floatingatoll

Note that their goal is to master programming on a new platform, not just to play it in a browser.

That’s correct. However, purity is not relevant; only hate and non-hate is. The only requirement is to have non-haters that hate the haters. Everything else is specific variable details per social group and per person.

“A bunch of haters grouped together and started hating on people that they hated; the non-haters said “stop that”, and when the haters refused, the non-haters violently stopped them.”

This describes a variety of wars in human history, for example World War II. The non-haters aren’t “pure”, they don’t always succeed, sometimes they attempt non-violence first — but the tendency of societies to act in alignment with that description remains consistent across human history.

(ps. Humanity’s skills at balancing cognitive dissonance come into play quite strongly here, as being in the position of “non-hater” while also hating “haters” is definitely at tension with itself. I suppose the dissonance is balanced by over the tipping point of societal benefit versus personal benefit, but that’s not an area I’ve studied as closely yet; individual psychology is less interesting to me.)

Under no circumstances do I support publishing real names for users in association with their online activity. I grudgingly concede that some will wish to do so voluntarily, but it should never be compulsory, nor should it be permissible to indicate whether or not any user’s name is the same as their legal name. As long as people can be rapidly and efficiently held accountable if they abuse others, it doesn’t matter to me in the slightest what they want to openly call themselves on any given Internet site, and I want constraints in place to ensure that “publish your legal name” is an impermissible form of direct, indirect, and/or peer pressure.

No.

I’m arguing that it makes no difference whether the admins and law enforcement are working for an authoritarian regime; either way, the regime will just as readily be able to identify its citizens, voiding the theoretical protection that Internet anonymity supposedly offers their citizens.

So, then: Setting aside the theoretical value of “protecting citizens of authoritarian regimes”, what other reasons underpin the continuing support for prioritizing anonymity over the accountability of legally-protected privacy of identity, as I propose upthread?

I disagree. The vast majority of SWATting has not been considered worth prosecuting, much less targeted hate speech directed at women. We are nowhere near the absolute minimum that societies enforce in-person.

Incorrect; Apple allows apps associated with purchases and rentals of physical objects to add credit cards to pay for things.

In one digital goods example, Kindle books are not “sold”, even though Amazon uses the word “Buy” in the button; if Amazon truly sold you a Kindle book, then they would be required to provide it to you upon terminating your account, as it is your possession in their care, and withholding it upon request would be grounds for a lawsuit. Under such a scenario, Amazon could successfully argue that Kindle purchase should be given the same rights as physical purchases, as they are truly purchases and not just “licenses”. Amazon has chosen not to pursue that scenario to date, as granting each of us full ownership of a copy of a digital good would compel Amazon to act in ways that are hostile to Amazon’s interests.

In reality, when hate speech speakers congregate, they eventually end up being forced to stop by an ever-growing collective of people who will not tolerate hate speech; with speech, courts, laws, and violence.

In the world you describe with telepathy, we would know instantly who was thinking hate speech, and be able to identify them and protect those they hate from them, and prevent them from congregating into cancerous hate mobs. Some would argue that this is thoughtcrime enforcement, which is an expected outcome from granting telepathy to all. That is, in a nutshell, correct: peer enforcement of group morality in a telepathic society would, by definition, put the “thought” in “thoughtcrime”.

However, in today’s non-telepathic world, we cannot easily identify those who use hate speech online and protect others from their hate. This is presenting many difficulties not addressed by your telepathic example, and is the core of the problem that must be addressed.

Authoritarian countries that actively seek to identify and prosecute their citizens for thoughtcrimes have simply compelled citizens to install tracking apps and/or use government-monitored data centers and/or SSL proxies that de-anonymize them, largely removing their ability to make use of whatever online anonymity remains, if they’re even allowed to access our Internet at all. Their access to anonymity from authorities online is therefore neutralized, as countries such as Russia and China and North Korea are all demonstrating today.

Meanwhile, lots of people (especially women and minorities) in non-authoritarian countries on the Internet are being threatened, harmed, or killed (for example, by SWATting) by anonymous people in the Internet.

What arguments exist that support non-accountable anonymity online in today’s world, now that we’ve seen the outcomes of endorsing those argument three decades ago and the resulting harm to societies?

Privacy would be fine, as long as the identity is traceable by admins and authorities. We’ve experimented with true anonymity and it’s garbage for humanity, so now we need to come up with a better way to protect people from being identified except to admins and law enforcement, and pass laws to protect our right to keep our real life identity from being divulged maliciously.

This is wrong on two points, based on the other discussion and the post itself.

There was no Telemetry outage. An HTTP3 response header’s case was changed by a third party without notice. Telemetry continued working, other than the case change causing a bug.

There was an http3 infinite loop bug in Firefox that crashed all networking. Many different things could have triggered the bug once it was introduced. Telemetry happened to be the first thing to do so, but not due to any faults in Telemetry’s code or implementation.

(FYI: The bug was not in the telemetry code, it was in the http3 code; see comments further up in the post for details.)

Per other comments here, supposedly the same issue would have occurred with a variety of non-telemetry tasks as well. One of them is indicated to be certificate-related, which suggests to me that CRL lookups could have triggered it, though I don’t know for sure. It ended up being that the issue occurred first with telemetry rather than with certificate stuff or who knows what else. But the flaw wasn’t in telemetry code, so focusing on telemetry wouldn’t have prevented this at all.

Per elsethread, supposedly any site could have triggered the crash, not just ”side functionality”: https://news.ycombinator.com/item?id=30175916

That's probably a violation of the App Store Review Guidelines; you're not allowed to withdraw app functionality unrelated to notifications if a user denies notification access; Apple has various language in various places that hints at 'you can't arbitrarily take away features to compel users to opt-in' being a core intent. If you're an Apple developer, and you're willing to stake that claim with Apple, you can report it while logged in to your developer account.

It's just a debugging step. Don't delete your existing profile. If you confirm that it's fine in a stock profile, then you can use various methods to see what's different and find the bug (eg. “what non-default settings overrides are set in my profile”).

Did you reuse existing profiles on both versions, or in either case did you start a completely fresh profile? If you haven't yet tested with a newly-created profile (which doesn't require deleting your existing profile), then you need to do so in order to triage whether the problem is with Firefox-by-default or Firefox-and-your-profile.

If Google restructured into a franchise model, where each franchisee independently operates Google XY per country XY, then that would legally allow each Google XY to comply with GDPR while paying Google US a franchise fee. Technically, however, this is a nightmare to implement, since each Google XY would have a due diligence responsibility to audit all source code changes, and Google US would be required to issue a complete working set of product code to each independent franchisee, as otherwise they're just subsidiaries from a code standpoint, which when interpreted by a court would likely be found equivalent to being a full subsidiary rather than just a franchisee (as Google US would then retain the ability to collect GDPR-protected data in violation of GDPR).

As long as you proxy^ all requests to Google for that data through your own servers, and do not include X-Forwarded-For: <gdpr-protected-client-ip> or any other identifying details in the request you transmit to Google on their behalf, and your crypto implementation is deemed sound, then that would likely be found not to be a GDPR violation. This runs counter to the tendency of websites to offload the burden of "go fetch and evaluate XYZ" to the useragent, and requires a server under your control that is not under US jurisdiction^^ to host or proxy all internet traffic of any kind necessary to deliver the service. (I am not your lawyer, this is not legal advice.)

^ some services may ban you for proxying in this manner without a contract

^^ proxy must not be hosted by or operated within AWS, GCP, Heroku, or any other US-controlled services provider

That’s not how the GDPR is written. It may seem premature, but someone has to be first to be ruled against in order for the interpretation to come into being, same as the Supreme Court and any other interpretive judicial systems.

That the private fine is essentially a token throwaway amount reflects that the court isn’t trying to throw the book at them; one can imagine the court will be much more upset about the government instance you highlight if it remains unaddressed.

The rulings this past week specifically contradict this. Subsidiaries of US corporations are subject to illegal-under-GDPR data collection requests by US authorities, just as much as any other US corporation, as the subsidiary has no legal protections under US law from GDPR-illegal requests by its parent.

Yes, they could theoretically file a GDPR complaint. It is not certain that the courts would judge it a violation, but it’s quite likely, since their data is resting in servers owned (subsidiary-to) a US business.

Google would have to redesign their corporate structure so that EU customers of Google EU are never subject to US law, with no US-owned business anywhere in the subsidiary chain. Imagine that this is the current chain:

Alphabet (US) -> Google (US) -> Google (EU)

Under such a structure, Google (EU) is not GDPR-compliant, and will need to drop all upstream inheritance of (US) to comply with this ruling.

I am not your lawyer, this is not legal advice.

If y’all write a blog post about how your preblinding option makes you GDPR-compliant for silent embedding even though you’re a US entity, that would be front page material right now.

And because websites used to link to other websites for non-profitable reasons (blogs, directories, and webrings).

Note that the US is absolutely capable of passing a data protection law at any time. I wouldn’t hold my breath, though.

And GCP.

In your scenario, is the theoretical Google GmbH a subsidiary of a US corporation?

If you, a GDPR-bound business, are silently serving, embedding, or otherwise using resources served by US businesses without explicit opt-in approval, then you absolutely could be violating GDPR, specifically for example if the user’s IP becomes known to the US-operated resources.

This would theoretically apply whether using AWS hosting (even in EU availability zones), Stripe or PayPal cart checkouts, or any other platform owned and/or operated by a US business or its subsidiaries. It isn’t relevant where those US-owned data or servers are hosted.

This unfortunate situation could be corrected by the US signing a new treaty or other law that ensures that the US governments, law enforcement, and courts cannot compel US business to violate GDPR.

(I am not your lawyer, this is not legal advice.)

Your interpret my wishes correctly, but take comfort: I already expect near-universal disagreement from my peers here.

I am absolutely onboard with expressing our dismay at how Tesla altered a core safety feature of our vehicle with neither consent, nor an updated printed owner’s manual (which requires a formal recall).

I’m not onboard with telling them how to respond to that dismay. I know everyone will, but it weakens the problem report and muddies the waters. Filing a bug report without also including suggestions on how to fix the problem is a hard-earned skill for me personally, and I expect I’ll always wish it was more widely utilized by tech folks than it ever will be.