Hacker News Reader

kronoon Fakespot Is Acquired by Mozilla

Fully automated profiling, deciding, and then advertising to as many people as possible whether you are a scammer or if a review you left is genuine. And the only method through which you can discover that you are the victim of of a false accusation is to use this product to actively and manually monitor your own content.

Both freedom of expression and automated decision-making are already quite heavily regulated in the EU today with even more and tighter rules currently the way[1]. These new regulations also happen to extensively cover the combating of fake and illegal content by online platforms.

Additionally this seems contrary to Mozilla's claim[2] of commitment to human dignity, individual expression, accountability, and most of all: trust.

Strange thing to be investing in for any other reason than to make it disappear, which I don't think is the plan. Money would have been better spent elsewhere... or anywhere else, really.

[1]: A Europe fit for the digital age https://commission.europa.eu/strategy-and-policy/priorities-...

[2]: Mozilla Manifesto https://www.mozilla.org/en-US/about/manifesto/

kronoon Fakespot Is Acquired by Mozilla

Here are a few that contained violations at the time when I checked them out last February:

https://addons.mozilla.org/en-US/firefox/addon/giphy-for-fir...

https://addons.mozilla.org/en-US/firefox/addon/tabliss/

https://addons.mozilla.org/en-US/firefox/addon/youtube-subsc...

The official policies can be found here:

https://extensionworkshop.com/documentation/publish/add-on-p...

Some highlights of commonly "forgotten" rules:

> No Surprises

> Add-ons must be self-contained and not load remote code for execution.

> Add-ons must limit data collection to what is necessary for functionality [...] Data includes all information the add-on collects, regardless of the manner.

> Collecting, or facilitating the collection of ancillary information (e.g. any data not required for the add-on’s functionality as stated in the description) is prohibited.

> Modifying web content or facilitating redirects to include affiliate promotion tags is not permitted

kronoon Fakespot Is Acquired by Mozilla

Yes absolutely! Also why I tagged on that call-out of Safari and other browsers.

And not to forget that Google has even shipped several early-days standards track features to production of which the API was still in flux. In a few cases the API later changed in - for Chrome, at least - breaking ways. Fun times.

kronoon Fakespot Is Acquired by Mozilla

Many Firefox extensions including the "recommended" ones which are claimed to be actively monitored are breaking Mozilla's extension policies by secretly sending telemetry, injecting advertisements, load and execute external resources, etc.

None of the ones I reported have had their recommended status revoked, several ones have since even been allowed to publish new versions where the same violations are still present and even a few published updates that introduced additional violations.

To Mozilla: If you want to change the world, start with yourself.

To the rest: Whenever you install or update an extension, always go through its published source first. You can get to it by right-clicking the install/download button to "save as" and then simply unpacking the xpi file.

kronoon Fakespot Is Acquired by Mozilla

Its great that everything just magically seems to work so well for you, but behind the curtains it took additional effort from the developers of websites you visit to make it so. Same goes for Safari and some of the less popular browsers.

kronoon Gpt4free repo given takedown notice by OpenAI

This AI-Age Robin Hood is merely liberating the stolen goods from their fence. Morally speaking neither party is doing any better or worse than the other.

kronoon Cube.js: Headless Semantic Layer

Fair enough, although it's not as clearly advertised as I'm of the opinion that it should be, either.

kronoon Cube.js: Headless Semantic Layer

Beware of their quite well hidden opt-out telemetry collection:

https://cube.dev/docs/config#options-reference-telemetry

It's really quite improper to not have this clearly mentioned anywhere obvious.

kronoon Funds of every Trust Wallet browser extension could have been stolen

They sell security, whilst habitually neglecting to secure their shit. Who knows what it'll be that's compromised next.

For being offline wallets, their products sure do come with many connectivity options and live/online service integrations.

kronoon Funds of every Trust Wallet browser extension could have been stolen

What good is all this super reliable gold-standard encryption when its provider has shown to be so incredibly careless with the exact sort of information this solution is meant to protect?

Whatever security goals they claim to pursue exist only in their marketing copy.

kronoon Funds of every Trust Wallet browser extension could have been stolen

  > Creating good randomness is a daunting task - Ledger devices rely on dedicated silicon logic in our certified smartcard chips that have been the gold standard of secure industries for the past 40 years to guarantee high quality randomness and tamper resistance.

Which is worthless and entirely irrelevant when they keep leaking their customers' personal and purchase data (which they claimed not to collect or keep, and even failed to delete after the first leak) time and again.

https://web.archive.org/web/20221030030843/https://cointeleg...

https://web.archive.org/web/20220901153130/https://www.coind...

https://old.reddit.com/r/ledgerwalletleak/comments/ki1nsz/re...

https://old.reddit.com/r/CryptoCurrency/comments/rts1w2/got_...

https://twitter.com/yeolddoc/status/1353139243548364805

kronoon JavaScript private class fields considered harmful

A quick glance over the GitHub issue titles should give you a general idea.

Whilst I don't personally share all of the concerns posted there and even believe some of them are a little bit silly, I have to say that I do not at all like the way most of the discussions are abruptly cut short or simply left unanswered, and how difficult questions or ideas that aren't entirely in line with the original proposal are immediately declared nonsensical/invalid or shot down without any further exploration at all.

The above is a common theme in that repo and not difficult to find. I've never seen that kind of behaviour in any other proposal at that stage. Very sad to see.

https://github.com/tc39/proposal-function-implementation-hid...

kronoon JavaScript private class fields considered harmful

There is actually a stage 2 proposal "Function Implementation Hiding" that is being pushed through despite the many very legitimate and thoroughly described concerns that people have been voicing on GitHub and everywhere else this topic is brought up.

https://github.com/tc39/proposal-function-implementation-hid...

kronoon Dropbox telemetry can't be disabled

Ah gotcha, yes, you're right, except that only holds when you are not collecting any other data from the "subject" at all.

The major differentiating factor here is that that Dropbox does in fact process PII - convenient storage and distribution of their customers digital life is their raison d'être, after all, it's precisely what those people expect of Dropbox and pay them their monthly fee for.

In this case, where telemetry is gathered by the same desktop application that is also a primary component of their legitimate and consented-to data processing activities no less, they would at minimum be required to specify what information goes where, how it is anonymised, and for what purpose they require it.

I'm not assuming ill intent or unsanctioned data mining activities or anything of the sort, but whatever it is that they are collecting and doing is not as clear as it should be.

kronoon Dropbox telemetry can't be disabled

False, I will rephrase: it is a regulatory requirement under the GDPR to disclose the fact that you are collecting data, to provide a detailed and easily accessible specification of the information contents, a precise definition of how this data is processed and used, and your legal justification(s) for doing so, and to do so for each separate type or kind of collection involving individuals, regardless of whether this includes any PII or not.

The few exceptions that exist are only applicable in cases where there is no potentially identifiable data collected at all, which is obviously not the case here.

Here is a very accessible (although non-official) GDPR resource that I've come across: https://gdpr-info.eu/

Obligatory "I am not a lawyer" disclaimer :)

kronoon Dropbox telemetry can't be disabled

You're mixing several things together here. Transparency is one of GDPRs cornerstones and very much not just nice to provide, but a deeply serious and non-negotiable hard requirement regardless of how you legitimise the data collection.

kronoon Compromising Garmin Sport Watches: A Deep Dive into GarminOS and Its MonkeyC VM

They never shipped out my Pebble Time 2 before the project (and company, for that matter) got shelved. Something I'm still sad about even today.

No other smartwatch released before or since has even come close to Pebble's Pebbles.

Kickstarter page is still up: https://www.kickstarter.com/projects/getpebble/pebble-2-time...

kronoon Introducing 'Trusted Publishers'

Indeed, not the publishers are trusted but rather their authorisation of a delegated publishing action taking or haven taken place in their name.

The name is inaccurate and even misleading in a way that actively undermines the purpose of the entire initiative itself. A mistake which I believe only a name change can and should fix.

kronoon Reddit will begin charging for access to its API

Reddit does not own their users' content, however - they would also be simple resellers. All that's happening here is that they have failed to monetise where others are succeeding, and now they are positioning themselves to get a piece of that pie.

The right thing for them to do morally, would be to implement content visibility/privacy controls for their users similar to what Facebook offers (strange feeling to be referring to Facebook in this context).

kronoon Reddit will begin charging for access to its API

  We are the Borg. Lower your shields and surrender your ships. We will add your biological and technological distinctiveness to our own. Your culture will adapt to service us. Resistance is futile.

kronoon A new search for a new world

With the relevance of search results being inferred and continuously trained and adjusted to this degree with the help of AI - the new standard, soon, I believe - using behavioural data from a majority audience of users with typically functioning (or neurotypical) brains, I am now more than a little bit worried that getting relevant/desirable/useful search results, suggested content, and similar such things will soon become highly problematic across the board for people with atypically functioning brains such as yours truly (ADHD).

kronoon Universal Music Asks Streaming Services to Block AI Access to Its Songs

Now that you've written it out for me here (thanks for which btw, and for your thoroughness in particular), I see that I should have been able to infer your angle from your previous comment. For the record, not that I was meaning to imply anything with my hypothetical question, but now I know where you were coming from I see that it's not very relevant at all and I wouldn't have asked it.

It would require an unthinkable near unanimous societal willingness and cooperation, such comprehensive planning to the likes of which I believe humanity is practically incapable of today with currently available tools and mindsets, an ultra-careful and yet pertinacious iterative implementation process that will probably need to take place over a multi-generational timeframe.

If, however, we would somehow pull all that off and manage to rework our world into one that is entirely formed around the philosophy you describe above, then I am fully convinced that not only humanity, but also our planet and in fact the rest of the universe too would be better off for it.

kronoon Universal Music Asks Streaming Services to Block AI Access to Its Songs

A work that is protected by copyright - which most works are by default in the majority of cases - is by definition not in the public domain.

To offset that nitpicky line above a genuine question: if I were to produce a work and share it with you directly, in private, and perhaps for good measure clarify to you that I am only sharing it with you personally to hopefully get your feedback on whatever it is that I made, and that I do not want you to do anything else with it than the minimum that would be required to fulfil that purpose.

Wouldn't you then see any natural wrong in sharing my work with others or even the broader public, regardless?

kronoon Show HN: Debate Devil – AI debating practice app

Except on Reddit you also have to be increasingly careful that the person you are wanting to go up against and anyone who's commented an affirmation of agreement with your opponent aren't a subreddit moderator or you'll risk getting yourself shadowbanned (through automoderator bot) across the quite possibly large part of Reddit they control.

kronoon Consent-O-Matic: Automatic cookie management

What I usually do is to select a parent HTML element of the list of third parties using the browser's dev console and then use JS to find, loop, and click each of those toggles automatically in one go. The script would look something like this:

  $0.querySelectorAll('.thirdparty button.optoutToggle').forEach(({click}) => click())

Where $0 is an automatic reference to the selected parent element. The pseudocode/example string passed to querySelectorAll should be a selector (same syntax as selectors in CSS) to get each individual toggle element. Then forEach of those toggles it simulates a mouse click event.

That said, whatever is on these websites isn't usually even worth all this effort and it doesn't always work.

kronoon Consent-O-Matic: Automatic cookie management

Curious to know if this also handles that nasty pattern where all "legitimate interest" opt-out toggles are hidden under the expanded details of each individual third party. The only live example of one variation on it I can remember right now is on msn.com (sort of fits their theme, got to give them that).

kronoon WebKit Features in Safari 16.4

That's not at all what I'm saying, you are putting words in my mouth.

"I'm not paying for the privilege of..."

Edit: A continuation of the above but paraphrased from my previous comment: ...being allowed to step over this ridiculous barrier to implement these fixes myself on my own device.

kronoon Employees are feeding sensitive data to ChatGPT, raising security fears

If the contract says the code is special, then the code is special.

kronoon WebKit Features in Safari 16.4

Paying for the privilege of getting to fill gaps and solve problems on my device operating system that the recipient of those payments who also happens to control said device and operating system refuses to resolve or has even purposefully introduced. Yeah, no thanks.. I'll pass.

kronoon Little Snitch Mini

They have no terms of service or privacy policy. As I said, their telemetry collection remains entirely undisclosed and on top of that collects much more data than you might expect it to, as the Sentry SDK they use is wrongly configured to be in debug mode. It's a complete shitshow.