kqp

I don’t think you understand what consent means.

Can we get a title edit? OP’s title implies this is a Git bug, but the bug applies to half of macOS, including curl, openssl, python, perl, and ruby, and to only the macOS version of Git. The original title is less misleading, but personally I’d have titled it something like “macOS still trusts the compromised eMudhra certificates in git, curl, openssl, python3, perl, ruby, more”.

Man, this comment section is not good.

I was surprised recently when I tried to really dial in the colors on my personal website, and found that I perceive and get a different feeling from a hex code change of only 1. I didn’t test whether it’s just me or whether this particular color makes it more visible, but I did test a few monitors, including a bad one. So, I get feeling some way about a specific hex code, if you spent longer picking it than we usually do.

I do, though, wonder what the idea behind assembling a centralized registry is. Is it about making a few favorite very specific colors easier to refer to? Browsing colors? Browsing ideas people have about what colors mean? What would the ideal ultimate form of this list include, every color? What’s the difference between a good name and a bad one?

So, reading between the lines, somebody pressured them hard but they’re providing instructions to DIY instead?

Try turning off autocorrect. It seems like a non-option, but I found it made my mobile typing skill greatly improve over the following months, to the point I’m now just as fast while also fully removing that frustration from my life, and also not reliant on a particular phone. Retrospectively, it makes sense: autocorrect numbs feedback, removing the mechanism by which we learn to subconsciously and quickly do what works and avoid what doesn’t.

People absolutely know what they experienced, they’re just guessing about what went wrong and how to fix it. “I hate AI” doesn’t necessarily mean “I can only please this person by not using AI”, but it sure does mean there’s something about your AI this person hates. “The economy’s doing poorly” doesn’t tell you about Nvidia’s stock price, but it does tell you about this person’s experiences and information exposure.

I think the core problem is they’re called passkeys and evangelized as a replacement for passwords, which makes people think they’re like passwords or like keys—secrets we’re responsible for not losing—whereas actually they’re like session cookies. They’re a fast path in that you’re meant to be able to create, delete, and even clear all of at will, with no penalty but that you’ll have a fussier login next time. They sure do suck as an only way in, they’re not even meant to be able to do that.

I was thinking of push notification data and skipping several other significant partial leaks. After a little research, I think I overstated the push data leak, though it’s still significant. Anyway, framing it as copies was a rough approximation, the issue is many high probability partial copies resulting in virtual certainty of unencrypted access to any desired data.

iMessage leaks I know about:

- iCloud backups. While I appreciate Advanced Data Protection, I still count this because it’s not available everywhere, most people have it off, and most people with it off are unaware of it backdooring the E2EE marketing they still saw.

- Recipients’ copies, and all the ways their copies get copied. Yes, tricky to address, that’s the comment. While no app can guarantee no unencrypted recipient copies, privacy focused apps do make it not happen unintentionally and by default.

- APN leaks the timestamp, sender, and recipient of every message. Especially powerful in combination with recipient copies.

- Apple controls the key directory and can MITM at will. As usual, see Signal for a high profile attempt at a centralized key directory that’s resistant to controller abuse.

- Contacts, Siri, and Apple Intelligence all ingest then upload iMessage data.

- No source code or reproducible builds. Obvious reasons, still a real hole.

Others have already pointed out that your assumption of Apple TV not spying on you is wrong, I’d like to make a meta-comment on that.

Apple regards privacy as a feature, and I mean that precisely: some places they implement it, other places they decide it’s not worth it, and they only ever tell you about the former. A good example is iMessage: everybody in tech knows it’s E2EE, many fewer realize that the other three copies of your iMessage data on Apple’s servers are just, uh, not encrypted.

You can’t have the same intuition for Apple and privacy that you would for a group like Signal. You need to instead ask yourself whether you fully understand what you need, then whether Apple has guaranteed precisely and fully that, without weasel words.

I must confess, I don’t actually think I can. That’d be pretty sweet, though, if we could.

TVs died. Not fully, but they went from the ubiquity of smartphones to the “oh yeah I’ve got one lying around” of VR. The shit they’ve been up to since is a response to trying to recover a much bigger industry’s profits by juicing a remainder that they’ve realized is so inert they’ll let you do anything to them. I really hope the resemblance to mainstream tech is minimal.

Hey buddy, you’d better be careful what you post on a public forum. Sooner or later somebody’s gonna ask their own personal LLM to write a comprehensive test suite for how you respond to comments and situations, move the mouse cursor upwards and to the left to click a button there, and recreate you as legally their property now. If I were you I’d gimme money gimme moneyyyyyy before my big LLM here teaches you a lesson the hard way.

You don’t have enough tokens for time pressure?