Britain has a historical defence pact with Ukraine, which unlike Russia, it is actually honouring. An inconvenient truth is that without the very defence pact formed as part of the Budapest Memorandum (which resulted in Ukraine relinquishing its nuclear arsenal and the UK being duty bound to provide aid) every major Russian city would have probably been (very legitimately) nuked in self-defence by now. Thankfully, it's just a bunch of drones sabotaging Russian national infrastructure, and it could all end tomorrow if Russia was willing to actually honour what it too had originally promised instead of trying to play a failed game of conquest.

Likewise, it was Russia's leadership which created the "Ukrainian Nazism problem" that it's complaining about by spearheading a violent uprising in the mid-2010s which turned fringe groups into recognised militia (e.g. Azov) who are now perceived as heroes of the people seen as acting in the best interests of the Ukrainian majority. It isn't just Ukrainians but also Jews, Muslims, Greeks, Crimeans, disgruntled Russians and Belarusians who all ended up uniting under the same banner that was originally considered to be Nazi-adjacent. The irony is that both the problem and the resulting "denazification" all happened in the blink of an eye, and now those so-called "Neo-Nazis" will be forever remembered for protecting Ukraine from an invasion by an evil Russian dictator called Vladimir Putin.

If I was Vlad, I'd be pulling out and claiming the military operation to be a success before integrating all those volunteer North Koreans into Russian society.

At this point, webmasters should accept very short lived client TLS keys signed by neutral third parties who take care of the proof of humanity on their behalf. Since security requirements for most websites are low, even places like libraries could issue them if needs be, and webmasters could choose how many or how few authorities they trust. The standard could be used creatively such that Valid To field is used purely as an limiter for initiating trust for the first time, providing convenience to users while making it easy to ban any bots which somehow slip through by banning a trusted entity or even a whole country if they are found to be on the fiddle.

Every URL is sent to Microsoft with Optional/Full telemetry enabled when you don't use InPrivate Browsing and that includes your GDID. You can observe this in the Diagnostic Data Viewer, and as it's full URLs (not just domains) Microsoft knows every little search query too. Even if you scale back to security-only telemetry, Microsoft still receives full URLs (not just domains) not via diagnostic telemetry data but instead via Microsoft SmartScreen, and AFAIK that still includes a unique device identifier, with the legitimate reasoning being for their Intelligence Graph to identify malicious endpoints between sessions.

Likewise, all the telemetry related to the running of programs is queued and uploaded with Optional/Full even if no crashes occur, as well as diagnostic logs relating to software installs/updates, so Microsoft can see what devices have been running, when and for how long. All of that can be correlated once law enforcement is involved because they can subpoena third-parties to nab access logs which allow for the use of statistical analysis to reidentify the user.

All of this is legit, but the problem is that Microsoft abused our trust by violating their own Privacy Policy, since they claim not to identify people, but clearly did in this case.

Microsoft tied the device ID to the person, then looked up the telemetry associated with the device to work out how the device was used, then sent all that data to the feds, despite their privacy policy stating that device identifiers will not be used to identify people.

We must not forget this. They lied.

Publish a book, a song, a movie, or even a play, and you are legally required to make copies available to national libraries for archival in the countries you opted to publish them in, along with copies of accompanying scripts, manifests and documentation. Members of the public then have a right to access those copies for education and research purposes. DRM be damned there as well, as the library is freely allowed to use the analog loophole to break it when it gets in the way of legitimate archival.

Software developers and video game publishers should not get any special treatment here, and if scripts and manifests are not off limits, then source code and technical documentation should not be either. Thereâ(TM)s zero reason members of the public should be prevented from independently studying how any published work functions, irrespective of whether they have even purchased a private copy of their own. That is how it has always worked before and that is how it should continue to work in the modern day.

Might also be worth noting that no other guardrail for anything allows alleged harmful output to occur before trying to claw it back like they are Alex Jones lawyer.

We are at the point where every bug that can crash an application is treated as at least a DoS CVE of some kind, even if it has an extremely low rating. In that sense, LLMs finding these bugs, even if automating a fix is not possible, is still a good thing from a reliability improvement standpoint.

The sad part is when folks see all these reported bugs and decide to abandon the software altogether as a result, which is something we have been seeing with kernel drivers for old hardware which, quite frankly, could have been marked as post-production, carrying a taint flag of some kind if loaded. A mechanism needs to exist to flag these unloved drivers with known issues for a year or two and to maybe gate them off by default using a one-way sysctl, a kernel command line or something else which does not rely on blacklisting so we can have the best of both worlds..

We saw this stupidity in full action with COVID, and it created problems for people trying to do their bit to educate people. At the time of peak pandemic, if you used a search engine, you would only get NHS or WHO results unless you started adding specific academic keywords which most people would not use. If you used YouTube, the results were further manipulated to always favour specific content by a handful of creators unless you explicitly wanted nutty content. The result was a massive distrust by a public who wanted to find out actually useful information, not vague facts the government thought the public ought to know, as they could see everything was being manipulated by companies at the whims of our government without any transparency over what was deliberately censored and why.

It seems they have not learned their lesson since then and seem hell bent on making the public distrust them further by applying this same flawed principle to presumably every search relating to a trending topic of any national relevance. This is not just a bad look, it is a very bad idea, especially given a string of recent events where fast news cycles resulted in somewhat inaccurate commentary and glaring omissions of facts from reporters and journalists alike.

The true fix for this is to put an end to the attention economy, not to try to divert attention towards likes of Rupert Murdoch and co.

It is your data they took without your consent to make their services profitable, so they probably should compensate you and everyone else you know for the privilege of having done that!

Stick to testing installable software only, that way if the maintainers decide not to pay out, immediately publishing a vuln with or without a PoC is still ethical as it gives sysadmins a chance to mitigate before anyone else finds it. When it comes to cloud hosted crap, you have no recourse, therefore, do not help them in the first place.

They're the makers of Ozempic so an attack on them is an attack on Americans, obviously!

You asked for a citation, I gave you a citation which didn't represent one isolated incident but an ongoing chain of them which was considered serious enough for the government to use it as part of their justification to mandate the future scanning of every photo everyone ever takes with their smartphones from now on. Feel free to also gloss over the girls who abused the trust of boys without their consent in order to sell videos if that helps fit your narrative.

Regarding physical store transactions, you don't have to provide ID to buy alcohol in the UK unless you look under 25 (also known as Challenge 25) and nobody is required to record face in order to perform said verification, your purchases usually remain completely anonymous, as they should. Also, in England, we allow drinking alcohol in private from the age of 5 because the concept of underage drinking enforcement came about in response to drunk youths in the street causing trouble. So the sales restrictions aren't even there to stop children from consuming it, they exist to stop troublesome behaviour in public, which is a key differentiation you also seem to be glossing over. Regarding tobacco, the only reason people will now need to supply ID is to prove they were born before a certain year, since Starmer wants to ban smoking outright via raising the legal age by 1 year for every passing year in perpetuity.

If you want to equate how you want the Internet to work and match it up to how physical in-store transactions work, at least educate yourself on how those transactions actually work first, before calling people paranoid for pointing out the flaws, especially when you're conversing on a tech website where the EFF and others have already debunked the claims you're making.

See my other comment, complete with a trustworthy citation from mainstream investigative journalists which blew the lid off everything (included here for your convenience)

Banning children from every mainstream user-to-user service that falls under their definition of social media (almost every website except a handful of very specific exceptions) will only make them less equipped to deal with the real world. Everything from children losing the full multiplayer experience in video games through to restrictions being applied to open source software projects (alongside misinformation being spread around schools that's designed to vilify gifted and talented children) is going to deprive them of the same kinds of extra-curricular learning opportunities which led to the success of multiple generations of adults in their prime today.

Starmer himself can't even articulate, when questioned, how his new plans will actually resolve the problems his own party's previous cock-ups caused in the first place, he's only able to explain what they are and his reason why he's implementing them. Worse still, he has chosen to push for measures to actively prevent real victims from being able to locate unauthorised images of themselves by legislating to prevent new smartphones from being able to view them in the first place, while perpetrators will, as usual, be completely unimpacted. Ofcom can't even successfully block nor fine the likes of 4chan, a website where people literally upload originals to request "community creation" of realistic deepfakes. Let that sink in for a moment.

Do a bit of research into what's going on, and you'll find victims will only be further harmed by this, not helped. Government advisers understand the technical trade-off and have decided that making people more identifiable online long-term is, in their minds, more desirable than actually helping victims today by reversing course on a chain of terrible past decisions which all led to where we are today, starting off by encouraging people to make their own niche spaces again, instead of legislating them into oblivion.

The difference between the AUR and Debian repositories is that there's a natural level of checking built into the process. For simplicity, I'm going to completely ignore Debian Stable and talk about Unstable, which ultimately gets far less scrutiny due to less security team involvement.

Each category (or group) of packages generally has a team of people who work together to commit changes to Unstable, aided by senior developers who have non-maintainer upload rights to dip in and help out if packages end up lacking named maintainers. There's no concept of a random person with no history of contributing immediately taking over orphaned packages, and while a package maintainer owns the responsibility of making sure changes work, folks definitely aren't alone when it comes to QA/QC.

Debian also splits out everything so that any potentially reusable dynamic libraries can be re-used by as many other packages as possible. If there's a new dependent library being introduced which no other package already makes use of, it needs to be added to the Debian archive as a brand new package, where the process is ultimately overseen by a separate team of people. Even if all that scrutiny doesn't pick up on something, Canonical engineers also use Debian's packages as the basis for Universe/Multiverse in Ubuntu and have to perform their own checks before syncing over new packages in from Debian Unstable when MOTU ("Masters Of The Universe" aka. community contributors mentored by Canonical) put in a request as part of maintaining the packages they look after.

The end result is potentially even better scrutinised than the packaging approach typical macOS and Windows apps receive, due to the number of separate individual maintainers taking responsibility for dependent libraries, as opposed to an independent or small team of developers taking responsibility for everything. However, it does also mean if one common library gets subverted in some way, especially by a compromise of the upstream project (as people saw with the xz backdoor attempt) then the net impact could be far wider than with vendored libraries (how packages work with macOS/Windows) where developers can choose to stick with older versions for their application for longer. Of course, that's somewhat mitigated by that thing I'm ignoring called Debian Stable... =]

Note: I'm not a Debian Developer (just someone who ends up reading way too much) so it's possible some of what I'm saying isn't as accurate as it could be, but I hope this gives you a general gist of the differences.

Your statement of "social media doesn't work if you can't log in" is demonstrably untrue. Millions of people watch pre-recorded YouTube videos, Twitch livestreams, Tiktok shorts, music tracks on Spotify/Soundcloud, microblogs on X/Bluesky and many other services without ever logging in to them. People don't have to post, comment nor create content in order to consume it, and there has always been, in aggregate, more silent consumers than contributors.

It's also important to understand how lawmakers define social media, relative to the old school definition of social networking, which is what a technical Internet user typically thinks of when it comes to social media. In Britain, if a service is capable of user-to-user communication, it is treated in law as if it is social media, and if you're able to access *any* content on the service, even without yourself sending any messages to users, you are still making use of a covered service. To ensure that the new, onerous legal requirements don't completely break the Internet, they carved out specific exceptions for email, SMS, RCS and private instant messaging services. They then followed this up by tabling a bill to mandate that smartphones analyse every picture or video ever taken to stop specific types of content from even being created (as part of the Children's Wellbeing and Schools Bill, which also, among other things, appears to be an attempt to implement a framework to implement watershed times in the future for unauthenticated access to online services).

This is why we're seeing companies like Microsoft disabling chat capabilities on video games like Minecraft on the client side, even when the connection is to a LAN-hosted server. It's still user-to-user communication (i.e. social media) and Microsoft's legal team clearly assessed that messing with the game client itself (as opposed to server side code) was the best way to comply. It's why Apple has started forcibly applying client-side filtering on iOS, subject to ID checks in order to allow users to disable them (suffice to say, I'm now using GrapheneOS as my daily driver, my iPhone is relegated to the role of banking).

Regarding what happened with OnlyFans, you'll see that in the UK, participating customers simply got refunded, the girls in question received counselling (not a punishment) and British parents/grandparents who allowed their IDs to be used (but where there was no evidence of stereotypical child abuse) did not get prosecuted either. OnlyFans guarantees their content is legal, so if there's illegal content which passes their initial manual checks, at that point it's no longer possible to claim the customer should have known. All liability in the equation was taken on by OnlyFans. Parliament even debated the issue, with the result being politicians pointing out that the fault was solely with the Government, not businesses performing the completely ineffective checks they were asked to perform.

Hopefully this explains the point a bit more clearly.