jkp56

It's one cat and millions of mice that multiply rapidly. Ads networks that use random unpredictable domains are intractable by the static blacklist approach. Not only that: ads networks can watch the public blacklist and adjust their domains accordingly. If declarative API was about security, Apple would rather block network access for adblockers.

Agreed about Firefox. My goal here is to call out the hypocrisy of the declarative API. So I want to repeat myself that the declarative API is about giving ads networks an easy way to not get blocked, while using performance and security as false arguments that impress only those who know nothing about performance and security.

Which is same as banning ad blockers. With the declarative API you can't know what domains this website connects to and you can't prevent it from connecting to bad domains. Moreover, trackers and ads can choose a random domain to completely avoid any blacklists.

I don't understand your point. It doesn't matter what the language is: JS, Lua, Python, C++ or even Rust. What matters is the API the extension has access to: tab URLs, web requests, storage, network, DOM read only or read write. Just like in mobile apps: it doesn't matter what language it's written in. It only matters what system apis it has access to.

Everybody misses the point.

The declarative API takes control away from the user. Currently you can block everything except the useful content. With the declarative API you can block only trackers A, B and C, but not C and D, because C and D weren't added to the global list of trackers. Moreover, you won't even know that C and D exist. With the declarative api, trackers get a trivial way to bypass adblocking: they can just change the domain name. This is the true goal of declarative API, not performance or security.

Why does the declarative API still allow to monitor your traffic? This sort of contradicts the security selling point, right? Because corporate users need to monitor activity of their employees: they install a corp extension that monitors traffic. They don't need to block anything, but they need the monitoring ability.

The argument that adblockers can route all your traffic thru their servers simply doesn't stand. If this was a concern, the browser could refine the permissions model: an extension can monitor and block any traffic, but it doesn't have access to the internet. Just like in Android you can uncheck the camera and mic permissions for any app. Problem solved.

This law is a step in the right direction, although in its current form it's toothless and uses disgustingly submissive language (e.g. the user may not out or the user needs to be informed about how theur data is going to be abused). The final goal of such laws should be to poison user data: so that collecting it and storing would open all sorts of legal and criminal troubles and that no company would want to touch user data with even 10 foot pole. This will open more ethical business opportunities that currently can't compete with data mining model. An analogy in real world. If theft and robberry was legal, no other business model could exist: if you sell gas for 3 bucks a gallon and your neighbor sells it for a negative price, but sells user address to theft agencies, you'd be out of business long before everybody realises the true cost of that "free" gas.

I'm an expert. The correct answer is to not log any PII data. Logging obvious PII because it might be useful in some hypothetical future sounds like plain incompetence. If you really need to log PII, log it separately and set clear policies about how this data is stored, how it's replicated, who can access it. If you need to log some PII IDs in common logs, use some fuzzy hashing: good enough for logs, not good enough to restore the original PII.

This is plain truth, not nonsense. You can go and start a corporation any time. If it appears successful, you need to hire a CEO and a bunch of other people. At that time you'll own nearly all preferred shares that give control. Despite CEO will get maybe 5% and will run the company, according to laws, preferreds will give you a final say in everything and you can fire that CEO at any time. This is even more true with big execs: they hold nowhere near 5%.

Brad Smith clearly wants to corner software engineers and leave them no choice, but to unionize. I understand that this is not Brad's idea and he just delivered the message from the MS board meeting.

However the big tech does need regulation and this regulation is called GDPR. We need laws that make it a criminal offense to use user data without an explicit written consent in a standard form set by law per each use of this data.

Neither engineers not execs really make decisions to be good or evil. They implement the will of major shareholders who actually run the company. Satya Nadella has maybe 100s of millions, while the capitalization of MS is 1 trillion. This means that Satya isn't the decision maker. Only in small companies CEO and the owner is the same person.

I was told by a Google HR that on average a candidate tries 4 times before passing the interview. That's believable because when any of the 5 interviewers saying "probably not" translates to a no hire, stars really need to align even for stellar candidates.