quatrefoil

Guest mode does not honor your settings. It mostly defaults to install-time configuration.

Incognito mode is fine. It doesn't persist data, it doesn't give websites access to existing main-profile data (cookies, etc), and it actually honors the settings of the profile it was spawned from.

None of this robustly prevents fingerprinting, but neither does switching to another browser or wiping your profile clean. There's just a bunch of system and network characteristics that leak info because of how the web is designed. Google didn't make it so and I don't think they're using it to serve you ads.

I think two things can simultaneously be true. Google's privacy practices aren't great, and they weren't actually doing anything that a reasonable person wouldn't expect to be happening in incognito. This was a lawsuit filed to shake them down, not to benefit the consumer. And apparently, it was flimsy enough that it started with a $5B demand, and is ending with no payout at all.

If the exploit wasn't baing used, the odds would would be pretty low. They picked the right place to bury it (i.e., effectively outside the codebase, where no auditor ever looks).

That said, if you're not using it, it defeats the purpose. And the more you're using it, the higher the likelihood you will be detected down the line. Compare to Solarwinds.

You're comparing to medians; is this a median crime?

A browser is one of the most consequential attack surfaces in the lives of billions of people. Redis isn't. Having proofs where said proofs don't matter much in the first place is not a particularly good use of our time. And FWIW, the correctness specs for Redis would be pretty intractable too.

That's a pretty cynical take. I think a more profound problem is that formal specifications for software are fairly intractable.

For a bridge, you specify that it needs to withstand specific static and dynamic loads, plus several other things like that. Once you have the a handful of formulas sorted out, you can design thousands of bridges the same way; most of the implementation details, such as which color they paint it, don't matter much. I'm not talking out of my butt: I had a car bridge built and still have all the engineering plans. There's a lot of knowledge that goes into making them, but the resulting specification is surprisingly small.

Now try to formally specify a browser. The complexity of the specification will probably rival the complexity of implementation itself. You can break it into small state machines and work with that, but if you prove the correctness of 10,000 state machines, what did you actually prove about the big picture?

If you want to eliminate security issues, what does it even mean that a browser is secure? It runs code from the internet. It reads and writes files. I talks directly to hardware. We have some intuitive sense of what it's supposed and not supposed to do, but now write this down as math...

Request deletion from backend brokers? Many have some mechanisms for opt-out, either in general or for people in specific states (e.g., California).

Not really. There's a fairly small and stable number of companies that actually collect and resell information about you. There is also about a zillion ephemeral web front ends that republish this data, however. I suspect this is done for a reason, but a bit of sleuthing quickly reveals who the big players are.

These "data removal" services spend a lot of effort going after the frontends, which is pretty self-serving: they can show the customer that there's something new to remove every single month or quarter, so you have to keep paying forever.

There are commercial influencing operations on Reddit, but I think what you're describing doesn't really affect the usual user experience.

I suspect that the objective of these bulk spamming operations isn't to promote stuff on the platform, but to mess with other apps. LLMs trained on Reddit content, search engines that rank Reddit posts highly, etc.

Scraping is a lot more dicey than using an official API. Why did Google enter that partnership? They have the data in their index. The only conceivable reason is that they prefer to pay Reddit to avoid the risk of litigating it and ending up with some unfavorable precedent.

I'm guessing the plan is to cast a wide net, then hope that you can dredge up some incriminating or morally ambiguous quotes during discovery. When you have a company of 100,000+ people, there's probably some "haha we're killing the competition" in there, which you can then use to prop up the case.

And then either use that to win the trial, or force Apple into settling.

Right, and from all my friends who did take VC money: it's an incredibly demanding period of your life, a large proportion of which isn't about delivering on your vision. You're gonna learn a lot about office space leases, accounting, fundraising, customer pitches, etc. You're gonna have impatient VCs on your board, with the power to fire you, breathing down your neck. You won't be relaxing much and won't be spending that much time with family and non-work friends.

It's a valuable experience with a lot of potential upside in the long haul - but let's not pretend that it's less taxing than a cozy 9-to-5 tech job where your boss might ask you to update your OKRs once in a while.

I mean, we had this stuff for pets for a long time. The basic idea is that yes, it's a lipid-soluble neurotoxin. Because it is fat-soluble, it spreads throughout various tissues and lingers for a good while, which is these pet formulations last for weeks or months.

And yes, it is technically a mammal neurotoxin too, although our bodies are better at compartmentalizing and managing the risk. Similarly, you don't drop dead if exposed to caffeine or nicotine, even though they are insect neurotoxins produced by plants to kill bugs.

But it cracks me up that we are flipping out about herbicides such as glyphosate or 2,5-D - both of which are plant growth regulators that have no real mechanism to cause obvious harm in animals - but we're a lot more flippant with actual animal neurotoxins such as permethrin.

It feels like you're picking apart an argument I didn't make. But I would note that most people don't see this so unambiguously as the position you're defending. To give you an analogy: doxxing is "fair game" too if you posted your info online or gave it to others. But it's not exactly cool to do it, right? It's a subversion and abuse of the system we have in place.

Finally, here's a fun experiment: decide that terms of service don't matter and start building a product by scrapping Facebook or Google. See how they'd react. Actually, no need for guesswork - they clutched their pearls and threatened legal action more than once before. It's a bit of a "have your cake and eat it too" kind of a deal. Their data is precious intellectual property; your stuff is, well, up for grabs.