Complete bullshit. Even for fullscreen video, the website doesn't need to know my screen size. It should tell the browser "here are the resolutions I can offer you" and the browser picks one of those. All the website needs to know is if I prefer 1080p or 4K. And I might pick 1080p even if my screen is 4K because, say, the hotel wifi is slow.

Complete bullshit. None of these things break if I don't tell you my OS. I've got extensions in this browser that can fake my agent string and nothing breaks. Fonts? Are you kidding me? Be more specific, what exactly do you mean by that?

And there's no reason it needs to. What legit use case requires a website to know whether my GPU is an NVidia, AMD, Intel or whatever chip? A shitload of the capabilities are only needed for 3D scenes (like max texture size), which is 0.1% of the websites I visit - they can ask and I can whitelist just them. Why does it need my refresh rate?

Again: All of these things have a legit use case, sure. Often exactly one. That is rarely if ever used. There's absolutely no reason that EVERY WEBSITE can query information that only one website in a thousand actually needs.

You don't tell the baker, florist and car dealer your shoe size just because the shoe shop needs it to serve you, right?

Because I want to be irrelevant to the fucking ad industry. I don't want them to track me, profile me and try every trick in the book to manipulate me into buying shit I don't need.

Sure, the same way that putting a finger into another man's ass has a legit use case (prostate examination) - but that doesn't mean I want every man to do that to me all the time.

The point is that tech companies are exploiting the legit use cases by abusing them when you're not in that use case. Basically, they think they can finger up your ass whenever they want, because once a few years ago you consented to a doctor to give you an exam and maybe you will do that again in the future.

I don't mind it being capable of. I mind it doing all kinds of shit without telling me and without giving me a choice. For example, I absolutely do not want websites to access my microphone. Or even know that I have one. For the once-a-year case where I might actually use that, I can enable it.

The problem is the same problem that the cybersecurity field has been fighting for 40 years: Permit All being the default.

Serious question - How does the Online Streaming Act work in practice for content on demand? When a Canadian tries to binge the latest season of Stranger Things, is NetFlix required to say "nope, go watch this Celine Dion concert first to get our CanCon ratio up"?

Nope. If you want to watch Stranger Things on Netflix, you select (or find) Stranger Things and that's it.

The OSA only requests that streamers prioritize Canadian content so if you're trying to determine if you want to show a film from the NFB (National Film Board) or some classic US film, the Canadian version is preferred. The other aspect is that a certain amount of Canadian income is spent on Canadian productions (about 20%). Which streamers like Netflix already greatly exceed since they film in Canada. (Those productions do count as "Canadian" I believe, so Netflix can promote its own series as "Canadian" content).

Of course, if you want to sell service in Quebec, you have to obey their laws too. (Many companies simply don't - there are many Canadian companies who simply do not ship to Quebec to avoid those laws, and many American companies often do "Canada (excluding Quebec)". That stuff is legal to do and is a business decision by the companies that want to go into Quebec. Nothing bars Netflix from not serving Quebec if they want to avoid French content rules.

Ancient Rome made amazing aqueducts. One day they had built all the ones they really needed and with no new projects for a new generation to learn from, they quickly just forgot how to make aqueducts.

"Big Tech" is now entering this phase. In a generation all innovation will be gone.

900$ for a base model with 256GB SSD is pathetic.

It doesn't NEED to know any of these things. My browser knows the window (not screen) size and if your CSS is well-formed, it'll manage or maybe your page looks shit if you build it shit. It needs to know my OS only if I want a download link, not on every page I ever visit. It doesn't need graphics capabilities unless it wants to bypass the browser rendering engine, in which case it should ask for permission or fuck off.

The thing is that we give up too easily and the major browser manufacturers (one of which is an ad company themselves) are complicit.

I want "fuck the ad industry" mode, where the browser generates random but plausible values for every non-essential information a website requests. Different ones every 5 minutes.

Which doesnt âoefixâ the underlying issue - the browser is leaking data about you against your knowledge and permission.

That sounds like a flaw in the browser. That should probably be fixed.

Most browsers have fixed it. Firefox, for example, uses software libraries that implement high precision math so every Firefox user ends up looking the same because the fingerprint you get comes back the same.

Safari does something different, and it adds random noise to the audio waveform so the same browser will continually report a different fingerprint every time it's run.

I believe Chromium simply blocks the script

Then make it retroactive. Donate the proceeds to the victims of this program who had to train their replacements.

Before Silicon Valley, a lot of tech was done in the East. It's why some of the biggest "tech" companies were based on the east - Kodak, for example. But other ones like IBM were based on the East Coast. And many early computer companies were started in the East.

The westward migration created Silicon Valley as companies like Fairchild and such created companies in the orange groves of California.

Well, I'm pretty sure your bank has a web interface, so you don't have to use the banking app to do your banking.

Your work auth app may be more complex - if it's TOTP, you might be able to export the seed and key and there are plenty TOTP generators. (It's also one of the easiest programming assignments to do so any competent programmer should be able to come up with something in under an hour without vibe coding). Unfortunately there are a few TOTP systems that make it extremely difficult to get the seed and key values to use a third party TOTP generator.

Your state legal filing app, well, I'm sure there's a web based version of that as well - I can't imagine the state restricting legal filings to owners of Android or Apple phones.

Now, the car sharing app might be more complex - I think most car sharing sites have regular websites so you can book them from the desk, but there is also a good possibility a lot of them are app only for no good reason. Though many do use app based "car keys" which use some NFC thing to control the car.

Not in 2003 it wasn't

Her name is Pamela Jones, she was a paralegal. She's done real interviews in the past. She was/is real!

This is essentially a high-stakes gamble. The payout is potentially millions, so they just try whatever. And I bet if it all turns against them and they're forced to pay legal costs etc. they'll just file for bancruptsy.

Perfect illustration of the thinking problem here. You don't even get WHAT the problem is.

Why is a driver able to fuck up a system? The OS should be the watchdog that says "WTF are you doing there?", not the obedient slave executing whatever.

A great illustration is W^X - first found not in Windows, but in OpenBSD. Because Windows happily goes "whatever you say, master", while the guys at OpenBSD said "no actual use case of non-broken, non-malicious software should ever behave like that, so we'll block it".

If you are responsible for a sensitive location, and a five-year old kid from the neighbourhood one day just wanders in and take a look around out of curiosity, pressing a few buttons to see what happens - you would definitely not keep your job by claiming that the little kid is actually the problem here.

If the C code does something unsafe, how can it be machine-translated into safe Rust, without knowing the intention of the programmer?

The key word being "if".

There's a ton of C code out there, the vast majority of which doesn't do anything unsafe. Take say, Apache httpd - what unsafe thing would it do? It just forks, spits a file out over a socket and that's it. The most unsafe thing it does would be to run a plugin, but that's mostly handled by the dynamic loader.

In fact, most userspace code out there isn't really doing anything irrational or unsafe - they're using kernel interfaces to do the unsafe bits, and everything else is just system calls and library functions.

And even if you can't convert all code, you can protect most code. Never let perfect get in the way of good enough. The few bits of C code that need to exist because it's unsafe is much easier than millions of lines of C code that doesn't do unsafe stuff but can become unsafe in certain weird situations.