• 0 Posts
  • 546 Comments
Joined 2 years ago
cake
Cake day: April 3rd, 2024

help-circle





  • E-bikes are allowed to go faster than 25 km/h, it’s just that the motor has to stop helping beyond that speed. Important difference.

    I don’t think that a general 20 km/h speed limit is the best choice. Maybe add tiers based on the type of path. Bike lanes on roads and bike paths without immediately adjacent foot paths could go pretty fast, bike paths separated from foot paths only by a line on the ground a bit slower, and shared foot/bike paths even slower. Maybe something like 30/20/15 km/h.

    Before someone comments “but bike lanes on roads are also immediately adjacent to foot paths”: Yes, but so are roads without bike paths and cars are allowed 30 or even 50 km/h on those. It’s generally understood that roads are dangerous and need special consideration so I’d be willing to allow 30 km/h on bike lanes.




  • I read about this a while ago and people then concluded that FROST is harder to exploit in real-world scenarios than in the lab. Still worth addressing and a fix shouldn’t be too difficult, e.g. by adding small amounts of random latency to OPFS accesses. Firefox already does this with other APIs to make fingerprinting harder. Chromium doesn’t because they love fingerprinting.

    Honestly, I’m not thrilled with the OPFS model in general. Each page can randomly occupy part of your storage with you having no control over the process. You don’t get asked. You can’t even inspect the data. Even if it turns out to be useless for fingerprinting, the ability to use your storage invisibly with zero effort is not a power I want to hand out like candy in an environment that supposedly is assumed to be adversarial by default.

    The only upside is that browsers do have a quota which is apparently shared between all instances of IndexedDB and OPFS. So the threat model of “use OPFS to fill up the user’s entire storage” isn’t plausible per se even if you have multiple tabs to attack with. Filling up the storage to evict other sites’ stored data might actually work, though, and while it sounds like more of an annoyance, it might also become a step in some other attack.

    Besides, quota size is entirely up to the browser; while Firefox uses 10% of total storage or 10 GB, whichever is lower, Chromium can in principle take up to 60% of total storage. When I tried, both a Firefox-based browser and a Chromium-based one had quotas of exactly 10 GB; I suspect that my distro’s packagers configured the latter when the built the browser package.



  • Not really.

    We already had the “now everything will get better” moment when Obama replaced Bush Jr. and brought promises of change and the USA becoming a better country. He was a lame duck for many reasons but he did make an effort to short up the country’s reputation.

    Bush had demonstrated that the USA were perfectly capable of suddenly tearing up agreements that had been stable for decades. Obama’s case was that this was a one-time slip-up, that the USA were still a reliable and trustworthy partner. It was a hard case to make on an international stage where treaties are expected to remain stable for decades if not centuries but he made that point by leaning on the States’ accumulated goodwill as a trade partner.

    Then Trump I shat all over that and made clear that no, American policy could pivot on a dime and having to renegotiate everything every four years was just the cost of doing business with the USA these days. And you better did business with the USA on their terms or they’d get mad.

    Biden tried to do an Obama but a) was even more of a lame duck and b) tried to argue a point that had become thoroughly implausible at this point.

    Trump II now shows us that four years was actually restrained by American standards and that American policy can now change whenever and however he wants it to, continuity and common sense be damned. L’Etat c’est lui. On a stage where a decade is a short time he changes the country’s tenor on a weekly basis.

    The EU’s reaction? Trade deals with just about everyone else. Mercosur. Canada. Japan. The UK. Singapore. Vietnam. New Zealand. Ukraine. Moldova. Georgia. Kenya. Plus several others in early stages. Which European trade deals are staling out? The ones with the USA and China.

    The world is pivoting away from the USA because it lost its trust in America as a trade partner and it’s going to take decades of concentrated and stable good-faith effort to regain that trust. The States won’t just have to make a case for keeping them as a preferred partner but for making them a preferred partner again. The hurdle is higher now.


  • Mind you, openly defying the ICC (and thus subverting the idea of a rules-based world order) and breaking the WTO are much older than the Trump administration. Randomly fucking with foreign countries has been going on ever since the USA had the ability to project power.

    The USA have been a bad friend for a long time. They had a bit of a redemption in the 40s but just kept coasting on that one moment (and fear of a belligerent neighbor), assuming that their popularity comes from them being inherently awesome and always right. The luster was already rubbing off in the 2000s with Bush’s bullshit wars.

    But now Trump is openly showing that the States feel entitled to whatever they want, are simultaneously subservient to much smaller foreign powers, and have zero respect for human rights, long-time friends, the values they supposedly stand for, and themselves. The belligerent neighbor they’ve been using to prop up their image is a broken man now and they kiss his feet.

    Uncle Sam is not just a bad friend, he’s a washed-up unstable asshole whom nobody in the friend group actually likes but who keeps showing up and threatening people if he’s not included.



  • I think what you’re thinking of is a limited free trade agreement. The UK is free to pursue one of those. The UK would probably have to play by EU rules regarding things like product standards (with little say in what those rules are) but free trade without freedom of movement is absolutely doable.

    A military alliance is also no problem.

    Anything beyond that is going to be difficult, though. For countries joining the EU after it’s inception, points 2 and 3 are hard requirements. The UK doesn’t have much to offer that would justify giving it special treatment.




  • Mind you, the people who are pushing to replace everything with LLMs are not the people who spend half a billion bucks on tokens in a month. They’re the ones who charge half a billion bucks and the ones who charge them for the hardware. As far as they are concerned, that half a billion dollar bill is a rousing success they’d like to see repeated as often as possible.

    Okay, and then there’s the useful idiots who vibecode a 50 kLOC basic CRUD application with broken auth in two days and conclude that LLMs can craft arbitrarily complex applications instantly at near-zero cost. And then proceed to shill the stuff every chance they get because these days the internet is all about hyping yourself up and they can pretend that their finely-honed 1337 prompt crafting skillz will make them as god-kings among peasants when vibecoding will inevitably subsume all other forms of development, nay, all forms of creative work entirely!

    While remaining cheap, of course, because nobody has ever offered a service for cheap and then made it more expensive.



  • You seem fixated on the idea that OPFS is some kind of ramdisk. It isn’t. When a website stores a file in OPFS, the browser writes some kind of opaque data structure describing all stored files to disk. That data structure can take whichever shape the browser desires excewpt for just dumping those files in a directory in order to isolate OPFS from the regular filesystem.

    You can query the browser for the maximum quota available to you and then just tell it that you want a file that big. Boom, now you own that chunk of the user’s SSD.

    As has been pointed out elsewhere, that’s still of dubious value for fingerprinting but I don’t particularly enjoy the thought that random websites can just occupy gigabytes of space on my computer without even asking.


  • You can absolutely have fancy UI elements that provide additional functionality. Most OSes don’t have built-in 3D visualization widgets but that doesn’t mean you can’t write CAD software for them.

    My point is that your custom widgets should make an effort to look and feel as much like native widgets as possible. Any skills the user has in using native widgets should carry over to your custom ones. So your custom text field should look and behave like a native one until the user types two left brackets. When they do, the menu that pops up should be a native menu or one designed to resemble one very closely.

    Thanks to web-first development and lazy cross-platform UIs, standards in this regard have deteriorated to near-nothingness. Buttons don’t have to look or even behave like anything else on any platform. It’s perfectly reasonable to expect the user to relearn the UI for any application. Modern UIs spiritually follow in the footsteps of Bryce 3D rather than any Human Interface Guidelines. And that peeves me.

    For all their faults, Apple got Mac users to have very high standards in this regard for quite some time, which led to a bevy of good-looking and approachable applications, at least until post-skeuomorphic macOS took care of the “attractive” part. The consistent UI across vendors was something I really liked back when I was a Mac user.