Kadin

Forcing ByteDance to host the data in the US, on Oracle's servers or anyone else's, doesn't mean a lot if there are a bunch of people in China with the login to those servers. Who has access to the data and the various administrative controls over it are more important than where it physically resides.

ByteDance has claimed that their US operations were administratively firewalled from their Chinese ones, and then it's been repeatedly shown not to be the case. At this point they have lost all credibility about their ability to 'firewall' or internally control access to user data, probably because they (or certain parts of the company) don't really want to.

Yes, there is a private/direct messaging feature in TikTok that should of course be considered accessible to ByteDance, and by extension the Chinese government.

However, that is not the only valuable information.

The user behavioral profiles (which users have viewed what videos when, what do they engage with, what do they re-share to others) are valuable, particularly if you can de-anonymize them against account registration data. Also, the social graph of a big service like TT is a goldmine.

Both types of information are useful whether you're doing traditional espionage, targeted influence operations, or mass-influence/propaganda.

For traditional espionage, knowing what sort of content someone watches could give you direct insight into non-public aspects of their life that could be leveraged. (I.e. mental or physical illness, sexual interests, relationship problems, fringe political leanings, etc. etc.) There's a fair amount of not-exactly-porn but porn-adjacent stuff (and lots of health/wellness/lifestyle content) on TT that could give you leverage or at least ideas on how to approach someone if you wanted to convince them to pass information to you, provide access to something, etc.

The real value is in targeted influence ops, though. Find someone you want to influence, or a small subset of the population you want to influence, and drill down to figure out who their 'thought leaders' / opinion-setters are within their social circle. Figure out what kind of media engages them. Go after them indirectly via their friends/colleagues/family. TT is demographically limited right now, so you're probably not changing many Senators' votes directly, but you might be able to get their kids, their kids' friends, their junior staffers, etc. thinking a particular way. Done the right way, the actual influence target might never even need to be messaged-to directly. They'd get the full social-media 'Inception' treatment and probably think they came up with their opinion organically or by being in touch with the culture.

And then of course for mass-messaging/propaganda, you use the information in aggregate just like any big advertising company does, but for political ends, and without having to engage an actual advertising company that's going to create a tangible trail.

The Chinese government, like the US government or any other large national government, is not monolithic.

Having information available for easy perusal via a commercial channel (which is potentially not even illegal) is very different from having information accessible via use of national-asset intelligence capabilities. Information which can only be obtained the second way is almost certainly going to receive different treatment than the first.

There is value in making information more difficult (and more illegal, and less socially and politically acceptable) to access, even if that control is not 100% effective or if there are still ways of getting around it.

Increasing the friction involved in accessing personal information is an imperfect win, but a win nonetheless.

For most users of commercial software, your system is penetrable and should be considered insecure against a nation-state level attacker willing to spend a 0-day on getting in. But that doesn't mean you should just leave everything hanging out in the open where any doofus can get to it, or voluntarily hand your information over to an unfriendly government's partner corporation. At least make them work for it.

I paid a guy a bit under $200 to pull Ethernet cables from my basement up to the attic of my house.

Now I can keep heat-generating stuff like my storage server and the cable modem (surprisingly heat-intensive) in the basement, have a WiFi AP in the attic for great coverage in the yard, and I can easily drop lines down into rooms on the 2nd floor from above by just drilling a small hole in the top of a wall and feeding the Cat6 down, or put one into a 1st floor room by going up from the basement. Cat6 anywhere I want it, basically.

It's something I've wanted for years and held off doing because I knew I was capable of DIYing it, and therefore I hesitated to hire it out. This was dumb.

It took him an hour or so using various specialized tools ("fish bits", "fish tape", tall ladders, drywall saws, etc.), when it would have probably taken me the better part of a weekend and I wouldn't have done as clean of a job. He also knew from experience where the easiest place would be to get all the way from the basement to the attic, given my house's construction style.

Definitely worth the two bills, and also now I have a "wiring guy" for future projects. I've already called him back to help run wiring for PoE outdoor cameras, another thing I've wanted for years but haven't bothered to execute on.

Interesting. I think this shows what a change there's been in synthetic materials in the last 20 years.

The standard advice I used to hear was to never wear synthetics in hot climates, because they'd be terribly uncomfortable! Instead you were advised to wear only natural fibers in the heat, particularly cotton and linen, because they were more "breathable".

What I also find interesting is that many of the 'new' synthetics, including the "Bamboo" derived ones, are basically updated versions of Rayon, a fiber that had a terrible reputation in the 80s and 90s (and was typically associated with very cheap faux-silk clothing that was hard to wash and harder to keep unwrinkled). Some of my older family members were shocked to find out that the high-tech synthetics were made from wood pulp in a manner similar (although obviously much improved) to the 'manufactured silk' of the early/mid 20th century.

I just got issued a System76 at work and I thought I must have configured something wrong.

On one hand, I guess I'm glad it's not me; on the other hand, I wish it was just some dumb config toggle ("terrible_battery_life enable") that I could flip back to get more than a few hours of working time, or ~48 hours in my briefcase with the lid closed (!!!), before it was dead as a brick.

It's like the early 2000s all over again, where the battery just got you from one outlet to the next.

I feel bad even saying anything, because I like the company and Pop_OS and what they're trying to do in general. But damn, that's a big flaw to just ship products with in 2022.

Well, the alternative is probably paying some contractor a great deal of money for the same information.

Just think of all the taxpayer money you're saving!

Lots of the slides are just displayed as black for me.

Is that a browser issue, or are there embedded links to now-dead resources in the deck...?

(For instance, slides 51 and 52 are supposed to have content per the speaker's notes, but are just black in my version of the deck.)

The utility of home servers and server-like devices is limited by upstream bandwidth on asymmetric connections (virtually all home broadband except some fiber-based services). Not IP addressing.

Dynamic DNS has been around for decades and provides a solution if you really want to run a home server behind NAT. If someone wanted to market a home server box, they would just need to implement something like DDNS... and Plex basically does just that.

But most people have limited upstream bandwidth, such that it's impractical to serve much content from home, except maybe to yourself as a 'road warrior' via VPN, or video streams via Plex, stuff like that.

If home broadband was symmetric, even with NAT, we would see many more applications taking advantage of that upstream bandwidth.

> Facebook added 24MILLION new users in the same period

Of those 24M users, how many of them are people I care about or want to follow? I.e. not bots, not people on the other side of the planet, not people who don't have a language in common with me, etc. etc.

A network with 10,000 users, 10% of whom are interesting enough for me to want to follow, is much better than a network with 1M users but only 0.1% are people I'd care to interact with.

Mastodon has a nice feature where you can prove ownership of a link in your profile by setting a backlink on it (implying you at least control the content of that page).

So, if you don't want to set up your own Mastodon instance under your domain, you can instead link your Mastodon account to your homepage running on a domain of your choice. It's not something I bother to do, because I'm nobody important, but if I was e.g. Taylor Swift or something, I could show that my Mastodon account was affiliated with www.taylorswift.com, and thus give you a pretty good idea that I'm actually the real deal.

From the Edit Profile page on Mastodon (v3.5.3):

> You can verify yourself as the owner of the links in your profile metadata. For that, the linked website must contain a link back to your Mastodon profile. The link back must have a rel="me" attribute. The text content of the link does not matter.

No, the idea is that you block entire instances where the admins are lax about allowing spam or bot accounts.

If you run an instance and don't do active moderation and just let any putz sign up and post crap, you'll end up getting de-federated and your real users will probably leave (Masto makes it easy to migrate your stuff from one account to another).

This is one of the reasons why having lots of instances is a good thing, and one of the risks of Mastodon's federated structure is having a lot of users sign up to one or two big generic instances.

I'm hoping that more sites that have existing user communities will start offering Mastodon instances for their already-vetted users. The instance I use (SDF.org) is largely but not exclusively for existing SDF members, and this seems to work quite well. I don't know how the mainline Mastodon server's authentication system works, but hopefully it's reasonably straightforward to plug into an already-existing user database for auth purposes.

Google bungled the G+ rollout quite badly.

They seemed to forget that the thing that made Facebook gain traction initially was a very gradual rollout targeting affinity groups (colleges and college students) at first, with quasi-private networks, before they opened it up to everyone.

Google did the invite-only thing for a while but then IMO tried to grow too quickly too fast, and it felt like a Potemkin village situation.

My feeling is that if you want to launch a social network, you need to concentrate on an actual existing social group and get substantial penetration into that group, then slowly branch out. Trying to get anyone and everyone to sign up from the beginning is almost guaranteed failure, or at least a very hard uphill battle with trying to please everyone at once.

Yeah there are some UX optimizations that could probably be made...

OTOH, I can't think of many big-name mobile apps that don't have some issues with less-than-obvious long-press functionality. (Snapchat seems to literally do this shit on purpose, because it's "fun" apparently.)

IMO that's a general problem with mobile UX... long-press actions have zero affordance. There's no way to tell short of randomly long-pressing on stuff what's going to have an action associated with it.

Personally I hate the "toot" nomenclature. That's something you teach a toddler to say instead of "fart".

"Posts" forever and always.

Twitter didn't really have much of a discovery mechanism in its early years, and that's when it really built the userbase that is its main competitive advantage right now. I'm not sure that's a huge impediment, particularly since Twitter could be the de facto discovery mechanism for people on their way out the door ("Hey, I'm leaving for Mastodon, where I'll be foo@bar.org").

I do think there's an unmet demand for aggregator accounts on Mastodon right now, though. Like if I'm interested in esports (just f.ex.), there should probably be someone I could follow who boosts significant content related to that subject to aid people in finding new people to follow. (To be honest that probably already exists; like early Twitter, Mastodon is pretty tech heavy. There are a lot of gaps though.)

Most people are going to do that regardless.

It becomes not a question of whether to trust some for-profit company, but which one.

Many people feel, and I tend to agree, that Apple is a safer bet than Google, because Apple (at least, at the moment) makes its money via hardware and software sales, rather than advertising revenue. They have significant incentives to protect your data and not share it, in a way that an advertising-centric company like Google does not have.

Of course, as Apple gets into the ad business they will erode this advantage, whether actual or just perceived.

> All I am calling for is that punishment meets the crime. Not meets the crime and exceeds it in order to prevent unrelated parties from committing the same crime.

That doesn't make a lot of sense. The whole point of the criminal-justice system is to attempt to deter criminal behavior. It's practically definitional.

Although the systems have often been merged in recent times, many places (including some parts of the US) had two entirely separate court systems: a "court of law" for the enforcement of laws by the government, and the imposition of punitive sanctions to discourage behaviors by making them unprofitable to engage in, and "courts of equity" wherein individuals could bring suits directly against each other and where the judges had broad discretion to impose various remedies (e.g. specific performance).

An example would be if your neighbor stole one of your cows: the government (often in the form of a sheriff or magistrate or similar) could decide to go after them in a court of law, because having people stealing each others' livestock is socially corrosive, hence why it's illegal. But you as the owner of the cow could petition a court of equity for relief, independently of the government's decision to pursue action in a court of law. The court of equity's remedy might basically be "give back the cow", or if they had already eaten the cow, maybe they'd tell them to give you an equivalent cow instead.

There are a few US states that still maintain these dual systems: Delaware is the most well-known one, and its Court of Chancery deals with lots of contract disputes and such between private parties. Tennessee and a few other states are similar.

AFAICT the existence of courts of law (or their equivalents) are almost universal features of complex civilizations and probably governments generally.

If there's no punishment for breaking the law, you don't have laws, merely polite suggestions.

> I'm surprised the insurance will pay for this.

Yeah I'm a bit surprised by that, too. The negotiations with their insurer must have been really something. Only thing I can imagine is that they cut some sort of deal that makes it worth the insurance company not trying to fight with them over it. Maybe they have to basically pay it back over time with interest..?

Denying the Chinese access to American-designed parts broadens the competitive landscape, by forcing them to compete not just on supply chain, integration, and software, but also on chip design, in order to maintain parity in a key technology area.

This is advantageous to the US, or at least it's not as obviously disadvantageous as national competition centered on, say, manufacturing.

The US is never going to compete seriously with China on bulk/commodity manufacturing. But I think that there is a sense that we might have more of a shot competing in very advanced manufacturing (actual die fabrication; the manufacturing of high-end machinery and tooling for such; etc.) and in microprocessor design. Thus it makes sense to try to deny to China the fruits of those industries.

I would assume that the machinery used in high-end fabrication is probably a logical next step, if it's not export-controlled for one reason or another already. (If it's not, some arm-twisting might be required to get the Europeans to play ball, since I think a lot of that stuff is also made in, or made with significant submodules from, the EU.)

Apple made a fairly big deal of the fact that the G5 processor, when they started putting it into their machines (or maybe it was when they went to dual G5s?), had just recently stopped being export-controlled by virtue of being classified as a "supercomputer".

(What really happened was that the Feds revised the definition of "supercomputer", and suddenly the G5 configuration they were using didn't qualify anymore... it had nothing to do with anything Apple did, except perhaps lobbying for it so they could build computers in China.)

Well, sure: but if the company doesn't want to release the source code at a future date, they just... don't do it. That's sort of a separate problem. If you assume the company (or the developers, whatever) actually want to reveal the code, but just don't want to give it away to their competitors today, it seems like it would work.

One situation that seems relatively common is developers who are working on a commercial product who might want to see it open-sourced down the road. The developers (not the company) could prepare the source code on the company's hardware (i.e. where they normally do development), timelock-encrypt it, and then take it home with them or publish it somewhere. They would then have the assurance—since they actually prepared and encrypted the source code snapshot—of what's inside.

Average Joe Coder might not have the pull to get their company to agree to such a scheme, but I can imagine some very high-profile people might. E.g. if you're a recognized expert in your field (think John Carmack or someone of his stature in whatever niche you want), maybe you put a requirement for timelocked access to the code you write as a must-have in your consulting contracts. Then you would still be able to get work with private companies, but have some assurance that your work would be publishable and benefit the public down the road.

I'm sure you could probably even rig up some Git hook that timelock-encrypts every commit and pushes it to a public repo somewhere (Internet Archive, maybe?) that's expected to be available for a good long while.

This is something that I think has basically flown under the radar of mainstream understanding: you can now live "off the grid" and have many of the perks that used to be the domain of grid-connected living.

Not all of them... but "off grid" no longer means living like Ted Kaczynski. The popular understanding has yet to catch up.

You can have artificial lighting all night long (thanks to LEDs and batteries), computers (ideally you want to avoid the DC -> AC -> DC conversion), Internet access (although most satellite systems aren't really optimized for low power yet), running water (solar-powered pumps, cheap large-capacity plastic storage totes), etc.

The items that are still hard to get, because of their inherently energy-intensive nature, are hot water out of the tap on demand, and interior climate control (space heating especially). You need a pretty big solar array and battery system to run even a fairly efficient (AC or heat pump) climate control system. Lots of people get around this by siting their off-grid cabins in places that don't require AC, and making the interior volume small enough to heat with a small biofuel furnace (like a modern, efficient wood stove) that can burn locally-obtained fuel.

Printing the source out on paper would probably be the most long-lasting storage method (aside from engraving it into large pieces of stone, maybe). But typing the source code back in for most non-trivial pieces of software would be really painful.

"Here's the source code, go type it in" hasn't been a very popular method of distributing software, for good reason, in a long time.

Maybe there's some way that you could include the true source code (in C or some other well-understood language) of a small decoder program, which would then take as input some more-compact representation of the desired programs? Something minified and compressed, but kept in a form that would make it relatively quick to type in? Maybe you could have the user type in groups of characters (6-7 or so at a time, because that's generally assumed to be the number of abstract symbols a person can easily hold in working short-term memory) and get a checksum back, that they could verify against the input book.

Actually, you should probably have checksums per-line, per-page, and per-chapter/section. That way if you had a decoding problem, you could quickly drill down to the error without manually checking each character.

It's likely limitations of the drivers for the underlying hardware they were able to source in quantity and at the right price. Some of the highest-volume manufacturers have traditionally also been bad about Linux drivers (looking at you, Broadcom).

It's unfortunate the modern Macbooks are such sealed boxes. The M1 compares surprisingly favorably against even the i7-1165G7 that you get in the Framework "Performance" series. About the only advantage you get with Intel right now is the higher maximum addressable memory (64GB vs 24). And Windows, of course, if you consider that an advantage.

Wow. A person could perhaps not cover, but at least nicely subsidize, the cost of a trip to Australia by hand-carrying a couple of laptops with them... wonder how many you can bring through Customs before they start to get suspicious?

It reminds me of my family from the UK when they used to travel to the US decades ago. They'd go home with half a dozen pairs of jeans each, and nearly pay for their tickets.

They were also very right about one critical point:

> without charging users for the service, is it reasonable to expect to make money off of this?

Dropbox was initially pitched as a free service, which was absolutely not sustainable, and someone would have been right to be very skeptical about the underlying business model. People might not have been quite as enthusiastic if they'd said from the beginning "oh, and it'll be $100/year for the rest of your life, or until you get your shit together and move your data elsewhere".

Not really; they just lobbied the Bush II Administration into crippling the Clinton-era rules that required them to allow competitive DSL providers.

The requirement was called "Local Loop Unbundling" and it required the RBOCs (legacy local telcos, from when the Bell System was broken up) to lease "dry pairs" to various competitive DSL providers at reasonable and nondiscriminatory rates. And for a few years it worked! The dialup ISPs started to move into DSL services and it looked like we would have real competition (admittedly DSL, but this looked decent enough at the time).

But they lobbied the shit out of Congress and got LLU killed in the early 00s.

I'd pay $200/mo for that if it didn't come with a transfer cap.

That's the problem with making bandwidth the only metric that we grade broadband connections on. You end up with "Gigabit" connections that you can only use at that speed very occasionally, because otherwise you'll hit a monthly transfer cap. (E.g. Cox's "Gigablast" service, which pairs a 1Gb connection with a transfer cap worth about 20 minutes per month at gigabit speeds.)