quatrefoil

Guest mode does not honor your settings. It mostly defaults to install-time configuration.

Incognito mode is fine. It doesn't persist data, it doesn't give websites access to existing main-profile data (cookies, etc), and it actually honors the settings of the profile it was spawned from.

None of this robustly prevents fingerprinting, but neither does switching to another browser or wiping your profile clean. There's just a bunch of system and network characteristics that leak info because of how the web is designed. Google didn't make it so and I don't think they're using it to serve you ads.

I think two things can simultaneously be true. Google's privacy practices aren't great, and they weren't actually doing anything that a reasonable person wouldn't expect to be happening in incognito. This was a lawsuit filed to shake them down, not to benefit the consumer. And apparently, it was flimsy enough that it started with a $5B demand, and is ending with no payout at all.

I don't think your comment is accurate. The formulas appear to be DFT and IDFT, in line with:

https://home.engineering.iastate.edu/~julied/classes/ee524/L...

If the exploit wasn't baing used, the odds would would be pretty low. They picked the right place to bury it (i.e., effectively outside the codebase, where no auditor ever looks).

That said, if you're not using it, it defeats the purpose. And the more you're using it, the higher the likelihood you will be detected down the line. Compare to Solarwinds.

You're comparing to medians; is this a median crime?

A browser is one of the most consequential attack surfaces in the lives of billions of people. Redis isn't. Having proofs where said proofs don't matter much in the first place is not a particularly good use of our time. And FWIW, the correctness specs for Redis would be pretty intractable too.

That's a pretty cynical take. I think a more profound problem is that formal specifications for software are fairly intractable.

For a bridge, you specify that it needs to withstand specific static and dynamic loads, plus several other things like that. Once you have the a handful of formulas sorted out, you can design thousands of bridges the same way; most of the implementation details, such as which color they paint it, don't matter much. I'm not talking out of my butt: I had a car bridge built and still have all the engineering plans. There's a lot of knowledge that goes into making them, but the resulting specification is surprisingly small.

Now try to formally specify a browser. The complexity of the specification will probably rival the complexity of implementation itself. You can break it into small state machines and work with that, but if you prove the correctness of 10,000 state machines, what did you actually prove about the big picture?

If you want to eliminate security issues, what does it even mean that a browser is secure? It runs code from the internet. It reads and writes files. I talks directly to hardware. We have some intuitive sense of what it's supposed and not supposed to do, but now write this down as math...

Request deletion from backend brokers? Many have some mechanisms for opt-out, either in general or for people in specific states (e.g., California).

Not really. There's a fairly small and stable number of companies that actually collect and resell information about you. There is also about a zillion ephemeral web front ends that republish this data, however. I suspect this is done for a reason, but a bit of sleuthing quickly reveals who the big players are.

These "data removal" services spend a lot of effort going after the frontends, which is pretty self-serving: they can show the customer that there's something new to remove every single month or quarter, so you have to keep paying forever.

There are commercial influencing operations on Reddit, but I think what you're describing doesn't really affect the usual user experience.

I suspect that the objective of these bulk spamming operations isn't to promote stuff on the platform, but to mess with other apps. LLMs trained on Reddit content, search engines that rank Reddit posts highly, etc.

Scraping is a lot more dicey than using an official API. Why did Google enter that partnership? They have the data in their index. The only conceivable reason is that they prefer to pay Reddit to avoid the risk of litigating it and ending up with some unfavorable precedent.

The API situation seemed baffling to me at the time. The timing wasn't coincidental and it was clear that they were responding to people training LLMs on the Reddit corpus.

But here's the thing: prevailing HN sentiments notwithstanding, your average Redditor leans left and is fairly anti-big-tech, so Reddit could have leveraged this angle. They could've said it's a pro-user move to stop OpenAI and the likes from unfairly profiting off your work. And most users would have applauded.

But Reddit didn't say that. They took a PR hit and decided to wait it out. The cynical explanation was that they were actually just trying to get some of that LLM money for themselves. And not long ago, they announced a big deal with Google to give access to user data for training purposes: https://www.reuters.com/technology/reddit-ai-content-licensi...

Frankly, I was on the fence about the API access thing until the motivation became clear.

I'm guessing the plan is to cast a wide net, then hope that you can dredge up some incriminating or morally ambiguous quotes during discovery. When you have a company of 100,000+ people, there's probably some "haha we're killing the competition" in there, which you can then use to prop up the case.

And then either use that to win the trial, or force Apple into settling.

Right, and from all my friends who did take VC money: it's an incredibly demanding period of your life, a large proportion of which isn't about delivering on your vision. You're gonna learn a lot about office space leases, accounting, fundraising, customer pitches, etc. You're gonna have impatient VCs on your board, with the power to fire you, breathing down your neck. You won't be relaxing much and won't be spending that much time with family and non-work friends.

It's a valuable experience with a lot of potential upside in the long haul - but let's not pretend that it's less taxing than a cozy 9-to-5 tech job where your boss might ask you to update your OKRs once in a while.

I mean, we had this stuff for pets for a long time. The basic idea is that yes, it's a lipid-soluble neurotoxin. Because it is fat-soluble, it spreads throughout various tissues and lingers for a good while, which is these pet formulations last for weeks or months.

And yes, it is technically a mammal neurotoxin too, although our bodies are better at compartmentalizing and managing the risk. Similarly, you don't drop dead if exposed to caffeine or nicotine, even though they are insect neurotoxins produced by plants to kill bugs.

But it cracks me up that we are flipping out about herbicides such as glyphosate or 2,5-D - both of which are plant growth regulators that have no real mechanism to cause obvious harm in animals - but we're a lot more flippant with actual animal neurotoxins such as permethrin.

It feels like you're picking apart an argument I didn't make. But I would note that most people don't see this so unambiguously as the position you're defending. To give you an analogy: doxxing is "fair game" too if you posted your info online or gave it to others. But it's not exactly cool to do it, right? It's a subversion and abuse of the system we have in place.

Finally, here's a fun experiment: decide that terms of service don't matter and start building a product by scrapping Facebook or Google. See how they'd react. Actually, no need for guesswork - they clutched their pearls and threatened legal action more than once before. It's a bit of a "have your cake and eat it too" kind of a deal. Their data is precious intellectual property; your stuff is, well, up for grabs.

It takes deliberate effort, but I was actually able to get pieces of my writing out of one of the leading LLMs (not ChatGPT). This is not particularly unique, a number of folks demonstrated the same.

You make a lot of categorical assertions here, but I don't think they're really all that watertight. If any individual "economically harmed in an intellectually honest sense" if PG&E overcharges every subscriber five cents on every bill?

No, and a class action lawsuit against that practice doesn't make anyone better beyond "meaningless psychological satisfaction". But it's still something we do as a society, for good reasons, right?

Here, you have a number of commercial entities that are poised to make a ton of money off individually small but entirely non-consensual contributions of other people. You also have a "data laundering" industry where the datasets of webpages, books, and images are published by notionally non-profit entities that are in one way or another bankrolled by the commercial players, keeping their hands clean.

Framing the debate as being about "human progress" is sort of goofy in that world. We're not talking about academics tinkering with wacky ideas. We're talking about an industry that takes your work without asking and monetizes it. Yes, the sum of it is greater than the component pieces, but that doesn't mean you get to do whatever you want.

While a lot of attention has been given to books3, another large component of this dataset is the deceptively-named "OpenWebText2". What's that? It's a scrape of 15 years' worth of third-party websites that were linked to from upvoted Reddit submissions. I know this includes some of my writing.

Kafka was virtually unknown during his lifetime. It's unlikely that there was any expectation of profit. They probably just liked the writings and thought it would be a shame to destroy them.

It still boggles my mind how we managed to make it so politicized. I mean, there's really no clear reason I can pinpoint.

I was wearing a mask early on in the SF Bay Area. Back when the health authorities were saying that there's nothing to worry about and that masks don't help anyway. I remember so many people giving me the stink eye for no reason. I guess my behavior was the "anti-science", tinfoil-hat stance back then.

Then it all flipped on its head pretty much overnight. And when later, having been vaccinated and having had COVID, I stopped wearing a mask out in the open, I remember the same people getting angry at that. But if you traveled 50 miles outside the SF Bay Area, the reactions were exactly the opposite.

It just bugs me so much that we find ways to turn every single thing into a culture war. We go out of our way to find reasons to lash out against others. I'm not sure if social media is the source of it, but it sure provides a positive feedback loop.

My first thought: gosh, these knobs don't seem at all comfortable to operate.

Missed opportunity for a metaphor... "we're gonna need you to walk the plank".

But fundamentally, I don't think this is an indefensible stance. There are many industries that hire seasonally or for specific projects, and where the expectation is that you will need another job when the season is over / the task is done. Tech is actually pretty "seasonal", going through cycles of manic, excessive hiring and then belt-tightening and layoffs at the first sign of any headwinds. It's been like that for 30+ years.

The problem is that nobody is going to be honest with you. In fact, in the fat years, tech workers are coddled and told they're family. I can't really see the industry changing any time soon, so if you want to stay sane, just don't fall for the lies. By the end of the day, you're just a delivery guy for a very posh version of UPS.

Here's the thing, though: we, the general public, did this.

Up until the mid-2010s, the prevailing dogma within Google and at most other Big Tech companies was this spirit of "information libertarianism". We make all information accessible and useful, and the world gets better.

Around that time, a lot of pressure started to mount on tech companies for their complicity in bad things; the election of Donald Trump was a pretty major catalyst. So, all the companies responded to public pressure by building algorithmic fairness organizations. But because tech companies hire from specific backgrounds and in specific locations, and aren't particularly ideologically diverse, they converged on enforcing a worldview that aligns with their morality and their concerns.

Gemini is incredibly touchy about hot-button issues that animate progressive folks in the SF Bay Area and almost nowhere else. But then, we literally demanded Google and Facebook to become arbiters of morality - so what outcome were we hoping for?

I find it perfectly possible to be concerned about some aspects of the US penal system without implying its equivalency to the terror endured under one of the most oppressive political regimes in the world.

I don't think it's really about "the people in charge of deadlines". When you, as a senior engineer on the team, work crazy hours, all the junior folks on your team who look up to you (even simply because they also want a fancy job title down the line) copy that behavior. And then it becomes the new normal.

USPS owns and maintains some cluster mailboxes at apartment complexes and HOAs.

Religious norms and laws were the same for much of history. You could get stoned for adultery for a good while... The decoupling of the two is a pretty recent phenomenon.

For a while after, religious and secular norms still provided a fairly rigid template for how you're supposed to behave, but we dismantled a lot of that too. For good reasons, just with a lot of unforeseen consequences.

I don't think the phenomenon you're describing is a matter of replacing the old system with something completely different. The laws we're passing are a consequence of belief systems too. One of the beliefs is that businesses are inherently greedy / immoral / destructive. Another is that individuals are. For people who see the world that way, these beliefs are unfalsifiable, just like the belief in an adultery-hating god.

Appliance repairmen existed in the 1980s, we probably had more of them per capita than we do now, and they had their hands full. The idea that it's often easier to toss out an appliance than to repair it is a newer trend...

Have you honestly tried?

Product reviews were never the right place to look, because they don't get published after 10 years of use. But unlike in the 1970s, 1980s, or 1990s, you are one search away from appliance repairman forums that lay it bare.

I confess to not having done this when I first bought my LG appliances, but that's on me. And then when they broke and I called a number of SF Bay Area appliance repair shops and they all said "we don't touch LG", I had an epiphany.

I mean, it's cool to pin it on manufacturers trying to increase margins, or on "planned obsolescence" - but a lot of it is our doing. We're willingly enabling it. There are manufacturers that make simple and serviceable appliances; for example, most Frigidaire fridges don't have cool-looking displays, wifi connectivity, and other bells and whistles. But how many Frigidaire products are sold every year, compared to LG or Samsung? These brands are not only loaded to the brim with "smart" features, but many technicians refuse to work on them due to poor design and poor availability of parts. So when they break after 2-5 years, they are destined for the dump.

This day and age, the knowledge is at our fingertips. But when shopping, we select the appliance with the most futuristic LCD and that plugs into Alexa to notify us that the laundry is done...