I know it's not very nice to post that here, but given it's hard to get good info about python because the ecosystem is so huge, I'd rather give it straight:
Pex doesn't work on windows, is slower than shiv and shiv solves the resource files problem that you will encounter with dependencies like django. To achieve this, shiv unzips the whole zipapp in a cache on disk and create a transparent proxy to it.
Still, I wish zipapps had better tooling honestly. Using either pex or shiv is more complex than it needs to be.
I hope uv will eventually give you something like "uv zipapp" and make it good and simple.
Right now, to bundle all deps for shiv you have to download first all wheels, then figure out the proper incantation to include them. And if you use WSGI, you probably want some kind of dedicated entry point.
The tech is cool, but it deserves maturing to be a true ".war for python".
FWIW, pex now also has options to unzip the archive to a cache directory on startup (I believe this happens by default now, but am not at a computer to confirm), to side step the zipapp limitations that you reference.
While we're posting not-nice things, I'll throw my current favorite out: pipx ( https://github.com/pypa/pipx ). I use Python's Poetry to build a wheel and then pipx to install it. Super-easy, barely an inconvenience :)
I'm not a pipx expert (I'm a "I got it to work for my use case and then stopped" person :) ) but I was able to get my project working after installing a local wheel file (so i don't think you need access to the Internet to install things).
I thought the wheel file has all the dependencies since (my understanding of) pipx uses a venv for each individual wheel file/app. Certainly I'm using a bunch of packages that I needed to pip install into my development environment, but it's entirely possible that my pipx-managed wheels are using those installs, too.
I think the last two points are accurate, and I've never tried to use APIs like wsgi with it.
Also pipx isn't reproducible - it re-resolves dependencies so you may end up with different versions over time or in different places, eventually causing something to break.
If you have a shiv working it stays working, assuming you have a solution to distribute the required interpreter version.
In the early 2000’s open source hubris, next year was always the year of the Linux desktop. Since then consumer windows matured into a totally ok OS and one with the best support for graphics and C++ development at that.
Non-windows support nowadays is a fairly strong signal of a non-serious software offering if there is no obvious reason for it. And that’s totally fine, hobby tools developed by enthusiasts rock - but they are not industrial in scope as such.
A lot of serious software offerings are only concerned with the server use case, modern servers run Linux unless there's a good reason not to, and modern windows has more than one acceptable way to run Linux binaries if you absolutely have to.
> modern servers run Linux unless there's a good reason not to
I think many people on HN would be surprised at how many orgs are using Windows servers heavily, because of their familiarity and comfort with Microsoft, or because some application requires it.
Of course they are non-tech companies using the servers internally for enterprise applications, not web servers, but there is absolutely a lot of windows server usage in corporate environments.
> I think many people on HN would be surprised at how many orgs are using Windows servers heavily, because of their familiarity and comfort with Microsoft, or because some application requires it.
I think most HN readers are well aware that there are a lot of Windows servers out there, especially in the sorts of environments where it's "The Server".
That doesn't change the fact that there are orders of magnitude more Linux servers in the world, and as the post you replied to said Linux is the default assumption. Basically every container and the vast majority of VM guests are Linux. I'd be willing to bet that more Linux servers have been deployed in the time it took me to type this post than Windows servers will be deployed this week.
I'm not trying to make the point that there is a comparable number of Windows servers to Linux servers, and I believe that going off "number of servers" is of limited usefulness. There are of course going to be far more Linux servers because they are far easier to provision, and the people managing them are generally going to be much more apt at orchestrating large fleets of small servers than the people managing Windows servers, which will tend towards larger servers with multiple purposes.
I'm simply trying to say that Linux is not the default assumption in many contexts where a lot of money gets spent on licenses and services for server software.
There are of course large contexts (tech companies and web servers) where Linux is the default assumption.
It would today, because macos requires signing, and windows has "the mark of the web".
They don't apply to scripts, so Python is fine, but they do apply to executables.
Having to sign your zip every time you produce it would nullify the benefit of the concept. And because the checksum of the executable file change according to the content of the zip, you can't just sign the cosmopolitan part.
- The underlying python code cannot use open() to access its own resources, but must use pkg_resources, and most packages on pypi don't do that because most dev don't even know it exists or what problem is soves.
- _ _ file _ _ is not available, breaking a lot of things. zip_safe is a build option, but actual compliance to it is hard work and rare.
I was thinking more along the lines of using namespaces and FUSE. I'm aware that Python kinda treats them like folders transparently, but not completely for reasons (and more) that you described.
A 2016 comparison by the developer of WinFsp says WinFsp is several times faster in performance tests [1]. According to the readme for Donaky [2], since then Dokany got faster.
> you don't need a banner even of you do track users for anybody with DNT
This is not true. The specific text of the law requires that websites have to provide details about their cookies, and then document and store user preferences.
If you just honored the DNT, you would still be out of compliance.
I'm with @belval on this one, it's ok to prioritize github, but people that want the standard to implement an alternative should not feel like they are doing something that may not be supported.
Again, to be clear: the standard does not stipulate GitHub or any other specific identity providers. The plan is to enable GitLab and the other Trusted Publisher providers in short order.
This is exactly the same as Trusted Publishing, where people accused the feature of being a MSFT trojan horse because GitHub was enabled first. I think it would behoove everybody to assume the best intentions here and remember that the goal is to secure the most people by default.
It's said explicitly in the second sentence in the usage docs[1].
> Attestations are currently only supported when uploading with Trusted Publishing, and currently only with GitHub-based Trusted Publishers. Support for other Trusted Publishers is planned. See #17001 for additional information.
At this point it should be fairly obvious that if you have to defend the phrasing in multiple threads here on HN, get some folks to help rephrase the current document instead so you can comment with "we updated the text to make it clear this is a first pass and more options are getting added to the doc soon".
If you draw an ugly cat, and someone tells you it's ugly, it doesn't matter how much you insist that it isn't, and the same is true for docs. It doesn't matter what your intention was: if people keep falling over the same phrasing, just rephrase it. You're not your writing, it's just text to help support your product, and if that text is causing problems just change it (with the help of some reviewers, because it's clear you think this is phrased well enough, but you're not the target audience for this document, and the target audience is complaining).
Anyone can run an OIDC system if they want. But PyPI is not under an obligation to trust an OIDC provider running on a random rpi3 in your basement. More than that, GitHub is "trusted" because we can be pretty sure they have an on-call staff to handle incidents, that they can reliably say "This token was provided on behalf of this user at this time for this build", etc.
Even if you standardized the more technical parts like OIDC claim metadata (which is 100% provider specific), it wouldn't really change the thrust of any of this — PyPI is literally trusting the publisher in a social sense, not in some "They comply with RFC standards and therefore I can plug in my random favorite thing" sense.
This whole discussion is basically a non-issue, IMO. If you want to publish stuff from your super-duper-secret underground airgapped base buried a mile underneath the Himalayas, you can use an API token like you have been able to. It will be far less hassle than running your own OIDC solution for this stuff.
Please improve your reading comprehension. I swear, this website is embarassing sometimes. You can still do this with an API Token. You can upload from a C64 with an API token. What you cannot do is run some random OIDC provider on your random useless domain and have PyPI magically respect it and include as part of the Trusted Publishers program. There is no point in it, because the program itself is constrained by design because it only provides any benefit at "large scale." Your random dumb server providing a login for you alone does not provide any benefits over you just using an API Token.
Any pathway to provide trusted attestations for random individual Hacker News users like yourself will, in fact, require a different design.
I always ask the robocalls to say something specific.
It finally worked the other day! A robot repeated "chrysanthemum" back to me when asked. Sadly it seemed to be limited to this one single trick; as I continued my attempts to exploit it, it abruptly apologized and ended the call.
Cute, but one day I am going to get lucky and a scammer is going to get absolutely wrecked.
Chrysanthemum is also my go to. That or “You’re in a desert. You’re walking along in the sand when all of a sudden.. you look down and see a tortoise..”
It would seem to me that it's a lot easier to build an AI that acts as a non-tech-savvy granny to keep scammers busy, than one that actually successfully executes a complete scam from start to finish on a real life person.
I'm already surprised that they are not looking at the number, realizing that pilots cost much less to train than planes to build, and draw conclusions from there. The army has been more cynical in the past.
As usual, the problem with this is that it assumes a way to perfectly identify somebody on the internet, which in turns mean a way to perfectly identify, in real time, somebody carrying permanently a tracking device with GPS, microphone and camera.
It's crazy that all the things we considered the worst of dystopia in the 80's, thinking nobody would be stupid enough to do, and that those societies in SF books were only distant fictions, are things we are actively seeking now.
Things like "Find my" and "air tags" are already beloved my millions, people use it to track loved ones and they swear by it. Even very intelligent, educated people.
There is such a cognitive dissonance between people swearing the last election meant a likely dictatorship and the same people setting up a tech rope around their necks in case a dictatorship does happen.
My now-dead Jewish grandfather met my grandmother during the French occupation because she was making fake papers. He would be horrified if he knew what we are doing right now with our data.
My German ex was born in East Germany, 11 years before the fall of the Berlin Wall. She thinks people are mad to believe that tracking is not going to be abused.
SocMed / AdTech cos. can already ID and target users with precision. Knowing someone's pregnant before their family does, per the canonical example from 2012.[1]
Impose an insanely steep tax (say, 10,000%) on all ads revenue tied to underage individuals.
Now it's possible to pursue the Al Capone prosecution: tax fraud.
SocMed cos. will avoid anyone underage like the plauge.
Given my experience with ads today is that they frequently get my gender, language, nationality, and country of residence wrong (and in mutually incompatible ways), I suspect that the famous pregnancy story was dumb luck rather than a reflection of quality.
But yes, the Al Capone solution seems like it would work.
I don't mind them having a positive ROI. I do mind them spying on me and my children, even if they draw incorrect conclusions about what ads interest us.
Simply being positive does not mean it is ideal. Accepting the first approach that delivers a positive result could mean you miss out on other even better opportunities.
> SocMed / AdTech cos. can already ID and target users with precision.
Not reliably so, and not people who are deliberately trying to fake the system.
Looking at the ads FB are showing me, they are not well targetted at all. I can see an add about AI in education that seems to be aimed at teachers (not a teacher), one from a charity aimed at people with spare rooms that could be used to accommodate human trafficking survivors (I do not have a spare room), a summer school for kids who might do a history related subject at university (that one is well targetted), one advertising admin jobs at British intelligence agencies (I only just meet security requirements and I do not have relevant experience). I get shown multiple ads aimed at Muslims (I am not a Muslim). In the past I have been shown ads for Judaism GCSE courses (not Jewish either, and my kids did not do any religion GCSEs).
As a counter to this: advertisers not knowing how to use the targeting options available to them != the platform can't target well.
Saying that though, it does seem like as soon as I click one advert (either out of curiosity, or to waste obvious scam advertisers budget), I'm suddenly inundated with similar adverts.
Worse I've clicked an ad, bought a product and still seen adverts for the same product from the vendor after the fact. I'm pretty sure there are ways for vendors to preclude such wasteful ad spend.
> As a counter to this: advertisers not knowing how to use the targeting options available to them != the platform can't target well.
Also, it's not like the platform is going to give advertisers access to its full capabilities. For one, they don't need to - they only need to sell the minimum it takes to keep the advertisers on board. Two, they wouldn't want some clever advertisers to extract juicy data indirectly and cut out the middleman.
And yet Netflix, Amazon, etc recommend movies and shows I’ve watched in the last 6 months. They literally know who I am and what I’ve watched and can’t/won’t build a basic recommendation engine that includes “don’t recommend things watched in the last X months”.
Maybe there’s a reason they want me to rewatch things, but I find it extremely annoying to have the first rows of recommendations be things I watched recently.
This might make sense given the priors. e.g. someone who's hasn't watched Star Wars in the past 6 months might be less likely to watch and enjoy Star Wars than someone who's already watched Star Wars in the past 6 months.
Exactly, if cigarettes were currently available at any age, and it was proposed to be limited to 18+, you'd get people in here decrying the law, saying it's completely unworkable to prevent absolutely every under age person ever from consuming tobacco, and therefore we shouldn't limit it at all.
It's a very technical misunderstanding of how law works, or the effects law have on society. Legality isn't technicality. Something being physically possible doesn't "break" the law, and breaking a law doesn't render that law useless.
> Something being physically possible doesn't "break" the law, and breaking a law doesn't render that law useless.
No, but the ease of breaking the law does need to be weighed against the costs it imposes on everyone else. Carrying a driver's license is almost a non-cost, and is really only necessary til people hit 28 or so and cashiers largely stop checking.
Needing to verify age online could place very real costs on people. Enabling surveillance is an issue. The chilling effect of knowing that database leaks are going to tie your real identity to your online one is an issue (think the Ashley Madison leaks, but for your old angsty teenager Reddit account). There are a lot of small groups who don't want their membership revealed, like LGBT people in countries with laws against it, domestic abuse victims, support groups for people with trauma, etc, etc.
I don't think I've seen a system that doesn't involve those issues. I'm sure one is hypothetically possible, but that never seems to be a goal of these laws.
So the question is whether restricting social media use by age is worth those drawbacks. My personal values say it's not, but I do recognize that's a value call to some degree and views will differ.
You can make social media illegal for under 16s without requiring online age validation.
After all, a form of this already exists with the US COPPA [1] law, and the presence of that law hasn't forced age validation on everyone.
If the US can make it de-facto illegal for companies to let under 13s use social media, and has been the case for over 20 years, then it shouldn't be a sudden privacy-ending problem for Australia to make it illegal for under 16s to use social media.
Kids get around COPPA all the time. Everyone in my kid's middle school knows that you have to simply lie about your age when you sign up for an Internet service, because most of them won't let you in if you are stupid enough to say you are under 13, and the services that let you in are nerfed to the point of uselessness.
Furthermore, now I have to navigate the morality of encouraging my own kid to lie, just so she can use an online service that I approve of as a parent. Terrible law.
Also we have to consider that gov spying programs are developed everywhere in the world, and the fact CP has been used as an excuse to pass questionable bills again and again.
What's even crazier is that we have to even argue this is a problem.
And that intelligent people are arguing that this is all OK. People that read history books, saw PRISM and Snowden, heard about cops abusing their system already, etc.
> If it becomes commonplace, the iPhone could vouch for you about your age, without disclosing your identity.
No, it really couldn't. If it can't disclose your identity, then there's no mechanism to revoke a compromised or cloned identifier, and no ability to demonstrate in court that you performed the necessary diligence correctly.
Age verification systems must, inherently, either produce a secure proof of age with no genuine anonymity, or a chocolate teapot highly insecure proof of age that's no better than a "I am over 18" tickbox that isn't going to protect websites in court from these clumsy laws.
Eh, companies would probably be permitted to keep using the systems since "it's the industry standard, there's nothing more we could've done", and it would just become another instance of regulatory capture.
See, e.g., the GDPR, which as written has strong language against storing data, but as applied is riddled with 'reasonable' exceptions that have never been tested in court. It's like Schrödinger's regulation, it's both incredibly restrictive and trivial to comply with (unless you're Super Evil™) at the same time, somehow.
The problem is, what is "it"? Are applications like WhatsApp and iMessage social media? They seem to be significant sources of teenage angst but they are also incredibly useful tools. What about Hacker News? Is it social media?
> As usual, the problem with this is that it assumes a way to perfectly identify somebody on the internet, which in turns mean a way to perfectly identify, in real time, somebody carrying permanently a tracking device with GPS, microphone and camera.
It's Australia, who often rank very low for a western country on human rights.
While trying to introduce laws to weaken encryption an ex Australia prime minister famously said:
> "The laws of mathematics are very commendable, but the only law that applies in Australia is the law of Australia" Malcolm Turnbull.
What's crazy the west look at places such as China as dystopian with the great firewall etc, it appears China was just ahead of the game.
Australia is probably the easiest place to introduce a system to block social media, a experimentation ground for five eyes. Easy to push things through, protesting isn't an Australian pass time, not that big of a country, not that small of a country.
Not that I agreed with the person for doing it, but people got arrested for protesting lockdowns on social media over Facebook. I remember seeing a video of a self-proclaimed pregnant woman being handcuffed. I cant imagine why nobody protests in Australia, assuming this is the normal government response.
Australia has been a petri dish for the testing of totalitarian-authoritarian policies and populist dogma since its inception as a nation.
Never forget that the Western worlds first, most successful racist genocide occurred in Australia, and the same racist reasoning that allowed it to maintain White Australia policies into the 80's are still being used to justify the slaughter of innocent human beings all over the world.
When the USA wants something dirty done, in yet another illegal war, Australia is ready with hat in hand, willful and subservient, to commit yet more crimes against humanity and get away with it.
Australia is where the apparatus designed, with intent, to massively violate the human rights of over a billion human beings currently operates, at insane scales, every second of the day. Australians are fine with it.
There is no sane discussion to be had around the "stolen generation" (I don't believe it was white, they were black) due to the mass misinformation that exists, the situation is muddy and complex where the facts simply don't meet reality.
(EDIT: please look at the URL, which includes the anchor directly to the section on the "White Stolen Generation" - for some reason when following the URL through HN, the jump to the anchor for that section is not followed, giving the impression that there is no "White Stolen Generation" section on the given website, when .. indeed .. there is.)
Those who don't want to confront this painful aspect of Australia's terrible history tend to want to muddy the waters, but those of us who actually suffered under the forced human trafficking regime that was official Australian government policy see things a lot more clearly...
No, it was not an unfortunate typo. You have merely not bothered to take anything more than a superficial glance at the details.
Please, before you rush to be right about something you know nothing about, try a simple google search, at least - especially for such a subject where some of us were victimized by our own governments.
The link given goes directly to the section on the White Stolen Generation:
Did you know that in Australia there is another stolen generation, one which shares the pain and consequences? It's called the "white stolen generation" to distinguish it from the Aboriginal stolen generation.
In the five decades up to 1982, the newborn babies of young, single women were forcibly removed from them for adoption, a practice sometimes called 'baby farming'. Mothers were drugged, tethered to beds, not allowed to see their babies, told they were dead. [54] Many of these adoptions occurred after the mothers were sent away by their families due to the stigma associated with being pregnant and unmarried.
More than 250,000 white mothers lost their babies to forcible removal at birth by these past illegal adoption practices. Groups such as Adoption Loss Adult Support and Apology Alliance offer help and support.
Between 2010 and 2012 apologies were offered by Western Australia, South Australia, ACT, New South Wales, Victoria and Tasmania. Prime Minister Julia Gillard offered a national apology to those affected by forced adoptions in 2013.
Apologies, when I open the link it takes me to the top of the page on mobile which says “A guide to Australia's Stolen Generations
Read why Aboriginal children were stolen from their families, where they were taken and what happened to them.”
I don’t have a dog in this fight and know very little about this piece of history, so I am bowing out. I did think it was legitimately a typo
Many people in Australia know people that were affected by such policies .. but wait, there's even another third "stolen generation" in Australia aside from the Aboriginal kids (whom I know a number of) and the single mother kids (of whom I know a number of) .. the post WWII UK orphan kids sent to Australia for their health a better life.
That didn't turn out well thanks to kiddy fiddling "Christian Brothers" at multiple institutes across Australia who worked their way through literal boatloads of children.
Clontarf Boys Town, Castledare, Bindoon, and several other sites in this state alone were the subject of a massive nation wide Royal Commission into child abuse.
No, the tracking is irrelevant. The important point is to establish a shared cultural norm.
In the US, children under 13 are usually forbidden from having online accounts. Do some kids lie? For sure, but the sites will try to ban those accounts.
In practice, this legislation would be very positive because it would establish the expectation that young teens _are not on social media_. This only works if it's national legislation: No kid will feel left out because his/her friends are on SnapGramTok. They are all banned. They can be mad at the unfair government/adults together.
This would need to be ban on specific blocklisted companies and services which might be a good thing because alternatives might arise that could try to do their best to not end up on the blocklist.
The government, and big tech companies, don’t need air tags or “find me” to track almost everyone, they have a mobile phone constantly chatting with local towers.
I don’t understand what is dystopian about knowing where I left my keys, and seeing how my wife’s commute home is doing without phoning her while she is driving, assuming we always both have mobile phones.
As you immerse yourself in technology, you hand over privacy, signals to act, and the framing of reality to an adversarial third party. It is an adversarial relationship as corporations and governments are not interested in your well being (if they appear to this is merely the 'candy' to draw you in) - they are interested in divesting you from your resources (time, money). If they are able to intermediate reality for us, the very means to experience a natural/unmanipulated mode of existence will be no longer be available.
What does any of that have to do with having “find my” enabled for my wife, as opposed to just owning an iPhone or android phone, which at this point almost all adults have, and give all their location data to billion dollar multinational corporations?
I think the difference is between cheering on the loss of privacy and recognising the loss.
The loss of privacy was something that was totally foreseeable (by me, at least) but embraced by the general population. The general embrace has meant that we all operate within a panopticon-like system - this itself modifies behaviour. No alternative choices are available - as a collective all have to 'follow the herd', with phones etc being essential to modern existence, despite the privacy reservations felt by many.
I'm taking the opportunity to express the idea that it is possible to find appeal in this or that tech feature and to lose sight of the broader ramifications. Each incremental change can be justified (no batteries makes my phone slimmer, 'finding my' is useful, its good to know my blood pressure, etc) but to imagine that the rollout of these features is a natural unfolding of reality without preordained end goal (technocratic governance) is naive.
Technocratic governance is not a goal that anyone would accept if it was proposed in a straightforward way - hence the duplicity, incrementalism, destruction of existing institutions, etc.
"The dystopian bit is the corporation having this data."
I find data collection and tracking disconcerting not because I'm doing anything nefarious, unlawful or something I'm ashamed of—my life is pretty boring and uninteresting—but because it has the effect of reducing one's autonomy. If one knows one's data is monitored and one is being tracked then one acts differently. For some, they'll make minor changes in behavior, for others a lot. Even for those who've no idea about others tracking or collecting data about them there's the broader issue of how society ought to be conducted. That's a very big issue I can't address here.
Of course, the authoritarians amongst us would argue that monitoring is good thing as people won't be tempted to misbehave, commit crimes and such. I'd answer that by saying those who've nefarious intent will find ways of circumventing the surveillance so the net effect on society is negative as the 'innocent' are the onrs who are targeted without a good or just reason.
Right, pretty much everyone has a mobile phone. What has truly surprised me is how many people are prepared to trade data and being surveiled for convenience. I often wonder if they make such conscious decisions knowing the full implications of that surveillance. I suspect most do not.
Having a mobile phone it's inevitable I will be tracked by multiple entities from government to Google. My response is governed by how much I am prepared to trade privacy and autonomy for convenience and I reckon that's a large amount. Not having Google account and killing and or removing all Google services goes some considerable way but I'm under no illusion that Big Tech is still tracking me. That said, the info colllected wouldn't hold much value.
Right, I'm aware of that. In fact my phones are tighter than I mentioned. First, I've a number of phones, the one for calls is a feature/flip phone sans internet access. The others are internet-only smartphones and they're with a different ISP (I've multiple smartphones because I'm always mucking with the O/Ses and I must have at least one working). They're rooted and run either LineageOS or their native Android stripped of manufacturer bloatware and all Google stuff. Even then they always run with a firewall enabled, and the active apps are mostly from F-droid.
WiFi is set to only reconnect manually and mobile data is off until needed. There's lots of other protections too such as no Chrome browser and JS is turned off by default on the browsers (I've three different browsers set for different jobs, none keep cookies between sessions). With ad protection and JS off I never see ads. I've no social media accounts, HN is pretty much it—and you can hardly call it social media. YouTube is viewed through NewPipe and so on.
That's pretty tight. But it's easy for me because I've no need of social media and such. Right, my ISP can track me but I'm not in the drug trade or espionage so that's pretty irrelevant.
I've a box of older phones and GNU/Linux is a pending project for them. I'm watching Librem and I'll likely go that way eventually.
What I really want on my phones are manual click-type (air gap) off switches to switch the phone off in a split second, same with WiFi. Unfortunately, I've been spoiled forever. My ancient Nokia had a battery with a quick release button on the back. If say I was in a meeting and wanted to kill the phone quickly I could reach into my pocket and push the button and slide the battery abount 1cm which disconnected it—the phone was off in a fraction of a second, none of this nonsense waiting for the phone to shut down.
I miss that feature with a passion and I want it back.
Isn't this the point they were trying to make? The corporations already have that data, it comes with the platform.
The bit where you can use some of it for own purposes is not really the offending part.
It's offending because it's complicit with the dystopian mass surveillance. Encouraging of it even. "I can find my keys when I lose them, so it's fine that a single corporation knows where billions of people are and what they are doing"
Our family (my daughters, wife) has had Find My paired on our phones since, well 2010 when it was introduced. We like it.
I remember watching my sister and her husband calling each other frequently with, "How far are you away from home?" and just kind of scratched my head. (I think I have sinced talked them into enabling Find My.)
When my wife or I want to call a daughter we can see immediately if they are at work or at home... things like that are nice. There's also an indescribable sweetness to just looking longingly in on a daughter who is far away and wondering how her day is going. Empty nest blues? (Or maybe Miner at the Dial-A-View.)
Can you at least conceive that some people might find it deeply creepy that someone can follow their every step, and equally creepy to be able to 'spy' on another person 24/7?
Sure but those of us who have this sort of tracking for our loved ones enabled arent looking at that 24/7, and if you are referring to the corporations, well they already were. At least now they have made it useful to everyday people.
If you don't trust someone with your location, you don't have to give it to them. Personally I find the corporations angle more creepy. You cannot personally vet the people they hire, but you know who you give access to your address to. Outside of family, only one friend ever drops me his location information temporarily because he drives his truck and he uses it to give me a heads up when he's near him in town, in case we can hang out. I mostly ignore it though unless he tells me how close he is.
If your daughter or wife decided that she didn't want to be tracked by you any more, would you happily accept her wishes, or would you assume that she had "something to hide"?
Watching your wife's commute also makes me uneasy. Maybe she wants to get you a surprise birthday present or something. Anyway, I wouldn't want to track someone like that (including children) or be tracked like that.
I mean Apple even added a native feature to iMessage with full on tracking, exactly because of safety. Sure someone needs to send it manually but the whole point of Check-in (tracking someones progress home) is safety. Just too many shady blokes out on the street at night.
It seems like we don't need a technical solution for this and making one would be dystopian as you point out.
Why not just (a) make it illegal so the parents and tech companies see it that way and (b) put some fines on the responsible adult parties if violations are found?
Sure enforcement would be spotty and loose, but tickets for parents and fines for tech companies would go a long way to establish the cultural change without the need for "verification"
> Sure enforcement would be spotty and loose, but tickets for parents and fines for tech companies would go a long way to establish the cultural change without the need for "verification"
A company can't work like that - the tech company will need to do it's upmost to avoid the fines, and so will implement verification that is both unsafe, incredibly invasive, discriminatory but crucially has an audit trail, and it's insane to suggest they would do anything else.
If companies are motivated and parents are motivated to prevent it and schools have the cover to also police it, then social media usage probably won't hit critical mass for kids and they won't feel FOMO to get it.
"it's illegal" is usually a decent enough hard stop to most kids for "why can't I have it"
Should just age-restrict smartphones altogether imo lol. Entire generations survived without mobile phones and it would remove entire issues around addictive mobile games, social media abuse, attention/focus issues
Yes you would: you'ld learn <pick-a-language> just like people have for centuries - in school,
and you'ld learn how to code just like millions have for decades - in school or library computer rooms, or with an age-restricted computer that your family would provide.
If you put the parent in jail for 6 months and fine the company 1 million per user account, they for sure will start thinking real hard about fixing the problem.
not enough good/grand/noble characters in software engineering, management, leadership and so on.
nature-nurture x game-theory anxiety/thrill VS. consciousness & planetary/colony-wide awareness; and I'm not talking about some esoteric spirituality or whatever the fuck.
we are always in a natural balance, established by those who do and those who don't. all of us compartmentalise. and good/noble/grand people in law are rare and entirely absent in politics.
TV & the radio made a lot of destructive behaviours look cool (all that finboy shit) and so did feel-good literature like Siddharta.
and then there's the myth of "hard decisions" that can only be made by certain kinds of characters.
young ppl are easy to bend towards hierarchies that reward certain kinds of behaviour and convictions. makes em feel proud.
They surf on smartphones anyway, so it's enough to identify the device itself. Luckily the devices are already authenticated and identified, for your safety.
They figured out that if they get a load of hot girls, and cool goofy guys to entice people, and don't mention the spying part - it works a lot better than a bunch of government goons in badly fitting suits telling you to betray your friends and neighbours, or else.
Sounds like you are advocating for a much different law: one that bans (or at least makes prohibitively expensive) the kind of data mining/tracking that social media companies currently rely on for their business models.
It really is almost hilariously formulaic. I mean, it'd be hilarious if it didn't have such disastrous consequences.
The slide to dystopia which is described or implied by countless fictional books is, in fact, really easy to pull off. It's death by a thousand socially convenient compromises.
I remember when a significant portion of people thought carrying phones around was creepy, or that spending your life looking at screens was antisocial, and these things were actively proclaimed. Contrary to popularly repeated historical revisionist tropes, lots of people had to be cajoled and prodded and pressured into the "digital revolution". Surely others remember that?
And now we're at a stage now where if you don't have something like whatsapp or facebook or instagram or whatever, depending on the culture and the age group, there's a real chance that you'll be socially confronted, and even belittled in some circumstances.
> It's crazy that all the things we considered the worst of dystopia in the 80's, thinking nobody would be stupid enough to do, and that those societies in SF books were only distant fictions, are things we are actively seeking now
8 years old doom scrolling tiktok is a dystopia we are experiencing right now, pick your flavor
I agree with everything you said. Leaving the morale and ideology aside for a moment though and looking at the technical side, couldn't this, at least in theory, also be implemented in a way that's not so dystopian? Everyone has a SIM card, whether physical or digital, and also a cell plan. If you make carriers mark all underage customers and then have the SIM forward that boolean value to the phone and nothing more, could you in theory still implement something like this without any further breach of privacy? Of course, as with any system there's workarounds, but as a baseline this would work, no?
Maybe things have changed since I was a kid, and I'm not up to date as my kids are too young to operate cell phones, but - does anyone actually buys a plan for an underage person? I'd think it's usually an adult parent/caregiver who buys another SIM card under their own name and just gives it to the kid; the carrier shouldn't have a way of knowing which phone/SIM card belongs to an underage person.
Functionally yes, the plan is in the parent's name. But at least where I'm from, you already have plans that are geared at kids, e.g. they have limits on how big their bill can be so they don't blow it up, certain services are turned off for them such as pay-per-minute calls, and so forth. Perhaps to put a different way, the carriers might not have this info right now, but it would be straightforward to implement this limit this way. Any other approach that I can think of would be both more technical work and also a bigger breach of privacy.
> couldn't this, at least in theory, also be implemented in a way that's not so dystopian?
It depends on the assumptions you're willing to make.
Imagine if Australia introduces a block that works really well, and preserves privacy, but you can bypass it by using a VPN, or by rooting your phone.
Would that be good enough, because only 1% of kids will figure out those bypasses? Or will the knowledge spread like wildfire until 90% of kids are using VPNs or rooting their phones?
If you assume such bypasses would spread like wildfire, Australia would also need to block all VPNs or make every phone impossible to root. Tough to do that in a way that isn't dystopian.
That is why you always regulate the provider/seller (ie. the social media site) and not the consumption side. We already learned this in the war on drugs, prosecution of consumption has never really worked all that well.
In italy we have a digital ID (spid) that's actually managed by third parties authorized by government and you can use it to log in on some services, I think this way it would work
And there is a super obvious solution to this,assuming children can't buy phones then the parents should setup the account for the children and enter the birthdate. Now the OS the browser int eh phones know if the user is an adult in that country, or whatever age level needed.
If say an adult is incapable to setup a phone/tablet, then a person at the store would help them set the initial part but skip the login with Google/Apple etc.
No idea why this was not tried and then see if it fails.
>Just because there is no solution to a rat infestation doesn't mean you should burn the house with the people in it.
reply
What? you mean asking the parent to enter a date of birth before giftin the child a phone and setting it in child mode is like burning things?
Did you really relied to me? Then explain
Seems to me a better idea then government IDs or sending your ID to Facebook.
I could guess why Google did nlot add this feature to Android , they want the money from ads, and maybe Apple wants Google to bhave money to share with them.
> What? you mean asking the parent to enter a date of birth before giftin the child a phone and setting it in child mode is like burning things?
How do you want to enforce it? Everyone who grew up as Internet started knows that everyone is over 18 on the Internet. Or did you, as a kid, ever put your real birth date on a form asking for it for purposes of age-walling you?
And if not voluntary, then... it's either companies asking for government-issued IDs on a case-by-case basis, or a larger system, perhaps legally mandated, that forces you to tie your government-issued ID into it so age information is automatically propagated in the background.
>How do you want to enforce it? Everyone who grew up as Internet started knows that everyone is over 18 on the Internet. Or did you, as a kid, ever put your real birth date on a form asking for it for purposes of age-walling you?
Easy
1 make it illegal for children to buy smarthpones, tablets.
2 make the OS vendors to add a parent mode/child control API, when the phone starts first time the parent enters the details
3 inform the buyer that if he is a parent he is responsible for the child not the government, the parent must set the correct birthdate on the device and set the device in child mode , they can decide to trust the child but then the government is not responsible.
4 the browssers on this locked devices will report to the websites if the user is adult or not, they will not report he brithdate just a true /false
5 if a website fails to read the age from the browser and still offers oillegal content to a browser that is marked as minor then the website is repossible and it is fined.
At no point the child is asked to enter his age so there is not similar to current place where you click I am over 18.
If you have children you might have made an account for them to use a smartphone, Did you lied bout their birthdate ? Did you gave them the new phone in a box and let them set it up because you were to busy ?
My personal theory is that powerful people didn't want people to be digitally free. It might make them think about fighting for freedoms offline as well.
> As usual, the problem with this is that it assumes a way to perfectly identify somebody on the internet
Nope, it does not require this.
What you can do is to construct a zero-knowledge proof of the age of the smartphone user. You can do this based on the certificate that is provisioned in modern electronic passports. The proof construction can choose to ignore expiry date, so the government can offer to issue expired passports with blank photos for the instances of people who should not have functioning passports.
Then you need the social media sites to agree on a common auth mechanism that uses the zero-knowledge proof, and if the same proof gets used on multiple devices, you log out the previously used device.
So even if a parent lets their kid use the parent's passport to generate the proof on the kids phone, every time the kid uses this proof, the parent gets logged out of Facebook and all other social media apps.
Then no parents are going to let the kids use their ID, because of the negative impact to themselves. And you have no more means of tracking than already exists today.
This also offers interesting possibilities for a startup! In the EU today, there are essentially zero legal ways for a 12-year-old to have a group chat with their friends, apart from RCS and iMessage, which then divides the friend group into two halves. Imagine then a chat app aimed specifically at group conversations for teens, where every user has a verified age. This type of app is something parents will pay good money for.
> Then you need the social media sites to agree on a common auth mechanism that uses the zero-knowledge proof, and if the same proof gets used on multiple devices, you log out the previously used device.
> So even if a parent lets their kid use the parent's passport to generate the proof on the kids phone, every time the kid uses this proof, the parent gets logged out of Facebook and all other social media apps.
Doesn't this automatically give the "common auth mechanism" perfect knowledge of all the parent's social media accounts, whether under a real name or a pseudonym? That sounds like an additional means of tracking.
Also, what if the parent legitimately has multiple devices that they use for social media (e.g., a phone and a laptop)? You might say, "log them out if it's used simultaneously from multiple devices", but then you're tracking all social-media usage everywhere in realtime.
- You don't have full control over the knife. In fact it's not about your use of the knife.
- The people in control of the knife have a poor track record at caring about you, and belong to a category that history has proven we should not trust.
- Every time you use the knife, you sign a blank contract giving full authorization to future non-specified knife usage to people you don't know nor do you know their motive. And you trust none of those people, for an indefinite length of time, will abuse it.
- Cumulative use of the knife can accumulate stabs that may be delt to you and all your love ones one day all at once.
- Use of knife can be automated and scale at the level of all countries.
- Most people are not knowledgeable about the knife, don't know much about it, and it's invisible to them.
> You don't have full control over the knife. In fact it's not about your use of the knife.
There are many knives in your relative proximity all the time. Some of them are used for your benefit, other are used for other's benefit, every one have potential to be abused against you by evil actor.
> The people in control of the knife have a poor track record at caring about you, and belong to a category that history has proven we should not trust.
Scrutiny should be proportional severity of harm times the frequency of harm.
> Every time you use the knife, you sign a blank contract giving full authorization to future non-specified knife usage to people you don't know nor do you know their motive. And you trust none of those people, for an indefinite length of time, will abuse it.
Everytime you enter restaurant or even leave your house you are giving full authorization to people around you who posses knives to use those knives for non-specified purposes. You can only hope they are reasonable and won't cause you harm.
> Cumulative use of the knife can accumulate stabs that may be delt to you and all your love ones one day all at once
Knives don't need to accumulate anything. One misapplication can end your life literally
> Use of knife can be automated and scale at the level of all countries.
There are many machines that are basically bunch of fast moving knives. It's on you to not be where they are. Their operators are bound to take precautions proportional to harm times the frequency of harm.
> Most people are not knowledgeable about the knife, don't know much about it, and it's invisible to them
You usually can't really tell how many knives are around you and most are hidden at most times.
Some places don't. Some do. In Poland news about ban on knife carrying was April fool's joke. In UK it's a serious law with serious punishments. In UK people who'd carry a knife with malicious intent just moved to carrying caustic chemicals. It's often not specific tech that's a problem, but the culture and incentives for its misuse.
Although reasonable restrictions on all technologies aren't inherently bad.
Restrictions imposed pre-emptively just because nightmare scenarios are easy to imagine and captivating are not great.
Not in the hand of a government that has a monopoly on violence. Most governments in the world dont have your best interests in mind and being tracked 24/7 is a bad deal to get.
People say "monopoly on violence" as if it's a bad thing. As if the opposite of that is no violence at all. But the opposite is commonality of violence which was the case before government became strong enough to enforce monopoly on violence and still is the case in places where the government is weak enough to lose the monopoly.
Monopoly on violence is the most significant cultural development that allowed incredible wealth and societal development.
Currently we are in the age of commonality of surveillance. If this turns out to be harmful enough we might as well move towards monopoly on surveillance and it might be an improvement.
Personally I think it won't be necessary.
I'm sure of one thing. Surveillance won't go away because it's a useful technological tool.
Now that you mention it, the would-be dictator that was just elected in the US is allied with both the stereotypical hand-wringing think-about-the-children people (religious groups) as well as with Elon Musk, owner of a major social media platform and future "efficiency czar". Talk about cognitive dissonance...
> It's crazy that all the things we considered the worst of dystopia in the 80's, thinking nobody would be stupid enough to do, and that those societies in SF books were only distant fictions, are things we are actively seeking now.
> What the hell is going on?
Because they weren't all that dystopian? Maybe people had the good sense of being able to see the amazing aspects of those future technologies even when the authors tried to paint them darkly? Or maybe we rightly all realized - even if just at subconscious, emotional level - that those fictional dystopias are thin, simplistic narrative devices, and "no one would be stupid enough to" actually implement them?
What we didn't predict was adtech. For all the anti-corporate fiction that was part of, or adjacent to, science fiction of that era, the western culture is still obsessed with self-made people, glorifying entrepreneurship, making money. Well, turns out there's hardly a difference between small businesses and large corporations. The incentives are the same regardless of size; sole proprietorships and multinationals aren't some sworn enemies, they're just different size of the same thing.
What we didn't realize - and many still don't - is that, while no one may be stupid enough to implement the techno-dystopia outright, many will happily do whatever it takes, no matter how unscrupulous and underhanded, to secure their income. We didn't realize that glorifying "business sharks" means creating an entrepreneurship culture where customers are resources to be exploited, not human beings. Iterate on it enough, and we get to techno-dystopia indirectly, with no stupid steps made on the way - just plenty of exploitative ones.
Perhaps the memory of the first 3/4 of the 20th century has us put too much focus on the governments, and blind to private interests. A particular pet peeve of mine, for example:
> My German ex was born in East Germany, 11 years before the fall of the Berlin Wall. She thinks people are mad to believe that tracking is not going to be abused.
Yes, and at least some people who think alike also like to bring up Nazis pulling census records to make their purges more efficient. But frankly, I don't think this is a good argument against censuses, or contact tracing. It's not the census that put minorities in concentration camps, it's the Nazis. They wouldn't have stopped if that data didn't exist, they'd find some other proxy or just do it systematically, like they did elsewhere.
A better argument is to perhaps not collect data you don't need. A census without religious affiliation would be less useful to Nazis and the like, and it's questionable how useful having this information was for the purposes it was collected. But my ultimate point is, when your government turns evil, you're screwed anyway. We need to try and prevent it from going bad in the first place. It may indeed involve fighting against badly justified surveillance overreach, but trying to take away tools that an okay-ish government uses for good, only because they'll be used for bad things when the government turns evil, is just self-destructive behavior.
I mean, you could argue that teaching a person how to grow strength and keep a healthy body, how to read, write, plan, think, negotiate, convince, are all bad because what if that person becomes a criminal or a dictator? Yes, it would be much better if murderers and tyrants didn't know how to use a knife or a gun, or how to talk people into helping them. But we consider that risk to be worth it because of all the good it brings to everyone else, continuously.
And yeah, we're all so focused on the idea of governments going full-Nazi again, that we've ignored the gradual overreach of private interests, which at this point not only actively screws with our everyday lives all the time (hello advertising industry), but also undermines our governments too. Even worse, all the "dual-use" tech and data private interests have, that okay-ish governments would love to access but have good sense to refrain themselves, sits there gift-wrapped for any evil government willing to reach for it. We ended up choosing the worst option of all: all the downsides of tech being abused by private interests now and evil governments in the future, with none of the upsides of okay governments using it for good today.
So perhaps we should concentrate less on things like AirTags being potentially deadly in hands of the next Stalin, and focus more on fighting private and public attempts at abusing them early, while maximizing the benefits society can get from such technologies.
Or, in short, let's pay less attention to how some tech could be abused in principle, and more attention to people who are trying to abuse others.
Typical hacker misconception regarding the law. You don't need to implement perfect tracking to enforce a law. Make it illegal and then let BigTech use their AI algorithms to detect and block minor accounts. Parents will also play a major part.
Don't use pex, use shiv: https://shiv.readthedocs.io/
Pex doesn't work on windows, is slower than shiv and shiv solves the resource files problem that you will encounter with dependencies like django. To achieve this, shiv unzips the whole zipapp in a cache on disk and create a transparent proxy to it.
Still, I wish zipapps had better tooling honestly. Using either pex or shiv is more complex than it needs to be.
I hope uv will eventually give you something like "uv zipapp" and make it good and simple.
Right now, to bundle all deps for shiv you have to download first all wheels, then figure out the proper incantation to include them. And if you use WSGI, you probably want some kind of dedicated entry point.
The tech is cool, but it deserves maturing to be a true ".war for python".