“It’s kind of broken, maybe they will fix it at some point,” has become a common theme across products from all different players, from both a software defect and service reliability point of view.
8,073 karma · joined July 15, 2013
https://a.drien.com
https://github.com/drien
https://infosec.exchange/@adrien
“It’s kind of broken, maybe they will fix it at some point,” has become a common theme across products from all different players, from both a software defect and service reliability point of view.
Closure was something I had known was a risk with any conflict with Iran after learning about the Tanker War in some politics class in college, and following the various threats over the past 15 years or so. It seemed like something that should have had tons of coverage as soon as I heard the US had attacked Iran, and I wanted to know what was actually going on with it...yet all of the mainstream press seemed to skirt around it until oil prices finally spiked on Sunday, even though traffic through the strait had fallen off a cliff a week beforehand.
It's some combination of what they call "self monitoring" in social psychology, plus general EQ and Machiavellian personality traits that allow people to read the room and adjust their tone, speaking style, word choice (including picking up in-group lingo quickly), posture etc to be most effective given the setting. This applies to basically any social environment, and is often a frustrating reality to many people who may be extremely competent but see others around them who are obviously less competent "getting ahead" through social acumen, office politics etc.
This has been studied among MBA graduates, Do Chameleons Get Ahead, The Effects of Self-Monitoring on Managerial Careers (pdf): https://web.mit.edu/curhan/www/docs/Articles/15341_Readings/...
- VMs, I'm leaning on them more and more for sandboxing stuff I'm working on, both because of the rise in software supply chain threats, and to put guardrails around AI agents.
- Local LLMs experimentation, even pretty big MoE models (GPT OSS 120b) run pretty usably (~10 tokens/sec) with the latest tooling on a 16GB GPU and a lot of system memory.
- Even compared to a fast NvME drive, it's super nice to load a big dataset into memory and just process it right there, compared to working off of the disk.
Two examples that are top of mind…
They exploited browser vulnerabilities not unlike malware to track users’ behavior across the web: https://www.eff.org/deeplinks/2025/06/protect-yourself-metas...
They bought a “privacy” VPN app and used it to harvest data, then abused Apple’s enterprise app deployments to continue to ship the app after it was banned from the app store: https://en.wikipedia.org/wiki/Onavo
A lot of potential harms are at a societal level as well—from a public health perspective, if everyone starts having regular MRIs that produce incidental findings which require followup, you’re suddenly tying up lots of resources that would otherwise be available to actually-sick people. A person with symptomatic problems whose treatment is delayed because they can’t get an appointment because the specialists are booked full with incidental findings, that person is indirectly harmed by this.
The radiation from CT scans is not especially concerning at an individual level when there is a compelling reason for it, but, if we’re suddenly doing tons more to investigate incidental MRI findings, there may well be a point where those scans are causing a significant amount of cancer overall—a recent study suggested, I believe, that CT scans may be responsible for 5% of cancers already.
I remembered this guy from his “Reflection 70b” scam in 2024. That should have basically put his credibility at zero, but clearly it has not.
I found this interaction in the HN comments from the time of that minor scandal to be prescient:
>> It's amazing what people will do for clout. His whole reputation is ruined. What was Schumer's endgame?
> But does reputation work? Will people google "Matt Shumer scam", "HyperWrite scam", "OthersideAI scam", "Sahil Chaudhary scam", "Glaive AI scam" before using their products? He wasted everyone's time, but what's the downside for him? Lots of influencers did fraud, and they do just fine.
It’s a pretty large app (I think >1M lines of Python). I ran a self hosted version for several years and found it performant and pretty easy to keep running and updated.
The US, for example, apportions representatives and votes for President in a way that overweights less populated states, and there are various aspects of parliamentary systems that help avoid landing in a two-party system where a simple majority gets the say in everything—they force compromise and coalition building among disparate groups. Additionally, Constitutional systems will enumerate the rights of its citizens such that they cannot simply be taken away by a simple majority of any body.
Democratic countries are also basically never "pure" democracies where everyone votes on every decision as in your Plato's ship analogy—we elect people who audition for the role of running the ship, ostensibly those among the people who are best suited to the task.
We decided we'd just stay out late, then go to the airport and wait it out for our flight. After some effort trying to sleep on hard plastic benches in the airport Burger King (where Michael Jackson's Thriller was playing loudly on repeat, I do not know why), I pulled out my 12" PowerBook and found out via that site that the airport had a meditation room with dim lighting, soft carpet, and no Michael Jackson. Ahh.
Amazon sort of threw this out with the steady movement towards blending third party sellers in with products they sell directly. They made it less and less obvious and easy to filter based on seller over time, so now you have all sorts of junk from the digital equivalent of street vendors mixed with normal products, and it’s up to the shopper to figure it out. They tolerate tricks and fraudulent behavior from those sellers much more than they should.
Amazon could, if they wanted, make it easy to filter for products that have been selected by a buyer who has a relationship with the vendor, and are directly sold by Amazon themselves, but it’s seemingly more profitable to allow third parties to peddle garbage en masse.
I was into StackOverflow in the early 2010s but ultimately stopped being an active contributor because of the stupid moderation.
It seems to be there has been some sort of internal conflict between the need to add basic functionality to be remotely comparable with Android, and the desire to keep everything "simple". The end result being a kind of a worst case of neither being especially featureful nor all that simple. There's a cottage industry of apps that exploit users' lack of understanding of their own device's capabilities (e.g. flashlight apps with ads + in-app purchases).
I've found myself in this mode before, too. A couple of years ago I was preparing for weeklong wilderness backpacking trip with some friends. I'd recently quit my high-stress job to take some time off, and I had a few new pieces of gear I wanted to test before relying on them on a longer trip. When I looked at the calendar, though, every weekend before we were to leave was already spoken for.
I was worrying about it to my wife, trying to decide whether I'd just have to use the old worn out gear or risk it with the new stuff, when she stopped me: "why don't you just... go on Monday?" It took me a second to even get what she was saying—I was still so much in work-all-the-time-mode that my brain didn't even consider whatsoever the possibility that I could just... go off and go camping on a weekday. I was really baffled for a moment, and I've reflected on that a bit since, it's funny how you can be trapped in your own default operating mode and not even realize it.
Discussions about this often wind up with a lot of people saying "GET requests aren't supposed to change state!!!", which is true, but just because they're not supposed to doesn't mean there aren't some floating around in large applications, or that there aren't clever ways to abuse seemingly innocuous side effects from otherwise-stateless GET requests (maybe just visiting /posts/1337/?shared_by_user=12345 exposes some tiny detail about your account to user #12345, who can then use that as part of a multi-step attack). Setting the strict flag just closes the door on all of those possibilities in one go.