jeroenhd

An associate state is not a member state. It's a funny name to give a country with a specific kind of trade deal and understanding.

Mercosur, sanctions against Russia and Belarus, defence of France after the AUKUS fiasco, an intent to cut down reliance on natural gas, an ethics commission following the Qatari corruption scandal, the European green deal, European defence plans, she's done plenty of good.

She's also done plenty of bad things on the political theatre, but it's not like everything she does is destined to be a failure.

It would be rather foolish, but they can continue using the GBP. Or they can start using the Euro before joining. They wouldn't be able to mint their currency, but plenty of small (often island) nations use foreign currency already.

Scotland is already a separate country, technically speaking, so I don't think it's comparable with the Basque situation. Furthermore, with the UK leaving the EU, they've opened doors that non-EU members can't use to work around such issues.

I don't think it'll happen soon, but the desire for independence does seem to be there to a significant extent already: https://www.telegraph.co.uk/politics/2026/09/13/irish-scots-...

The largest problem for an independent Scotland trying to join the EU would probably be that the EU doesn't just let anyone join. You need to have a strong enough economy and a grip on national debt to join.

The collapse of the USA as the world leader was already happening, but plenty of countries were under the impression the USA and the other western countries were working together to save the sinking ship.

The USA did plenty of offensive stuff before that (like a full campaign labeling the French as cowards for not supporting their baseless war in the middle east), but it took until Trump and his unhinged behaviour for the world to see how bad the situation really was.

The US invaded South America and is treatening to invade Greenland, just like Russia is invading Ukraine.

The EU is offering enhanced trade relations with Canada and Georgia.

Those are completely different things.

They won't need to if they start electing normal politicians and put in the effort to fix the damage they've done over the past decade.

Calling for Canada playing "under the wings of the US" is like calling for Ukraine to play "under the wings of Russia".

The US government has repeatedly called for invasion of Canada. Canada would be insane not to find allies against the American threat.

It all depends on when or if Apple actually activates this system. Unless Apple can prove when a compromise first took place, they would have to retro-actively classify all iPhone pictures taken before discovery of such an exploit as "potentially fake".

Plenty of certification bodies refuse to revoke their given certifications because of brand damage or effects on their customers. That's why cryptographic verification of things like Secure Boot are basically broken on most systems by default.

If an independent security researcher does it and Apple rolls out fixes a month later, I can see it happening. If it turns out a government agency hacked the platform "at some point", I have my doubts Apple will retroactively reject all of their iPhones' signatures.

The lower bound is specified by the device, you don't need support from the timestamping server for that. Determining if this timestamp is or isn't suspicious can be done at verification time. The timestamping feature itself makes sense from a verification perspective (though the privacy implications are questionable, of course), but I don't think it necessitates an Apple-specific setup.

This approach does have one benefit, which is that Apple gets all the (meta)data to determine if something is or isn't "real", rather than letting the verifier decide beforehand.

I can only imagine the outrage if Google or Microsoft added a "upload all of your photos to us and we will mark them are real or fake" protocol, even with all of the verified compute gaff.

A bunch of them already offer one. Have been a while, actually; the S25 and Pixel 10 came with exactly this.

The timestamping server is the hard part, especially with the verified compute component. It's just not something I see Samsung doing.

I expect Google to show up with a blog post titled "extending C2PA with timestamps for industry-leading authenticity confirmation" any time.

You'd need to jailbreak the camera sensor chip and the phone's secure element. Which isn't exactly impossible either, but it's harder. I don't think it has been done yet (but I'm sure it will be at some point).

That's also why the approach is fundamentally flawed. The open-ish C2PA protocol has been "defeated" by tricking phones into signing arbitrary data already. The even-more-closed Apple version can be defeated the same way and relies on Apple to be the sole arbiter of truth.

By the time you made your comment, such a system had already been invented, even partially rolled out: https://en.wikipedia.org/wiki/Content_Credentials

Apple's protocol differs in that it requires a timestamping server to sign the file and centralising Apple as the single arbiter of truth. An excellent addition, if you trust Apple and the governments they're friendly with (I don't, especially the latter part).

That's a lot of words to say "we re-invented C2PA but made worse by getting our servers involved somehow".

Like with C2PA, the entire thing hinges on nobody being able to dump keys or trick the TPM into signing arbitrary image data. The timestamping server is a nice idea (though I don't see why they can't just use a normal timestamping server, I guess to keep control over the protocol) but it doesn't solve the fundamental problem that defeated C2PA.

Apple can hold the AI customers hostage by locking this level of AI integration to their app store, taking a 30% cut of AI subscriptions while at the same time having someone else fix the reputation of their devices' voice assistant for them.

There's profit to be made by offering customers choices here, I'm sure Apple will be ready to scoop up all of those delicious slop dollars.

WhatsApp doesn't even have the option to disable e2ee anymore and it's doing just fine, despite their best efforts to screw over their customers.

So was RCS, until Google resurrected its rotting corpse and made it the default messenger for billions.

All we need is for a billion dollar company to build their own implementation and XMPP can be back once more. Exactly the way it gained popularity back in the day.

Based on web browser statistics I've seen, most people use Chrome, some of them use Safari on their phones. There are also people who use Edge sometimes.

But most people seem to use Chrome on every device, no matter how much I wish they didn't.

To be fair, dead birds don't tend to migrate as much (unless they're helped along and stored in a cooler, if you call that migration).

Depending on your needs, XMPP or Matrix are probably your best bet. Both have different clients of varying usability and quality on different platforms, so you have to pick your poison. If E2EE is important, you also need to determine how encrypted you want your messages to be (as both XMPP and Matrix carry quite a bit of identifying metadata in its unencrypted headers).

For most people and use cases, either will probably do, but if you're a human rights activist or journalist in an oppressive country, I'd stick to Signal.

Matrix is a vastly different protocol with vastly different privacy implications. Things like leaking reaction metadata outside of the encrypted envelope (though there finally is an MSC to fix that) should make that obvious. Matrix is cool tech and I use it every day, but comparing Matrix to Signal doesn't make much sense. You can't do what Signal does with Matrix or XMPP, simply because the lack of federation affords privacy and security advantages that federated protocols cannot support.

As for Moxie's post: all three points feel completely valid for a service they're offering for free. Moxie does know better than most users (most users don't know the first thing about software, programming, protocol design, or UX design) and it's a companies choices that drive users to their platform in the first place. Users who don't like it can choose from the dozens of other chat apps instead.

As for the second point, Matrix's ever-moving target of a protocol makes selecting a client or server that covers all of your needs a massive pain. Currently, Matrix's primary server software, Synapse (which is also at the base of the matrix.org server many people default to when joining the network), is violating the Matrix protocol, making it impossible to invite users to chat if they are on compliant Matrix servers. On the XMPP side, there are two different methods of achieving E2EE communication, with seemingly no standard mechanism to support the use case "I want to log in to my chat on my laptop and be able to decrypt the messages in the group chat". I can't blame Signal for not wanting to deal with issues like that. One piece of server software, one set of client versions, with fixes ready to deploy when they're called for: Signal's current design saves a lot of time and effort.

As for the third point, that's part of the reason I use Signal in the first place. I like federated networks as much as the next nerd and I like open standards even more, but the decisiveness behind the company, even when I disagree with their decisions sometimes, is what makes it clear what you can and cannot expect.

On the XMPP defence: yes, I believe what they are saying, XMPP could in theory be a good product, just like Matrix could be, and like Signal is. However, currently, it isn't. XMPP is currently losing in terms of public marketshare to Matrix, which I also wouldn't exactly call a great success.

A lot of chess.com information is public (by default) if you know someone's profile. Stuff a couple million email addresses and phone numbers into the "find friend" API and all you need to get profile information is the associated account username.

Chess.com should probably prevent scraping, but as we can read in just about every comment thread about LLMs/Cloudflare/Anubis/Go-away, that's not as easy as it sounds these days.

I would feel the same way if these people weren't installing a permanent surveillance camera.

I don't think it's fair to cry harassment if you're getting filmed setting up the harassment machine.

If anything, Americans are being too nice to Flock. We're watching the villain and setup of a 1980s dystopian scifi horror, except there's no unlikely hero who can save the world by shooting a single weirdo in a suit on top of a skyscraper.

> FortiClient VPN and SmartVPN have 4,134,648 cumulative Google Play installs between them, while Google reports more than 3 billion active Android devices.

A very strange way to reason about killing an API instead of fixing the VPN issue (as someone from Google already suggested they're planning on doing). "Only 4 million people use this, we should kill it" is exactly the kind of reasoning Microsoft in the 2000s would use to kill the ability to install Linux on a PC.

That seems like a good trick to me if you want to prevent people from installing spyware without any obvious signs.

You can almost hide the warnings (there's one small notification in the bottom of the notification tray you can't disable) and on some phones even the VPN icon, but you can't hide the new lock screen code your victim suddenly needs to enter to use their phone.

It used to be that Android showed random popups and notifications about identified security risks, which were awfully annoying if you have a private CA certificate installed. Luckily Google got rid of those.

In my experience, you can also set up biometrics on basically every phone, and Google has a few "don't lock the phone while it's with you in your pocket" like services you can optionally enable as well. Your backup PIN doesn't have to be four numbers, you can put a whole passphrase in there if you want it to be secure.

You could also do facial unlock. Less secure than Apple's implementation but more than good enough if you didn't have any lock screen set before that.

It's technically possible but very unlikely. Running TTS continuously is a big battery drain and slows down the rest of the phone while you're using it. Google has a live TTS service for hearing impaired which I've run for a while to test it, and even with it practically built into the OS it's sucking up battery like you'd expect it to.

It's more likely that this is all due to external forces. Having your device on the same network, in close enough proximity to detect each other, for instance, combined with one of your friends having Googled the stuff you were talking about.

Or just basic data collection. There's the classic story about how supermarkets know you're pregnant before you do, just based on the groceries you buy (no, not pregnancy tests). Ad networks buy and collect a humongous amount of information about everyone and serve ultra specific targeted ads based on nothing more than pattern matching based on what the rest of humanity is doing.

It's impossible to rule out that the thing did run a 24/7 TTS service, but I think the depressing fact that ad networks don't need to listen to our conversations to know what we're talking about is more probable.

Some are friends with politicians

No need for more regulation, is there? A company used its infrastructure to orchestrate a cyber attack. Arrest the people running the company.

If you make money trying to resell Google's free services and data, this is a disaster.

As a regular user, it's a minor annoyance.

These days with cryptenroll and friends, using the TPM is hardly an issue anymore. LVM and swapfiles both work well if you just create one large "everything but EFI" encrypted volume.

You'd need to keep secure boot on, preferably with your own keys loaded, to get all of the benefits, and that's a bit harder to automate.

Windows does all of this and more. It's harder on Linux because of a lack of tooling/interest/business incentives, and because on average Linux users want more control over their hardware than Windows users.