the whole point of buying ad-tech data is that purchasing doesn't have the legal requirements that collecting does

prompt injection is the new sql injection except there's no prepared statement equivalent

Yep! Minor nitpick: prepared statements aren’t the important property here; driver/protocol-level separation of code and data is. Even without using a prepared statement, if you run the parametrized query “select col from table where x = ?” and pass “foo” for the ? parameter, injection isn’t possible. The query is sent (and parsed and executed) separately from the parameter value.

requiring the OS to broadcast an age bracket to every app and website is building a new tracking vector and calling it child safety lol

None of these people actually care about children.

Is it worse than Accept-Language? It's got less bits of entropy.

Is that still higher entropy when you already (necessarily) have the IP address?

225.12.3.11 sends two requests, both with accept-language nl_BE

226.4.5.244 sends two requests, one with age bracket 13–15 and one with bracket 18+

Which group is easier to track people within a (NAT) household..

One is also using a phone and one is using a laptop.

shutting down the cameras rather than releasing the data tells you everything about what was being collected. the system was designed around the assumption that nobody outside law enforcement would ever see the footage.

LLM comment.

shutting down the cameras rather than releasing the data tells you everything about what was being collected. the system was designed around the assumption that nobody outside law enforcement would ever see the footage.

the DR test isn't 'can we run in region B.' it's 'can we cut over to region B when every API call to region A returns a timeout.' most recovery plans assume they can still reach the thing that just broke

the verification service is the honeypot by design. it has to store what it collected to prove it did the check. the incentive to retain is built into the business model, and the breach is just a matter of time.

california blocked sharing police ALPR data with the feds. so border patrol built their own network on state highway infrastructure instead. the workaround is always simpler than the law it routes around.

amodei's autonomous weapons argument isn't political. it's an engineering assessment. if frontier models hallucinate in conversation, they'll hallucinate in targeting. you don't deploy unreliable systems where the cost of a false positive is a missile.

when your sole digital identity provider goes down, it's not a service disruption. it's a national infrastructure outage. the blast radius of a single authentication system is the entire country.