Do they require disclosure of what font the developer used for coding the patch? No one thinks it matters, but no reason not the be transparent, right?

The reason not to require disclosure is because in their opinion it doesn’t matter any more than the font matters. If the person reviewing the code can’t tell it’s AI, and the code stands on its own, then it stands on its own. If they can tell then it doesn’t meet code standards anyway.
A perspective that I don’t disagree with is that “disclosure” can be a shield for the developer to hide behind. “Anything weird wasn’t me being dumb, just the AI being wonky”, and that’s writing an excuse for subpar code. You submitted it, it’s your code, and if you can’t justify some dumb bit in it then you deserve the shame without the help of a face saving “it was the AI”.

It’s typically considered bad form to tell someone to Google your point for you instead of actually explaining your point yourself.
You’re clearly trying to convince people of something. Actually do that instead of telling people keywords that mean something to you.

They run a car into something that only crunches a corner. Simulates a tree, telephone pole, or guard rail collision.
Uneven force application is much harder to safely accommodate, and it’s also a more representative crash test, since more crashes happen in that manner than full width head-on collisions.

That’s pretty fair. I know the cameras can be more effective, particularly in situations where the driver may be using lane centering or something, but I’m not sure I could be fully comfortable regardless.

You’re literally quoting a part of a sentence to seemingly disagree with. Specifically a sentence that’s saying that you don’t need to believe it’s nefarious for it to be reasonable to want privacy and assurances of privacy.

They seemed on the fence about if they were being paranoid or if they were justified in feeling concerned and it was as bad as it seemed.
I’m saying it doesn’t matter what you believe their intentions are, it’s not paranoid to have concerns about the camera in your face. You can short circuit questions about the technology or their reputation and go directly to resolving that discomfort however is most suitable to you.

Yeah, I can see the safety benefits but I’m honestly not sure how I would feel about it. My current car has a variant but the camera is mounted on the outside, and it notices lane drift and changes in responsiveness to curves. It’s basically an extension of the collision/lane centering/automatic windshield wiper (weirdly) systems.

I’m okay with that because it’s not looking at me, but at the road, which I expect the car to do. Even if it was verified to not be sending anything anywhere I can honestly say I’m still very unsure about just being passively on camera like that.

Fatigue detection is a real thing that doesn’t use the type of AI that people think of when they hear that word today most often. It’s not language based but instead it’s able to recognize faces and posture, tell where your attention is focused, and recognize signs of fatigue like head drop, eyes closing, and attention drifting from the road.
It, along with other attention based driver safety features, are real and effective and can be done on device with a computer with less power than a modern cellphone.

It is, however, at least a little creepy. It’s made a lot more so by it not being disclosed upfront with disclosures and full user awareness. It should be explained by both the website, the car manual, the salesperson and the car itself exactly what it’s doing and where any video data is being sent. It’s probably processing the video locally and at most sending telemetry about which driver just sat down and such, but 1) you might not want that 2) unless they actually tell you that you don’t know.

It’s not paranoia to want an explanation and appropriate assurances, or for it to be in your control. You don’t need to assume it’s the worst case for that to be true. It’s probably a real safety feature with a couple of quality of life features taped on so people can see it do something, since you don’t really see a passive safety feature. But without actual communication you don’t actually know that.

Nah, it’s cool. We’re clearly talking at cross purposes. Have a good one.

It was bought by Microsoft after becoming established. Most free software projects don’t care enough to move if they don’t self host.

And I’m just letting you know that link bombing isn’t, and it’s actually a discussion if you explain your point rather than dropping someone else’s novel.
If for no other reason than because you don’t have to dig for what part of what was posted is related to what they were saying, and you can much faster say “ah, you’re talking about something totally different than I am”.

Just so you know, from looking at the wall of text you pasted by proxy: those are arguments against the notion that a tpm can make the device itself secure, not that it is untrustworthy for the notion of signing and storing encrypted data.

Next time, make your point and provide references (or not), rather than just link bombing.

I’m not seeing anything that’s not a great look about requiring strong authentication for access to sensitive portions of a users account. What you’re saying is akin to calling it a bad look that they force users to use complex passwords against user wishes.

I’m not sure what “trust me bro, my cloud is safe” has to do with anything. Passkeys live on your device. There are ways of facilitating device to device migrations of the keys if you want. You don’t need to use them to use passkeys. And at least on Android you don’t need to even use Google to manage the keys.

Most semiconductors are closed source. The processor, ram, and radio are also more than likely closed. The software interfaces to all of them have open specification and implementation. There’s like, six for Linux. Microsoft open sourced theirs.
Tpms are not security through obscurity. They are obscure, but that’s not a critical component to their security model.

What they do isn’t really what “collecting biometrics” implies. They’re storing key points in a hashed fashion that allows similarities to be compared. Even if it wasn’t encrypted in a non-exportable way you still can’t do anything with it beyond checking for a similarity score.

You’ve done a good job explaining what I said previously: there’s sometimes a disjoint between privacy and security concern, and so sometimes people don’t understand something about security.

That’s close enough for a privacy perspective. There’s also limitations on domains that can request the auth, specifically ”only the one the credential is for", and there’s a different key per domain and user typically.
It’s also implemented in a way where if the user doesn’t choose to disclose their account to the service, the service can’t know.

Caring about privacy and caring about the details of a security protocol are distinct. You’d be surprised how many people who care about privacy are deeply wary of passkeys because of the biometric factor, which is unfortunate because the way it authenticates is a lot harder to track across domains by design.

I understood they had a lot of concerns, one of which was biometrics via passkeys since GitHub was a very early adopter due to the supply chain risk they pose.

I know how device fingerprinting works, thank you though.

You don’t need my fingerprint, hardware or personal, or biometric shit.

To me that sounds like hardware identifiers, but also quite specifically the things passkeys use. Hence I mentioned it as aside from their main point, which was “don’t track me”, because the biometrics GitHub or any website is going to ask you to use can’t be used for that.

Tangential to the main point you’re going for: when you say fingerprint or biometrics I think you’re referring to passkeys.
Passkeys don’t share any of your fingerprint or other biometric identifiers with anyone.

https://www.eff.org/deeplinks/2023/10/passkeys-and-privacy

One of the major design criteria of their creation was to be an increase in security without sacrificing privacy. It’s made them more finicky to get working but there’s a very good reason they’re very popular with security professionals.

So for the first part, I don’t disagree at all. I just don’t think the logistics or theoretical necessity is a bearing on the symbolic-ness of it. Same for the effectiveness of it. Even if it changed literally nothing and no one would ever know I still wouldn’t shake hands with someone I considered evil.

I don’t see defining a subset of what you consider evil, like dissemination of hate speech, to be a downside.

There’s a lot of complex questions around a platform curating ideological content which could possibly make them loose certain platform protections. Right now most platforms are roughly content neutral because it allows them to be viewed as platforms, rather than publishers. This is more a response to the claim that there’s no reason for them not to remove ice. It may or may not be compelling, but it’s a real reason.

As for the use of the word “service”, sometimes my hands type slower than my brain thinks. My intent was to convey “those who develop and control the mastodon license”. Hopefully my original statement makes more sense in that context.
Those are the people providing the printing press schematic analog. Obviously an idea can’t support an ideology in that sense.

I’m not of the opinion either supports them in a way that’s worth getting angry over.
We also aren’t talking about being angry at ISPs for being willing to deliver packets to and from ice or Nazis, or any of the other entities that do less then the most they could possibly do to distance themselves.

Says the fact that it’s come up multiple times amongst a wide swath of the open source community, and look about you. Those licenses aren’t used. One or two exist and have a vanishingly small usage level and a couple more I have been “in progress” for years.
The people who write most of the open source licenses have explanations for why it’s not compatible.

Group behavior is a collective decision and a reflection of the group.

No, you’re not understanding what I’m saying. I’m not the person you were replying to.
Mastodon is a piece of software. It has a license, just like bluesky or any other. You can put a clause in the license saying the software cannot be used for the dissemination of hate speech. The open source community has discussed this and decided it goes against the principles of free software and open source.

If you’re mad at one and not the other, you’re applying different standards because being part of the fediverse weighs more.

Personally I hold platforms to a different standard and so I’m neither mad at mastodon nor bluesky. I just think it’s hypocritical to be mad at someone for publishing a fascists letter but not be mad at the person who gave the same fascist a printing press.

So the mastodon service supports Nazis.

nobody owns it and anyone can run it

They could have chosen a license that forbid usage for spreading hate. They put “free software” and “open source” above blocking hate speech.
They’re providing software to Nazis, and I don’t really see how that makes them better than providing a place to post.

Yup. The risk of someone breaking into your house and stealing your post-it note is vastly different from someone guessing your password, and the risk changes again when it’s a post-it note on your work computer monitor.

One of the best things you can do with your critical passwords is put them on a piece of paper with no other identifying information and then put that piece of paper in your wallet. Adults in modern society are usually quite good at keeping track of and securing little sheets of paper.

I’m paranoid, so I put mine on an encrypted NFC card that I printed to look like an expired gift card to a store that went out of business. It’s got what I need to bootstrap the recovery process if I loose all my MFA tokens (I keep another copy in a small waterproof box with things like my car title. It’s labeled “important documents: do not lose” and kept unlocked so any would be thief feels inclined to open it and see it’s worthless to them rather than taking the box to figure that out somewhere else. The home copy is important because there’s vaguely plausible scenarios where I lose both my phone and wallet at the same time. )

Stealing my laptop and getting my stuff is a significantly larger risk than me leaving my computer on and unattended without locking the screen.

Passkeys are a good trend because they’re just about the only security enhancement in recent memory that increases security and usability at the same time.