Postosuchus

Disney (CTV) doesn't take any open auction demand. All their programmatic demand is deals - meaning that they carefully plan those campaigns with highly reputable agencies and advertisers. There is zero chance for a contentious scammy crypto exchange ad (or even a moderately innocent crypto wallet one) to show on their properties.

Which you can absolutely do, when you are Disney (read, agencies fight to run a campaign with you). When you are, let's say, TechCrunch, the situation changes - you can still strike some deals but a lot of your demand is not the same grade.

If you really read what I wrote above - there is no "monolith" (and yes, Google is everyone's favorite Boogeyman). AdTech is a primordial pool all kinds of actors, each of which has found a profitable niche to "add value" (or to bullshit partners about "adding value").

I think we currently are - but not because of online ads. :-)

My main concern is supply chain attacks. I'm afraid, the frequency and sophistication of such attacks will only increase, thanks to really powerful LLMs. From there - to running keyloggers and stealing your bank credentials etc.

I don't have any conflict of interest. I'm proud of my work and I think it is great. I personally dislike ads as much as the other guy, but I am pragmatic and I have enough sense to understand that this economics has flourished because it maximizes common good: content creators are incentivised to produce good content and get properly and sustainably rewarded, regular users don't get nickel and dimed every time they load some web page.

To paraphrase Churchill, it is a terrible model but others are worse.

Obvious sarcasm aside, I compel you to ponder on this question next time you read "free" content on the web (a newspaper, a dedicated niche site or anything in between).

You have to be specific what you mean by "ads" then. If you mean creatives that ultimately rendered - you are absolutely correct. I don't have any stats handy to check the ratio between the two to estimate the number of unique creatives, but I believe it is a) several orders of magnitude smaller but b) still very very large.

And again, we are talking about logical creative (the actual visible part). Click URLs and such will definitely be different.

No, it's not. It completely upsets the economics of content management and makes it absolutely impractical for content owners to monetize through ads. No ad revenue would be worth such liability.

Then there are all kinds of fun scenarios - from drive-by malware to landing page malware to malware served after clicking an ad ON A LANDING PAGE. Who would assume responsibility for those?

Bottom line, this is not much different from "regular" crime. It happens. Governments employ police and various deterrents to reduce it. But it doesn't relieve you, the citizen, of responsibility to be mindful and exercise situational awareness.

You clearly misunderstand the sheer scale of online advertising (compared to linear TV ads, magazine ads etc). There is no chance you can vet every single creative and a landing page (one public number is 30B daily ads just served by Google alone in 2012 - which is probably closer in spirit to the Punic Wars than to 2026).

That's the first point. Now, who should be responsible for getting the ads? The website? That will absolutely kill the monetization model and it is simply unrealistic. Which means, that responsibility now should be pinned on someone else. Who would that be? My point being that no one there has an inherent lawful obligation to provide such vetting, which would be a) costly and b) only applicable to one player (out of many).

And then we get to bad actors. If I were a really motivated bad actor as early as in 2005, I was serving different creatives and different landing pages to different audiences - a perfectly well-behaved ones to Google's crawlers (again, Google does A LOT to fight malware), a questionable quality clicky ones to general audiences and maybe malware-ridden ones to specifically targeted audiences. And you would not be able to catch me in real time - only after the fact, once the campaign was run and someone looked at the evidence (assuming it was collected, which it isn't normally)

AdTech engineer here (some 13 years in the industry). A couple of notes:

- The report is highly sensationalist in the "zero-click" aspect. It details to some degree the aspects of distribution and C&C but goes very vague the main point - what was the mechanism that activated that zero malware in a zero-click fashion.

- To the point below that "ad providers should be held responsible." There is no such thing as "ad provider." The AdTech ecosystem is teeming with different niches and business models - see the famous LUMAscapes diagrams: https://lumapartners.com/lumascapes/ . The sheer volume of traffic makes it virtually impossible to vet even a fraction of it. Google has thrown a lot of compute power to pre-scan 3p creatives and even then bad actors can sneak through. Add to this a lot of sophistication on their side (from different landing pages based on the perception of the type of user to farming throw-away advertiser accounts aimed at running just one campaign like that to hijacking legit accounts through sophisticated technical and people engineering means). In the end, politicians full of indignation do what politicians always do - sue or fine Google and call it a victory, whereas the true bad actors just keep going.

This is probably a wrong audience. Most people here are very technical - the kind that would not put up with tiptoeing around a sacred computer from decades ago running some magic software from the DOS era. This crowd will aggressively move it to modernized architecture or at least emulate it using a more modern platform.

The company I worked at in the late nineties, used Managing Your Money (MYM) for bookkeeping - initially on a dedicated DOS machine. My colleague set up a DOSEMU-based emulator and moved the software to it (bye-bye, dedicated DOS machine!). Later, he re-wrote it in STk (Scheme w/ Tk bindings, running natively in Linux) as ageneral-purpose transaction storage. ¯\_(ツ)_/¯

This!

I've had a Snapdragon X Elite laptop for 2 years, constantly trying to get Linux off the ground on it. Didn't happen (well, technically, toward the end of that period, there was an unsupported port of Ubuntu but it lacked half the drivers). And yes, when I bought it there was a very similar announcement from Qualcomm promising first-class Linux support. So I wouldn't gamble on it (especially considering that prices are crazy) until there indeed is a supported distro.

Hmm... Is it an experiment? I'm seeing all reviews both on the web and in the app (Android phone).

Having said so, I am not hopeful. Amazon has gone the enshittification route with the gusto few companies have. And they've been actively (and gleefully) making some of the most useful features near useless. This can be seen most pointedly with order history search. Whereas in the past searching for a string brought up the past orders based on string match, now trying to search for a given term brings up gobs of past orders with items having absolutely no relevance to that search term. My cynical theory here is that someone "improved" order search by bolting on "AI."

It pains me a lot. I've been a fiercely loyal Amazon customer since 1994 and for a long time they've been the most customer-obsessed company out there. I can't even describe how different things are now.

Looks like you haven't seen what they've done with Order Search. Being a customer since 1994 (yes, when they just came out as a neat way to buy books online), my order history has been an invaluable reference allowing me to find that thing I bought 5 years ago, its specific and the price I paid. Now, instead of a good old substring search, they do some kind of insane fuzzy search which comes up with hundreds of absolutely irrelevant results. They've made it completely unusable.

But I'm sure a good bunch of people got promoted for "enhancing" the search with AI...

KeepassXC comes with its own share of risks (supply-chain attacks, zero-day vulnerability detections etc). No matter, which 3p software you are using, you are effectively gambling on the chance that none of those risks materialize. The only alternative is to personally audit the code - library by library, script by script and build it yourself. But even that carries risks: https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_Ref...

It used to be pretty popular for mathematical modeling in quantitative finance.

You might have missed the memo, but Roku's main business has been advertising for quite a while. It is just shrouded in streaming and platforms. But it is advertising nevertheless.

Being a platform, Roku benefits from advertising 3 ways - by running its own ads in some apps and on home screen; by exercising carriage rights on 3p apps that show ads (getting a cut as a platform); and by building and selling audiences for targeting.

For all I know, Fox has zero interest in platforms or technology. But they are fairly sophisticated when it comes to adtech and this is purely an adtech play.

That's precisely what is wrong with the state of the UI for Linux. Instead of boring, long research into user habits, finger memory, and productivity, resulting in boring standards like IBM CUA or Apple HIG, we got a bunch of opinionated engineers who think that people using computers fall into two categories: wizards, who are happy to spend their life tinkering with config files and making various pieces work together - and a bunch of losers not worth developing software for...

(Until Microsoft had actively started fracking it up, sometime around Windows Vista) just like a Roman citizen landing up in any town of the Empire, one would be able to effectively and consistently navigate around, using both keyboard and mouse across most Windows applications. Everything worked in a boring, predictable way. Everything used standard API that provided the whole spectrum of UI capabilities.

With Linux, unfortunately, this was never considered ideal and instead we have a zoo of different paradigms and technologies (plus intense politicking of UI development). Which means, when something happens to work as expected without excessive ServerFault/ChatGPT trawling and config/gconf/dbus wizardry, it feels like a sheer delight and an exception rather than a rule.

I was not aware of that and literally read into this particular article. Thanks for clarifying!

As someone who shipped my fair share of critical production features, I find this plan raising my eyebrows somewhat. Disabling a feature AND simultaneously removing the codebase for that feature almost never ends well. There will always be some use cases that people haven't thought of.

In serious projects (read, your career is at stake) a much better strategy is to first make the feature unavailable by normal means while still allowing a workaround (in this case, for example, PLM could remove X11 option from the menu but still allow X11 sessions when some magic environment variable is set.) That would give people an easy way to get the old functionality if something is critically impaired for them. And only then, once we are confident that no massive unforeseen issue has surfaced, can the codebase be removed.

Almost 40 years of software engineering experience - and I hate Gradle more than I would consider reasonable. In fact, I consider Gradle the absolute worst software system out there.

Absolute majority of people I witnessed using Gradle (myself including) approached it with almost religious terror. Making a change - any change - is akin to playing Russian Roulette, except all chambers but one are loaded. Change one directive - and your build breaks in most weird and incomprehensible ways.

And then there is the whole notion of stability (I mean "contract stability.") Almost every single release of Gradle breaks things in some subtle ways. I can take a project from the olden UNIX days with its Makefile and that Makefile will work in gmake in the freshest Linux distro, using gmake release that was produced multiple decades after Stu Feldman's make. It doesn't require a very specific version of libc or kernel. Because it is 1. Written portably and 2. It treats its behavior (jokes about using the Tab character aside) as a contract and it doesn't violate it just because some poorly educated software engineer decided that it would be a good idea to change the behavior in the upcoming release.

Amazing project - and you actually fulfill a dream of mine (to have a collection absolutely all historically interesting UNIX-like OSes in VMs available on demand).

I'll dig through my collection of "abandoned" OS distros to see if I have something that could make an addition to your museum.

I'm not gonna laugh but I can tell you quite authoritatively that Google will not abuse your passwords and passkeys. But more importantly (which is the main decision factor for me personally) - given the current state of software (in)security, I trust Google more than anyone else to build it right and to avoid attack vectors less sophisticated companies might expose.

(DISCLAIMER: I am on 1Password which I've been using for long long time - way before password management in Chrome became a real thing. But let's just say, GPM is becoming more and more compelling proposition).

Google's is even better, as it is cross-platform (although same caveat of having even more dependency on your account is still true). Plus (not sure about Apple) but Google also does (portable) passkeys and OTP.

That's an excellent idea! It will work out absolutely great - much like Communism.

Meaning, when you forcefully standardize and regulate how phones are built, you might expect that companies will not compete on making better phones (since they are not very much differentiated) but on who produces the cheapest phone.

This will not work for two reasons:

1. Thanks to the sanctions, it is virtually impossible for RF citizens to purchase anything abroad with Russian credit cards.

2. VPN was design not to obfuscate but to encrypt - that is, the protocol doesn't conceal the fact that VPN channel is being used, you just cannot peek into the content in this channel. Which means that more and more sophisticated tools are being used to block VPN communications.

Oh no! Yet another "difficult but right decision" (tm) to self-fund further investment in AI.

Funny, how we reliably keep finding the boogeyman - first in computer games, then in "right wing extremists online" then in LLMs, while carefully avoiding the correlation of dysphoria and mental disorders with gender change...

Indeed, they made Level Editor available. In fact, there was even a friggin' book on level design: https://www.amazon.com/dp/0782118690

Blast from the past indeed. Many many moons ago, I came up with a "bright" idea of designing a mod for Duke3D that modeled the office of my then-employer (large fintech company). At least I had enough sense not to boast about it - several months later a crazy guy brought a shotgun to HIS former employer and made national news, I don't think people would have taken my creation as lightly as I did back then. Still, working on it was fun.

Snapdragon X Elite laptops have been out for the last two years, if not more. How much has Qualcomm did over this time to make Linux work on those devices - almost nothing. As of 2 months ago, the best you could do was a special cut of Ubuntu that kinda sorta booted on those machines and required Windows to be present in order to pull some drivers.

So how about you give me a fucking break, Qualcomm? Call back when Snapdragon has first class support in major distros and you are serious about Linux.

This. And speed aside, Gradle embodies everything that is wrong with modern software development. A giant, opaque, idiosyncratic black box. I develop for Android (Java and Flutter) and it has become a sad pattern from Hell: Android Studio update mandates upgraded Gradle, which breaks previously the build in most weird ways, forcing one to trawl StackOverflow looking for proper incantations to do in the myriad of files it has created with the single purpose of building the damn app. Sometimes I wish, creating new build systems was outlawed some time after gmake or cmake...