>if you run code on your computer, it can run code on your computer
For the love of God will someone please just make a web browser that isn't a web browser and it's just a cross platform multimedia sandbox with a couple of APIs in it, and you can run programs written in rust or something on it, and it doesn't let the programs touch your file system unless it has explicit permission? That would solve 99% of the application use cases. That's literally everything I want. I want the safety of the browser, outside the hell that is web development.
I think the rest of your sentence was "by default" which is the same thing the comment you're replying to said: "security gets in the way of everything"
The problem is that defining a reasonable policy for any modern app is a gargantuan pain -- as is the case with any security policy language -- so as the GP said people hated it and now it's dead https://openjdk.org/jeps/411
I think a key part of solving that is by not thinking of it as a set of security enforcement rules on top of the preexisting platform, but as a new platform (that just runs everywhere). So, instead of ACL listing what files can be accessed, shove it in a sandbox where the app has its own files, and the platform open file dialog enables the user to authorize one-time access to individual files.
You basically can't take a complex thing and write complex security rules for it and expect success & real world adoption.
It's called iOS. Browsers are also NOT safe. You know what was safe? Not letting random endpoints ship you code to run. HTML was safe, though implementations at the time likely had security flaws.
You cannot make a turing complete language that JIT compiles into machine code and verify it as "safe". Machine code is not safe, so anything that lets you generate arbitrary machine code cannot be proven to be safe. If you take away the arbitrary machine code generation from javascript, it's too slow to run the modern web.
Then don't compile it into machine code? The problem is in application development, not low-level programming. If a random person on the internet makes an application, there's a non 0% chance it's malware if you try to run it. It shouldn't be that dangerous. It's ridiculous that it still is that dangerous after decades of desktop computing and the only way to avoid this is anti-virus heuristics.
All we want is to get rid of the possibility of an application developer including evil code.
We could have a fully interpreted language layer running on a platform that never lets application code touch the file system. How do applications do fast stuff like GUI then? You just have a package manager with libraries that can do low-level stuff but are vetted so they don't expose APIs that let application code interact with the file system. That way in order to exploit an user's computer you need to exploit a flaw in a library thousands of other programmers use instead of just importing std io.
A lot of security seems geared toward server environments where you are only dealing with code you fully trust in, like the left-pad library. If bad code broke your server, you could really just load a backup. But most of people using computers are on their personal computers, a majority of them have no backup, and they are downloading and running random programs all the time. It makes it harder for both desktop application developers and their users if there isn't a sandboxing layer in the middle. It's probably one of the factors that is killing desktop apps in first place since most users can trust a website that is an image editor but fewer would install an image editor because it can contain a cryptominer, or a ransonware, or a virus, or whatever.
You're skipping over a lot of pragmatic middle ground between "full hardware access" and "verifiably safe" (i.e. formally proven?) here.
An absence of turing completeness and JIT compilation is neither necessary (see sandboxing) nor sufficient (see variousexploits against media codecs, PDF parsers etc.) to ensure safe processing of untrusted data, whether that data happens to be "actual data" or code.
You can make your own life easier or harder with your choice of sandboxing target, though: x86 Win32 binaries are probably harder to do sandbox in a working and secure way than e.g. WASM/WASI.
I still can't use a password manager to keep my apple account secure. You must memorize your password, and be able to type ... uh, I mean, draw, no, write? your password on a watch as well (if you get one of those).
iOS is not exactly safe until I can use it without knowing my apple password.
My watch somehow became unpaired from my phone and needs my password. I just ignore the prompt because all attempts to enter the password fail for one reason or another. Even moving my wrist too much or taking too long clears the prompt.
On a related note, I appreciate the ability to specifically disable JavaScript JIT in GrapheneOS' browser, Vanadium. Theoretically, it's a nice balance of maintaining site compatibility (as opposed to disabling JS entirely) and reducing one's attack surface.
There's probably nothing that I hate in programming more than having full access to the file system. Any time I write a program that has to delete a file I just make it move into a trash folder instead just in case I mess up somewhere and accidentally delete the entire file system.
Both, it's both, and they're meeting in the middle. Windows has taken a nosedive with 11, while I can say at least for KDE that it has been improving massively in stability over the past few years, and Proton has made gaming on Linux possible. Adobe being Windows-only is still a big hold for lots of people, but unlike decades ago, today lots of top software like Davinci Resolve is now nativelly compatible. Pinta is no Paint.NET and Okular can't match Adobe Reader, but eventually they just might be good enough.
One day we'll look back at the legacy pile of self contradicting nonsense that Windows is and wonder how we ever used it productively.
People have reasons, personally I don't like placing the burden of a viral license on people. I don't write code to further a copy-left cause, I write it to build things and make it easier for other people to build things.
But by doing that, you don't protect the users. If a commercial entity writes software that depends on e.g. an LGPL library. Then I as a user totally benefit from the fact that is it LGPL. Maybe it can even allow me to update the dependency myself, be it for security reasons, or for compatibility reasons (I could patch something in the library that would make the whole project work on my machine).
By not using copyleft, you make it easier for others to make proprietary products with your code. But is that what you want? As a user, are you happier with a proprietary Windows or an open source Linux?
I think the problem with this argument is that you think the user wants the source code. I agree that would be great ideologically but 99.999% of the people using computers couldn't care less. Not just non-developers but even the best programmers would rather just pay money to not have to fix someone else's bugs. Nobody wants to waste their time replacing libraries. They just want to use software. If we're being pragmatic about what is good "for the user" then the best thing for the user is that there are as few obstacles as possible for developers to create products for the users to use.
If we consider the dichotomy of use the viral license or make no software, then the user will always prefer to have software that exists in proprietary form than having no software at all. If a company doesn't like GPL, they'll simply not use GPL code, and maybe not using GPL means their product is not viable anymore because they have to rewrite everything themselves, and now something that was going to be made isn't going to be made because they can't get free labor. Is that good? According to GPL and FOSS, yes. According to the user that wanted to use that piece of software, no.
I have to add this feels so awkward because every time there's a thread about AI you'll find someone saying that the fact that data is copy-able renders copyright a thing of the past, and then you turn around and you see GPL and no-no-no-no-NO! You want to copy MY source code, my LABOR, and use it for free in your proprietary products? That's completely unfair! And next week there's a new OpenAI lawsuit and everyone's like "if you didn't want to get scrapped, shouldn't have posted it on the internet." It's so awkward.
> I think the problem with this argument is that you think the user wants the source code.
I want the source code, so I want developers to push for copyleft. I am a developer, so I push for copyleft on my end, for the others who want the source code like me.
> even the best programmers would rather just pay money to not have to fix someone else's bugs
I regularly need to patch some (open source) software I use. I probably couldn't pay for it (not sure if anyone would fix it for me), so I don't have a choice. The proprietary alternative is that I just can't have the damn software fixed.
> If we're being pragmatic about what is good "for the user" then the best thing for the user is that there are as few obstacles as possible for developers to create products for the users to use.
When you make it as easy as possible for developers, you end up with ElectronJS crap and similar. With proprietary protocols, nobody can write a different client (e.g. to make it more accessible). I don't consider this good for the user.
> If a company doesn't like GPL, they'll simply not use GPL code, and maybe not using GPL means their product is not viable anymore
First, there is not only GPL. The weakest copyleft I know is MPLv2, which requires to share the modified files. If a company's product is not viable under those conditions, then that product is simply worthless.
Second, as an open source developer, I don't really give a shit if another company that is not paying me is not viable with my copyleft license. I am not working to help them make money while making the world less convenient for me.
> I have to add this feels so awkward because every time there's a thread about AI you'll find someone saying that the fact that data is copy-able renders copyright a thing of the past
It's not weird: I don't want AI to train from my code without permission. BigTech can abuse my licenses because they are too powerful for me to do anything about it. It's just a shameful workaround, and I am hoping that new licenses will come out that explicitly forbid ML training, so that I can update my licenses.
> everyone's like "if you didn't want to get scrapped, shouldn't have posted it on the internet."
I surely don't say that. People who say that have no idea how copyright works, there is nothing worth discussing there.
Often can't contribute either. When I worked at Google, contributing to open source projects was permitted with the right paperwork etc. but there was extra caution around GPL licensed projects, esp V3.
Which to me is more of a sign that the GPL actually works than anything else.
In a corporate context, is there any risk or downside associated with making a specific contribution to GPL code which doesn't also apply to MIT/BSD?
The only downside I can perhaps think of is a strategic one: endorsing the use of GPL in general and contributing to a healthy copyleft ecosystem, which may be disadvantageous to a giant corporate like Google.
For a smaller company, [A]GPL would provide only upsides, especially in terms of protections against freeloaders, and that's why companies are using it.
If you make a contribution to GPL, the entirety of your contribution must be GPL. If you're using some internal library, you must make your library GPL. If your library is GPL, anything that depends on it must be GPL.
For-profit companies don't like sharing and making the community better if it doesn't make them 10x richer, so they don't like GPL.
You can define what your contribution is, right? You can publish any code you like under GPL, with zero further commitments as far as I'm aware. It doesn't have to be working software, it doesn't all have to be licenced the same. The copyright is still yours and you can do what you like. You can sell the software. You can enhance it and keep the enhancements proprietary and secret. You can use and sell the enhanced software without providing source code
The only obligations come if a company (or individual) accepts GPL contributions from outside, because they don't own the full copyright any more and have to obide by the licence of the code they accepted from outside.
I was talking about an internal library as in "a library developed inside My Company that is not made public"; as someone working for My Company, you'd have the responsibility to change the license of said library.
Of course if you're using a library you're not an author of, the library must already be compatible otherwise you just can't use it.
Exactly! As an employee, I don't give a shit about the paperwork needed by my company. What's best for me is to have my code open sourced. If my company is forced to depend on GPL code (because it can't write it from scratch itself), then that's good for me as an employee because it means that my code will have to be published according to the GPL!
Employees should push for copyleft. Whoever owns the code obviously wants the choice to keep it proprietary, but the vast majority of devs do not own their code.
HN, Reddit, and sites alike have an extremely awkward relationship with "content mills."
They're link aggregators, so threads start from links. But nobody reads the linked articles, they only head the "headline." In other words, the headline is the title of the thread, and the comments are a discussion starting from that title.
So what is the linked content? From the user's perspective, the linked article is just another comment. Which for users somehow make sense. The "author" is just an user with a site making a comment on a topic on their own website, while the thread are users without their own websites making comments on the same topic. If a single "comment" is just somebody's opinion, then it's highly likely most "are not worth reading," including the linked article.
So why is the link necessary in first place then? It certainly doesn't feel like it's needed. You could make a social media where to start a new thread you just type the topic and that's enough. We could also have the extreme opposite: we could have a social media where you also just type the topic to start a thread, but all "comments" must be links to articles.
I wonder if there's a social media like that. It would be interesting to compare what the threads look like.
They aren't seeking information. They are seeking drama and attention. A thread has many users (eyeballs) looking at it, talking about things. If it's drama they want they may find it in the comments. If it's attention they want they may engage with the users in the comments like they would be able to in a chat room.
The easiest way to get someone to actually read your hot takes isn't to post it on Twitter where you have no followers but to reply in a tangential and practically non-sequitur way to someone in a thread where there's a lot of eyeballs looking at the comments. You know, exactly the way I'm doing right now.
What exactly am I stealing if I don't take the deal, walk away and then enjoy an AI-generated artwork that just so happens to resemble the thing closely instead? I'd think that stealing requires taking something away from someone, regardless of how hard certain industries try to gaslight me into expanding the definition to protect their business model.
Stop trying to gaslight yourself into thinking what you are doing isn't morally wrong.
If you do not agree with their business model, don't get involved with their business, at all. Your disagreement doesn't give you the right to exploit flaws in their methods to protect their business. Just like the fact you don't want to pay for something doesn't grant you the right to exploit the fact that the laws of physics allow you to just grab something you didn't pay for with your hand and run away with it.
Copyright is the right to copy things. You don't even need to sell it. This is why Wikipedia images are mostly Copyleft images.
Google gets a pass because nobody is suing Google. When people try to sue Google, Google simply stops indexing them and then they start begging Google to infringe their copyright again.
This interpretation of copyright only made sense while the transfer and storage of information was tied to physical objects. That time is long and we dont consider it infringement to remember a media or reproduce it at home. Furthermore, we are now entering an era where the production of information is also being untied from physical objects, so it'll only get worse for copyright. I made a post to diacuss this stuff as I find it interesting right now and want to hear more opinions.
I completely disagree. Tech exceptionalism makes no sense. We should be making technology to ensure people have their rights protected, not to come up with technobabble excuses to pretend such rights don't exist.
Just because people having been posting memes and reposting pictures and comics with cropped credits and pirating stuff that doesn't mean any of this is legal.
Legality isn't about what you can technically do thanks to how the computer works, or how HTTP works, or how the laws of physics work. Legality is just about what is law and what is not.
Redistributing copyrighted works without license has always been illegal. People don't get sued for it all the time because it isn't worth the hassle and most small time copyright holders simply lack the resources to pursuit action against random Internet strangers across the Internet. That doesn't mean they don't have a copyright, they merely chose to not exercise it. And that's not a W for technology. That's literally just more abuse than a person can cope with. It's an L for society. That's like if you started getting so much spam in your e-mail that you gave up marking them as spam. That doesn't make them not spam.
For example, if I wrote something in my blog and someone made a scrapper that reposted it entirely in their website full of stolen posts, I could take legal action against them. For a blog post. For something I wrote on the Internet. That's my right. But imagine how much time I'd have to spend to do this. It would be easier to check if Google has a way to tell someone stole my content and just get them delisted from Google than going through legal channels.
But I'm not talking about legality, I'm talking about what we should make the law to be. Just imagine memory implants become commonplace, shouldn't they be allowed to store copyrighted media you have consumed? If not how do you separate between your natural memory and the artificial one? How is it going to work?
An argument I've seen made in pro of AI in past threads about this is that "scraping is legal."
Yeah, downloading the content of a webpage may be legal, but redistributing it isn't.
I wish people stopped trying to make these things seem more important than they really are just because IT people call them "technologies". Blockchain isn't a technology. HTML isn't a technology. React isn't a technology. And AI is now not a technology.
When I see ChatGPT or OpenAI, I don't think of "technology". I think of a program. Software. Because that's what it is. You don't say "none of the laws that exist in this world apply to this" every time you release new software.
I bet many people can't tell the difference between a quick answer from Google and a text generated by ChatGPT on Bing. They just see the output.
All that amazing capability of generative AI? That got old fast. It was groundbreaking for one instant. Now it's just an app that generates images. Just another piece of software. Nothing special about it.
Torrenting and other p2p file transfer protocols didn't get a pass for inventing groundbreaking ways to break the law. I don't think OpenAI will get a pass for doing the same.
> All that amazing capability of generative AI? That got old fast. It was groundbreaking for one instant. Now it's just an app that generates images. Just another piece of software. Nothing special about it.
Speak for yourself, personally I find it still groundbreaking and while the magic won't last forever, it is and will remain groundbreaking especially considering that technological progress and development will continue way beyond what we have today.
For the love of God will someone please just make a web browser that isn't a web browser and it's just a cross platform multimedia sandbox with a couple of APIs in it, and you can run programs written in rust or something on it, and it doesn't let the programs touch your file system unless it has explicit permission? That would solve 99% of the application use cases. That's literally everything I want. I want the safety of the browser, outside the hell that is web development.