Giver of skulls
Are there people of voting age that are exempt from paying taxes? Because I’m pretty sure the federal government has a huge database of its citizens already through the IRS. People who became adults after the last tax season and people committing tax fraud would need to register manually once, but I don’t think that’s such a big risk.
How would an illiterate dude living in a cave register to vote?
I guess America just can’t pull of what just about every European country does, but even then you don’t need this recurring manual registration mess. Just register everyone who filed a tax form last year and you should get most of the voting age population already.
Legal risks: serious in theory, none in practice. Just don’t leave your instance running unmonitored for months and make it moderately difficult for bots to sign up. There are tools to detect child porn and other such material but they require a GPU which makes hosting a server quite a lot more expensive. Just make sure there’s a way to contact you in case of problematic material and you should be fine. Read up on your local laws about what’s expected of you as a hosting provider if you’re still in doubt, every country has its own requirements.
As for mental health, it depends on what kind of people you attract. A group of friends visiting normal communities brings barely any mental toll, open signups will have you spend time every week banning and blocking abusive accounts and filtering out borderline porn content.
It’s because the Linux desktop landscape is a complete and utter mess. Any standard Linux GUI has a tool to make a bootable flash drive, but the steps to get there and the buttons to click are all different. Using the command line often works on every platform. I generally use Gnome’s disk tool, though KDE’s partition manager is also very competent. On the more minimal distros, Gparted always seems to work for disk operations. I’ve never really had any problems because of a bad cbecksum when it comes to Linux but I’m pretty sure there are GUI tools for verifying those too.
Among some Linux users there’s also a feeling of superiority about using the command line instead of the GUI, but those people usually come from distros that expect their users to know what a dd is and how to find the right drive in /dev. Those users seem to throw their hands in the air and go “download <some GUI tool>” when you ask them about Windows, though, because they don’t seem to care about the command line in Windows (even though Powershell is equally competent and in some areas even superior to most Linux shells).
Some people are all so annoyed by etcher’s large file size, but I can’t say I’m too annoyed about having to download 150MiB when I’ve just downloaded a 6.7GiB installer image that contains two office suites and five image editors in case I need them.
You make claims like “that means one website can take over your entire phone” and I reject that. I know what these isolation layers do and I also know that they’re not going to make a difference in practice for the vast majority of people. For instance, same-site isolation, which you specifically mentioned, is not a defence against anything but CORS bypasses and maybe some memory leaks. Firefox not having it is suboptimal, but it’s hardly the end of the world. Just rather annoying to let them open themselves up to the risk of side channel attacks and such.
The Android sandbox is designed to sandbox entire binaries. That alone should withstand any malware that enters the phone, or at least constrain it within a sandbox. If that sandbox is broken, GrapheneOS itself is broken. There are CVEs and CVE chains to break out of that sandbox in unpatched version of Android and there are probably a few that are present but haven’t been discovered by the good guys yet, but that’s the part that prevents any app from taking over your phone. It’s also why rooting your phone is such a hassle if you don’t have an unlocked bootloader.
That’s also what Firefox is supposedly “crippling” by not using Googles process sandboxing API. That just shows that GrapheneOS assumes their sandbox to be broken to the point where every app is crippling their security by not calling the APIs used for process isolation.
The kind of browser protections you’re arguing for are defence-in-depth measures. They lengthen the kill chain of certain families of exploits by requiring more workarounds and making exploits less stable and efficient. That’s no doubt good for security in general, and I’m not denying Firefox has work to do here, because Google is ahead of them.
However, their browsing recommendations are only valid for their threat model. That includes “always disable USB”, “always hide your IP address”, “sacrifice RAM and performance for better ASLR”, “break API compatibility to enforce better malloc rules”, and tons of other modifications that are protections against the most advanced kinds of malware. Of any if this were a problem, the average Android user with their four month old copy of Chrome on their two years outdated Android phone would get hacked every single day. Writing reliable Android exploits is actually quite hard because every manufacturer likes to alter their ROMs in tiny but annoyingly significant ways. Your ROP chains don’t line up anymore, your kernel exploit needs to call a different method, the ROM comes with a different version of a driver for no good reason, it’s almost security-through-annoyance.
The protections Graphene provides are similar to those of an iPhone in lockdown mode (a severely underused mode, in my opinion, one that mainline Android should include). It protects against vicious malware that’s made by people with vast resources through several levels of defence in depth and sacrificing usability for security where necessary, to the point they call themselves “an operating system with Android app compatibility”. It’s why only GrapheneOS and the latest (well-configured) iPhone were shown to be resistent to hacking tools such as Celebrite. Excellent for journalists, human rights activists, and other potential targets of such directed advanced malware. Hardly a problem for the majority of the population whose malware exposure is “your WhatsApp is outdated click here to install WhatsApp.apk” and “download super gambler from the Play Store and Elon Musk will send you free crypto”.
For some perspective, compare GrapheneOS’ opinions on Gecko with those of DivestOS, which provides a more nuanced recommendation. They recommend their Mull and Tor for privacy reasons, despite the lack of the two isolation features GrapheneOS is so adamant about. They also mention dynamic first party isolation, which Firefox implements but Chromium doesn’t, and which even Vanadium doesn’t have a comparable implementation.
You said users should understand the risks associated with their browser choices, and I agree. I just don’t think the risk is as high as you seem to think. And no, I’m not developing an Android ROM, and even if I should, that wouldn’t make me more or less reliable on a forum like this. When it comes to browsers, my recommendation would be “use Mull for privacy against advertisers and data brokers, buy a Pixel and use Vanadium or buy an iPhone and put it in lockdown mode if you’re afraid of one or more governments”.
I still don’t really see what “that kind of security concern” is in this context. Same-site isolation protects two websites from each other, nothing more. The isolation API Chromium uses to drop permissions on some of its threads are used to limit the potential of a single exploit, but they don’t prevent things like the Qualcomm vulnerability from being abused.
It’s not like any website can just break a web browser, they need to exploit the browser in the first place.
For unpatched people, that means they’re in trouble. Luckily, Android is so fragmented that there is no exploit that’ll get root access on all devices. It’s hard to even get root access on the same model of phone. In practice, drive-by malware is actually quite rare for how many unpatched Android phone are out there.
There is probably more risk in using Firefox than there is in using Chromium, but the additional protections here are quite overstated in my opinion. You can’t get enough layers of defence when you’re a human rights activist or whatever (but then you’d use an iPhone in lockdown mode anyway), but just because Firefox doesn’t implement a particular API doesn’t mean your phone can be taken over by any website you visit. You need a complex chain of exploits directly targeting your phone’s hardware and software configuration to get anything more than a force closed browser tab.
As for the attack surface, Chromium implements a significantly larger API and provides a significantly larger attack surface, with permissions and code to do things like access USB drives and open serial ports. I’d say the huge chunk of Chromium-only browser features leave Chromium with a larger attack surface, not a smaller one.
I personally prefer the additional privacy improvements Firefox brings over the two layers of malware protection that patched versions of Chromium provide. I’m no Khashoggi and I don’t work on any nuclear plants, I’ll probably be Fine™️ and so will you.
People like to pretend stocks are some kind of scheme by the big bad CAPITALIST MACHINE to oppress the workers and enrich the wealthy but that’s not what the stock market is about. It’s what happens when people who have no idea what they’re doing throw their money into financial products and lose everything, but whether you know it or not, your money is probably tied to the stock market at some level. The profit you make at the stock market is directly tied to the amount of money you’re risking, and the amount of risk you’re willing to accept. No risk means no reward, lots of risk means you can be billions in the hole.
Stocks are essentially lending money in exchange for a tiny bit of a company. If the company does well, you get paid back an amount depending on how much of the company you own. You can sell that bit of the company and then someone else will get paid instead, but you get to keep the money off your sale. You usually also get to have a say in how the company works if you own enough stocks, as you own part of the company now.
Selling stock allows a company to expand more than if it had to slowly save up its profits. You can only mortgage your assets once, but as long as you can convince people to lend you money, you can make money with stocks. The more a stock is worth (=the more trust existing or prospecting lenders have in you), the more likely people will be willing to buy parts of your company.
By not selling every part, or keeping a small set of parts for employees, the company can also directly profit off of price increases.
There are also companies like co-ops where the workers all own part of the company. That means they get a say in how the company is run, as the workers collectively have more power than even the CEO, for better or for worse; convince the majority of a terrible business plan and the entire coop goes to hell, even if the CEO warns everyone about how bad an idea something is. On the other hand, when someone tries to cut costs by doing mass firings, the workers can come together and put a stop to that. This also motivates workers, as the stock they get paid is worth more when the company is doing well. This doesn’t have much to do with the stock market, as these stocks usually aren’t traded publicly, but it’s just an example of stocks being used to improve the position of the working class. Unfortunately, co-ops like these can’t use stocks to attract investment, so these companies don’t grow as much, and you don’t see too many of them as a result.
You can do a lot of things with stock if you enter the stock market. Most of that is actually contracts about how you’re going to treat a stock you own or want. For instance, you can borrow a stock from someone else for a modest fee, sell the stock off, wait a bit for the price to drop, then buy it back, pocketing the difference. If you misjudge the price difference, you end up paying more than you’ve sold the stock for.
You can also do the inverse, basically buying someone’s promise to sell you a stock for a certain amount of money in a certain amount of time, hope the stock is actually worth more than what you’ve paid by the time the exchange happens, and get expensive stock for cheap. Once again, this can lead to a situation where you make a loss, for instance when the stock drops in price and you’ve paid more than if you would’ve bought the stock directly.
It’s basically all betting and betting on other people bettings. Making money through normal stocks takes a long time, as the company you’ve bought stocks of may take years to reach the growth you’ve funded, and these bets can make you a lot more money in a shorter amount of time. However, you’re not obligated to do anything crazy with your stocks; you can just buy them, hold on to them, and make a small profit over the money the company pays back.
Companies that don’t sell stock and still compete with stock based companies often have other investor deals. Without these kinds of loans from people with free capital, it can take decades to collect enough money to pull off growth that would take a year with stocks or other loans. If you’re starting a business, they can help you achieve your goals and bring your products and services to everyone for affordable prices. If you’ve got more money than you need, you can use stocks to help someone else get their business running, and you get a bit of cash in return. If you think you’ve got a good idea for how to run the business, you can buy a significant chunk of stock and weigh in on how that business can work best.
Stock also has another upside: the stock market allows you to take money you have pooled (be it retirement funds or just some money you’ve got floating in your bank account) and invest it in some safe bets which make about 2 or 3 percent profit over a long time. If you don’t do that, the amount of money you’ve saved will remain the same, but because of inflation, that money will be worth less over time. A million dollars was enough to retire on a few decades ago, but if you’ve saved a million and stopped back in the day, you won’t have enough to retire now because everything has gotten more expensive. That’s why pension funds usually invest part of their money into stock markets. Minor fluctuations over time (like a company losing a quarter of its value this year and making everything back next year) aren’t very important if you’re saving money for 30 years in the future.
There is a massive downside to stocks, though: they’re a quick way to lose money, and way too many people get sucked into complex financial contracts they have no understanding of. Take the Robinhood traders that didn’t realise they were signing contracts that could make them owe tens or hundreds times the amount of money they put in. You could also make a mistake and loan a lot of money to a company in exchange for stocks and end up with nothing when the company goes bankrupt. You could also sell too early and lose all of your profits to the minor fees stock brokers demand to do the actual stock trading for you, as everything needs to be registered properly.
Another problem with the stock market is that large funds, such as hedge funds and pension funds, need people to run them. There’s an incentive for those funds to make as much of a return as possible, regardless of what happens to the companies they buy parts of. When these funds come into control of a company, making decisions that only make a profit in the short term and screw over everyone in the long term can make those funds a lot of money, at the cost of the businesses they buy. Businesses can protect themselves from this (by not selling more than 49% of their stock, for instance, or by having 51% or stocks in the hands of their CEO/leadership, so any decision can be overruled). However, companies often like the idea of making money more, plus the more control they give to stock holders, the more their stock will be worth.
This stuff is also why there are rules about all of this. Look at the lives ruined by cryptocurrencies to see what happens when you don’t have them. In the end it’s just people making mistakes and ruining their own lives, but as a society we’re better off protecting each other from making those mistakes.
When it comes to anticipating rise in/fall of value, you don’t need stocks. There was a massive prospective market on pogs and beanie babies. People still buy action figures, Pokémon cards, and action figures to hopefully make a profit one day.
If a third part web browser “bypasses or cripples” OS sandboxing, then any app can. Seems like Graphene’s hardening isn’t very good for third party apps in that case.
Firefox doesn’t use Android’s API for sandboxing processes from each other, but that sandboxing isn’t what’s protecting your phone from getting taken over. There are many layers of security present within Android and process isolation for web content is just one of them.
I’m sure Graphene’s fork of Chrome is more secure than Firefox (especially with JIT turned off) but that doesn’t mean running Firefox presents any risk.
Android’s design is such that I should be able to install a random app and see no adverse effects other than battery drain/high network load without clicking through dozens of security prompts. If that’s not the case, there’s a vulnerability in the Android layer that needs patching, such as the Qualcomm vulnerability that was released recently.
With open security holes like that, not even Chrome’s site isolation is going to protect you
No it doesn’t? It means that a malicious site that can take over a browser process can also take over connections/accounts on websites that share the same browser process by bypassing mechanisms such as CORS.
This isolation mode is also pretty effective against things like side channel attacks, though real mitigations of those bugs require kernel/microcode updates.
To take over your phone, you need at least a sandbox escape exploit to break out of the browser app space, a privilege escalation exploit to get past selinux and other such protections, and even then the damage you can do is quite limited unless you’ve gained root access. Site isolation exploits can be used as the first step in a chain of exploits, but it’s not a very important part when it comes to preventing privileged RCE.
I see. I don’t think missing that is enough of a problem for me to switch browsers, it is rather unfortunate that it’s still missing on Android.
Then there really are no excuses left for those supermarkets. Just a weird Americanism, like using imperial units.
Interesting. What security risks are you talking about exactly? Do you have a link?
I know Chromium is faster and more responsive on Android but I haven’t read much about security differences yet. With Chromium being pre-installed and signed by the OS vendor, I always assumed the risk of exploiting the Chromium process was higher instead of lower.
I’m not sure what threat model you’re protecting yourself from if the Android sandbox isn’t good enough for either to be honest, but I suppose there’s risk in hijacking the browser too.
Sending the labels from a central location seems wildly inefficient when label printers are as cheap as they are.
Plus, prices are already adjusted at the state level at the very least, if you’re gonna ship every store their labels from a central location you may as well update the tax info on them.
Even the budget stores here are switching to a digital display system with those small e-ink displays. When that technology hits the US, there really won’t be an excuse not to label things including tax anymore.
Most expats leave after a few years. They only move in to make a quick buck with tax advantages and then move back/on to another country.
I suppose they’re a form of immigrant, but a very specific subgroup. One that often also doesn’t intend to integrate with local culture, so their approach is quite different from most legal immigrants. You can’t really compare the experiences of war refugees with Americans that come work in another country for five years, even though they’re both forms of immigrants.
I don’t just consider the Brits and Americans to be expats, I’ve also met expats from eastern Europe, India, and South East Asia. Maybe the rich expats don’t like to be grouped together with them, but I also consider the cheap eastern European labourers that do jobs like working the fields for half a year to be expats.
I mean I guess stores in places with 0% sales tax don’t, technically. American stores just don’t want to bother doing the math while labeling and make you do the math in your head (and then they do it at the till).
Another consequence of the crazy American tax system.
They know the price to charge at the till so they definitely can show the full price. It’s just convention not to at this point. Why go through the effort when it only makes you look more expensive compared to the competition, after all?
As someone whose native language has a “vee” and a “wee”, the whole “double u/v” always seemed kind of weird.
I know the history of the letter (v turning into u later after being the same letter for centuries) but I never got why some languages stuck with the “double” letter for this long.
It’s a bit hard to articulate the difference I’ve noticed with Americans when talking about work. It’s not like America is stuck in the 60s with executive toilets and executive lunches, but office culture definitely seems different.
What probably makes a difference is the difference in management styles.
Some people don’t like to receive help from others without getting something in return, because it makes them feel pitied. If you think this applies to you and they’re refusing help because they don’t want to be a burden, ask for a little favour yourself every now and then, even if you don’t really need to borrow that lawnmower/hammer/bucket. That way, they don’t feel as burdened asking you when they need help.
If you’ve got money leftover for them, you can’t go wrong with keeping some funds reserved in case they need it. It sounds like they’re doing fine, so an emergency fund is all the monetary aid they may need. If that doesn’t get used, you can always invest it and have it ready for them when they age and run into stuff like healthcare bills.
You could also spend the money another way, like giving nice birthday/Christmas gifts. Save up for holiday vouchers, or get them a roomba or a dishwasher to sneakily help with cleaning.
Also consider that maybe they really are fine, and would be happier seeing you invest your money in yourself and your future. Most likely, they’ll appreciate spending time with you much more than the money you may be able to provide.
You’re not wrong, but the question then becomes “why did the US send an advanced military defence system that needs a hundred highly trained American operatives to work”.
I’m guessing the reason is a combination of politics (lots of American politicians with ties to Israel) and practical reasons (validate that these systems still work against the enemies of the state without actually getting involved in a war directly, perform analysis for future improvements for defence on home soil, get people behind Israeli lines to extract intelligence that might not be shared willingly).