9,047 Matching Annotations
  1. Jun 2020
    1. The EARN IT act turns Section 230 protection into a hypocritical bargaining chip. At a high level, what the bill proposes is a system where companies have to earn Section 230 protection by following a set of designed-by-committee “best practices” that are extraordinarily unlikely to allow end-to-end encryption. Anyone who doesn’t comply with these recommendations will lose their Section 230 protection.
    1. A year’s worth of cajoling back and forth has ultimately resulted in the EARN-IT bill wending its way through the U.S. system, a bill that, if passed, would see messaging services become legally responsible for the content on their platforms. While not mandating backdoors, per se, without some form of probes into message content, the argument runs that the punitive risks become unsurvivable.
    2. there’s a bill tiptoeing through the U.S. Congress that could inflict the backdoor virus that law enforcement agencies have been trying to inflict on encryption for years... The choice for tech companies comes down to weakening their own encryption and endangering the privacy and security of all their users, or foregoing protections and potentially facing liability in a wave of lawsuits.
    1. Once the platforms introduce backdoors, those arguing against such a move say, bad guys will inevitably steal the keys. Lawmakers have been clever. No mention of backdoors at all in the proposed legislation or the need to break encryption. If you transmit illegal or dangerous content, they argue, you will be held responsible. You decide how to do that. Clearly there are no options to some form of backdoor.
    1. Unlike Telegram, WhatsApp is not open source, so there’s no way for security researchers to easily check whether there are backdoors in its code. Not only does WhatsApp not publish its code, they do the exact opposite: WhatsApp deliberately obfuscates their apps’ binaries to make sure no one is able to study them thoroughly. 
  2. May 2020
    1. The task of "making a thing satisfying our needs" as a single responsibility is split into two parts "stating the properties of a thing, by virtue of which it would satisfy our needs" and "making a thing guaranteed to have the stated properties". Business data processing systems are sufficiently complicated to require such a separation of concerns and the suggestion that in that part of the computing world "scientific thought is a non-applicable luxury" puts the cart before the horse: the mess they are in has been caused by too much unscientific thought.

      Dijkstra suggested that instead of concerning ourselves with a software system that meets the user's needs, we should first separate our concerns.

      We should first concern ourselves with the user's needs and draw up careful specifications – properties to which the system should adhere should it satisfy the user's needs.

      With those specifications in hand we can concern ourselves with making a system guaranteed to have stated properties.

      The problem with this thinking, which the software industry would later discover, is that a user's needs cannot be accurately or completely determined before building the system. We learn more about what is needed by the process of building.

      This is an instance of the [[Separation of concerns]] not working.

      This is also why the industry has settled on a technique to build iteratively (Agile), always leaving the option open to change course.

    2. Some time ago I visited the computing center of a large research laboratory where they were expecting new computing equipment of such a radically different architecture, that my colleagues had concluded that a new programming language was needed for it if the potential concurrency were to be exploited to any appreciable degree. But they got their language design never started because they felt that their product should be so much like FORTRAN that the casual user would hardly notice the difference "for otherwise our users won't accept it". They circumvented the problem of explaining to their user community how the new equipment could be used at best advantage by failing to discover what they should explain. It was a rather depressing visit.... The proper technique is clearly to postpone the concerns for general acceptance until you have reached a result of such a quality that it deserves acceptance. It is the significance of your message that should justify the care that you give to its presentation, it may be its "unusualness" that makes extra care necessary.

      When you've developed an idea, you will typically want to communicate that idea so that it can be understood and used more generally. Dijkstra calls this reaching "general acceptance".

      To do so, you must communicate the idea in a way so that it can be properly understood and used. For certain ideas this becomes a challenging problem in and of itself.

      Many forgo this challenge, and instead of figuring out what new language they need to invent to most accurately communicate the idea, they use legacy language and end up communicating their idea less effectively, in pursuit of general acceptance.

      Dijkstra says that the proper way of dealing with this dilemma is to separate your concerns. You separate your concern of the solution from the concern of communicating the solution.

      When you've reached a solution that is of such high quality that it deserves communicating – and only then – do you concern yourself with its presentation.

    1. For the past few years, we've run GitLab.com as our free SaaS offering, featuring unlimited public and private repositories, unlimited contributors, and access to key features, like issue tracking, code review, CI, and wikis. None of those things are changing! We're committed to providing an integrated solution that supports the entire software development lifecycle at a price where everyone can contribute. So what's changing? Over time, the usage of GitLab.com has grown significantly to the point where we now have over two million projects hosted on GitLab.com and have seen a 16x increase in CI usage over the last year.
    1. Did the marketing team create a new landing page that isn't searchable? Osano is aware of hidden pages and keeps you in the loop about what is loaded where – everywhere on your site.

      How would it "know" about hidden pages unless the site owner told them about their existence? (And if that is the case, how is this anything that Osano can claim as a feature or something that they do?) If it is truly hidden, then a conventional bot/spider wouldn't find it by following links.

    1. These options have almost deceptively similar wordings, with only subtle difference that is too hard to spot at a glance (takes detailed comparison, which is fatiguing for a user):

      1. can use your browser’s information for providing advertising services for this website and for their own purposes.
      2. cannot use your browser’s information for purposes other than providing advertising services for this website.

      If you rewrite them to use consistent, easy-to-compare wording, then you can see the difference a little easier:

      1. can use your browser’s information for providing advertising services for this website and for their own purposes.
      2. can use your browser’s information for providing advertising services for this website <del>and for their own purposes</del>.

      Standard Advertising Settings

      This means our ad partners can use your browser’s information for providing advertising services for this website and for their own purposes.

      Do Not Share My Information other than for ads on this website

      This means that our ad partners cannot use your browser’s information for purposes other than providing advertising services for this website.

    1. Taxonomy, in a broad sense the science of classification, but more strictly the classification of living and extinct organisms—i.e., biological classification.

      I don't think the "but more strictly" part is strictly accurate.

      Wikipedia authors confirm what I already believed to be true: that the general sense of the word is just as valid/extant/used/common as the sense that is specific to biology:

      https://en.wikipedia.org/wiki/Taxonomy_(general) https://en.wikipedia.org/wiki/Taxonomy_(biology)

    1. In order to comply with privacy laws, especially the GDPR, companies need to store proof of consent so that they can demonstrate that consent was collected. These records must show: when consent was provided;who provided the consent;what their preferences were at the time of the collection;which legal or privacy notice they were presented with at the time of the consent collection;which consent collection form they were presented with at the time of the collection.
    1. Customizability is a popular word that arose of jargon in software and computer related circles . It is not yet a formally recognized and would not be correct utilized it is not yet a formally recognized and would not be correct utilized in formal writing outside of its common reference to the flexibility of a design and it's ability to be altered to fit the user.
    1. The folks at Netlify created Netlify CMS to fill a gap in the static site generation pipeline. There were some great proprietary headless CMS options, but no real contenders that were open source and extensible—that could turn into a community-built ecosystem like WordPress or Drupal. For that reason, Netlify CMS is made to be community-driven, and has never been locked to the Netlify platform (despite the name).

      Kind of an unfortunate name...

    1. after nearly 10 years of continuous improvement

      Not necessarily a good or favorable thing. It might actually be preferable to pick a younger software product that doesn't have the baggage of previous architectural decisions to slow them down. Newer projects can benefit from both (1) the mistakes of previously-originated projects and (2) the knowledge of what technologies/paradigms are popular today; they may therefore be more agile and better able to create something that fits with the current state of the art, as opposite to the state of the art from 10 years ago (which, as we all know, was much different: before the popularity of GraphQL, React, headless CMS, for example).

      Older projects may have more technical debt and have more legacy technologies/paradigms/integrations/decisions that they now have the burden of supporting.

    1. "linked data" can and should be a very general term referring to any structured data that is interlinked/interconnected.

      It looks like most of this article describes it in that general sense, but sometimes it talks about URIs and such as if they are a necessary attribute of linked data, when that would only apply to Web-connected linked data. What about, for example, linked data that links to each other through some other convention such as just a "type" and "ID"? Maybe that shouldn't be considered linked data if it is too locally scoped? But that topic and distinction should be explored/discussed further...

      I love its application to web technologies, but I wish there were a distinct term for that application ("linked web data"?) so it could be clearer from reading the word whether you meant general case or not. May not be a problem in practice. We shall see.

      Granted/hopefully most use of linked data is in the context of the Web, so that the links are universal / globally scoped, etc.

    1. Thickness of the neck

      However you represent the head, whether it is relatively simply yet characteristic, or incredibly refined, you can now identify the start of the neck from the chin. The digastric plane is the bottom plane, it gives the head thickness. It will be useful when drawing the head from other angles - the biggest hurdles is working in a flat 2d plane while seeking to depict volume.

      The gesture from the chin to the bottom of the neck is curved and downward. It is better to make the neck a little too long than too short. You then come from the bottom of the skull, the key here will be not to make the back of the neck too skinny.

      Notice that the neck starts very low in the front and very high in the back. Think of your shirt collars, it sits high in the back and low at the front.

    1. Sure, anti-spam measures such as a CAPTCHA would certainly fall under "legitimate interests". But would targeting cookies? The gotcha with reCAPTCHA is that this legitimate-interest, quite-necessary-in-today's-world feature is inextricably bundled with unwanted and unrelated Google targeting (cookiepedia.co.uk/cookies/NID) cookies (_ga, _gid for v2; NID for v3).
    1. Explicit Form (where the purpose of the sign-up mechanism is unequivocal). So for example, in a scenario where your site has a pop-up window that invites users to sign up to your newsletter using a clear phrase such as: “Subscribe to our newsletter for access to discount vouchers and product updates!“, the affirmative action that the user performs by typing in their email address would be considered valid consent.

      Answers the question I had above: https://hyp.is/tpgdQo_4EeqPcm-PI0G2jA/www.iubenda.com/en/help/5640-email-newsletter-compliance-guide

    1. In the absence of an adequacy decision pursuant to Article 45(3), or of appropriate safeguards pursuant to Article 46, including binding corporate rules, a transfer or a set of transfers of personal data to a third country or an international organisation shall take place only on one of the following conditions:

      These conditions are individually sufficient and jointly necessary (https://hyp.is/e0RRFJCfEeqwuR_MillmPA/en.wikipedia.org/wiki/Necessity_and_sufficiency).

      Each of the conditions listed is a sufficient (but, by itself, not necessary) condition for legal transfer (T) of personal data to a third country or an international organisation. In other words, if any of those conditions is true, then legal transfer is also true.

      On the other hand, the list of conditions (C; let C be the disjunction of the conditions a-g: a or b or c ...) are jointly necessary for legal transfer (T) to be true. That is:

      • T cannot be true unless C (one of a or b or c ...) is true
      • if C is false (there is not one of a or b or c ... that is true), then T is false
      • T ⇒ C
      • C ⇐ T
    1. generic-sounding term may be interpreted as something more specific than intended: I want to be able to use "data interchange" in the most general sense. But if people interpret it to mean this specific standard/protocol/whatever, I may be misunderstood.

      The definition given here

      is the concept of businesses electronically communicating information that was traditionally communicated on paper, such as purchase orders and invoices.

      limits it to things that were previously communicated on paper. But what about things for which paper was never used, like the interchange of consent and consent receipts for GDPR/privacy law compliance, etc.?

      The term should be allowed to be used just as well for newer technologies/processes that had no previous roots in paper technologies.

    1. It’s useful to remember that under GDPR regulations consent is not the ONLY reason that an organization can process user data; it is only one of the “Lawful Bases”, therefore companies can apply other lawful (within the scope of GDPR) bases for data processing activity. However, there will always be data processing activities where consent is the only or best option.
    1. If you’re a controller based outside of the EU, you’re transferring personal data outside of the EU each time you collect data of users based within the EU. Please make sure you do so according to one of the legal bases for transfer.

      Here they equate collection of personal data with transfer of personal data. But this is not very intuitive: I usually think of collection of data and transfer of data as rather different activities. It would be if we collected the data on a server in EU and then transferred all that data (via some internal process) to a server in US.

      But I guess when you collect the data over the Internet from a user in a different country, the data is technically being transferred directly to your server in the US. But who is doing the transfer? I would argue that it is not me who is transferring it; it is the user who transmitted/sent the data to my app. I'm collecting it from them, but not transferring it. Collecting seems like more of a passive activity, while transfer seems like a more active activity (maybe not if it's all automated).

      So if these terms are equivalent, then they should replace all instances of "transfer" with "collect". That would make it much clearer and harder to mistakenly assume this doesn't apply to oneself. Or if there is a nuanced difference between the two activities, then the differences should be explained, such as examples of when collection may occur without transfer occurring.

    1. Though not always legally required, a Terms & Conditions (T&C) document (also known as a Terms of Service, End-user license agreement or a Terms of Use agreement) is often necessary for the sake of practicality and safety. It allows you to regulate the contractual relationship between you and your users and is therefore essential for, among other things, setting the terms of use and protecting you from potential liabilities.
    1. it buys, receives, sells, or shares the personal information of 50,000 or more consumers annually for the business’ commercial purposes. Since IP addresses fall under what is considered personal data — and “commercial purposes” simply means to advance commercial or economic interests — it is likely that any website with at least 50k unique visits per year from California falls within this scope.
    1. I know, you don't trust Mozilla but do you also not trust the developer? I absolutely do! That is the whole point of this discussion. Mozilla doesn't trust S3.Translator or jeremiahlee but I do. They blocked page-translator for pedantic reasons. Which is why I want the option to override their decision to specifically install few extensions that I'm okay with.
    2. What's terrible and dangerous is a faceless organization deciding to arbitrarily and silently control what I can and can not do with my browser on my computer. Orwell is screaming in his grave right now. This is no different than Mozilla deciding I don't get to visit Tulsi Gabbard's webpage because they don't like her politics, or I don't get to order car parts off amazon because they don't like hyundai, or I don't get to download mods for minecraft, or talk to certain people on facebook.
    3. I appreciate the vigilance, but it would be even better to actually publish a technical reasoning for why do you folks believe Firefox is above the device owner, and the root user, and why there should be no possibility through any means and configuration protections to enable users to run their own code in the release version of Firefox.
    1. Mozilla does not permit extensions distributed through https://addons.mozilla.org/ to load external scripts. Mozilla does allow extensions to be externally distributed, but https://addons.mozilla.org/ is how most people discover extensions. The are still concerns: Google and Microsoft do not grant permission for others to distribute their "widget" scripts. Google's and Microsoft's "widget" scripts are minified. This prevents Mozilla's reviewers from being able to easily evaluate the code that is being distributed. Mozilla can reject an extension for this. Even if an extension author self-distributes, Mozilla can request the source code for the extension and halt its distribution for the same reason.

      Maybe not technically a catch-22/chicken-and-egg problem, but what is a better name for this logical/dependency problem?

  3. Apr 2020
    1. The common law—so named because it was "common" to all the king's courts across England—originated in the practices of the courts of the English kings in the centuries following the Norman Conquest in 1066.[10] The British Empire spread the English legal system to its colonies, many of which retain the common law system today. These "common law systems" are legal systems that give great weight to judicial precedent, and to the style of reasoning inherited from the English legal system.
    1. Third, the focus should be centered on improving transparency rather than requesting systematic consents. Lack of transparency and clarity doesn’t allow informed and unambiguous consent (in particular, where privacy policies are lengthy, complex, vague and difficult to navigate). This ambiguity creates a risk of invalidating the consent.

      systematic consents

    2. organizations may require consent from individuals where the processing of personal data is likely to result in a risk or high risk to the rights and freedoms of individuals or in the case of automated individual decision-making and profiling. Formal consent could as well be justified where the processing requires sharing of personal data with third parties, international data transfers, or where the organization processes special categories of personal data or personal data from minors.
    1. While Web site is still doing well in the U.S., it is all but dead in the U.K. Current Google News searches limited to U.K. publications find only about one instance of Web site (or web site) for every thousand instances of website. The ratio is similar in Australian and New Zealand publications. In Canada, the ratio is somewhere in the middle—about 20 to one in favor of the one-word form.
    2. Exceptions are easily found, however, especially in American sources, where Web site (or web site, without the capital w) appears about once for every six instances of website. This is likely due to the influence of the New York Times, which is notoriously conservative with tech terms. The Times still uses Web site, and many American publications follow suit. Yet even those that often use Web site in their more closely edited sections tend to allow website in their blogs and other web-only sections.
    1. Competition exists when there is comparison, and comparison does not bring about excellence.

      Disagree. It does once you master the "Inner Game" the way John Galway explains it. Competition then is your ally to find the best version of yourself. To do things you did not think you could because your opponent helped you bring this out of you. And so it is in Aikido and value of a good opponent.

    1. Before we get to passwords, surely you already have in mind that Google knows everything about you. It knows what websites you’ve visited, it knows where you’ve been in the real world thanks to Android and Google Maps, it knows who your friends are thanks to Google Photos. All of that information is readily available if you log in to your Google account. You already have good reason to treat the password for your Google account as if it’s a state secret.
    2. You already have good reason to treat the password for your Google account as if it’s a state secret. But now the stakes are higher. You’re trusting Google with the passwords that protect the rest of your life – your bank, your shopping, your travel, your private life. If someone learns or guesses your Google account password, you are completely compromised. The password has to be complex and unique. You have to treat your Google account password with the same care as a LastPass user. Perhaps more so, because it’s easier to reset a Google account password. If your passwords are saved in Chrome, you should strongly consider using two-factor authentication to log into your Google account. I’ll talk about that in the next article.
    1. Less than 1% of users in the world have Javascript turned off. So honestly, it's not worth anyones time accommodating for such a small audience when a large majority of websites rely on Javascript. Been developing websites for a very long time now, and 100% of my sites use Javascript and rely on it heavily. If users have Javascript turned off, that's their own problem and choice, not mine. They'll be unable to visit or use at least 90% of websites online with it turned off.
    1. One of the drawbacks of waiting until someone signs in again to check their password is that a user may simply stay signed in for a long time without signing out. I suppose that could be an argument in favor of limiting the maximum duration of a session or remember-me token, but as far as user experience, I always find it annoying when I was signed in and a website arbitrarily signs me out without telling me why.