I don’t understand why that’s considered legal under GDPR. How can consent be express and informed when it would take 30 minutes just to identify each entity your data is being shared with?

In fact the law even specifies “no pre-ticked boxes” but every banner always has “accept all”. And it’s 50/50 to see “reject all” even though it is a requirement that denying must be as easy as accepting.

They should pay a bounty for reporting non-compliance.

> In fact the law even specifies “no pre-ticked boxes” but every banner always has “accept all”.

That's not entirely true. Websites that don't actively try to fuck over their users (because their purpose is not shoving third party ads at you, it's providing information about/a platform for their company's product) often provide a modal with two buttons:

'Accept' 'Decline'.

This, IMO, meets both the letter and the spirit of the law. The funny thing is, for any website actually doing that, if you click 'Accept', your data will likely only be used to improve it.

Negligence and “negligent homicide” are entirely different beasts.

Civil negligence would apply here but that would be limited to recovering damages.

The hacked website could sue to recover costs incurred, but what costs were incurred here? Maybe some wasted network bandwidth but that’s minimal.

You have to point to monetary losses caused by the hack. Only that would be covered.

Negligent homicide doesn’t apply because no one was killed.

Yes, obviously (and thankfully) no one was injured. I'm just using that as an example to show that Negligence is definitely considered in US criminal law ( https://en.wikipedia.org/wiki/Criminal_negligence )

Ok but what aspect of the CFAA applies a negligence standard?

Better question: why should CFAA be the entirety of law to be considered?

Do you have another charge that you think is applicable?

The FTC can fine for deceptive practices. There are a slew of vicarious criminal recklessness and liability approaches that charge an operator. Damage to infrastructure falls under public welfare and strict liability. There are state-level AI statutes (like Wyoming law that doesn't really allow "autonomous" defense) For civil damages, the CLAIM Act can be used to sue devs for negligince.

The law is much more broad than CFAA!

You listed a couple civil claims, but the rest is pretty vague.

Outside of the CFAA, what criminal charge do you feel is applicable here?

I also listed several criminal options!

You listed some broad areas of criminal law. If you’re saying that some statute inside those areas would apply here, can you say what it is so that we can actually look at the elements?

GDPR, CCPA, and such laws absolutely do treat stuff like MAC addresses and network topology as legally protected information.

The legal protection for an actually novel process is a patent, not copyright.

> What matters, he said, is whether the product is great and whether people want to pay for it. If they do, he said, founders can find the funding.

News flash: funding is easy when you’re profitable.

But I do think he’s generally correct. Of course there’s a quantum of VC funding that is only possible in California but that’s focusing on the 1%. There’s plenty of VC in EU now.

That’s very sector dependent.

Most of my clients want a tech stack that is FOSS to the greatest extent possible since the cost of vendor lock-in can be crippling.

Explicit legal guarantees yes for sure, enterprise will pay for “FOSS as a service” since that comes with SLA’s and means they don’t need or don’t need as large an internal platform team.

But a system of systems composed of MIT and Apache-2.0 components… it might sound ironic but that commands a premium when it’s a proposal for a large enterprise. You’re giving them the guarantee that they can walk away if they want to and you can charge for that.

Probably models on ASIC, and also smaller models becoming increasingly viable. Both leading the next next and next AI waves as some variant of Moore’s law takes hold.

Should they pay for their pipelines too?

After all, they should know how to compile their software. Any automation of that process is cheating their employer.

It’s cool to see the research but was this not already a known fact?

Eg it’s known they had Stone Age technology and prepared spear tips etc by flaking stone. I assumed that it was assumed those spear tips went on the end of a stick.

I agree. To my knowledge we have also evidence of art made by neanderthals in France. Of course they would have known how to do wood work. They already extract tar(?) from birch and made smoke less fires to be able to explore deep caves.

I think if you’re human-reviewing all the output of AI, then you’re going to hit the human comprehension bottleneck.

The key is to have clear specs and clear architecture, and then have agents enforce this.

I devote most of my time to specs and much more of my time to e2e and integration tests.

I find a lot of value, even more value than before, in strictly hexagonal designs and even a large does of DDD.

Following these principles, it’s relatively easy to design systems of systems that decompose to domains that decompose into use cases / ports / adapters.

By the time you’ve decomposed to this level, AI is very capable and it’s easy to review or verify by tests. I am very comfortable with AI verifying if a basic CRUD port is functional, for example, because at this point each operation becomes less than a dozen lines of code.

Stop thinking of yourself as a programmer and start thinking of yourself as an architect.

The key rule is that decomposition of a problem into smaller problems is what wins. This was always true, extremely true before AI and extremely true with AI.

Focus your individual effort on the top-level decompositions and let AI handle the lower-level decompositions. Trust AI to test the lower-level and make sure you test the higher levels.