sodality2

This was my home gas station for 4 years so I may be biased, but it is fine. Symptomatic of a deeper car-centric problem, sure.

Side channels that enable intended behavior, versus a flat-out bug like the above, though the line can often be muddied by perspective.

An example that comes to mind that I've seen is an anonymous app that allows for blocking users; you can programmatically block users, query all posts, and diff the sets to identify stable identities. However, the ability to block users is desired by the app developers; they just may not have intended this behavior, but there's no immediate solution to this. This is different than 'user_id' simply being returned in the API for no reason, which is a vulnerability. Then there's maybe a case of the user_id being returned in the API for some reason that MIGHT be important too, but that could be implemented another way more sensibly; this leans more towards vulnerability.

Ultimately most fingerprinting technologies use features that are intended behavior; Canvas/font rendering is useful for some web features (and the web target means you have to support a LOT of use cases), IP address/cookies/useragent obviously are useful, etc (though there's some case to be made about Google's pushing for these features as an advertising company!).

I'm not sure I'd use "compromise" at all - these (or the ones I have) are purposefully designed with zero authentication or pairing, the ones that use apps are already "compromised" in the sense that I can walk past any windowsill with one in it, open it, and it will immediately connect to it. I really don't mind if someone walking by were to change the LED color patterns

Yep, here they admitted there were local revolutionary war re-enactors who were falsely flagged (although thankfully they didn't let it get past the first flag).

This is a very common pattern; my university pushed through a ZeroEyes AI camera/open carry weapon detection contract within 2 weeks of a shooting at a nearby school, even though it’s trivial to bypass by hiding it; it’s most probably just (gruesome as it is to think about) a bad press insurance so if anything happened, they can say they had “state of the art AI detection” and they did all they could. No one wants to be the one caught not doing “all they could” against the media cacophony in the immediate aftermath.

> That means the lock-in isn’t just product strategy. It’s also architecture.

> And that omission isn’t some harmless simplification. It’s the entire trick.

It isn't just once. It's—twice. ;)

I too am in this episode.

Is there any evidence that going outside the scope of the agreement would amount to anything more than a contract violation? Are we really to expect that Anthropic general counsel sits at the API gates allowing or blocking requests?

More generally, are there any comparable contract requirements in the field of defense, for a company in the same position as Anthropic? I'm curious.

Hm true, I wrote off Chrome OS altogether, does it provide enough customizability that MacOS/Linux does? You mention dev containers which is already way beyond my perception of its capabilities (and the general public, I think)

Yeah, the optimization is going to make or break it. I've heard people say that 8GB on their Air's with M chips are sufficient, but I do wonder if it will still be true now with MacOS - maybe we'll get a cleanup/performance release cycle?... With regards to AI I hope it's not a Gemini/Pixel situation where there's a lot of ram but 3.5GB are permanently reserved for the on-device model to be always-available.

I expect the customer of this product is not worried about repairability: to them, it's just an iPad with a keyboard. You're also citing 3x higher costs, so they're really not comparable.

The lack of upgradability is directly what provides a lot of benefits that I expect the average consumer vastly prefers: better performance with soldered memory and better battery life. It's not just to shaft you on prices (though that's definitely a big factor).