entuno

But it's still useful to know about price variation so that you can plan ahead. I regularly drive past several different petrol stations, and if I know that one of them is usually cheaper or usually more expensive then I choose to use or avoid it, or to decide that I'll fill up tomorrow when I'm going that way rather than today at a more expensive one.

And that'd be more useful built into satnav, so that if I know I have to fill up somewhere along my route then I can pick the cheapest place, since there's no real time cost to any of the options compared to each other.

Denied.

> Eight titles were excluded from the analysis due to them being either shorter than the other full-length novels (Eric, 1990; The Last Hero, 2001), or because they are part of his titles for younger readers (The Amazing Maurice and His Educated Rodents, 2001; The Wee Free Men, 2003; A Hat Full of Sky, 2004; Wintersmith, 2006; I Shall Wear Midnight, 2010; The Shepherds Crown, 2015).

Open source is a bare minimum, although even that's not worth as much given how much harder it is now to load extensions that you've compiled yourself.

But those features you're talking about sound like they need extensive privileges within the browser. And while your extension might do what it says today, what's stopping you sticking a load of malware and adverts in there tomorrow? Or selling it to someone else who does?

If the author is an established person whose been known for years to develop good quality extensions and not sell out, then that gives some assurance. If it's an organisation like the EFF, even better?

But a random anonymous person making their first extension? No chance.

If you're trying to protect your own website and servers, those markets won't be a concern for you. If you ship a widely used product that's an attractive target (like web browser, mobile device, network kit, etc) then they definitely are.

If you tried to submit it would spend a while with a really slow progress bar, and then say it failed to submit and asked you to contact SETI directly. I wonder if anyone actually did....

* Spend ages trying to find someone to submit a report to.

* Waste a whole load of time fighting through the generic contact and support desks to try and get your report to someone who understood it.

* Get completely ignored by the developers.

* Spend time reporting a bug only for them to silently fix it without even bothering to respond to you, let alone acknowledge you.

* Get legal threats for making a good-faith bug report, even if you found it in an locally deployed instance of the software.

* Get called a black hat and more legal threats when you give up and just go down the full disclosure route.

I wonder if a better model would be to make the platform pay to entry, but not the specific bugs? So you have to pay a fee to gain access to a platform like HackerOne, and if your signal:noise ratio gets too bad then your account gets revoked? That would make it feel like less of a gamble than having to pay for every individual bug - but still has the same problem that it's putting a big barrier in front of legitimate good-faith researchers.

If I have to pay money to submit a vulnerability to the developers with no guarantee that I'll even get refunded for a high quality and good faith report, let alone any actual payout, there's much less incentive for me to do so compared to selling them to someone else who won't charge me money for the privilege.

If so I could understand this (although there are certainly arguments to have had about it). But if they allow accounts without MFA then this would seem counterproductive, because while TOTP has issues it's a lot better than nothing.

If 23% were higher and 23% were lower then you could make a reasonable argument that it's just incompetence from the store.

But if 23% are higher and none are lower, then that looks a lot more like malice - because the odds of you happening to have a 23% error rate than just happens to always work out in the retailer's favour are basically zero.

The three mindset changes I found that really help with this are understanding that:

* You don't have to try and get the last word in.

* Other people are not entitled to your time, especially if they're engaging in bad faith.

* Outside of small and curated communities, there's pretty good odds that you're not interacting with a real and honest person.

So whenever I click into the comment box, I always ask myself "Can I really be bothered with this? Is this really what I want to be spending my free time doing?"

And then I often close the comment box and get on with my life.

If the answer is "yes", then make your comment, check back and interact with the responses (assuming they seem to be in good faith). If it's "no" then just close the comment box and get on with your life.

But then I realise that it's fairly pointless writing this in the first place...

There are lots of different RSS readers out there depending on whether you want a web based or local one. Personally I use Thunderbird.

I would go beyond that and say that they're deliberately misleading.

They're not quoting a big scary-sounding number out of context to try and be unhelpful - it's an intentional and active choice to push a specific narrative.

> [...]

> saying that the economic pressure of the games business could incentivize some studios to crank out "mediocre or even slop games" without "care and polish."

Doesn't really sound like GenAI is the problem here - it sounds like companies caring more about churning out games quickly and cheaply rather than making them good is the issue.

First, we find no significant relationship between whether users have recently completed cybersecurity awareness training and their likelihood of failing a phishing simulation.

Second, when evaluating recipients of embedded phishing training, we find that the absolute difference in failure rates between trained and untrained users is extremely low across a variety of training content.

Third, we observe that most users spend minimal time interacting with embedded phishing training material in-the-wild; and that for specific types of training content, users who receive and complete more instances of the training can have an increased likelihood of failing subsequent phishing simulations.

Taken together, our results suggest that anti-phishing training programs, in their current and commonly deployed forms, are unlikely to offer significant practical value in reducing phishing risks.

I've long been of the view that most of the "phishing training" that gets sold to companies is largely snake oil with very little benefit, and is essentially a compliance-driven waste of money. It's nice to see a study supporting this view.