entuno

The "Other" category has a whole load of random stuff in it, including TV series like Breaking Bad, and music like Thriller or Master of Puppets. There's also some wonky attribution in places, like "Harry Potter and the Sorcerer's Stone by John Williams"

Or more realistically, ban targeting ads based on profiling the individual, and instead require that they're targeted based on the content.

I'd love a world without advertising, but it's never going to happen. But a world without profile-targeted advertising could.

Because advertising (and in particular targeted advertising) is so entrenched in every aspect of our lives and society that it's very hard to admit that it's harmful. Because doing so means admitting a multi-decade failure gross failure of the government and regulators, and accepting that we need a massive structural overhaul of the entire industry, and of the operating model of a significant chunk of the Internet.

That doesn't really answer the question though.

If the actions of these advertising companies are harmful, then everyone should be protected from them, not just one demographic that is considered to be more vulnerable.

And if they're not harmful, then in what sense are kids "vulnerable" to them and need protecting?

It's more like saying that a weapon is not capable of murdering someone.

No one is arguing that Claude can't stick an image onto a PDF. But that is not the same thing as signing a contract.

I disagree, in the same way that I'd disagree if you said the rollerball pen on my desk signed a contract.

They can be used by someone to sign a contract, but they cannot sign a contract themselves because they're just tools.

And Adobe Acrobat is far more capable than notepad. But that doesn't change the fact that they are tools, not individuals, and thus do not have the legal authority or ability to sign contracts.

I could write dozen lines of bash that finds for PDFs, pastes an image into them and emails it to someone. That doesn't mean that bash can sign contracts.

No, because you are a separate individual who does not have authority to sign a contract on my behalf.

Claude isn't. It's a tool, that isn't capable of signing a contract any more that Adobe Acrobat or Photoshop is.

OP used it as a tool to sign the contract. The question would be whether they did so knowingly and intentionally, if not then whether that invalidates the contract.

In most cases I'd think it's more of a deterrent for commercial entities, because spending money create complexity. Most employees are not in a position to just directly spend their organisation's money, so that $0.05 will often mean needing to get approval, purchase orders, deciding which cost centre it comes from, needing an invoice, etc, etc.

Very few people are going to invest that much effort when they're trying to do the company that they're reporting to a favour.

There's an assumption in here that every developer is spending a load of money on the latest and most capable LLMs to scan for bugs in their code before every release.

But the last couple of decades have shown us that huge numbers of developers aren't even following basic and free secure development practices, let alone pouring money into expensive scanning tools.

There is a history of companies and organisations threatening legal action against security researchers when they report vulnerabilities in their systems or products.

Sometimes even when the testing has been completely offline - I know people who have downloaded some software, carried out testing against a local copy of it, and then faced legal threats when they tried to report serious security vulnerabilities to the vendor.

It's one of the reasons that some researchers don't bother trying to talk to the vendors and just go straight to full disclosure, or if they do report to vendors they do so anonymously. But if you have to pay, that's creating a link back to yourself which makes the latter much harder.

If I've stumbled across what I think is a security issue in your systems, there is zero chance that I'm going to get out my credit card and pay you for the privilege of responsibly disclosing it to you. Especially if it's the vulnerability is in the site hosting the contact form.

Historically there have been vulnerabilities in various applications due to HTTP method tampering, and in the days of people accidentally leaving WebDAV enabled then methods like PUT and DELETE could be very damaging. Plus the issues with TRACK and TRACE.

Given that most websites only ever use a handful of methods (even once you account for REST APIs using PUT, PATCH and DELETE now), and that list very rarely changes, the WAF developers tend to look at this question from the opposite angle: when you know there are only half a dozen widely used methods, why would you allow anything else by default?

AWS CloudFront blocks GET requests with a body, so it doesn't even have to be a particularly strict setup or an explicit WAF.

It would be very dependent on the exact circumstances - who made a complaint, what exactly they're accusing you of, what evidence there is, how high profile it is, the current diplomatic position (which changes by the hour), etc, etc. I don't think you can really get a simple answer for this kind of question.