This is only true if you are using apps that require no communication with a server.
Otherwise it's constant forced updates, and basing security on the version number of the installed app is a moot point since you can't guarantee the server will send the same replies to 2 different users.
I can't parse the part about e2e not making sense for webpages.
> This is only true if you are using apps that require no communication with a server
End-to-end encryption is all about going through an untrusted server. You don't need end-to-end encryption otherwise.
> Otherwise it's constant forced updates
There are apps that allow you to verify that you are running the same signed binary as others. Think key transparency but for apps. It's trivial to do.
> basing security on the version number of the installed app
Obviously you don't base your security on the version number of the installed app?!
> since you can't guarantee the server will send the same replies to 2 different users
With a website, you cannot. When you open protonmail.com in your browser, you don't know if you are running the same code as I am when I do the same.
With a mobile app, you can. You get a signed binary, it's trivial to compare. Also even if you don't check that, if you get the Signal app through the Google Play Store, it means that the app is signed by Signal but distributed by Google. They have to collude in order to have you get a different binary.
> I can't parse the part about e2e not making sense for webpages.
It's what I'm saying above:
- If you audit the Signal sources, compile them and run them, then you don't have to trust the server.
- If you use the Signal app distributed by Google, you can trust that you got the same app as everybody else who downloaded it through the Play Store, unless Signal and Google collude.
- If you open protonmail.com in your browser, you have to blindly trust that the Proton server is sending you the code you expect. But if you have to blindly trust the server, then it's not exactly end-to-end encryption anymore, is it?
Just the other day at the NATO summit he seemingly claimed Iran's nuclear program is so damaged they'll never be able to build a bomb. So, mission accomplished? Nothing the guy says is credible..
Can anyone explain something? Since there are so many open source chat applications, what keeps anyone from "just" exchanging a key with someone else out of band, and then modifying the client so that it uses that key to encrypt all communication? I understand that this does not scale to big groups, but surely whoever is pushing this crap must have thought about this? Or is the idea that we will have completely locked down PCs as well ala android and ios so you can't run anything unapproved?
Nothing is stopping people from doing that. It’s just more inconvenient than other available options. If I were a politician trying to remove private communication, I would first pass something that allows scanning communications, then pass something that allows e2ee messages to be scanned, then make it illegal to use non-scannable e2ee messaging. People could still do it, but now they could be punished if they’re ever caught
That was the strangest line for me as well. The article tries to play up this "Polish engineer with an MSc in computer science who has 13 years of industry experience" who ... used claude to review the code. My mom could have done this without an MSc or years of industry experience.
>The challenge with screen mirroring solutions is that they take over every single pixel in the car, and that’s not the way we see ourselves interacting with our users.
Wassym Bensaid sounds like an incompetent person to be a chief software officer working on cars if he does not understand this is not how carplay works. It's either this, or he's just weaseling out of saying "we want to capture all our users data, and we want to put in rent seeking subscriptions into our cars, which is going to be hard if we enable carplay".
What's the point in making this distinction? This is HN, 99% of the users here are aware of what zero knowledge proof is and that it's possible to implement it that way.
The general consensus and what the article is alluding to is that it will be probably implemented in a way that allows individual tracking and identification.
I don’t know? Maybe its the little give and take that helps build a solution that is mature and limits the kind of harms kid are facing, without sacrificing privacy?
It’s also the very cool, nuanced and technical tooling that people here tend to enjoy figuring out, and building.
It side steps the thought terminating tar pits of “privacy at all costs” or “save the children”.
If this is clickbait, you are a google shill. The limitations of v3 are very clearly explained on the ublock homepage:
uBlock Origin used the webRequest API to intercept and block network requests in real-time. The replacement declarativeNetRequest API has hard limits on the number of filter rules (previously 30,000, now 330,000) and lacks the dynamic filtering capabilities that made uBlock Origin so effective.
Cannot use all filter lists simultaneously (rule limits apply)
No cosmetic filtering in the default mode
No scriptlet injection by default
Limited dynamic filtering capabilities
Requires broader host permissions upfront
The part no one gets is that mv3 by design cannot do privacy protection by stripping tracking tags. Any sort of programatic URL manipulation or introspection is impossible by design. Advertisers can switch to a scheme of base64 query params inside URLs, and there's nothing MV3 based adblockers can do to filter this
To me it sounds like the agent's operator is a person who has zero self awareness, and is entitled to the maximum to believe that he can just 1) point an agent at real people and expect them to do his bidding, 2) and then ask for a refund for his "experiment". Let's not even discuss the fact that his bill is from AWS, and he's trying to get a refund from DN42.
There is no arguing with people like this. They are not here to learn anything about networking. Asking the LLM to stop will not make it go away.
Burn a hole in the operator's wallet. It will make it stop very quick.
If this was my hobby project, I would have told the agent to spin up more higher capacity EC2 machines because this is not enough, and I would have felt no shame. This is a project I'm operating at my own cost for educational reasons. I'm not going to argue with people who the only line of communication I have towards is an agent and have guns pointed at my infra. They are ready to put any amount of financial burden on me. Fuck all of that. Burn a few of these idiots, and people will learn.
I can't parse the part about e2e not making sense for webpages.