> It operates in Texas if it is serving Texas users.
What do you mean "serves"? Does that just mean not actively blocking users from Texas? Allowing your web site to be accessible regardless of user location is, and always has been, the default way to run a web site. Your assertion would mean that web site operators are beholden to the laws of all jurisdictions on the planet if they don't actively block those users.
Think about what a bad precedent that would be. Some countries criminalize promotion of pro-LGBT+ content. What if those countries suddenly demand extradition of people who run pro-LGBT+ blogs because the web sites are available there?
Also, keep in mind that geolocation isn't actually part of the Internet - it's an overlay that private companies have cobbled together that usually works. But it's not perfect, especially at the subnational level. Many times I've connected to public Wi-Fi and I get an alert that I've signed into something from across the country, because that's where the Wi-Fi provider's IPs are located. Are you sure that every jurisdiction in the world will accept that if gelocation gets it wrong, you're off the hook? Utah has already claimed that companies are responsible for complying with their laws even if the user masks their location with VPN. https://www.privacyguides.org/news/2026/05/11/utah-targets-v...
Replace "climb the social ladder and have power and influence" with "be able to afford a home, have kids, and go on vacation occasionally."
It's become very difficult to have even a middle class lifestyle without a college degree. Obviously a huge percentage of people there don't want to be.
Even if example.com is unsigned, the delegation from .com to example.com will still be signed (including an attestation that example.com is unsigned). So lack of DNSSEC adoption by users of the TLD wouldn't save them here.
It's not like the long-haul fiber not owned by FAANG is a public utility, at least not in most places.
Traffic that goes over "the Internet" traverses some mix of your ISP's fiber, fiber belonging to some other ISP they have a deal with, then fiber belong to some ISP they have a deal with, etc.
All those ISPs are being paid to provide service, they can invest in their own networks.
Assuming that RFC1918 addresses mean "local" network is wrong. It means "private". Many large enterprises use RFC1918 for private, internal web sites.
One internal site I spend hours a day using has a 10.x.x.x IP address. The servers for that site are on the other side of the country and are many network hops away. It's a big company, our corporate network is very very large.
A better definition of "local IP" would be whether the IP is in the same subnet as the client, i.e. look up the client's own IP and subnet mask and determine if a packet to a given IP would need to be routed through the default gateway.
I don't think OP was specifically stating we need to save these specific jobs, rather they were pointing out the interconnected nature of the economy. Less importing hurts the workers in those industries. Taking that further, it will hurt businesses near the ports where the workers may have gotten lunch, etc. etc. etc. That's how recessions look at a microeconomic scale.
I'm fine with this as long as they include the tariff in the listed price.
I'm worried businesses are going to use tariffs as an excuse to have a fake list price, then hit you with massive hidden fees at the point of sale.
Some sectors have been doing this for years - "service fees" at restaurants, "regulatory response fees" in the telecom industry, all sorts of nonsense in event ticketing.
Physical goods have mostly been spared this type of fake pricing - aside from sales tax not being included, but that's been universally true in the US forever so everyone is used to it.
Tariffs could be the end of that if businesses see sales plummet. Especially because these scams actually work - the reason restaurants give for not just increasing their menu prices is because higher listed prices drive people away.
> 4Chan's "Not your personal army" mentality vs. the widespread doxxing/"call their place of employment!" witch hunts
That's too generous. "Not your personal army" started because 4chan had a well-earned reputation for harassment - usually raiding other web sites, but often targeting individual people who caught their attention for one reason or another.
The "not your personal army" slogan came about because people who were very aware of this reputation were showing up, hoping to make a web site or person they disliked the next target. That got annoying fast, hence they told those people to go away.
It wasn't a moral stance against target harassment - far from it. It was a stance that the group mind will choose the next target when they feel like it - not because some rando is mad at their ex or something
When the first-gen iPhone was out there was a TIFF vulnerability so bad that you could jailbreak an iPhone just by visiting a specific web site. I remember going to Best Buy and seeing all of the display phones had been jailbroken. (It was easy to tell - this was before the App Store, so having extra app icons on the home screen wasn't normal.)
This was a user-empowering application of the vulnerability. Obviously, a bug that allows root-level arbitrary code execution just by getting the user to load a single image could be used for some pretty bad stuff. (And perhaps was.)
I would also say don't run ghostscript with the same permissions as the web server, especially not if you can just hand it your PDF through stdin and take a PNG through stdout. Sandbox it as much as possible. PDF is a really complex format which means lots of opportunities for buffer overruns and the like. (Edit: Actually, reading through Arch-TK's post above, it sounds like it was much dummer than something like a buffer overrun.)
There are portable SCIFs, basically specially designed trailers, to allow senior staff to communicate securely on the road. It's very likely Vance had one of these nearby.
In the early days of the iPhone, there was a vulnerability that allowed you to jailbreak your phone by visiting a specific web site. IIRC it was some vulnerability in the TIFF handling code. The same vulnerability could have been used to silently install spyware with root level access. No need to break signal's crypto if you can just silently capture screenshots.
It's not hard to imagine some foreign intelligence agency is sitting on some severe zero-day vulnerability, waiting to use it on very high value targets, such as senior administration staff.
Endpoint integrity is also critical. If Apple or Google were compromised, they could silently push an update that replaces the real Signal app with a modified version that forwards everything to an adversary.
Any system where the government doesn't have total control over software deployment will never be viable for handling claasified information.
Treating a proprietary API as a standard is risky - this is a good example of why. From Amazon's point of view there's no reason to keep the S3 SDK backwards compatible with old versions of the S3 service, because they control the S3 service. Once this feature was rolled out in all regions, it was safe to update the SDK to expect it.
Amazon may not be actively hostile to using their SDK with third party services, but they never promised to support that use case.
(disclaimer: I work for AWS but not on the S3 team, I have no non-public knowledge of this and am speaking personally)
Who is this actually for? It seems like most people who need private security need it on an ongoing basis, not just for a one-off thing. Even if the need arises suddenly (i.e. a stalker starts threatening a celebrity), it still seems like someone who needs that would have it arranged via their management / assistant, and wouldn't have any need (or desire) to arrange it themselves.
I actually can see some situations where on-demand private security would be useful. Say you need to retrieve your belongings from your abusive ex-partner's place (and imagine you're on the lease/deed so you have the right to enter without their permission) - having an escort could be useful if the person is violent.
However... situations like that don't seem to be what this app is going for?
> Every booking comes with a motorcade and users get to select the number of Escalades that’ll be joining them as well as the uniforms their hired goons will wear.
It honestly seems like it's for people wanting to LARP as being powerful and important. Which is fine (as long as no one gets hurt), but how big of a market is there for that?
And it's worth noting that you can't just ignore this problem if you're using websockets - websockets disconnect sometimes for a variety of reasons. It may be less frequent than a long-polling timeout, but if you don't have some mechanism of detecting that messages weren't ack'd and retransmitting them the next time the user connects, messages will get lost eventually.
The next long-polling request can include a list of the ID(s) returned in the previous request. You keep the messages in the queue until you get the next request ack'ing them.