One thing I haven't seen tried in any of these things floating around (I'm still on macOS 15) that is the first thing I'd test after deletion is to stick a locked dummy file in there of the same name and see if that interferes with redownloads without any of the other mess. That's a classic simple hack. Ie, after deletion just a quick
Then reenable SIP (or not). While maybe Apple stuck in some extra smarts in their download logic, and a full system update I think nowadays just blows everything away and replaces it, I've found in practice developers (not unreasonably) tend not to consider non-trivially-removable files appearing "where they're not supposed to be" and build a path for that. Granted, possible the process just ends up spinning trying to redownload over and over again or something but would be an easy thing to test.
>Is there any difference between US citizens and visitors?
Yes. US citizens have an absolute right of return to the US (at a land border anyway, they can be stopped from boarding a flight to the US while physically in another country). If there's an active warrant for arrest or they commit a crime right there or the like they can be arrested, but the process at that point plays out the same as an arrest anywhere in the country with the same standards. Property can be screened and denied, or potentially seized, but the person can than challenge that and it must be returned unless there is reason. This significantly changes the math as far as practical inconvenience to refusal to cooperate, though I don't want to downplay how much it could suck for most people to have expensive stuff taken for even a short period of time. But they can't keep someone from getting home and, in turn, back to financial, legal, political, and social support networks which can back them from there.
Visitors on the other hand have no right to entry at all and can be denied for any legal reason (which in practice amounts to near anything). They can be banned from future entry as well for a period of time or indefinitely. So they face different (and greater) pressure.
>In my home country I can just deny getting my devices searched. They might be allowed to seize and seal them, awaiting a court order for searching the device. Which I could appeal.
This sounds roughly the same as America then, depending on specifics. Here LEAs may not unfortunately need a court order to search the devices of an American "as best they can", but they can't compel cooperation either (and in fact generally cannot get a court order for that at all outside of a narrow exception due to the 5th Amendment). So if a device isn't encrypted, or if it is but they're able to break into it, or if (as in this case) the person in question simply goes ahead and unlocks it for them then that's at least for now allowed (hopefully SCOTUS overrules the 2C), but they can't legally force password entry.
>Basically the same process as anywhere else in the country, international borders are not some special place that gives the police superpowers.
You don't mention your country (and that's fine!) but I don't think there is a single nation anywhere that doesn't have "police superpowers" at international borders. It's sorta a core part and parcel with the basic idea of a "nation" at all, that it can if it wishes regulate its people/goods exchange with the rest of the world. When you travel within a typical free-ish country you can just stop at a store in town and buy stuff and then take it home and the police can't investigate it and demand receipts and that you pay additional taxes or just outright seize it or make you take it back. Right? That's just, normal, within a single polity everything is already under the same rules.
But a border between independent polities by definition means that there could be goods legal in one but illegal in the other, or that are subject to different standards, or different safety considerations, or where there is disagreement on whether/how externalities are accounted for, or just simply taxed differently for pure revenue purposes. In turn, what country doesn't give themselves the right to regulate import of physical stuff, even if internally there is total freedom of movement and goods? Genuinely curious?
The argument here though is that this isn't about regulation of imports, but a criminal investigation. And I agree with legal scholars like Orin Kerr that the Second Circuit got this one wrong. This was not an import power thing, trying to stop contraband or levy legal import taxes, this was a criminal case, and I think that should always be protected by the 4A.
>No statute defines "clean room RE" and there's basically no relevant litigation establishing case law.
You seem confused here? "Clean Room RE" is simply a descriptive result of copyright law in the US, and is well established. In the US there is no "sweat of the brow doctrine", pure facts simply cannot be copyrighted at all, nor underlying methods/ideas (that's patents). And as a direct result of the latter, again unlike patents, if two people truly independently write the same thing, both get separate copyright.
"Clean room reverse engineering" is just applying that to make any legal fight much cheaper or discourage it from every being bothered with in the first place. You have an RE "dirty" team that goes through copyrighted software and makes a specification that is purely factual, ie, "function 1 takes (int16)X input and does equation ABC on it, function 2 takes (long)X & (long)Y inputs and does LMN" etc. A factual/math spec like that cannot be copyrighted, so it breaks any derivation chain. They then give that, and only that with no other communications, to the clean team. If someone with no other exposure to the software being RE'd uses that spec to write a new piece of software themselves, then by definition the result cannot have any copyright of the original. It's a brand new work based off a list of uncopyrightable facts & math/ideas (though worth noting it could still get tripped up by abomination that is software patents).
There are other ways to argue against copyright infringement successfully, but they're much more subjective, which legally speaking reads "expensive, uncertain". CRRE simply trades that for two clear binary questions: was the spec copyrightable, and did the people writing a new piece of software from that spec have any previous exposure to the original? If the answers to that are no, then all arguments about function names being similar or whatever are no longer relevant.
On the subject of LLMs, one curious twist is that proprietary software might have less effective protection then open source depending on how it all goes. A coding LLM almost certain trained on all open source software available on the web. So there's at least some argument it's tainted. But proprietary software is proprietary. If the LLM has never had any of the source code in its training input, then isn't it clean in terms of producing anything derivative of that? That'll be kinda interesting, and might leave some companies with a bit of a conundrum (or I guess pushing the patent side even harder, but that has a much more sane 20 year expiration date vs copyright).
While I'm sure it has its uses, particularly if someone really does want to game or do complex computational stuff purely within a web browser, I'll admit I've grown pretty cautious/tired around the ever increasing amount of hardware attack surface area the browser vendors seem to be rushing to expose as Google in particular appears determined to try to be the "operating system on the operating system" as much as it can. In this particular case it made me realize I'd awhile ago set dom.webgpu.enabled and pdfjs.enableWebGPU to false in Firefox, same as I disabled WebGL. Kinda figured if I ever saw something ultra cool I could enable it just that one time but so far I haven't. Semi-related, reviewing the available settings now for the first time in a bit I notice they have a dom.webgpu.blocked-domains with the sole entries being "easyeda.com,*.easyeda.com", I wonder what that's about?
It looks like per-domain WebGPU blocking was added exclusively just for easyeda.com !
Haven't read it all, but the story seems to be that EasyEDA's WebGPU usage was broken because it relies on some aspects which Firefox hasn't implemented yet. So they made this blocklist to get Firefox to behave as if it lacked WebGPU support completely on this domain, which makes EasyEDA fallback to some other non-broken version. Maybe they couldn't get in touch with EasyEDA directly, since it seems far easier to have them just disable WebGPU for some known versions of Firefox.
I'm with you. WebGPU has been used to compromise and fingerprint systems. Firefox (and related forks) are usually able to disable this kind of insecure fluff but it'd be nice if other browsers did as well.
>On the other hand, disabling WebGPU is offering entropy for fingerprinting, too. A vanishingly small % of users will have done so.
I think near any anti-fingerprinting efforts though presume some floor level of system security and stability. If some particular hardware exposure feature lets attackers run arbitrary low level timing and hardware testing code or crash the system or break the sandbox the game is likely over for most people.
An extra bit of entropy isn't meaningless sure, but at some point there should be some weighing of absolute attack surface against it right? Some features just seem inherently anti-privacy/anti-security and one might just have to try to deal with that via other approaches.
Hopefully, but it's good to have it disabled as well so that your system isn't screwed by the next zero day and to help cover you in case the fingerprinters manage to find a technique to get identifying data from WebGPU that your ad-blocker hasn't accounted for. It's a constant arms race after all. Hopefully the ad-blocker is still feeding them randomized data even with it disabled, but otherwise other randomized data points should keep your fingerprint unique even if a lack of WebGPU support stays consistent.
WebGL is also a major security risk that has been used to compromise many machines. The world didn't end, but many people have been hurt because of it. I disabled WebGL the moment support was added in firefox too.
Quite so. When it first took off, I took no end of flames and downvotes for suggesting that WebGPU is a terrible idea. HTML and the browser were originally conceived to render documents, not serve as a bastardized application distribution platform.
The only arguments I've ever heard in favor of wasm/webgpu were that using native graphics/GUI toolkit APIs are a pain. That's definitely true, because I've written stuff with gtk and it sucks, but that doesn't mean we should just shovel an entire tech stack into the browser.
Just because we can, doesn't mean we should. I'm tired of these BigCos shitting everything up.
So, I kind of agree, but I don't know what a better solution looks like.
Is it really better for users to download and run straight up executables with no security model? We tried that in the 90s and 2000s and it was pretty bad. We can have OSes introduce a security model, like Android and iOS do. But then what about desktop Linux users like myself? Am I just to be excluded because I don't use a popular (and proprietary) operating system?
Okay, we can invent a standard, cross platform app distribution mechanism with a security model. And that's... exactly what web browsers are. In the end it seems like the least-bad solution to me. I quite like that I can run GPU accelerated programs without the dev having to put in special effort to support my Linux distro.
>Is it really better for users to download and run straight up executables with no security model?
Yes. Unambiguously, a system where the only code that runs is code that you explicitly run is more secure. Social engineering and basic tricks of telling someone an app does A while it really does B are not solved on the web, because social engineering cannot be solved. In the supposed safe gardens of app stores, apps do exactly that all the time and are not well moderated. Apple's supposed moderation approved a "Lastpass" password manager app that was not made by the actual Lastpass company. If that can get through, then anything can get through.
Meanwhile, the webapp solution is for any site you visit to be able to download and execute whatever they want, rather than whatever you want, and most sites also set a third party to have the ability to download and run whatever they want, and Google wants that system to have as much control over your local hardware as the OS does, so how is this better at all? It's strictly worse. The web security model is worthless. It depends on random third parties you have no affiliation with to not get hacked themselves, and not make stupid choices.
It's fine to just not have "Web bluetooth" actually. 800 "Partners" just don't need to be able to access that.
What is the "Security Model" of the web, that every random person willing to pay a few cents for an advertisement should be able to run code on your machine without your authorization? That anyone should be able to target individuals for RCE through advertising infrastructure?
> Unambiguously, a system where the only code that runs is code that you explicitly run is more secure.
I don't think so? If I want to run a 3D modeling program and I download their executable and run it, it has access to everything on my system. All my local files, open access to my network connection, whatever's going on with my internal network, etc. If they want to read all my files and upload them, they can just do that. This is not true for web applications.
Programs that run in a browser are sandboxed and only have access to what web standards say they have access to. They can open a file select dialog to get a file from my machine with my permission, but they don't just have access to all of my files like a local program does. Web standards developers put a lot of effort into finding a balance between security and capabilities for new web APIs.
> What is the "Security Model" of the web
Unlike locally running programs, web applications don't have access to everything on the system by default. Interactions with the local system are intermediated by the browser. Usually the user has to approve access, or there are limitations on what types of access a web app can have.
If you head into your Firefox settings and select "Permissions and data", you can see what kinds of things given websites are allowed to access. Usually when they first try to use one of those APIs, the browser will pop up some kind of browser-level dialog asking the user for permission to perform that type of action (eg "access local devices" or "show notifications"). These are all examples of the web app security model (and there's a whole lot more that is not as user-facing).
Local applications on the other hand, do not have any kind of security model. The 3D modeling program I downloaded can just package up all of my files and upload them to their server, completely silently. That's way worse than what web applications can do!
> It's fine to just not have "Web bluetooth" actually. 800 "Partners" just don't need to be able to access that.
People don't want documents. Almost everything useful you do on the web is some form of interactive app from a simple forum with no JS to Figma or 3D games.
I think we need to go the other way, all in on apps. The browser only has to expose permission based I/O, WebGPU and a way to build a11y semantic trees. Globally cached libraries can handle everything else. That would reduce the attack surface and core complexity while making the platform more flexible. HTML can run as a legacy layer on top.
Yeah in the end I probably agree on WebGPU, I haven't really seen a single use of it, except for running shader code examples in browser, which might as well be replaced by a looping video.
For WASM though, I do not agree at all! It's genuinely a great system for high performance browser code. So much stuff I use now had WASM as the backbone, and I even started applying it outside of the browser in some of my architecture. I wish we had way more enthusiasm behind things like WASM, and way less for something like WebUSB.
Hey you’re right, we should gladly accept every decision the big corps make. They know best, after all. We should probably lick their boots too, in gratitude for their benevolence.
The application delivery thing was done as far back as Netscape threatening to relegate Windows to "a poorly debugged set of device drivers" so Web-whatever is simply another step in that direction. Like I said, if you purists want just document delivery, you can use links or w3m or maybe Gemini.
Some kind of market forces kept Netscape in check back then. Now they aren't.
Like, Tesco would prefer that my operating system was a roast chicken, Baowu Group would prefer it was made of steel, Berghain would prefer that it had to queue for hours to possibly get in, and Jagex would prefer it was an in-game GUI within RuneScape. None of those companies got their way, what makes Netscape special?
The point is that browsers have been made and funded by BigCo, and treated as app delivery platforms at least for the last 20 years. Netscape, Microsoft, Apple, Google (for Mozilla and then Chrome). The last non BigCo mainstream(?) browser was probably Opera.
It's silly to complain now about BigCo, WebGPU, and ignore the past 20 years of history. The WWW has not been about document delivery only for the last 20 years. Instead of tiring themselves out complaining about the Web and modern browsers, they can use something else.
>EXIF data is stripped for a good reason - because it can be a privacy hazard. Suddenly this plays no role anymore?
Can you clarify what your actual complaint is here? Putting aside for a second obvious implementation options, it's pretty standard that there can be a tradeoff between privacy and trust. Any of us are still perfectly free to upload images for fun to forums or social media or whatever that are private, or edited or whatever we like. But if there's something we [i]want[/i] to prove, this gives an extra option to do so. And in particular the set of cases where one cares the most about enhancing authenticity appears at first thought to be pretty much a union set with the cases where one will put their name (or at least the location and time of the picture in question) behind the image? Like, can you give examples of specific cases you are imagining where simultaneously the photo itself reveals no information about time and location [i]and[/i] it's something local/national/international-newsworthy where people would fear AI-alteration? Like, say you're photographing at a protest to document it including any violations of law. By definition, the images you take reveal the location and the time. That's the whole point of them. Having the location and timestamp signed wouldn't reveal anything extra as long as the photo was unaltered.
And actual legit journalism always has name(s) standing behind the reporting. Or for that matter, even if we're merely talking something like a review of a product, is it actually wrong to put a name or pseudonym behind that review if you expect readers to give you much credence? I mean, you'd be free in terms of law and tech to not bother. But even long before the current growing AI-slop age a lot of us have been starting to treat anonymous reviews with a lot of skepticism, or discounting them entirely for some product classes, for good reason.
Even in terms of maintaining privacy, remember we already have "tools" for that which this in turn could further help. You could privately report a tip to a reporter at a media organization, and then they could report on that without revealing you but be able to say "we verified the signature of the raw image and sensor data" alongside normal follow up. Then it's their name, but having a stronger chain behind it could still be helpful in places.
Finally getting back to "implementation options", there's no technical reason the image and multiple sets of metadata can't all be signed separately by the sensor stack such that you can pick & choose what to include and still have it all be signed, with readers giving greater or lesser weight to the trust based on your choices.
I think what got me worried is the GPs take that "I expect in the near future all digital cameras to digitally sign the images they take". Sure, if you have your special, verification-enhanced camera, go for it. But if this goes like with smartphones and we have all cameras embedding such a signature - and therefore all cameras are made locked-down and tamper-resistent - then we have another category of devices removed from control of their users.
> Any of us are still perfectly free to upload images for fun to forums or social media or whatever that are private, or edited or whatever we like.
First, the paper proposed a method of embedding the metadata inside the actual image pixels in a way that makes it difficult to remove. I think it's still possible, but you're will need a specialized tool to do so and it will alter the image.
Second, that's assuming forums or social media would still be allowing uploading unsigned images. If AI images really become as much of a problem as anticipated here, then sites might decide to block any image they can't verify completely.
> Like, can you give examples of specific cases you are imagining where simultaneously the photo itself reveals no information about time and location [i]and[/i] it's something local/national/international-newsworthy where people would fear AI-alteration?
All kinds of photos from warzones have this property. We wouldn't have an entire science of geolocating photos from landmarks that were accidentally captured if everyone was so easy with putting their GPS coordinates in the file.
As @severine said a few hours ago, lots of upvotes, zero comments, guess today between work we're all squeezing in a bit of Shattered 4.0.0 instead of HN ;). I got an incredibly lucky 7 challenge Assassin run going on the previous version that I'd forgotten about at floor 6, so I've been continuing with that to give the new one a kick. Just reached the new Imp Quest right now, trying to decide whether to try it here or do so on a fresh vanilla run to see how it goes without challenges on. If challenges apply in the vault Into Darkness in particular might be tough. Though I guess on the other hand unlike normal no point in worrying about further leveling or equipment before trying it since we get reset to zero, that's actually kind of fresh in its own way.
I agree that the new designs might just take awhile. They're definitely prettier, but right now since a lot of art hasn't been updated yet they stick out vs the older design style. I'm not sure they're as clear and readable either, though that's improved from the early redesigns, but even so I feel like the 3D-ish effects have caused a step back in contrast. That's a challenging line to walk with bulky pixel art. Still, the new terrain tiles are quite nice and general rejiggering there. I think overall once it's all updated it'll be a little slicker. Haven't seen any of the new enchants or the like yet, Prison/Caves felt mostly the same just a little more atmospheric. Troll quest was the same but his room was cooler.
One selfish thing I'd enjoy seeing as a player with [holy crap] hours into SPD over the years would be a sort of minor "trainer" mode, something that'd let you fix a few variables in a run while keeping the RNG otherwise. Basically having done near everything (though the occasional surprise is all the more delightful for that) when I go back for a game often I'm in the mood for something specific like a gardening/necromancer run or to try something silly as a build. Right now that can turn into a tiresome game of seed hunting though, you only get the right Old Mage quest 1/3 times for example and have to go through 7-9 levels each time first. And if you run it on vanilla to speed up the search, then play that seed, now you know a bunch of other info instead of just that it has the right potential, you don't go into the unknown again until the levels after. It'd be nice for vets if there was a way to just say "I want a game with Seed/Ember/Dust OM Quest" or "make the sad ghost drop a +1 whip" or "first crystal chest has a +0 corruption wand", that's it, just 1-2 seed variables overridden to be fixed but you still have no idea where they'll be or when, or know anything else about the run. Just that if you survive to find it it'll be there.
Edit: Ooh, the new rat king room is more appropriately majestic for the true ruler of the dungeon!
I'm a free speech absolutist (albeit one of apparently few people who actually knows what "free speech" is [0]) and I'm absolutely outraged and infuriated by this action and a long history of anti-speech actions by the USG, though this particular Administration is unprecedented in terms of censorship, general evil and authoritarianism in modern history. I also think it's unfortunate how many people in favor of all sorts of censorship now attack stawmen and treat something so vitally important as a joke like you have. The unseriousness you treat something incredibly serious with has become an endemic problem in our society, and directly inspires nihilism/fatalism/tribalism etc, feelings which in turn directly support authoritarianism.
----
0: For example, if HN bans you, shadowbans you, makes your posts dead by default, flags, or downvotes, that's all free speech.
I am not sure I see a fundamental distinction between HN censoring your speech on their platform or the government preventing you from speaking in public. Both are censoring you right? Is the difference the fact that HN is free to regulate its own platform as it wants to?
For a large part I see people using digital platforms as a primary method of expressing their thoughts and opinions. Governments in both the US and the EU have imposed restrictions on what platforms may host. I think we have not reconciled yet how to reinterpret free speech online.
Im no expert on free speech, of free speech absolutism, so please let inform me :)
Freedom of association and freedom of speech go hand in hand. You can say whatever you like. You should not be arrested for it. People may choose not to associate with you, or not to do business with you, or not to amplify your speech by hosting it for you.
If it was the government telling a platform to block certain speech, that would be a restriction in free speech.
The difference is that the ownership of HN has their OWN freedom to choose who they let post on here, and what they let be posted.
This is known as the 'Freedom of Association': The right to come together with other people to collectively express, promote, or pursue their common interest. This right also includes the right to accept or decline membership in the group for whatever reason they want. HN can choose to only allow whatever they choose on their site.
In the United States, this right is actually established (according to court rulings) by the same First Amendment that establishes the right to free speech.
The right to free speech does not require a private individual or company give you a platform to make your speech.
If I have a public platform and refuse to sponsor/publish/platform your speech, that is my free speech right! You don't have the right to force me to speak your words. Only the government is prohibited (by 1st amendment) from censoring/limiting speech (that does not cause or promote violence or injury to others). There are also some restrictions and protections also offered to the press (eg libel and defamation) and common carriers, along with the abomination of the DMCA.
Personally, I don't consider paid speech to be free speech, and I don't consider corporations to by humans, but the supreme court does.
Remember, facts aren't real, there is no truth, and crime is legal (in the current "Justice" Dept).
I don't think absolute free speech exists; there are always some limits to speech. Ideally not too many, but there are kinds of speech that I don't think you have any choice but to restrict if you want to have any kind of decent, safe and free society: threats, libel/slander, blackmail, and hate speech. Those are the kind of things that will silence, mislead or manipulate others, and are therefore by themselves a threat to free speech.
But things like criticising governments, questioning political or economic paradigms, or just making fun of powerful people, should always be legal and protected.
I think this depends on how you define 'hate speech'. Is talking about how billionaires are the scum of the earth hate speech?
I get the idea behind banning hate speech, but it gets really tricky when you try to think how to define and enforce it. Everyone agrees you need to be able to criticize groups that you don't like, so what makes it cross the line to hate speech (besides calls to violence, which would fall under the 'threats' category anyway)?
The worry is always that if you carve out an exception to free speech to protect vulnerable groups from harassment, how do you stop a future government from expanding those groups to include their political allies?
I think calls to violence usually only count as threat when they're targeted at a specific person. To me, hate speech is about creating an unsafe, threatening or oppressive situation for a vulnerable demographic group. Like saying a specific ethic group is a threat to society, or general attacks against women in general. Thing that, when repeated enough, will normalise the idea of violence or oppression against that group.
But what about similar speech against powerful groups, like billionaires? Well, they're not vulnerable or marginalised, they already have a disproportionally large voice, so they're not easily silenced. And of course being a billionaire is a choice; they can abdicate from their wealth in a way people can't do from their gender or ethnic group. So it's not the same. That said, calls for violence against them might still count as hate speech or be considered specific enough to count as threats.
There is obviously some fuzziness, but there also is with other limits to free speech, and there are courts to ultimately adjudicate that.
I agree with you that it isn't the same, and vulnerability matters.
My worry is that I can easily see an administration like the current US one claiming that MAGA Americans are the most vulnerable in the country, and they need to be protected.
Perhaps, but they don't seem to believe in free speech anyway. They're actively going after media that criticise the government, and are restricting government-funded scientists from using specific words that suggest research that doesn't fit their narrative.
>I am not sure I see a fundamental distinction between HN censoring your speech on their platform or the government preventing you from speaking in public. Both are censoring you right?
Wrong. HN is not "censoring" you at all, which requires engaging in violence (or threat of violence) against you to inhibit you from speaking in public. HN is literally engaging in Free Speech itself. Take arguably the most fundamental free speech activity in a democracy: advocating to your peers for the candidate you wish to vote for and have elected to represent you. You've researched and listened to Alice, Bob and Carol. You decide the best is Alice, and to show your support you do the quintessential thing and put out a Vote For Alice lawn sign on your lawn. That's obviously free speech right? Now what if instead some volunteer from Alice's election team comes by and asks you if they can put up a sign on your property, and you say yes. That too clearly involves your free speech rights, even if you didn't pay for the sign. Now say Bob & Carol's campaigns turn up, and they ask to put up signs on your lawn too. You don't support them and say no. Have you censored them? Of course not, that's ridiculous. Free speech isn't "everything is equal nothing matters", everyone is trying collectively to iterate towards truth and value by making their cases and listening, without general use of force. To say that "I think this idea/person/item is the best choice" by definition is exclusionary, it's also saying "I think all the other ideas/persons/items are NOT the best choice". It can also simply be "I wish to engage with these subjects, not those". You can make a forum dedicated to airplanes & cats, and ban anyone who starts threads on boats & lizards. You may have nothing whatsoever against boats or lizards, but that's not what you personally want to focus on on your own forum you're paying for.
Hacker News is the private property of its owners. They have their own free speech rights. Exercising those rights is not censorship.
Others in turn are free to use their property and/or their voice on public property to make their cases, and they can try to convince you and vice versa. And there can be social consequences, if someone really dislikes your speech maybe they don't invite you to dinner anymore and urge others to do the same, who might agree (or go the other way, or just ignore it). Humans can get passionate sometimes. But by keeping violence out of the whole thing outside of narrow exceptions that undermine the approach itself, room is preserved for minds to be changed and rifts mended years or even decades later, and for ideas to come back around if someone cares enough.
Government enforcing things though always involves violence, either directly or one or more orders removed. But a general monopoly on the legitimate use of force is a defining feature of government. If government doesn't like Alice, and tells you take down the sign, or else, that's fundamental infringement. They're closing down the whole cycle (if a private person did that it'd also be a bunch of other crimes AND infringement, because private persons are not allowed to use violence against others at all by default outside of narrow exceptions). And if government tells you "oh you can leave up the sign about Alice, but it's not fair you censor Bob & Carol, you must put up signs for them too. Or else." that'd be equally infringing censorship. If everyone has a sign, it's the same message as nobody having one. It's still suppressing "I think Alice is the best choice".
>For a large part I see people using digital platforms as a primary method of expressing their thoughts and opinions.
It is easier and cheaper than any point in human history to put up your own website, including your own forum to try to form a community around. You have no right to an audience though.
>Governments in both the US and the EU have imposed restrictions on what platforms may host.
What? What restriction has government in the US imposed beyond the long standing and unchanged exceptions that prove the rule (which essentially boil down to threats of violence, comms integral to crime, defamation AFTER a court case to prove it, serious violations of personal self with zero public value like CSAM, and purely commercial speech engaging in fraud)?
>I think we have not reconciled yet how to reinterpret free speech online.
There is nothing to reinterpret. We've gotten it fine since the passage of Section 230. The problem are constant efforts to suppress what we've already got, in some cases coupled with completely orthogonal issues like failure to enforce ancient anti-trust legislation.
Well I was just noting a suspicious correlation. (Also childishness is up a lot more than 50%, in case my tone was unclear :)
But you've given me quite an interesting endocrinology research project here. Last I heard, the root cause of the drop remains unknown. (And it's still dropping.)
>On hardware, it's very expensive to purchase anything which can provide a fraction of the performance of a subscription.
One of the basic questions/concerns here though is that it's not like the AI places are getting the GPUs for 10x less. It's true they have some economies of scale, but they also have some waste, and frankly in this particular case it's not clear they get that much gain over what a lot of businesses could achieve. The biggest traditional gain for central providers is that a lot of typical computing usage is burst-y, and in turn local kit might be underutilized. But with LLMs heavy users tend to use them all the time assuming their tokens allow it (and in the case of local hardware there's nothing stopping you, quite the contrary), they can use it directly interactively or leave them to go overnight on something too.
So it's reasonable to suspect that the reason subscriptions are only a fraction of the cost is that we're in a bubble seeing these companies losing money in an attempt to gain some sort of durable advantage. Just as every previous time, there is the chance that the music stops at some point, and they need to crank up pricing or pull other schemes to actually make money. Of course, it can be a good deal in the mean time, you basically get to suck down investor money for nothing, but it's also not unreasonable to at least be consider fallbacks. Even beyond questions of control and risk etc. I know at least a few places that are now genuinely considering questions like "what happens if a datacenter we depend on gets droned" that would have never had an iota of thought devoted to them even 5 years ago.
>On electricity, this is a surprising cost center depending on location. A system with just one 5090 can easily pull 1kW, and to achieve usable performance for a workplace is going to require dozens of machines. This can represent an extra $10-20k in electricity in cheap places.
I don't think that's "surprising" at all, everyone knows about power use. And this seems like it gets heavily into what you're defining as "usable" and is also more useful to define in terms of cost-per-employee vs total. Obviously a bigger business will have a higher line number total even if the cost per employee is identical, but simultaneously can be expected to be making more revenue to pay for it.
If we're defining an average of a dedicated 5090 pulling 1 kW for every single employee (presumably some people wouldn't use it all the time, but others would then pull the compute for other work), running 24/7 (to cover people running stuff when they're away), then that'd be 8760 kWh per year. At my not particularly cheap New England location that'd be about $1900 per employee per year at the generalized residential rate (~$0.22/kWh), or $156 per month. That doesn't seem radical if it really does boost productivity. However, there is a lot of room to go lower. I'd expect a business to run backup anyway, and these days there are a lot of incentives to do that at least partially with batteries. That also opens up rate shifting as another way to pay back the cost. If we change to time of day pricing, that's 8 hours of peak pricing with the rest off-peak. 8 kWh of battery can now be had for a few thousand. And the off-peak rate is only ~$0.14/kWh, cutting the cost per year by about $700 to $1200 per employee per year. Solar power is also usually far more valuable to use yourself then sell back to the grid, and also continues to plummet in price.
None of this is to say that it makes sense for every place at all, but it's close enough to the the line that the math is at least worth exploring, or could at least lower the cost enough to be worth it given other things. It really comes down to how much extra value the company (or individual) expects to come out of it per month.
>In California or Europe this could be $30-60k per year.
Dunno about Europe, but at the kinda prices I see for California I'm really surprised more places aren't trying to move a lot of usage to battery+renewable.
>The only real moat that local LLMs have right now is privacy.
I don't think resiliency and control are things that can be taken for granted anymore, particularly on the global scale. War and terrorism is getting worse again. International relations are getting nastier, and governments have the power to just order places cut off. If LLMs aren't particularly valuable to a business, then why an expensive subscription? But if they are particularly valuable, then insurance is something leadership should be contemplating.
>It's interesting that diesel is taxed more than gas in the US. It's the other way around in France.
Although in the US there is commonly an "on-road"/"off-road" split, at least in more rural/agricultural regions or states like mine. The diesel is dyed so it can be distinguished if inspected, and the off-road diesel is either not taxed at all or taxed at a much lower rate. The intention is to not tax agricultural usage, and also that it doesn't make sense anyway to tax tractors and other equipment (almost all using diesel still) used in fields and woods for road maintenance. In contrast, the biggest on-road use of diesel in the US is commercial trucking of various flavors, and those really do do much more damage to roads (and if anything aren't taxed proportionally at all). One of the very rare times the politics and costs have even mildly aligned.
It'd be nice if we could have more electrification in off road agricultural equipment as well but even putting aside all issues of energy density (which are solvable via quick swap packs/trailors if nothing else, and that's much easier to engineer in a tractor form factor and much easier to have a setup for at a typical farm) the weight will be a challenge, soil compaction is a very serious concern for most ag. Maybe electrification along with extra R&D/gov support can drive down the cost and improve the reliability of continuous track (or split continuous) for ag applications. John Deer has developed a few models with it, but the majority up and down the spectrum use tires. Combining the two though could allow for electrification with the same (or actually lower) ground pressure.
Any externalized cost that you tolerate as regulator is already an indirect form of subsidy in my view. E.g. allowing a mining company to dump tailings in the next river is exactly the same as paying for proper disposal with tax money (from a company finances point of view).
So any untaxed air polluter/CO2 emitter enjoys an indirect subsidy already.
But in the french case, farmers and fishermen got paid 15-30 cents per liter on top (removing all ambiguity).
In our case we use both Dropbox and also have a few teams using the 1P.com sync in addition. So we value both, plus just plain still don't like the 1P8 software itself.
Of course with the original Dropbox based sync, a concern is that Dropbox itself isn't set in amber, at some point it might get rug pulled and sadly 1P never introduced WebDAV or some other self-hosted option before subscription/VC fever set in. And I suppose that macOS continues to move along too. 1P7 on the latest and final version is Apple Silicon native and through a lot of major transitions doing nothing exciting, so it might well keep running for a long time. But the browser extensions will probably stop working at some point which is going to be another big line for a lot of people, and legitimately because it's a not insignificant bit of security.
Anyway, I mean, not like one couldn't keep running it a long time via various layers, but I figure probably time to at least survey the landscape on moving on :(
reply