“What about the fire?” she said.

“What fire?”

“Swept through our house just after we were married. Killed us both.”

“What fire? I don’t know anything about any fire!”

Granny turned around.

“Of course not! It didn’t happen. But the point is, it might have happened. You can’t say ‘if this didn’t happen then that would have happened’ because you don’t know everything that might have happened. You might think something’d be good, but for all you know it could have turned out horrible. You can’t say ‘if only I’d..’ because you could be wishing for anything. The point is, you’ll never know. You’ve gone past. So there’s no use thinking about it. So I don’t.”

Over here it's either LINE (does support adding by number but can't remember the last time I used that, literally years) or FB/Instagram.

> How many people can you reach with SMS?

Essentially no-one as we've all stopped trading actual phone numbers years ago.

Yes, reading some more of the discussions it seems like the answer is that (roughly) the same amount of memory is used, but hitting swap is no longer a major problem, at least for user-facing apps. Seems like the original quote is reading too much into the retain/release thing.

This quote doesn’t really cover why M1 macs are more efficient with less ram than intel macs? You’ve got a memory budget, it’s likely broadly the same on both platforms, the speed at which your retains/releases happen isn’t going to be the issue. it’s not like intel macs use GC where m1 uses RC.

(It explains why iOS does better with less ram than android, but the quote is specifically claiming this as a reason for 8GB ram to be acceptable)

This is one place where apple’s ban on alternative browser engines really hurts users, IMO. I’d be pretty comfy using an old iPad that was out of security support, _if_ it had an up to date browser. But since browser engine updates are tied to OS, there’s no way for obsoleted iPads to keep being safely used as cheap browsing machines. in this sense it might even be possible that using an outdated android is safer, if you’re just browsing and you’ve got an up to date browser.

Ah, OK. I don't really find that too compelling, to be honest - what's your NAT buying you if you don't have many users to mix your traffic with?

I live alone and as far as I can see, all my NAT does for my privacy is a smidgen of plausible deniability (maybe a visitor on my guest wifi made that request), and that you can't tell which of my devices I'm using when I access a particular service - which is a small privacy win, but not a meaningful one in my book. Even for what I imagine is the common case of a family sharing one router, I'd guess it's usually not challenging to distinguish traffic between the relatively small number of potential users/devices.

If you're lucky(?) enough to be behind a NAT with enough hosts to be meaningful privacy-wise (dozens? hundreds?), and whoever's running this NAT isn't keeping logs about it (do they? honestly don't know), then you might be seeing a significant privacy upside. But it's not built-in to the protocol, and just adding a NAT doesn't buy you any privacy by itself.

I think the problem is that the privacy enhancing part of NAT is an emergent side-effect, not the main goal. Now it's got me thinking there should be something like NAT but explicitly targeted to privacy, like guaranteeing that your traffic is mixed through an IP that minimum a hundred other people are using. Or something like that.

Can you explain what privacy you think it offers over IPv6+privacy addresses?

As far as I can see it offers that activities behind the NAT get grouped behind one IP to the outside world, and I guess harder host discovery. Is there more?

I'd argue that NAT provides negative security in the long term.

Two reasons: 1) This attack is mostly built off the complexity that NAT requires. STUN, TURN, ICE, ALG all exist because of NAT. More complexity == harder to secure. 2) The actual goal of the attack is to allow sending packets to hosts on your network. The only reason this is even considered an attack is because treating NAT as a security layer leads to the neglect of other security aspects. It shouldn't be a problem for your smart doormat to get random packets, but we've been allowing vendors to get away with shipping devices/software that's only safe on a 'local' network for decades.

Maybe I'm wildly optimistic but if ipv6 had been the default for years and every random IoT device was expected to be exposed to the public internet by default, maybe we'd actually have something approaching decent host-level firewalling/etc by default too?

They've also pulled off an incredibly hostile move for paid users of older Lightrooms - they're refusing to update it for 64bit-only OS X. The app itself is 64bit (in fact, the app itself is _only_ 64bit), but its licensing/installer components are not. So if you update OS X, it's not guaranteed that Lightroom (that you paid for) will run, or if it does, how long it will continue running for. This isn't some ancient software, this is the 2015 version of Lightroom.

This is 100% intentional to drive users to subscriptions.