holmesworcester

And those paying attention will see that the publisher-approved version of digital lending gives publishers a legal/technical off switch on the existence of libraries, to the extent libraries go digital. Is anyone here okay with this? Kahle/IA certainly aren't!

It sounds like many of these requirements are for safety and reliability.

I can imagine that participants in a war would be much more risk-tolerant than a typical team of professionals would be. Maybe they're okay with a high-ish chance of failure, injury, or death, and so they resource the mission within the limits of what they have, or what they believe will pass unnoticed?

The Germans believe that there were several people. Not 10, but several. The constraint was that they had to be able to pose as vacationers.

Skepticism is warranted for sure, but we shouldn't underestimate what highly motivated and courageous people can do.

The existence of the Internet does make existing copyright law much more destructive and limiting than ever intended.

The creators of copyright law never imagined a world where everyone could have a free library of a lifetime of books in their pocket, and where copyright would eventually be extended to make this impossible.

This creates urgency to change the law (e.g. back to the original 12 year copyright terms), challenge the law in the courts as archive.org has been doing, or disobey it on principle, as the operators of Anna's archive, Z-library, and Scihub are doing, heroically and at great personal risk.

...All with just one successful malware-as-a-service attack against the right employee. (Lumma was the malware-as-a-service used.)

Interestingly, there's another adjacent story on the frontpage about Pegasus being used against NGOs in Eastern Europe. The principle of least authority is important, but also device security is important!

https://news.ycombinator.com/item?id=40535912

What about this type of spying? (Also frontpage of HN right now, and done with similar tools i.e. Lumma malware-as-a-service)? https://news.ycombinator.com/item?id=40534868

The problem is, when the vulns exist due to hand-rolled parsing, you don't get to choose who the attacker is.

I think a lot of people are mis-seeing these Pegasus attacks as a problem of political will ("we need sanctions on NSO/Israel!") or memory safety ("rewrite it in Rust!") when there is a deeper problem: parser complexity.

Specifically, we're using context-sensitive and Turing-complete parsers up and down the software stack, which (at the Turing-complete level of complexity, says Gödel) guarantees that determined attackers can expect to discover an exploitable "weird machine."

Folks should watch this panel and other talks by Meredith L. Patterson (co-collaborator and wife of the late Len Sassaman) and Sergey Bratus (previously at DARPA, now Dartmouth) to get a sense of the problem and the solution.

https://youtu.be/8tAxHrntBJs?t=806

These folks are saying that, just as the industry handled over-the-wire insecurity with TLS and e2ee (and not rolling our own crypto) we can handle device exploitability with well-described data and automated parser generation from those descriptions (and not rolling our own parsers, which these folks say should be verboten for the same reason as rolling one's own crypto: parsing is too hard for non-specialists to get right).

Moreover, we don't have to redo the whole stack for it to be meaningful: big players can start using this tooling (e.g. https://github.com/UpstandingHackers/hammer) for parsers handling data from very untrustworthy inputs, such as message payloads sent to a phone number.

Apple's Lockdown mode is a step in this direction, though in such a crude, "burn the village" way that it makes the phone almost unusable. But sacrificing usability shouldn't be necessary with current methods. If these folks can make safe parsers for PDF (https://www.darpa.mil/program/safe-documents) it should be possible for anything.

Another great talk: https://www.youtube.com/watch?v=3kEfedtQVOY

> A US company would never be allowed to own any kind of social media company in China.

And it's even more implausible to think China would allow this as a result of a US law aimed at limiting China's power.

"Ban" is completely appropriate shorthand for "ban (unless something highly improbable occurs)."

We can say that Google and Facebook are "banned" or "censored" in China even though China would surely be happy to unban them if they sold their operations in China to a Chinese business. So it is consistent and fair to say that this bill "bans" or "censors" TikTok.

Yes, competition works for factors that the majority of consumers are aware of, like price and speed. But it doesn't work for enforcing net neutrality.

If you model it, how could competition work to protect a YC startup with 1,000 or 10,000 users?

You can't start an alternative ISP at that scale, so it's unthinkable that a new ISP would emerge just to serve that throttled startup's pissed off users.

And again, only a tiny minority of users would correctly attribute throttling-induced failure to the ISP. Most will attribute it to the new startup being janky.

Even or those who do correctly attribute it, what are they going to do? Convince everyone they want to use this new product with to switch ISPs?

> If ISPs are playing the long game, they're being incredibly patient about it.

They actually are, and this is how politics and lobbying work. In 2017 it made no sense for US ISPs to run ragged over net neutrality when the 2020 election was looming and far from predictable. Even less once Biden gets elected.

Plus there was the credible threat of state-level laws, which are even worse from the ISPs standpoint since each might go farther than the FCC rules in certain ways.

The California law passed and was a really big deal.

If you're looking for a controlled experiment of what the world looks like without net neutrality rules, just look to countries where there was never any such movement or credible threat of them.

Across Africa, for example, 1GB of mobile data can cost 10x more if you're accessing the normal Internet, vs. a mainstream service like WhatsApp or Youtube.

ISPs use net neutrality violations for price discrimination to extract more from white collar workers who need access to the Internet beyond WhatsApp-- which is fine until you think about the effects on any new WhatsApp competitor.

Mobile ISPs like T-Mobile are quite open about wanting to offer plans that privilege certain services over others.

This is some research it would be cool to see: was TikTok adoption measurably slowed in countries where net neutrality violations were common?

For example, it's the norm across Africa for providers to offer plans with radically lower per-GB costs for WhatsApp, Youtube, and other mainstream apps, as a way to price discriminate and charge a premium to tech and white collar workers who need access to the actual Internet. In such countries you would expect TikTok adoption to happen more slowly than expected.

FCC*

The California law is particularly strong and had a huge impact.

The other big factor is the threat of new FCC rules, state laws, or federal law. As long as net neutrality advocates can pose a credible threat of passing rules that, from the ISP's point of view, are more restrictive than the status quo, ISPs have to think twice before engaging in what John Oliver famously called "cable company f*ckery".

Actually, the empirical record on this shows that we see more net neutrality violations by ISPs in marketplaces with high competition.[1]

This is counter-intuitive but here's how it works:

In a competitive marketplace ISPs have tighter margins and look for every opportunity for cost savings, so if throttling a high-bandwidth application only affects a small percentage of customers, and only a tiny tech-savvy minority of those affected will accurately attribute the effect to ISP throttling, it will incur only the tiniest competitive pressure on the ISP, so the ISP will do it to increase profits.

We actually saw more net neutrality violations in competitive EU markets than in the US, until EU-level net neutrality rules passed.

Another way to look at the limits of competitive pressure is from a startup's point of view: if your startup is offering a new videoconferencing service, how will competition help you when a rogue ISP breaks your service for 10% of your customers by throttling your service but putting Zoom in a fastlane? Your customers will not think "oh, I'd better switch to a better ISP," when ~10% of call participants are unintelligible. They will think, "oh, this new service sucks, I'm going to stick to Zoom."

Competitive pressure on ISPs does not protect nascent startups with small userbases from ISPs. And yet, everything we care about on the Internet started as a nascent startup with a small userbase.

Competition is great for keeping prices down and the US needs more of it. But to protect the long tail of startups and all the new ways people use the Internet from ISPs you need net neutrality laws.

1. https://dl.acm.org/doi/10.1145/2700055. Key finding: Relying on consumer switching behavior to provide more comprehensive competitive discipline was insufficient for a variety of reasons, including the presence of switching costs.

The cool solution I've seen to this problem is to have some process for identifying the class of people who are affected by [locally burdensome thing] and then allowing the proponents (a business, the government, etc.) to negotiate some settlement with that affected class directly, with a majority vote used to accept the settlement.

For example, everyone near the airport could get some property tax relief or share of an annual payment that would go away if the airport went away.

This way a small minority of vocal opponents cannot effectively oppose something that would be good for everyone, but if something is irredeemably terrible and unfair locally affected people can block it.

Only if either:

a) the airport is far from any other humans b) the horde of humans your airport angers do not also ignore regulations OR your airport has its own sufficiently large private army

I feel that worry too, but I can validate his advice, somewhat.

I'm 44 and spent most of my career working individually and with my closest friends on projects that felt interesting, and it went really well for us in all of the ways. I also met these friends at a selective school, though it was a state-funded high school (massacademy.org), not a university.

Also, someone once came to my very conventional elementary school in 5th grade on career day to talk about a very unconventional career path (being a full-time peace activist) and this had a huge impact on me, both because it validated activism as a career and perhaps more importantly because it validated not having a normal job.

Getting a very short lecture in school from an interesting non-teacher can be at least very memorable and perhaps life-changing.

The US came very close to passing similar legislation recently and it still could. This bill had bipartisan support. Apple was able to kill it using relationships with leadership, but the votes were there. My organization Fight for the Future worked on lobbying for this, and while it's super difficult to pass legislation over big company opposition, it's not impossible. We can have similar rules in the US if we keep pushing.

https://en.wikipedia.org/wiki/Open_App_Markets_Act

But in reality capitalism does coexist alongside other value systems, no?

Purdue Pharma (opiates) is a good example of a company following its incentives that eventually was brought down for violating broader common sense values.

The values Apple are violating come close to being just as widely held ("something I buy should be mine") though perhaps you need some expertise or professional experience with tech to see the violation clearly enough to be as horrified.

Still, values held within communities of experts (like this one) can also have the power to correct incentive-chasing behavior when it runs amok, if only because sufficient misbehavior can make it harder to hire and retain the best experts. So it's wonderful this conversation is happening here!

One thing I was thinking recently is that if we get sufficiently good at humanoid robots, perhaps it will be within reach to build a robot around a human that can put arbitrary pressure on different parts of the body sufficient to create the feeling of soccer, jujitsu, or even sex. This is probably a 10-100x harder robot to make than a humanoid robot. But it seems more straightforward than a HBI capable of full VR.

When I talked through the game theory of BlueSky with the founder, it seemed that it would tend more towards competition between a few large services with fairly nuanced and predictable moderation policies. It is very easy to move your account and your followers to a new server, so if a big server started operating in the way you describe a large exodus would happen fairly quickly. But you have to make sure you are on a server that isn't being blocked by the other large servers, e.g. Donald Trump's server, some spammer's server, or a server that is difficult to distinguish from a spammer (like your own small server) so there will be an incentive for popular accounts that value their reach to stay on big servers shared by many other popular accounts that are hard to block without users noticing.

So, the situation isn't so bleak as you describe, but also, yeah, controlling the website or app called "Bluesky" is still a moat (until it's not!)

The fact that someone can screenshot something does not make deletion not real. Deletion is still valuable for many threat models and day-to-day situations humans run into.

As someone working on a p2p app that has done a lot of user research, I see it as a really good sign when a federated/p2p systems prioritize deletion, because I know based on my own research that it's something users care about and ask for.

The sample conversations here are hilarious, especially compared to the typical academic or corporate AI paper.

Another possible explanation for this skew is that TikTok and IG are primarily video platforms.

The videos of destruction and death in Gaza are far more horrific than corresponding videos in Israel, because the scale of what Israel is doing to Gaza is so much greater than what Gaza has done to Israel.

Another way of saying it is, it makes sense that someone who spends hours on apps optimized for empathy-based addiction would be more sympathetic to Gazans than someone who reads the newspaper or watches talking heads on TV news, since the latter portray the occupation as a two-sided tit for tat.

Maybe they're doing it because it's the right thing to do, and because they'd like people to trust them.

Also: https://techcrunch.com/2023/07/11/teen-and-mom-plead-guilty-...

They must be able to do good targeted advertising without message contents, with public likes and other data on scrolling behavior, especially as AI tools improve. Maybe having this data is more trouble than it's worth. Data is a liability as well as an asset.

Same experience with Google Assistant on Android. I used to be able to use it to create calendar events in one shot. A few years ago it started insisting on creating events in steps, which always failed miserably.

That would tip the balance of power to another corrupting influence. Corporations, say. Or professional associations representing highly-educated high earners like doctors or lawyers. Or to politically savvy deca-millionaires who use their money with more focused attention. And that's setting aside the question of how and whether you could prevent the existence of billionaires, which would lead to offshoring and (plausibly at least) dramatic unintended changes in what kinds of social and technological change happens. But either way, coalitions corrupting institutions is not a soluble problem generally. It gets solved with acts of effort and courage like this one, and by discussions like this.

Given that this feature would have to be real-time and robust, and given what we know about how AI inference works, I think we can assume that the mechanism will be running locally on the car.

Otherwise you'd be able to drive drunk when out of cellphone range, drive drunk by messing with your car's antenna, drive drunk during system downtime, etc.

It seems plausible that car manufacturers will keep "kill-switch triggered" events local, if only because it's a huge liability, or because of the sentiment behind articles like these.

I think the more interesting question here is a discussion about the public policy tradeoffs of a local-only drunk driving kill-switch.

Cons: lack of user control over their own software and hardware, a slippery slope, cars will be self-driving on a roughly similar timeline anyway, and false-positive edge cases, like someone having a medical emergency getting blocked for driving weird on the way to the hospital.

Pros: 100s of lives saved in the first years, ~100,000s lives saved globally after full global saturation, a reduction in the need for drunk driving enforcement (which itself is extremely totalitarian, with traffic stops, checkpoints, court fees, jail time, suspended licenses, manslaughter convictions, lost jobs, etc.)

I lean against on software freedom principles alone, but it's an interesting decision space, because it's easy to limit specific harms and there is a lot to be gained, even in pure liberty terms. A world where someone who blacked out wakes up with a manslaughter or murder charge does not feel entirely free or fair either, since the conscious action they took was "drink until lose control of drinking." Many of us would rather get pulled over by their car than by a cop, I suspect.

With enough fusion generator, water, lighting, robots, building materials, and seeds, you can grow all of that stuff pretty easily anywhere. Maybe you'd even be able to download and print the seeds.

It's not so implausible, actually.

"In 2019, 88% of the time L.A. County sheriff’s officers spent on stops was for officer-initiated stops rather than in response to calls. The overwhelming majority of that time – 79% – was spent on traffic violations. By contrast, just 11% of those hours was spent on stops based on reasonable suspicion of a crime." [1]

If police are mostly spending their time doing discretionary traffic stops, and using a criteria for those stops that ignores most white drivers, then "Pretty much all they do is harass and commit violence towards minorities" is accurate, at least in terms of time spent.

It could be simultaneously true that LA County sheriffs spend somewhere between 0.1% and 5% of their time playing a crucial role in society. It would be great to know whether this was true!

1. https://www.reuters.com/legal/government/police-are-not-prim...