Guest mode does not honor your settings. It mostly defaults to install-time configuration.
Incognito mode is fine. It doesn't persist data, it doesn't give websites access to existing main-profile data (cookies, etc), and it actually honors the settings of the profile it was spawned from.
None of this robustly prevents fingerprinting, but neither does switching to another browser or wiping your profile clean. There's just a bunch of system and network characteristics that leak info because of how the web is designed. Google didn't make it so and I don't think they're using it to serve you ads.
I think two things can simultaneously be true. Google's privacy practices aren't great, and they weren't actually doing anything that a reasonable person wouldn't expect to be happening in incognito. This was a lawsuit filed to shake them down, not to benefit the consumer. And apparently, it was flimsy enough that it started with a $5B demand, and is ending with no payout at all.
If the exploit wasn't baing used, the odds would would be pretty low. They picked the right place to bury it (i.e., effectively outside the codebase, where no auditor ever looks).
That said, if you're not using it, it defeats the purpose. And the more you're using it, the higher the likelihood you will be detected down the line. Compare to Solarwinds.
A browser is one of the most consequential attack surfaces in the lives of billions of people. Redis isn't. Having proofs where said proofs don't matter much in the first place is not a particularly good use of our time. And FWIW, the correctness specs for Redis would be pretty intractable too.
That's a pretty cynical take. I think a more profound problem is that formal specifications for software are fairly intractable.
For a bridge, you specify that it needs to withstand specific static and dynamic loads, plus several other things like that. Once you have the a handful of formulas sorted out, you can design thousands of bridges the same way; most of the implementation details, such as which color they paint it, don't matter much. I'm not talking out of my butt: I had a car bridge built and still have all the engineering plans. There's a lot of knowledge that goes into making them, but the resulting specification is surprisingly small.
Now try to formally specify a browser. The complexity of the specification will probably rival the complexity of implementation itself. You can break it into small state machines and work with that, but if you prove the correctness of 10,000 state machines, what did you actually prove about the big picture?
If you want to eliminate security issues, what does it even mean that a browser is secure? It runs code from the internet. It reads and writes files. I talks directly to hardware. We have some intuitive sense of what it's supposed and not supposed to do, but now write this down as math...
Not really. There's a fairly small and stable number of companies that actually collect and resell information about you. There is also about a zillion ephemeral web front ends that republish this data, however. I suspect this is done for a reason, but a bit of sleuthing quickly reveals who the big players are.
These "data removal" services spend a lot of effort going after the frontends, which is pretty self-serving: they can show the customer that there's something new to remove every single month or quarter, so you have to keep paying forever.
There are commercial influencing operations on Reddit, but I think what you're describing doesn't really affect the usual user experience.
I suspect that the objective of these bulk spamming operations isn't to promote stuff on the platform, but to mess with other apps. LLMs trained on Reddit content, search engines that rank Reddit posts highly, etc.
Scraping is a lot more dicey than using an official API. Why did Google enter that partnership? They have the data in their index. The only conceivable reason is that they prefer to pay Reddit to avoid the risk of litigating it and ending up with some unfavorable precedent.
The API situation seemed baffling to me at the time. The timing wasn't coincidental and it was clear that they were responding to people training LLMs on the Reddit corpus.
But here's the thing: prevailing HN sentiments notwithstanding, your average Redditor leans left and is fairly anti-big-tech, so Reddit could have leveraged this angle. They could've said it's a pro-user move to stop OpenAI and the likes from unfairly profiting off your work. And most users would have applauded.
But Reddit didn't say that. They took a PR hit and decided to wait it out. The cynical explanation was that they were actually just trying to get some of that LLM money for themselves. And not long ago, they announced a big deal with Google to give access to user data for training purposes: https://www.reuters.com/technology/reddit-ai-content-licensi...
Frankly, I was on the fence about the API access thing until the motivation became clear.
I'm guessing the plan is to cast a wide net, then hope that you can dredge up some incriminating or morally ambiguous quotes during discovery. When you have a company of 100,000+ people, there's probably some "haha we're killing the competition" in there, which you can then use to prop up the case.
And then either use that to win the trial, or force Apple into settling.
Right, and from all my friends who did take VC money: it's an incredibly demanding period of your life, a large proportion of which isn't about delivering on your vision. You're gonna learn a lot about office space leases, accounting, fundraising, customer pitches, etc. You're gonna have impatient VCs on your board, with the power to fire you, breathing down your neck. You won't be relaxing much and won't be spending that much time with family and non-work friends.
It's a valuable experience with a lot of potential upside in the long haul - but let's not pretend that it's less taxing than a cozy 9-to-5 tech job where your boss might ask you to update your OKRs once in a while.
I mean, we had this stuff for pets for a long time. The basic idea is that yes, it's a lipid-soluble neurotoxin. Because it is fat-soluble, it spreads throughout various tissues and lingers for a good while, which is these pet formulations last for weeks or months.
And yes, it is technically a mammal neurotoxin too, although our bodies are better at compartmentalizing and managing the risk. Similarly, you don't drop dead if exposed to caffeine or nicotine, even though they are insect neurotoxins produced by plants to kill bugs.
But it cracks me up that we are flipping out about herbicides such as glyphosate or 2,5-D - both of which are plant growth regulators that have no real mechanism to cause obvious harm in animals - but we're a lot more flippant with actual animal neurotoxins such as permethrin.
It feels like you're picking apart an argument I didn't make. But I would note that most people don't see this so unambiguously as the position you're defending. To give you an analogy: doxxing is "fair game" too if you posted your info online or gave it to others. But it's not exactly cool to do it, right? It's a subversion and abuse of the system we have in place.
Finally, here's a fun experiment: decide that terms of service don't matter and start building a product by scrapping Facebook or Google. See how they'd react. Actually, no need for guesswork - they clutched their pearls and threatened legal action more than once before. It's a bit of a "have your cake and eat it too" kind of a deal. Their data is precious intellectual property; your stuff is, well, up for grabs.
It takes deliberate effort, but I was actually able to get pieces of my writing out of one of the leading LLMs (not ChatGPT). This is not particularly unique, a number of folks demonstrated the same.
You make a lot of categorical assertions here, but I don't think they're really all that watertight. If any individual "economically harmed in an intellectually honest sense" if PG&E overcharges every subscriber five cents on every bill?
No, and a class action lawsuit against that practice doesn't make anyone better beyond "meaningless psychological satisfaction". But it's still something we do as a society, for good reasons, right?
Here, you have a number of commercial entities that are poised to make a ton of money off individually small but entirely non-consensual contributions of other people. You also have a "data laundering" industry where the datasets of webpages, books, and images are published by notionally non-profit entities that are in one way or another bankrolled by the commercial players, keeping their hands clean.
Framing the debate as being about "human progress" is sort of goofy in that world. We're not talking about academics tinkering with wacky ideas. We're talking about an industry that takes your work without asking and monetizes it. Yes, the sum of it is greater than the component pieces, but that doesn't mean you get to do whatever you want.
While a lot of attention has been given to books3, another large component of this dataset is the deceptively-named "OpenWebText2". What's that? It's a scrape of 15 years' worth of third-party websites that were linked to from upvoted Reddit submissions. I know this includes some of my writing.
Kafka was virtually unknown during his lifetime. It's unlikely that there was any expectation of profit. They probably just liked the writings and thought it would be a shame to destroy them.
It still boggles my mind how we managed to make it so politicized. I mean, there's really no clear reason I can pinpoint.
I was wearing a mask early on in the SF Bay Area. Back when the health authorities were saying that there's nothing to worry about and that masks don't help anyway. I remember so many people giving me the stink eye for no reason. I guess my behavior was the "anti-science", tinfoil-hat stance back then.
Then it all flipped on its head pretty much overnight. And when later, having been vaccinated and having had COVID, I stopped wearing a mask out in the open, I remember the same people getting angry at that. But if you traveled 50 miles outside the SF Bay Area, the reactions were exactly the opposite.
It just bugs me so much that we find ways to turn every single thing into a culture war. We go out of our way to find reasons to lash out against others. I'm not sure if social media is the source of it, but it sure provides a positive feedback loop.
Incognito mode is fine. It doesn't persist data, it doesn't give websites access to existing main-profile data (cookies, etc), and it actually honors the settings of the profile it was spawned from.
None of this robustly prevents fingerprinting, but neither does switching to another browser or wiping your profile clean. There's just a bunch of system and network characteristics that leak info because of how the web is designed. Google didn't make it so and I don't think they're using it to serve you ads.
I think two things can simultaneously be true. Google's privacy practices aren't great, and they weren't actually doing anything that a reasonable person wouldn't expect to be happening in incognito. This was a lawsuit filed to shake them down, not to benefit the consumer. And apparently, it was flimsy enough that it started with a $5B demand, and is ending with no payout at all.