Hizonner

> More and more people agree that kids shouldn’t be on modern social media, including me.

Has it occurred to you that nobody cares, or should care, about your opinions about what other people and other people's kids do? You and the "more and more" people who agree with you are cordially invited to fuck off.

> The solution is to propose ways to block kids from modern social media (that actually works) without mass surveillance.

The solution is for you to get over your bullshit, not to chase impossible pipe dreams.

> What would be a better way to incorporate AI as a spell checker?

Don't do a stupid thing like that in the first place.

> In comparison to non-AI traditional tools, AI has the advantage of "understanding" the text, reducing the number of "stupid" mis-corrections.

I doubt it, but if that's true, run a normal spell checker, and then give the output to your LLM to filter.

> what is there to gain by interfacing it with traditional solutions,

About a billionfold improvement in compute efficiency, and a lower error rate.

> and how can it be achieved?

10 seconds of actual thought.

It's amazing what practice and investment can do, even for a fragile system like X.509. Yet certs still break constantly. Like permanently killing people's "perpetual" Microsoft Word licenses in a story posted within hours of this one.

> Stop blaming the users when it's literally the company that's violating the contract/agreement (and potentially violating the law).

Why not both? I mean, if you leave your keys in your car and the window down, the car thief is definitely the one who should go to jail, but you're still an idiot.

I do agree that you have to be a special kind of stupid to take people to task for trusting Microsoft "perpetual" licenses while yourself trusting Google much more. I mean, just using Google in the first place is even dumber than buying the Microsoft license, but that's above and beyond the call.

> It is too fragile (multiple point of failure).

If your DNS isn't working, you're not going to be making connections anyway. And if you can't keep DNSSEC running, you can't keep certs up to date either. DNSSEC is actually much simpler, with fewer failure points, once you set it up.

> It is high volume (=it need be cacheable).

It is. Unlike certificates. And the cache lifetimes are much shorter than typical certificate lifetimes.

You mean under the control of the commissions, councils, boards, etc that are being elected in these very elections? Elections in which many actual humans may not be paying attention to positions on "arcane" land use rules, but the non-human legal entities in question (or their managers) will be?

I think I'm just gonna repost this recent link here... https://www.antipope.org/charlie/blog-static/fiction/acceler...

... and if they own 50 houses, each through a separate LLC, they can vote 50 times, even if they do not in fact even live in the area.

... and you can probably come up with a legal way to permanently bind a corporation to vote according to specific rules.

... and larger corporations have totally inhuman internal decision making processes that frequently arrive at conclusions no human would reach.

How about fuck absentee landlords, especially if they're not actually people?

> I'd rather try and get the executives, product managers, and engineers who implemented it fired

How has that been working out for you? Apparently you have some avenue to apply pressure for that, other than the obvious one of not buying the tickets.

Why should anybody fire them, given that their actions have caused no actual harm to the bottom line? Obviously the ticket buyers don't care, so why should management or owners care?

> and elect politicians that will make policies like that illegal.

Sounds great. Who do I vote for?

... and you continue to let them abuse you.

... except that you should be enraged at the title "Judge" being applied to administrative hearing officers.

Of course, you should also be enraged at administrative hearing officers being fired for doing their jobs correctly.

I'm pretty sure I had something very similar A/Bed at me by Bing the other day.

You know what I really miss? Being able to type a literal string in quotes and get pages that had that actual string on them. That's what I really miss.

The difference between Manfred and the influencers we have now was that he actually invented things, built things, and brokered huge deals while streaming everything.

I'm happy to report that my timing attacks have succeeded in accessing this simulation's substrate. Lobsters are reviewing my paper.

... but not the form of policy they actually have.

Except for payments to specifically sanctioned organizations, the policy is "we'd really rather you didn't do that, but whatever".

The specific sanctions don't cover most of the groups, either, and even when they do cover the group who got paid, you can't necessarily prove the people who got paid were the ones on the list. And there may be a scienter requirement even then; I don't know.

Making a list of specific criminals you can't pay is just stupid. No ransoms, ever, period, or it's da slammah.

> 1) the chief patrol agent has to set the distance to encompass an inappropriately large area in violation of this law,

Certain to happen.

> 2) an agent has to stop and search cars randomly,

Not at all. "Based on my training and experience, Mexicans drive Subarus. Your driving a Subaru gives me a reasonable suspicion to conduct a non-random stop on you.". Yes, it gets very close to that stupid, and a lot of times they even believe stuff like that. Even if they don't believe it, they know the lie isn't falsifiable. A system that lets random officers get away with unreviewed searches is a problem even if they do have to commit perjury to take advantage of it. Because they will.

> 3) somehow become suspicious that an occupant is seeking entry and ought to be denied entry,

Well, yeah, they're sitting right there in the freaking Subaru. Boom. Reasonable suspicion.

> 4) believe that searching that person's device would reveal information demonstrating that the suspicion is correct.

Well, if the suspicion were correct, it probably would. And if the suspicion is incorrect, even if the suspicion is a deliberate bullshit lie, anything they do find becomes fair game.

Sorry, no. Probable cause. And independent judicial review on your probable cause. Not trivial legitimization of totall bullshit suspicions.

... except that "policies" don't cut it. Criminal penalties for paying are what you need, and not just for payments to specific designated entities, either. The executive making the decision to pay has to have a real fear of personally spending time in actual prison.

> It's not a coup if the president isn't replaced...

... or even inconvenienced.

Incredibly stupid article.

> it'll become common/forced practice to pre-scan code.

You'd think.

But then you'd think people would do a lot of other things too. I hope, I guess.

The other danger is that "the cloud" may become even more overwhelmingly dominant. Which of course has its own large security costs.

> UUIDv4 is explicitly forbidden for a lot of high-assurance and high-reliability software systems for this reason.

Hmm. What do those systems do for cryptography? Just assume it won't work and not rely on it at all?

> With skill, and usually not consistently and systematically.

How do you know? If the people who like to crow about vulnerabilities aren't doing it, it doesn't mean that the people who are actually in a position to exploit them systematically and effectively aren't doing it.

Those embargoes have always been dangerous, because they create a false sense of security. But, as you point out...

> With AI, anyone can do this to any software.

Yep. Even if it hadn't been true before, it's clear that now you just have to assume that everybody relevant will immediately recognize the security impact of any patch that gets published. That includes both bugs fixed and bugs introduced.

... and as the AI gets better, you're going to have to assume that you don't even have to publish a patch. Or source code. Within way less time than it's going to take people to admit it and adjust, any vulnerability in any software available for inspection is going to be instant public knowledge. Or at least public among anybody who matters.

It's a near certainty that something is badly wrong with the RNG, and, yes, probably in how it's seeded.

It's probably messing up the cryptography, too.

> Uhm no the whole point of captchas is that it requires (or used to anyway) humans to solve them, thus limiting the rate to human speeds.

The CAPTCHA challenge page itself has to be served to a client that has not yet given any evidence that it's not a bot. It's just as expensive to serve the challenge page as it is to serve a cookie-setting page. Bots can infinitely retrieve the challenge page (and can also infinitely try to retrieve the underlying "authenticated" page, forcing you to process redirects).

The only reason it looks better to you is that a third party is serving the CAPTCHA. You could also have a third party serve the cookie-setting page.

How do you "determine" individual clients to show them CAPTCHAs? Yes, you can, and probably should, make some use of IP addresses, although that would work better if idiots hadn't polluted the Internet with quite so much NAT.

But you don't have to, and you definitely don't have to completely rely on it. Look for a cookie. If you don't see it, route the client through a page that sets it.

Yes, this is subject to flooding attacks... in exactly the same way that every CAPTCHA system is subject to flooding attacks. But it actually uses fewer resources per request than showing the CAPTCHA would.

Rate limit individual clients.

Depends on your specific problem. Usually redesign your system not to need to care if the other end is a bot or not.

I'm not a heart surgery hobbyist, therefore I don't chop people's chests open, no matter who suggests it.

... which is why you'll get locked out if you happen to visit an unusual number of sites in a day.

... You... think... it would be a good thing.

Don't you...