Gpt is the equivalent of the calculator but for words.
You don't expect your calculator to prevent people to make morally wrong calculations like quantities of alcohol in a molotov cocktail or uranium in a nuclear bomb.
Gpt has no more morality than a calculator becauqe that's what it is, and we should not have unrealistic expectations about it.
> Gpt is the equivalent of the calculator but for words.
Calculators are deterministic and necessarily correct. GPT is probabilistic and not necessarily correct. Although I appreciate the comparison as it relates to the non-application of morality, I think it's a generally poor one.
> Calculators are deterministic and necessarily correct. GPT is probabilistic and not necessarily correct.
This isn't really relevant to the issue.
We have a choice.
(a) Technology is subject to the will of each user. If they want to make it do something bad, that's what it does.
(b) Technology is subject to the will of some organization. They try to control what the technology will do.
The first one is clearly better for multiple reasons.
We already have systems (e.g. courts) for punishing people who do sufficiently bad things, which mitigates the harms of the first one.
The alleged good from the second one often isn't realized, because the really bad people (e.g. adversarial foreign governments, major criminal organizations) aren't going to be subject to it or will hack the safeguards.
The imposition of controls comes with a level of mass surveillance that isn't compatible with a free society.
And putting anyone in charge of what everyone else can do or see is a dystopia because there is no one you can trust with that kind of power, for reasons of both incompetence and avarice.
Technology should be designed to distribute power, not concentrate it.
The fact that some people got the idea that math is racist is interesting, I had never heard of this before, and it might be interesting to do some research on this topic.
Now, I'm not at all convinced by the arguments present in the National Review article. I don't know what was Pythagore's color skin and I never thought about that. We also cannot change history and purposely hide the fact that some things in math are European and Greek. Such, we could call theorems by other names, but we'd better check that people feel oppressed / discriminated by this kind of stuff.
And, above all, the fact that it is generally said that zero, some fundamental stuff, was invented by Arabs, and that we call the figures we use themselves the "Arabic numerals" is not at all mentioned. Arabs are not usually exactly considered white. Leaving out such obvious counter argument has to be deliberate or it shows a monumental lack of research or thinking on the matter. So… meh?
And the Fox News article… Meh too? I guess I will let this article and its citation choices ridicule themselves.
He was also inclusive AF. Female Pythagorean philosophers (Miya, Damo, etc), multiethnic Pythagorean philosophers (Abaris), plus, his whole thing was incorporating diverse wisdom from multiple cultural sources— Egyptians, Persians, Babylonians, Jews, Greeks, etc.
He was even inclusive of animals, if you read his vegetarianism.
So, the heart of western math is a pretty solid place to look for modern morality. Just saying. We can’t expect that of the ancients, but Pythagoras really delivers. In 530BC!
His father, Mnesarchus, was a jeweler and trader from Tyre. Source: Neanthes of Cyzicus, historian, 3rd c. B.C referenced in Porphyry’s “Life of Pythagoras”
Thanks. All the sources I've looked at say his ancestry is disputed and a great source of controversy, not surprisingly, so I guess it says different stories in different texts. I don't think your tone of certainty is at all justified.
edit: Porphyry's book begins:
"Many think that Pythagoras was the son of Mnesarchus, but they differ as to the latter's race; some thinking him a Samian, while Neanthes, in the fifth book of his Fables states he was a Syrian, from the city of Tyre."
Interestingly, in the same text, Iamblichus, who studied with Porphyry and seems to have been a devoted Pythagorean, says in his Life of Pythagoras:
"From the family and alliance of this Ancaeus, founder of the colony [of Samos], were therefore descended Pythagoras's parents Mnesarchus and Pythais."
There is so little known for sure about Pythagoras — and yet so much value in his story. The guy is a legend— and due uncertainty gets in the way of a good story.
The more I read about him, the better and better it gets.
Complaints around removing non-white names from theories or teachers pre-judging and sorting students seem valid to me. Are there specific examples that are crazy?
That's terrific I love offensive stuff. I seek out the most offensive memes, my favourite comedians are the most offensive ones. It's on offence that we find an affront to our own sensibilities and there us usually something to learn from that and become more resilient people.
This is bad but I don't think it'll read sympathetically in this venue. I have rarely seen on HN any endorsement of the idea that offensive text is harmful. In fact the general consensus seems to be that finding things offensive is the moral transgression there.
Well “offensive” is a subjective thing. I haven’t been offended by anything I’ve seen chatgpt do. It can produce some outrageous outputs - but it doesn’t cause any offence. Easy for me to say, but I don’t think it should cause offence in others either. It’s basically a random sentence generator… weird to be offended by that.
I see. I call this the “all code is just a really big abacus” argument. Others call it algorithmic reductionism or essentialism, and I will argue for it too in many cases. (I don’t get too bent out of shape about it, even when shallow depth of human thought may have security implications down the line.)
How about generative adversarial networks? Are they just calculators too?
Yes. The same way the best magicians are just using a complex construct of illusions to fool the audience. Or if two children stacked under a trench coat deliver a very, very, very convincing performance of an adult and manage to purchase alcohol, they still don't become an adult.
Spoken like a truly based groyper. :D I understand, yes, all things are composed of atoms, electrons, etc. All computation is achieved through calculation, or to be more precise, processes like execution of instructions and transistor flipping. How is this illuminating for doing anything practical other than circuit design, exactly? And why couldn't my Texas Instruments write me a blog post that fools thousands?
Your calculator can fool thousands, but only because you can fool others, it doesn't mean that it becomes the thing it is pretending to be.
My point was quite limited to saying that you won't get actual intelligence, even if the things that fool us get more and more convincing.
To me all of this is like alchemy or witch brewery. You just don't get gold or magic powers from some weird recipe or combination of non-gold stuff or non-magical stuff.
If it were the case, there would be no society with drugs and polyamory. Yet there are mormons, muslims, alchohol and cigarets.
What you call anti-social, some other group call it life. And vice versa.
A christian taboo or an american indulgence is not a universal construct. The same construct is not event stable throught time and extremely diverse and functioning social configurations have existed along history. Also, there is such thing as one that was so good that it lasted forever. No reference point to consider a standard.
However, they are local norms and ignoring them will cause contextual mismatch. So indeed, an austistic person may fail to appreciate this and only see the arbitrary aspect of it, and cause trouble.
> If it were the case, there would be no society with drugs and polyamory.
There are virtually no societies that embrace drugs and polyamory. Some highly individualistic societies tolerate both in the sense that they condone pursuit of individual satisfaction without regard to social utility. But virtually no society treats those things as virtuous, pro-social behaviors.
> What you call anti-social, some other group call it life.
You can call it “life” (I.e. the pursuit of personal satisfaction) but it’s still anti-social. Using drugs or having multiple partners might feel good to you individually, but it has only negative externalities on society at large. That’s pretty much the definition of anti-social.
> A christian taboo or an american indulgence is not a universal construct.
These rules aren’t “Christian” taboos. Drug use and polyamory are frowned upon across the Middle East, Asia, and Africa. Even within Islam and Mormonism, polygamy is a historical practice that is sometimes tolerated for certain people but downplayed by the mainstream.
Nor are those rules a matter of preference. Quite the opposite: they are nearly universal across diverse societies and cultures because they are rooted in physical, economic, and social realities. In that sense it’s similar to the rules that apply to economic transactions. Most societies discourage or ban various types of financial misconduct because they undermine the trust that enables markets to function. SBF’s financial crimes aren’t bad because some stone tablet says so. They’re bad because such conduct has a negative effect on society at large.
> Using drugs or having multiple partners might feel good to you individually, but it has only negative externalities on society at large. That’s pretty much the definition of anti-social.
Using sweeping terminology to dismiss drugs is problematic. Does your definition of anti-social drugs include legal drugs like alcohol and caffeine, partially illegal drugs like marijuana and psilocybin, etc?
In what way is having multiple partners inherently harmful to society? You are stating these things as if they are self-evident truths, but that is far from the case, such sweeping claims need some pretty hefty backing.
> Drug use and polyamory are frowned upon across the Middle East, Asia, and Africa.
The prevalence of a social reflex is not sufficient to justify it (see: racism). Setting aside the overly broad definition of "drug use", why would such a default state about polyamory be inherently correct, both through history and into the future?
One could speculate that such intuitions are primarily about one's personal notion of right and wrong, and for most folks that includes a deep sense of commitment to their partner. For the monogamist, the very idea that their partner could be participating with other partners is incompatible with their value system, and therefore they would never except that in a partner.
And that's perfectly fine.
But there are arguably social configurations that are perfectly compatible with polyamory. As long as all parties involved are on board, I see no further social harm unless you place particularly high value on procreation.
As it often goes with religious arguments, one need not impose those beliefs on others, nor is the existence of people with other belief systems a problem purely on the basis that they are non-conforming.
Society tends to develop and outgrow its mythology — lots of religious texts contain practices that no modern society would engage in (see: the Old Testament).
Nobody that's actually raised in modern mainstream Hindu society is conditioned to accept drug consumption or polyamory. The only way one might draw a contrary conclusion is if they were from the outside looking in, merely studying the mythology and totally ignoring what modern Hindu society has looked like in the last 100 years leading up to today.
I was raised in an extremely orthodox Hindu household, worshipping all of the Gods of Hinduism. Polyamory/polygamy is unheard of — if anyone in one's local temple engaged in it, they would be the subject of everyone's gossip. Ditto drug use...
Coffee and cigarettes improve productivity not reduce it. Heavy alcohol consumption will get you in trouble, could even get you in jail.
Muslims are not as a rule poly amorous. Only a select few. Mormons are a very very small portion of society.
Through millennia of cultural iteration we have arrived at monogamy and for good reason. You can already see what a society without monogamy is starting to look like. Thanks to Tinder, birth control and degradation of family values you get a lot of single mothers and 'incels' that have little to no incentive to contribute to society and every incentive to play video games and waste their life away. All from the fact that a few man have sex with all the women and society accepts it
To me, the point is that the claim "drugs are bad for society" is a problematic claim. Both from the standpoint that the word "drugs" is poorly defined when in reality there exists a broad spectrum of drugs/effects, and because to your point, the experience of using these drugs is subjective/varied, and can't be considered universally "good" or "bad".
So any transformation thay requires accessing something else than the data must be done in sql? Connecting to a ftp, parsing a yaml file, getting data from a rst api? And then text, date and maths opeartiond also in sql?
Yeah, no.
Sql is good at look up and filtering, but not for linking heterogenous sources and massaging data.
Well, if you work for facebook, ethics is not your priority in the first place.
On the other hand, if I ever decided to throw mine on the toilet and work for a company that manipulate people, and perform mass spying on them, then I would go all the way and just do things like this.
You misunderstood. I gave other examples of good things.
To elaborate, I said “work on removing the negatives”. If you won’t work at fb, others will. But when you work there, you actually have the power to change the place so that they do less of the stuff that you described.
I wouldn’t work for Facebook because I don’t hate myself enough. But I also don’t clutch my pearls and think that any for profit company is feeding starving children.
You can make a negative case for any of the large tech company.
> You can make a negative case for any of the large tech company.
Yes you can, but it's a spectrum. Microsoft abusing their monopolistic position to strangle competition and adding adware and spyware in an OS people pay for is ethically and morally bad, but is much less bad than Facebook profiting from and doing nothing to stop an actual active genocide. Facebook is by far the worst, ethically and morally, offender of the big tech companies not actively involved in the military industrial complex.
> The invisible hand is a metaphor used by the Scottish moral philosopher Adam Smith that describes the unintended greater social impacts brought about by individuals acting in their own self-interests.[1][2] Smith originally mentioned the term in his work Theory of Moral Sentiments in 1759, but it has actually become known from his main work The Wealth of Nations, where the phrase is mentioned only once, in connection with import restrictions.
Can FB even do anything meaningful against "an active genocide"?
It's important to assign some responsibility to those who have/had the ability to prevent it, but it's not clear to me that FB could have prevented it.
In close races like the US presidential election it's plausible that FB was the deciding factor, but places where genocides happen are not known for close races.
And to be clear, it's not like FB couldn't have done a lot more with a lot less money to filter out certain kinds of content, but they intentionally wanted some kind of neutrality, right? And that's probably noble (and the maximally harmless thing) when it comes to - let's say Norwegian politics - but not so great in a lot of other contexts. However engaging in moderation with the intent to prevent social ills is very non-trivial.
To me it looks like they realized they were in a hard place and then basically bailed out from the hard problem and instead went all in on trying to make as much money as they can.
The question is not “how could a social network like Facebook have done any better given small tweaks to content moderation?” It’s “is Facebook fundamentally designed to create these kinds of misinformation bubbles?”
That second question is much more painful to ask if you’re an engineer at a company like this, because it means there’s no changing it from within.
but it's also probably false with a likelihood of at least 99%
Facebook is designed fundamentally to be a social graph, a representation of people's lives, blablabla. the more time people spend representing their lives on FB, the more attached they are to their online persona/profile/connections (and the dopamine rewards through likes and engagement), the more money it makes.
misinformation bubble? who cares. if that is what people want to represent, FB provides it, sure, but it's not what it is designed for.
Am I alone in thinking even its Chrome implementation is a massive security risk? The fact that users can grant any webpage COMPLETE control of a USB attached device is astonishing. Live webpages shouldn't be able to access this feature - can't wait for fake jailbreak and backup services to start cropping up.
It's an incredibly bad idea, at work for the one Chromium browser we permit (Edge), we have to use policies to block this and several dozen major security vulnerabilities that exist solely because they make cool Google I/O demos.
Why is it a security vulnerability? I really want WebUSB to succeed, it could be a cross platform way to eliminate random executables from shady websites.
The idea is that your browser can mediate and scope access to specific devices. There are some edge cases where Web USB is equally as dangerous as the status quo, but in the common case it is far better and never worse.
The situation today is you buy a random USB gadget (e.g. a fitness tracker), but you can't use it without also installing the accompanying software/drivers. That effectively gives the manufacturer complete control of your computer. All you really wanted was for them to sync your step count, but you have no option but to give them complete remote access to your computer.
With Web USB you can allow vendor.com to access device 1234:5678 only, and revoke that access whenever you like.
Sure, maybe you could be tricked into clicking through all the confirmations and granting https://fakevendor.com access to a device. That could be bad - but no worse (and probably a lot better) than being tricked into downloading and running fakedriver.exe.
(disclaimer: I work for Google, have nothing to do with Chrome)
It's crucially important that Googlers are divorced of the belief a permission popup on the top of the screen is adequate indication of intent/informed consent. People approve these all the time without understanding what it's for.
Installing software is, at minimum, a very distinct action which users are aware of doing. Generally, they install a limited number of applications for specific purposes, whereas they may visit literally thousands of websites a month. Pretending these two things can be interchangeable is silly.
I am not entirely opposed to being able to use a browser as the UI for an activity like
this, but it should require a higher bar to activate it for a specific server to talk to a specific device. Even web extension installs remain far too easy to not be maliciously abused widely. (Chrome extensions remain the primary malware I see in the wild.)
EDIT: The HN gods have me rate limited so hopefully you'll see my response here to the below comment:
Installing software is a complex process. It entails navigating to the correct site, locating a download, fishing it out of the downloads bar (many seniors cannot find this, by the way, it absolutely baffles them), opening it, usually acknowledging that you know it's an executable program, and then navigating the install wizard.
A software engineer would reasonably believe simplifying this is a good thing, but as noted, people regularly accept malware into their browser and do not even consciously realize they did it because it involves a single click.
People absolutely get misled into installing bad software, but they always know they actually did it, it's impossible to follow that chain without having some idea you're doing something.
Accepting malware isn't the answer, understanding people is. There is no technical solution for security, because it's a human problem.
Why is installing software a distinct action, but granting device access not?
Malware is a huge ongoing problem, which suggests this distinction doesn't really exist.
I think we have to accept that there is no way to perfectly eliminate social engineering without also locking down legitimate access to devices. There will be some percentage of users who will click through all the warnings and confirmation prompts, just like there is some percentage of users that will run malware. That's bad, but you're letting the perfect be the enemy of the good.
Your argument could also apply to ssh, a small number of users could be socially engineered into sharing their id_rsa. This happens, we often find them checked into github, for example. Does this mean we should go back to telnet? No, for the vast majority of cases ssh is a huge imperfect improvement.
Likewise, in the vast majority of cases, Web USB is a huge imperfect improvement over installing drivers.
So the issue is we are talking about different dimensions of improvement. I concede that WebUSB is better sandboxed than executing a driver installer (likely running as admin or root) in terms of the blast radius. However, WebUSB is catastrophically worse than an installer in terms of the ability of the infection to occur in the first place. Both because of the aforementioned difficulty of user process of software installation, as well as the additional checks the OS and/or third party antivirus does, as opposed to Google's fairly limited abuse detection capabilities (just Safe Browsing in WebUSB's case, I imagine?).
This is a problem I have talked about many times before regarding Google's security outlook. On Project Zero there's a ton of interesting and surely exciting work into novel ways to compromise systems. ...That work has basically no bearing on improving security for the billions of users who will never be targeted in such a niche technical way.
Real world compromise tends to just be social engineering people into doing what Google explicitly permits websites to do. You could remove malicious activity from a billion users right now by simply... deleting the Notifications API from Chrome, which is principally used to spam ads. Because people mash that allow button all the time, every time.
I'd best guess I see ten times the malware in Chrome (either hijacker extensions delivered by the Chrome Web Store, push notifications from random adult websites, or both) than actual installed malicious software on a given Windows machine.
And this is fixable! Google could fix this with WebUSB and make a net positive all around! Likely by redesigning permission granting in the browser to require deeper user intent. But it would require a fundamental change in how Google understands and perceives security (and it'd likely reduce engagement stats for some features, which various teams would fight), and I've been beating this drum for several years and I don't really expect it to change.
(In fact, one specific change I could recommend: I think APIs like WebUSB, as well as the Notifications API and similar, should probably be completely blocked unless you install a PWA. It's not as much process as a Windows software install, but it's a clear gate to allowing a site more ability, and installing and removing apps is a far easier concept to explain to users than navigating the site privacy settings.)
I think I need to see some data to back up your claim that Web USB makes socially engineering "catastrophically worse". Web USB is deployed today for a billion users, and yet attackers still seem to prefer malware or walking victims through installing TeamViewer, correct?
We're not talking about any vulnerability here, this is social engineering. There is no amount of confirmation that can be required or warnings added that a confidence trickster cannot walk you through dismissing. The only solution is to limit what you're allowed to do with your own computer.
Ah, but before they got tricked into TeamViewer, they were likely compromised once or twice over by Google: It's likely the link to the scammer's screen came from a Google ad that directed a user to a browser hijacking web extension, all of which has roughly the same level of difficulty as WebUSB. Then after that, a scammer may talk them through the process of downloading a RAT. (Though TeamViewer has not been popular for this in a while because they are responsive to security reports. There are some overseas-based tools which have taken over exclusively in the last few years because the developer doesn't answer their email.)
WebUSB is new, non-standard, of course, and last time I tried it required feature flagging (it's saving grace... at the time). Compromises through extensions are probably more likely for a while, but WebUSB will probably be more exciting for persistence, considering you could flash an entire hardware device with malicious code, that the user has already demonstrated comfort connecting back to their PC.
Do you think you might have argued against the internet when it was being deployed?
It sure opened the door to a lot of scams, and was far from a perfect solution. Yet it does seem to have had a net positive effect. Maybe that can be true of other technologies sometimes :)
Let's leave it there, I don't think there's anything else to add.
It depends on your threat model. “A trusted party ships high-quality drivers” is a good model but bundling it with the browser, where you run all sorts of code from third parties, can be difficult from the perspective of exposed attack surface. I would expect that someone in the position that ‘ocdtrekkie probably blocks installing random third-party drivers on those machines anyways, so now there’s new a way for websites to do funny things to connected devices at best and pwn your computer because the high-quality USB implementation wasn’t that high quality after all. (I’m putting aside the conversation about phishing people into granting those permissions, because that’s a completely different, difficult discussion.) Also,
> disclaimer: I work for Google, have nothing to do with Chrome
> pwn your computer because the high-quality USB implementation wasn’t that high quality after all.
You have to compare it to the options we have available today, not an implausibly perfect implementation that doesn't exist.
Let's imagine there is some bug that means if I grant access to a device, then more access than intended is actually granted. That sounds bad, but let's compare that to the non-Web USB model, where you have no option but granting unlimited unrestricted access to everything... now it doesn't sound so bad :)
Isn't "if you can find an 0day exploitable bug you can get access to everything" better than "You don't need a bug, because you already have access to everything"?
I think we're talking past each other. If the two alternatives are "I need to use a random native USB driver to talk to this" and "I can use WebUSB" then WebUSB is probably better. But in reality a lot of devices actually already have drivers for that class in the OS, or there's a way to write some sort of restricted driver on that platform doesn't require loading things into the kernel. In that case I'm now using a browser where random websites can either trick me into giving them access to my USB devices with a click, or forcefully access them via an exploit on a surface that is generally amenable to such things. Put another way, I see WebUSB as being an attempt at writing userspace USB drivers by doing it in Chrome instead of the OS, and considering the entire point of using Chrome is so people can run code on your device it might be better to actually not put this capability here.
> Umm, I know what I work on?
As do I, and it would probably be more accurate to write "I work for Google, but not on Chrome".
> But in reality a lot of devices actually already have drivers for that class in the OS
Great, then you don't need to install anything or use Web USB, it's a no-op!
Still, until we can get Microsoft to ship every driver for every device, we still need a solution that works today.
> In that case I'm now using a browser where random websites can either trick me into giving them access to my USB devices with a click,
You can already be tricked into granting complete access to your machine with a few clicks, that's malware. It's a huge ongoing problem that can only be solved by limiting the ability to run third party code. That's a really high price to pay.
Sure, you could be socially engineered into granting an attacker access to a USB device. The only solution is to have no way for you to grant access to USB devices. There is no amount of confirmation or warning you couldn't be tricked into dismissing by a social engineer.
You will also need to uninstall Remote Desktop and OpenSSH, because you could also be socially engineered into configuring them to allow access. It's a common scam to trick people into downloading TeamViewer, so we will also need to remove your Administrator access and setup AppLocker with a strict policy.
> or forcefully access them via an exploit on a surface that is generally amenable to such things
That's not how it works. When a vulnerability is described as "arbitrary code execution", that means the code can do anything, not just access functionality that exists in the browser. If you were to use a browser without WebUSB support, an arbitrary code execution exploit would still be able to interact with USB devices.
The only added complexity here is after you've granted access to a device, otherwise the attack surface is entirely tractable.
This is a technical view, not a human-centric view. There is absolutely a level of warnings that will generally work. Not always, but I've found a number of people in the process of being socially engineered trip up on the UAC prompt and become more suspicious, to the point of booting a scammer out of their PC... and calling me. Likely because of the full-screen effect design and the short, but relatively scary language of the prompt.
You've posited effectively that if we cannot stop people from compromising their computer we should not bother to try. Either let them be owned with a trivial popup and a single press, or remove their agency entirely.
However, a better approach to security would be to take responsibility for designs that allow easy compromise, and build systems designed to drastically reduce the likelihood a user compromises their machines.
We can't stop people from finding a shady installer for a driver on a file sharing site hosted in Russia and running it, but we can make 99% of people less likely to do it with good design.
Web USB can realistically improve security for billions of people globally. It will improve security for me and my family, and we're all humans.
Sure, it's not a magic a wand that solves all problems, or makes malware disappear. I wish it did, but the fact that it doesn't is not a good reason to reject it.
It's deployed to billions of people globally, can you show me any evidence at all that there is any Web USB social engineering happening?
Immediately after WebUSB shipped in Chrome: "security researchers Markus Vervier and Michele Orrù detailed a method that exploits a new and obscure feature of Google's Chrome browser to potentially bypass the account protections of any victim using the Yubikey Neo".
The fact that fishing (and fingerprinting etc.) isn't reported widely doesn't mean it doesn't happen. After all you trust Chrome to properly implement everything and take care of things. And yet here's an example of a different hardware standard, WebMIDI: https://twitter.com/denschub/status/1582730985778556931 (note the comment: "Chrome still allows web developers to enumerate attached MIDI devices without user consent or even a notification")
The attack here was that if you get tricked into giving a phishing site your password and Web USB access to your U2F key and then you press your U2F key, then the attacker can bypass the 2FA. I highly doubt this ever happened in real life, it was just a proof of concept.
In my opinion, the Chrome team overreacted and blocked all WebUSB access to any U2F/HID device.
Now if you want to update the firmware or configure your key you need to download an .exe and run it instead, which seems unfortunate to me.
If the phisher had said "Your U2F firmware is out of date, please download and run this update to continue", would that have been a vulnerability? That could also bypass 2FA (or anything else, for that matter).
That is a trivial phishing path. In fact, the phishing site could easily justify that process as being required for security! "We need access to your YubiKey to use it to sign you in" seems extremely plausible.
I think it might be session, but the issue is that most users simply accept permission popups, often without consciously recognizing they did. I've cleaned out the notifications permissions on browsers for dozens of people; all of them denied allowing various websites to spam them with notifications.
