kbenson

I wonder how much of it is to collect data and sell ads compared to just getting people to start utilizing what is now Microsoft's core resource, which is cloud services.

For them, getting you using onedrive is a (huge) step towards getting you to pay them for more storage using onedrive, and to also allowing them to use their advantage as the OS provider to get you using features that both keep you from moving away from Windows and keep you from moving to dropbox or another cloud competitor that normal consumers commonly use. For example, onedrive desktop sync tied to your Microsoft login, so you can log into a new system and have it put your preferences and files in place.

Having more data to monetize people is useful, but I would bet that they value the the lock-in of integrated services far more, as that's where they can possibly grow (by offering more services once you're less likely to leave), and growth is king.

It's the same thing Google does (and Samsung also attempts to do with their custom apps and store) with Android, but at the desktop level. Apple is able to do it for both desktop and mobile.

I think what's left unsaid and implied is that the original system wasn't secure in any way, the "tuning" was just choosing a frequency. It's only a "hack" because of the claims that were made.

In a way, that would be like advertising a secure horseback large sign delivery service, where the "security" is that the sender and receiver choose one of a few routes between locations, even though the large sign is easily seen and entirely uncovered, making the courier easily identified and the sign when in transit easily read from a distance. The "hack" for that type of system is ultimately so trivial as to be mostly uninteresting.

But that's a matter of scale. When I was a child, the Harlem Globetrotters were far more more famous than any 3-4 NBA teams combined. They were in multiple Scooby Doo movies/episodes. They failed tp scale the model, but wrestling didn't.

I seem to recall almost two years ago when I was getting info on a possible solar install, we had the options of LG batteries or Powerwall, and one of the specific points of difference that the more expensive (and larger capacity) Powerwall battery install provided was stated to be power when the grid was down.

I can't speak to the accuracy of that, as I was speaking to a salesperson and I didn't go forward with the project so don't have any personal experience to add.

There's a graduated penalty structure based on how problematic it is. It goes from $10k to $100k and then $10m, depending on whether you're in violation knowingly or unknowingly and whether there's a risk of death or serious physical harm, etc.

And if later on someone proposes more aggressive action if you don't do that action, they now have a record of all the times you've failed to do that thing which they can point to about how the current level of penalties are not sufficient.

That said, the penalty is not just $10k. It's $10k for an unknowing violation, or $100k for a knowing violation that "does not create a material risk of death, serious physical injury, or a catastrophic risk" or a unknowing violation that does cause that, and $10m for if you knowingly violate it and it does cause risk of death or serious physical injury, etc.

I imagine the legal framework and small penalty if you fail to actually publish something can play into the knowing/unknowing state if they investigate you as well.

Importantly, I think it's much more obvious what you're doing with a web app when you upload data. There's an erroneous belief when you're using native app that the data you provide to it never leaves the device. That might be the case, but even in cases where the native app isn't just a shim to do something through a service, there's little guarantee they aren't utilizing your data for their own purposes, legally (e.g. Adobe) or not.

This isn't unique to mobile vs desktop, but from my experience people use those different device types with different levels of care. It's possible app stores play into this by giving people an incorrect sense of security about aspects of application usage and updating that they don't actually provide.

Which is mostly irrelevant because I have a few rack units of free space, with free power and bandwidth I can use if I want, but I haven't bothered because I don't have a need worth shelling out the money for a modern platform to put in it.

I'm well aware of the costs of power and the lgostics of colocation, this is purely about how I'm more willing to spend $100-$200 for a toy than I am $1000-$2000.

I have a couple units of free colocation cabinet space space and free bandwidth and power to go with it waiting to be used, so inefficient hardware is less of an issue for me. I've just been fairly lazy in sourcing it myself.

Source? That seems like something I would want to take advantage if at the moment...

My layman's understanding is that we've been doing it already for decades with expert system "AI", so likely much easier than navigating streets with other people.

I interpreted it as a roundabout way of increasing quality. Take any given subreddit. You have posts and comments, and scores, but what if the data quality isn't very good overall? What if instead of using it as is, you instead had an AI evaluate and reason about all the posts, and classify them itself based on how useful the posts and comments are, how well they work out in practice (if easily simulated), etc? Essentially you're using the AI to provide a moderated and carefully curated set of information about the information that was already present. If you then ingest this information, does that increase the quality of the data? Probably(?), since you're throwing compute and AI reasoning at the problem ahead of time reducing compute and lowering the low quality data by adding additional high quality data.

> I'm a middle class white native English speaking boring white boy with a hick accent so basically at the bottom of the interest at ACLU

I would assume they would be jumping at a few of these cases too, as a) it may be easier to bypass any ingrained bias in the system if you aren't necessarily matching people there may be bias against, and b) establishing case law is important for changing ambiguous legal situations.

Are you assuming they wouldn't be interested or did they communicate that they weren't interested?

The only way I can understand you coming to that conclusion is if you assumed that's what they were going to be and didn't actually read any of them.

> If you talk about politics and everyone agrees then you know you are working along side aligned people.

You state that as it it's a a truism. There are many times when having a group not be homogeneous allows for a greater breadth of knowledge and consideration to be brought to bear on a topic.

The point of being professional is that it's a way to allow people that may be very different to coexist and function together, sometimes to great effect.

Everyone's gotta start some time. My first comment wasn't until almost exactly a year after I finally made an account (according to search, but that lines up with my memory), and I didn't even create an account until I had been reading for a couple years IIRC.

I think it's often people that have an emotional response that make their first comment if they've been a lurker for a while already.

FWIW I think people are reacting negatively to you is because you've done the equivalent of walk into a community center where someone is showing their hobbyist art project and loudly proclaimed all the problems and that you'll be more interested when they fixed it up enough to make it to a real gallery. Not only is that person missing much of the point of why that person did it and judging it by standards it was never intending to strive for, but doing so around others that are there to appreciate it for what it is actually hampers their enjoyment and the empathic happiness they feel for someone striving to do something for the fun of it.

In other words, most people don't really care if this materializes as an actual product or project that's widely usable. It's a cool hobby project and some of us appreciate that, and appreciate people documenting their process in doing such things.

I actually ran across that and read the relevant section when googling earlier in this thread. To me it seemed unclear what his motivations allegiances were, just that enough people were worried that he was a piece on the board that could cause problems that he was removed from it. That doesn't mean it was likely, it just means that they didn't want to deal with the complications of having to think about it at all would entail, or to worry about players that would be enticed by it, etc. I imagine in a time of way you try to reduce complexities and unknown as much as possible. Even if a few people have concern over him, it may be easier to just ship him away and appease anyone's concerns if he's not meaningfully important to the war effort. He was made a major-general, but how much experience he had in that role and how good he was performing in it is unknown to me, but I suspect it was at least partially honorific or nepotism whether from the top down or emergent (do I promote the royal or the unknown? Which is safer for my career...).

But that's all during the war, and with one individual of the royals, and I would think the rest of the royals would not be happy going forward with the Nazis thinking they could mess with the line of succession/assassinate they King.

Hmm, from some light reading I'm unsure how active he was as "part of the plot". In any case, that sort of supports my original claim, in that the British royals not only have a history of Nazis attacking their country, but trying to meddle with their royal line and succession, which also wouldn't enamor the royals to them.

I haven't watched it, and skimming the wikipedia page isn't making it obvious what you might be alluding to, other than maybe him touring Germany prior to the war.

I'm not entirely sure where the downvotes came from since other than you nobody bothered to respond, but maybe it's based on people's belief that Nazis are some special and unique threat or that the only thing that should be thought about when they are mentioned is concentration camps and their treatment of the Jewish people, but they did so much more than just that, even if that was uniquely horrifying for the period. The Jews weren't the only people sent to concentration camps, and overall, WWII cost 70-85 million people their lives. Nazi Germany affected so many people, nobody gets to claim them as uniquely their own boogie men to the exclusion of all others.

For what it's worth, a UK prince is one of the few people or groups of people that I would assume were likely not hiding Nazi sympathies. Their entire country, and specifically their recent royal ancestors, where subject to Nazi aggression and responsible for countering it. There's a long history of dressing up as those you want to lampoon, especially in British media.

More likely your initial comment was downvoted because it provides little additional context and makes a claim without support, as if it's self evident. Comments such as that rarely do well on complex topics. My own rule of thumb is that if I'm stating something as fact and I'm writing a single sentence, it's likely a low effort and low usefulness comment that is unlikely to be beneficial to the conversation.

Your comment immediately above this was likely flagged because of your inflammatory accusations and assumptions about why your were downvoted, and IMO shows a alack of introspection about possible reasons as to why you were downvoted. Much better to ask why than to throw out accusations, at least if your goal is to have a useful discussion or learn something (bot of which require some level of assuming good faith to others here).

I think that's mostly BPA and phthalates, and microplastics are often listed along with those, but I'm unsure if it was actually tested or if we notices people had a lot of microplastics and just assumed that was a likely source.

Nothing as in there is no outside noticeable change in behavior and they report no change in speaking, or nothing as it relates to the topic of this thread, in that they have no profound or spiritual experiences?

So, like normal history just sped up exponentially to the point it's noticeable in not just our own lifetime (which it seemed to reach prior to AI), but maybe even within a couple years.

I'd be a lot more worried about that if I didn't think we were doing a pretty good job of obfuscating facts the last few years ourselves without AI. :/

That's about as clicbait a title given the content as I can imagine. I would summarize the article as:

- Subsidy schemes can often cause problems where monoculture farmable tree crops can reduce biodiversity can cause problems. But I think it's worth noting that replacing trees with another is not what I would call, or what most people likely think, when referring to new forests, and even if we ignore that point, the problem is not the new forests in general but the incentives used to cause it to happen.

- Carbon sequestration may be overestimated because if the ground is already rich in carbon, some of that may be reduced so the overall additional effect of sequestration is less than one might assume.

Neither of those are really in support of "new forests can do more hard than good" in my opinion. They may be worth discussing, but this isn't a good start for a useful conversation on the BBC's part.

A lot of things I would have previously said were impossible have happened in the last half year. If only a few of those things were of the impossibly good type.

Possibly, in which case, I'm not in disagreement, but that's not how I interpreted "Okay, fine: there is a use for human names for security bugs".

a CVE is just a link to uniquely identify a specific problem. They often also have names, coined by the people that discovered them, such as "heartbleed". A CVE is similar in concept than a URL shortener but with more procedural name generation.

A CVE is not the actual exploit or security issue, it's a way to reference the exploit or security issue. Internally, before this got a CVE entry, it likely also had an entry in Apple's internal bug system tracking. The identifier for that is similarly just another way to reference this specific problem.

A CVE number is no different than an incrementing ID in a database, except that it encodes slightly more information in the name. You can try to put additional information in the identifier, but it's hard to change after the fact, so you want to be careful what you put. Should you put the score in the identifier? Careful, they often increase after additional scrutiny is given to the issue. What about the product name, as is requested here? Sometimes additional products are discovered that are affected later. Sometimes those are just as important or more as the original, but the correct people that knew weren't contacted until the CVE was released. A CVE is most useful in providing a global id that different parties can use to reference the same item in their own databases.

It's an identifier. Keep it simple. Call it whatever you want in addition to that. If you subscribe to the CISA catalog update mailing list, they reference items like so, which is perfectly fine IMO:

- CVE-2025-4632 Samsung MagicINFO 9 Server Path Traversal Vulnerability

But that's not the CVE itself that is noting what it affects, that is CISA proving a summary of the problem, and notably in this case, one that's more descriptive than listed on the item itself and a combination of a few fields.

Edit: I'll note that from looking at a different response to me, that if you were just suggesting people name stuff more usefully when submitting here, I have absolutely zero problems with that suggestion, which should be obvious by the above. I interpreted your original comment to mean "CVE's should have more context in their names", which is what I disagree with if we're talking about the name as identifier.

> the fallacy of this argument is that it says that some bugs would be ignored because of namung confusion. But that's already the status quo for all bugs!

I don't think so. The difference is when you arbitrarily constrain data your introduce errors and edge cases. Either the name is standardized in which case what can go in portions of it needs to be constrained, or it's not. If it's constrained, someone will need to make a decision on what's appropriate and inappropriate to add. If the list of items that can and should be put in that field is large, you're likely so see some or (most) omitted.

The real question is whether that omission will be viewed as people to imply something is unaffected before they look more closely, and then ignore what might be something important. An argument could also be made that people might see a CVE name without a product and decide that it doesn't affect them, or ignore it when they might have looked closer because something in the name caught their attention, but I think that's a slightly different problem. I think my stance can mostly be boiled down to not wanting to unintentionally train people to rely on something that is unreliable.

I'll freely admit there are cases for both sides of this and differing opinions. It's similar to Postel's law in that it deals to a degree with human nature and people's propensity to take shortcuts (in both actions and thinking), so what we're actually talking about is how we perceive human nature and how it interacts with systems we create.

So, what if it's a bug in a project that has forked a few times with renames? You're possibly inviting people to ignore a CVE that says "chrome" or "webkit" or "blink" in the name, when in reality it could be from far enough in the past that it affects all of them.

What about project with a license that allows for easy inclusion of source in another project (BSD license, for example). If most people are exposed to the bug through a bunch of other projects that include it, what do you name it? Any choice likely implies something that might keep people from looking closer initially when they are affected.

What about this specific but? Should it say CoreAudio, or iOS, MacOS, or just Apple?

Naming things usefully in a way that conveys additional information is hard. Looking up CVEs is fairly easy. Just throw it into a search engine.