tpmoney

Ok, and the data is in a location that you need to grant full disk access to an application in order to access it. So what is the complaint here? Is it that if you run an application and give it access to the data that it has access to the data?

> I wonder what the boardroom meeting for this was like. Despite the outcome, I doubt the devs were pitching censorship as the reason for implementing this.

I imagine it went the same way that board meetings about any potential PR disaster go. "How bad of a reputational hit will we take if the NYT runs a headline about some kid getting auto suggested something culturally taboo on their iPad? Would it be more than the reputational hit we will take from the people that are annoyed that we won't auto suggest 'Nazi' to complete the phrase 'Trump is a' while they're typing out their tweets? If so, then let's add the list of "do not suggest" to our auto complete system." And that doesn't begin to count the bad press they could get if someone intentionally tries to get the auto complete system to generate something offensive. See also the AI companies getting shit because people were able to get the image generators to generate porn.

Such is the nature of trying to sell your products in a world where most people treat every single thing done by their technology as an intentional act chosen by the developers to specifically target them. If you want to buy someone else's package, you have to live with the fact that they are going to respond to the incentives to avoid headline scandals and government scrutiny much more strongly than to cater to a idealistic free speech model. This is why having a strong social and cultural free speech norm, that extends far beyond the legal letter of the law is so important. You want society as a whole to broadly consider free speech important and worth having over the inconvenience of Tiny Tim learning a new word today.

Every piece of data on your computer that is owned by your user is available to any other app you run as your user. That's hardly unique to this data, and is a well known issue when it comes to personal data and the applications you run under the unix permissions model. That this is at least behind the "full disk access" control makes it more protected than something like all of the tax and accounting data your financial software is storing in your Documents or home folder (well, technically under macOS your Documents folder also has its own permission, but it's the same sort of thing where anything with permission to read from your Documents folder can read anything in there).

It's an eternal balancing act because every time Apple implements some new restriction in their OS that prevents apps from doing whatever they want, whenever they want, people get mad at them. But without those restrictions, the ever increasing amount of personal data that is stored on your computer is exposed to the ever increasing number of data slurping applications that you run.

> Your own data processed on your device, it's fine. Your own data uploaded to be processed?

Ok, but that seems to contradict your original assertion that it doesn't matter where the data is processed. The processes we're talking about run on your computer, processing data about you so that the services your OS provides can use that data to make the services work. That sounds a lot to me like "your own data processed on your device"

How far does this go? Are the Bayesian spam filters that email clients have had for years that use your own classifications GDPR violations because they collect data about what you do or don’t mark as spam? Is your browser a GDPR violation because it collects data about your system that can be used to fingerprint you? Does your OS violate the GDPR when it displays your most recently accessed files in a file picker or as first suggestions when you search for something? Is the SMART monitoring built into your drives a GDPR violation? My understanding of the GDPR is that it applies to data the company is collecting about you. If the company never gets the data in the first place, then they haven’t collected it.

For the GDPR to have impact here, wouldn't they have to be collecting the information in the first place? If they're doing all the work on your own computer, that wouldn't trigger any GDPR issues.

Oh come on, data leaks (even unintentional ones) have been a part of our collective industry since about the time the first two computers were connected together. Whole industries exist to put together profiles of you based on data that deterministic applications that you installed and choose to use send with or without your knowledge all day long.

It's also possible to craft a comprehensive law. My state allows all of the following, even expired versions as long as it expired within the last year, or if the voter is over 65 as long as it was unexpired on their 65th birthday regardless of how long it has been expired now:

1) Driver's license, even expired if expired within the last 2 years

2) State Non-Driver's ID

3) Out of state Driver's License

4) Passport

5) Free Voter ID

6) College / University ID

7) School employee ID

Additionally all the following are valid, without any limitations on expiration as long as they are photo IDs:

1) Military / veterans ID

2) Tribal enrollment ID for Native tribes

3) Any other photo ID issued by any federal or the state's government agencies

In addition to all of that, if you still are unable to produce an ID, you can still vote with a "provisional ballot" and sign an affidavit declaring your inability to obtain an ID. All of the following are valid reasons:

1) Lack of transportation

2) Disability or illness

3) Lack of supporting documentation to obtain an ID (birth certificates etc)

4) Work or school schedule

5) Family responsibilities

6) A lost, stolen or misplaced ID

7) Applied for an ID but haven't received it

8) Other impediment (write in)

9) Religious objection to being photographed

10) Victim of a declared natural disaster within 100 days of the election

All provisional ballots must be counted before the state can certify the vote count and a provisional ballot can only be rejected by unanimous vote of the board of elections commission that the ID exception form was filled out falsely.

That seems a pretty reasonable system to me given how it's pretty much impossible to interact with the state, the federal government, banks or employers without a photo ID these days.

Providing you with a routine notice that applications are repeatedly tracking your location is improving your privacy. If the legal requirement is 1st party applications don’t get special treatment, then yes asking you for the weather app too as opposed to just not asking for any apps is improving your security.

You can delete the News app, give it a try.

Following renumbers has to be one of the worst parts of this. As an example, the text of the US code that was modified by the BCRA in 2002 has been renumbered / moved since Citizens United v FEC was decided. But the text itself is the same as it was since the BCRA passed, because courts don't remove the actual law text with their decisions. So if you want to know what parts of the current US code were ruled unconstitutional by the courts in that decision and are therefore unenforceable, you need to first find the text of the BCRA, because the ruling refers to the sections of that piece of legislation. Then you need to find the version of the US code that was on the books when the BCRA was passed to find the section references that the law talks about. Then you need to find the law that renumbered that part of the US Code and find the new parts. Then you need to see if any changes have been applied since (there hasn't really) and then you need to match the changes to the referenced sections in the old version of the code to the equivalent text in the current version of the code, modulo any changes to references that changed as part of the renumbering but are otherwise the same.

I'm not saying lawyers aren't really really expensive, but you don't have to spend a long time digging into just a simple question like "what parts of the law are no longer enforceable after a supreme court decision" before you start to understand why they charge the prices they do.

It depends on the question you're trying to answer. The text of the US law which Citizen's United struck down remains on the books today (though has changed since it was moved to a different part of the code, so references have been updated), but the actual effective law has most certainly changed from when it was written to now. Since courts can't write or modify the law, the literal text remains, even if some of that text is effectively stricken as if the text had been removed.

If you want to know the literal text (that may or may not be enforceable), then sure a plain text diff is sufficient to know that nothing at all has changed about federal communication laws since this section was last amended in 2002. But if you want to know what the actual law is, you definitely need more than just a text diff.

Something akin to this is a big part of the products that companies like LexisNexis or Thompson Reuters charge your lawyers a whole lot of money for. Because for a lot of legal questions, you don't just need to know what the law says now, but what it said at the time of the incident in question. And every legislative body around the country (at least at the time I was working in this space a decade ago) publishes legislative changes in completely different and often times not easily parsable forms. Web scraping and PDF scraping was far more common than you'd think. Some state legislatures published changes in more reasonable forms, and some states contract their official legislative compilation to companies like LexisNexis or Thompson Reuters and work to publish an actual change stream with proper standardized references. There's a lot of manual work that goes into making stuff like this work, a lot of lawyers and other legal professionals manually reviewing that the right pieces were removed or added in the right places, matching up references to parts of the law that might have changed between the time the legislation was passed and the time the change was published and figuring out what order everything actually goes in. And the actual text of the law is only part of the equation. Legal decisions from courts can dramatically impact the reading of the law, or effect effectively strike laws from the books (even if the laws are technically still on the books, just not enforceable). So often the right way to represent a diff of two points in time depends on the question you're trying to answer.

Are they really “doing everything they can to prevent it”? The Asahi folks have already talked about how some of the things in the boot loader only make sense to allow non-Apple OSes. On top of the fact that the boot loader itself is unlocked when we know for a fact they know how to lock down a boot loader for their own chips since they do it for iPhones and iPads.

It seems to me like they are indeed just “not supporting” it, to the fullest extent possible.

Arguably the thing you’re missing is the 5090 is $1999 MSRP and more like $5000+ retail currently, and then you still need to buy the rest of the computer. This on the other hand is a whole system for $2400 (for the 32gb config). Maybe won’t set the “local LLM” world on fire, but likely to do a lot more for it than the 5090s will for the moment.

Because people love to add slogans, catch phrases and witty sentence fragments, and AI was trained to mimic people. AI has shone a spotlight on it, and because AI isn’t perfect, it tends to overuse and use it where it shouldn’t. But go read news articles, blogs and corporate press releases from before the AI boom and take notice how often AI “tells” also show up there. The internet made hot take mic drop sentence fragments, “witty” turns of phrase and clickbait “it’s not foo, it’s bar” cliches a core part of its lexicon. It really shouldn’t be surprising that it shows up in AI too.

AI is going to be both a boon and a bane for doctors. Its "good enough" behavior will lead to complacency like it does any place where the automated system is "good enough" but the system still wants human validation. This will without a doubt result in some preventable tragedies that will end with more work and check lists (and probably not enough accountability). But there are other places where it will absolutely free up mental energy to focus more on the patient.

I was talking to my own doctor and their experience with a new note taking / transcription AI app they've been using, having worked on medical software before. One of the problems I noticed when designing software then was that software likes its categorized fields, with data entered just the right way and in just the right order. But medical work is almost never that neat and tidy. Patients and other medical professionals give you information in whatever order things come to their mind in, or in whatever order their own system and paperwork displays it. A simple prescription consisting of a patient's name, DOB, medication, medication form, dispensing quantity, refills and dosing instructions might be given to a provider in any order of those fields and no matter what order your software chooses, it won't be the same order as someone else giving it to you. Most providers that used the software I worked on resorted to hand writing everything down and filling it all in later, or having to ask for repetition over and over as they clicked through various fields trying to remember everything before it flicked out of their short term memory or the other person moved on. And as more and more systems and regulations require everything to be entered into electronic records, this has become more of a problem. To the point where you go to some appointments and you often don't even see your doctor's face because they're stuck behind a terminal nodding along as they try to capture everything you say into the specific fields in the system. AI tooling has the potential (and at least from my own doctor's experience, is already showing that potential) to free up the mental effort spent on getting the right data into the right fields. AI can do a great job of understanding that a free text field that says:

    Fucitol tab 25mg qid
    John Smith 01/01/75
    #30 3 months

and a free text field that says:

    Fucitol 25mg tablet
    30 tabs, 4x per day
    3 refills
    Smith, John 1975-01-01

say the same things, and get those things into the right fields in the record for you. They still need to go back and check it (and see the previous caveat about "good enough" systems) but by freeing the doctor from the mental load of intentionally categorizing all of the data they're hearing while simultaneously trying to reason through what all that data means and enter it at the same time they have more mental room to actually pay attention to the things the patient is saying, the things they're doing and the things the doctor is seeing.

And one thing I hope is that it makes switching doctors if you need to safer and more effective. The sheer volume of information a new patient can bring with them if they have all their medical records is massive and sorting through it all is likely something we'll never give our providers enough time and money to do. Things will get missed, or doctors will defer (consciously or not) to the diagnosis already listed, even if a more thorough review might reveal the diagnosis was wrong. An AI system designed to review an influx of data with an adversarial eye, or at least an eye towards looking for missed possibilities or potential reasons for the patient's dissatisfaction with the previous provider could go a long way towards helping end the sorts of "I went through 10 doctors all of which told me it was all in my head/I should try losing weight/I can't be experiencing this issue at my age, and then finally the last doctor had just finished reading a paper about how XYZ can cause these symptoms and now I'm finally getting treatment" stories anyone with friends or family with chronic health problems probably has heard more than once.

I think it was that it was a concrete example of Apple not sweating the little things that couldn’t be dismissed as just “people don’t like change”. And it was also a big and intentional enough change to not be an “oversight”. It wasn’t so much blown out of proportion as everyone could finally agree that it was bad

It sounds like an LLM because LLMs were designed to sound like people. I get it, there’s a lot of tells and “quirks” that clearly mark out LLMs. But what makes an LLM obnoxious is not that it uses the same cliches we use all the time, but that it uses the same ones repetitively and sometimes in places where it doesn’t make sense.

But start paying attention to how you talk and write and you’ll realize you’re using those same cliches all the time. Heck I just did the “it’s not foo, it’s bar” cliche in the previous paragraph because it’s a useful language construct and it appears often in writing. An LLM writes like a budding author that learned “never use ‘blank said’” as a writing rule and goes to tortuous lengths to come up with more “clever” ways to say someone said something. But those clever ways are used all the time by very good writers too because they’re effective phrases. LLMs and hyper vigilance for their writing just means we’re more aware of the cliches we use

This sort of panic about people who have been on a controlled dose for long periods of time or just straight up panic discontinuations of doses is the same crap that exacerbates opioid problems too. Too many stories from family members about their loved ones who were prescribed high doses of ${addictive drug} and then suddenly some other doctor (or sometimes the same doctor) suddenly decides this was all a mistake and cuts them off completely. Soon those family members who maybe did need to come down from where they were are seeking illicit sources of their drug. And it's near impossible to get out from under a doctor if you do think they're overprescribing because of just this.

My own family had a similar problem. The family member was way over-prescribed a drug by a doctor who clearly wasn't helping treat the underlying issues and frankly barely remembered the patient from month to month (for a person they were seeing every month). It still took us nearly a year to find a doctor we could switch to because everyone we called was so freaked out by the dosing the prior doctor had prescribed that half of them wouldn't even touch the case at all, and the others wanted to just stop everything cold and start all over again. The problem with that being that the underlying reason they were getting prescribed these medications was still an issue. Asking someone who does need the medication in question (or similar treatment) to not only suffer without it for a few months but also just stop their escalated doses cold turkey is just needlessly cruel and harmful. We were lucky to finally get a doctor who accepted helping us get things under control, with a pre-made plan of action and a "sole-prescriber" contract, both of which was fine, we just needed someone whose plan didn't start with "and now you stop everything you're taking to treat your condition and we wait until you're detoxed before we try anything else".

The flip side of this argument is that often times as a developer, you might be asked to implement a "security" change that is actually worse, but the people asking you think it's better. How many people still work with system that require regular password rotations, or arbitrary complexity measures even though that is no longer considered good practice by organizations like NIST?

For that matter, and speaking of NIST, their new guidelines apparently require checks against known breach databases when registering passwords. So if the goal is to "take every opportunity to reduce attack surface area and potential information leaks", if you're following the latest NIST recommendations it sounds like integrating with HIBP is actually the correct thing to do. Obviously they could also do things like offline checking with a downloaded DB (though are you potentially leaking information if HA requests an up to date offline DB?) or make the feature opt in. And I do think they should do both of those things, to be clear. But I don't think it's arrogant to want to understand the proposed threat model before making a change to your application's default security posture. Especially if you chose that posture with the intention of making the system more secure in the first place, and it does reasonably do so.

So it gets a little weirder too because here[1] is an article on their site where they are very clearly using a diacritical character in the main body of the text for "Hernándas" which means whatever backend they're using must support something other than plain ascii. If it was Latin-1 or a similar code page that might explain why they couldn't use the "macron" or "overline" diacritic characters directly, but it doesn't explain why they couldn't just use the HTML escape sequences then, since they can clearly inject them like they did between "Kau Desert" in the Hawaii article.

And while it doesn't say what their backend can do, certainly if you edit in the &#773 escape sequence after the U into the page HTML it seems work, so nothing in the page content itself would make them unable to display the characters. Just makes their note all the more strange.

[1]: https://www.sfgate.com/sports/article/alcantara-gets-another...

Calling attention to it kind of makes it worse. If they didn’t have that note anyone who saw and was bothered could chalk it up to them not caring or not knowing like so many other publications would be. But by dropping this statement at the end, they’re saying they know, they’re claiming they care, they just don’t care enough to actually fix their systems to handle apparently anything other than ascii text despite the fact that even if that was all they could store in their database HTML has support for Unicode escape sequences and they could use that.

macOS seems to have a “lock direction” for trackpad scrolling on zoomed in windows. Whether you like this or not is in my experience largely a function of how much you do normally do a diagonal scroll. On the one hand it means if you scrolled in to fill a column, you don’t need to be perfectly precise with staying up and down to scroll up and not also scroll the column off to one side. On the other hand if you don’t start with a very explicitly diagonal scroll, it won’t let you scroll diagonally without stopping and starting again.

macOS should in general always extend for the first press, and then move relative to that decision. So if you select some text with the mouse and then shift-left/right it will extend the selection in whichever direction you chose. But after that first extension, you’re now in a “keyboard selection mode” where continuing to move in the first direction will continue to extend, but selecting the opposite direction will shrink the selection. And the up/down keys work the same and relative to the current extension direction (so if you were extending to the right, down will continue extending since going right at the end of the line would move you down, and up will shrink the selection by the same logic. And the reverse for extending to the left)

Mostly this makes sense to me, though it is admittedly annoying when you’ve selected a little too much with the mouse and want to deselect, you need to extend a bit first and then reverse direction.

And also option-left/right moves the cursor by word, and option-up/down moves (I think I almost never use it) by paragraph.

This definitely must just be a “what you’re used to” because I find using ctrl for a modifier to be far more “contorting” than moving my thumb a bit to the left or right of where it’s already naturally sitting for the space bar, and my thumb is a “stronger” finger than the pinky so it also just feels easier on the hand. So much so infact that I remapped the right hand command key to ctrl in emacs (with the usual capslock-> ctrl remapping for the left hand) just to make it more comfortable.

It also has the benefit of (mostly) separating OS wide keyboard shortcuts from terminal commands. Copying text is always “CMD-c”, and not “usually CTRL-c, except in a terminal where it’s actually CTRL-Shift-c, because otherwise that would interfere with terminal control characters”

It’s an OS level thing (well, OS + standard widget library). As long as the app is using a native macOS text field, the OS has (and has since I think the first versions of osx) support for basic emacs movement keys, no extra effort on the app developers part.

> I think this post's arguments are mostly flawed, but without getting into that, my problem with "AI" is that it's just fundamentally antisocial - it's built on using the work of billions of people in a way that they would not like it being used.

I think any argument like this has to contend with the fact that our entire industry is rife with projects we almost all support at least a few of, that use or enable other people to use other people's work in ways they would not like it being used. From Napster, to emulators, to jailbreaks, to API compatible replacements, DeCSS, any fair-use defense of copyright infringement, community splits of open source projects, DRM stripping tools, CD rippers, tape recorders, even down to the humble search engine. It seems hypocritical for us to suddenly now develop a support for moral rights when the shoe is on the other foot.