I would say you can get to this point far below 100 million people, especially on web. Some people are truly special and have some kind of setup you just can't easily reproduce. But I agree, you do really have to be confident in your ability to control rollout / blast radius, monitor and revert if needed.
The use of "storage.googleapis.com" is probably because it's an "authority" domain that apps can't easily ban without side effects. Buckets can typically be used as a static site host where u can host a client side redirect, depending on how you set it up you can make it almost impossible for an app to ban a campaign in real time.
Is this constitution derived from comparing the difference between behavior before and after training, or is it the source document used during training? Have they ever shared what answers look like before and after?
Unfortunately, I feel like I'm in the minority here, but AI has been really helpful to me and my doctor visits when it comes to preparing for a ~10-minute appointment that historically always felt like it was never long enough. I can sit down with an LLM for as long as I need and discuss my concerns and any potential suggestions, have it summarize them in a structure that's useful for my doctor, and send an email ahead of the appointment. For small things, she doesn't even need me to come in anymore and a simple phone call to confirm is enough. With the amount of pressure the healthcare system is under, I think this approach can free up a lot of valuable time for her to spend with the patients who need it most.
IMO eliminating as much client side authority as possible is a very good foundation for MMOs where the latency is acceptable or factored into all aspects of the game (looking at old school runescape as an example). Very cool project!
Not dismissing your first argument but we had good success hiring talent through Discord servers. If you want to reach the same audience that attends hackathons and such it's in my experience the best platform.
They've used discord for a while for things like GSoC but in general it's becoming more widespread seeing that even Copilot has a Microsoft owned discord server, Valdi from Snapchat as well.
Please consider allowing the user to modify the TLS handshake / ClientHello. Out of all proxies I have used only Burp offers this through a plugin / extension.
From a security perspective it is best to assume everything in a GET query is public, it's not always your server logs that you have to worry about, it could also be logs on the clients system (as an example).
Not all websites work well, and you get a lot of captchas last time I tried it. From memory the way they make this work is pretty cool though, they capture Skia draw commands and send those over the network and use a wasm library to replay them.
Browser data points can make it easy to identify a browser or in some cases even a specific machine, but that doesn’t necessarily equate to identifying a user. What frustrates me is that it takes a service I trusted with my personal data to be the one that attaches an identifier to those metrics. The best practice for privacy is to always keep profiles and identities separated, rotate P.O. boxes, email addresses, phone numbers, and payment methods so that when someone identifies your browser or device, the accuracy of linking it to you stays low. Of course, this approach comes with its own problems...