Hacker Newsnew | past | comments | ask | show | jobs | submit | progbits's commentslogin

> EU regulators’ extreme interpretation of the DMA

It's not extreme interpretation, it's the intent.

Just say it would break your vendor lock-in.


I don't want my apps that have AI implemented to be able to read my messages because Europe mandates feature parity. And that's just the tip of the iceberg. For Apple it means building all the APIs that probably already exist but this time to be requested by apps, which would be a huge attack surface, even Apple's own apps suffers from security breaches (like Message before the switch to closed container execution). AI breaks the separation of concerns, which can lead to disastrous consequences.

EU has great intentions, and of course, feature parity should be offered so that competition can exist, but I don't find it crazy that it is more complicated on a product like that. As tech people things are very obvious to us but we need to remember that we are talking about a product used by everyone.


It’s not clear how it is significantly different from allowing apps access to your contacts, calendar, photos, and so on. And Apple doesn’t say that they merely need more time to properly implement it, the claim that they are unable to implement it without compromising privacy and security. And the latter I don’t really see, with the proper set of permissions presented in the way users are already used to.

As an Apple user I feel more patronized than empowered here.


> It’s not clear how it is significantly different from allowing apps access to your contacts, calendar, photos, and so on

Those are allowed via contextual consent prompts, several of which are for specific contacts, specific photos you wish to share, and so on.

Examples of the level of access an AI agent has include:

1. To read all indexed personal data from every app installed on the device

2. To perform actions in every supporting app on the device on the user's behalf

3. To read the current displayed apps for additional context as well as sensor data like current location

If you were regulated such that you had to allow any organization this level of access, and if you were hand-tied in how much you could convey the seriousness of accepting that consent prompt to an ordinary end user, and felt that it would be you, not any legal authority, who would ultimately suffer the reputational and legal consequences for the results - what would your yes/no decision be on shipping the feature in that jurisdiction?


How is this substantially different from Safari extensions that can effectively see and act upon everything you do in the browser?

One can imagine contextual prompts for all of the examples that you give, like which data sources and which apps the AI provider is given access to — similar to how you can choose for a Safari extension which websites it has access to — and for how long.

That all seams reasonably implementable. You could even use multiple AI providers in parallel with different subsets of data and apps, which would allow you to compartementalize access by different providers in a way that isn't possible with Apple's AI.

Such integration interfaces are necessary in the long run if we don't want to lock in our whole life to a singular combination of hardware, OS, and AI provider.


The law does not require Apple to grant all permissions to all apps for all users. It just requires Apple to ask users if the user wants to grant elevated permissions to specific apps that they download. The user can always say "no", which should obviously be the default.

The situation is that Apple won't even allow users to grant elevated permissions to any 3rd party app, even if the user wants to.


But then third party apps can force users to accept this before they work (here I am especially thinking of school and work apps that people might be forced to use).

App store guidelines already strictly prohibit developers from demanding overbroad or unnecessary permissions, and they expressly forbid locking unrelated features behind irrelevant data requests. Any app that attempts to do so can easily be yanked off the app store by a single complaint.

> don't want my apps that have AI implemented to be able to read my messages because Europe mandates feature parit

App permissions.

Beside you don't have to install any third party app, I only have Google assistant installed on my Android.

I heard the same kind of talk when the eu forced apple to switch to USB C...

There is a real, strong, monopolistic issue with some American companies that their government refuse to deal with because it's so corrupt. It would be fine if it didn't impact us in Europe, but it does.


> I don't want my apps that have AI implemented to be able to read my messages because Europe mandates feature parity.

The AI provider would still be YOUR choice. You could stick with Apple's if you don't trust the other ones.


Huh, this is an incident now?

Our github->slack subscription breaks every few months, they never acknowledged it before. At this point we have a doc with the list of repos and settings, whenever someone notices that things are awfully quiet we just go through it and resubscribe.


I think Slack requires reauthorization after some time. I get asked to sign back in to various accounts after a while.

I've experienced the following sequence more than once at work, and I remain baffled by it each time:

- Receive a huge vibecoded PR for complicated new feature.

- Complain that this needs some design doc to figure out the right approach first.

- Author says no need for design doc, easier to have vibed implementation and discuss the concrete code instead of abstract document.

- I disagree (obviously), but review the PR with feedback along the lines: this entire approach is flawed, throw this out and start over.

- Author gets defensive, says "but this is already working and ready, let's just merge".

- I tell them there is no chance in hell this is getting merged. They go sulk to their manager that I'm not interested in helping them launch.


> helping them launch.

I think that's probably the key - sounds like you are at a place that rewards "launches" and not long term maintenance and so you are ruining their KPOs or promo packet or whatever.


That's every place :(

SRE.

"You ship it, you take the pager. Once it's stable, then SRE org will take the feature. If it gets unstable again, SRE will hand it back."

If someone vibe codes something, and it works, then no reason not to merge it. So just set it up so if it doesn't work, they're on the line to fix it.

Along with their oh-so-supportive manager.

But also, if you have the clout, doing what you're doing nips the problem in the bud earlier, and so is more efficient. Good that you have the clout.


> They go sulk to their manager that I'm not interested in helping them launch.

But what happens if:

* You're not the only possible reviewer, and they get some patsies / kool-aid drinkers to approve the PR?

* Their manager is also the code repository owner?

:-(


And github has 100% uptime while cloudflare has 20%. Yeah, right.

If you enjoy this you might like https://cloudappreciationsociety.org/

They have forums where people post neat cloud photos and if you sign up for membership they will send you an identification chart plus a journal for keeping track of the types you have seen.

Makes for a nice gift for that person you know who always goes "oh look at that cloud!" :)


Thought so too and I think it's a sign I need a break.


> carefully sourced and labelled like Spotify

I wish I had your Spotify.

Over the last few months they have served me multiple slop tracks in the discover weekly playlist. Probably more I didn't notice when just listening without focus, but several had generic artist name without bio and dozens of nearly identical tracks.


Since the tool's quality strongly depends on the abilities of the user, I think I prefer:

Garbage Invoker, Garbage Output


Why is it that every gemini/gopher discussion throws out the baby with the bathwater?

> Chrome alone controls roughly 73% of global desktop browser market share.

> More and more, the webdevs of the world test and develop for Chrome only.

> It doesn't need to be this way. https:// is not the only way to connect and interface with the Internet

These are completely unrelated concepts! Google/Chrome doesn't control HTTP nor HTTPS. There is nothing wrong with the protocols, you can just make your website plaintext file if you like.


Google almost shipped a DRM for the whole internet in 2023, and they will try again

https://en.wikipedia.org/wiki/Web_Environment_Integrity


Yes that's absolute shit thing to do.

It's also on completely different OSI layer.

I don't see the difference between your comment and a statement like "I don't like email so let's stop using TCP".


Yes WEI operated between layer 5 and 7.

But the day your bank and insurance implement WEI, it'll going to be too late to switch to another protocol. Your existence will depend on it.


Honestly, I think at some point we will need something similar to WEI to ensure we’re interacting with other humans in a hostile AI internet.


Just like CAPTCHAs, WEI won't actually prove that you are a human, just that you are using an approved setup.


Before we ever come to this point I hope as a society we take a real swing as dismantling big tech. So much potential is being hoarded by literal dragons of progress.


You may be surprised to find out that the majority of gemini/gopher authors actually do have simple HTTP(S) sites. Some even have very complex HTTPS sites. Gemini and Gopher isn't really about getting rid of the WWW, it's about having a space that's entirely disconnected from it.


Why is it that every criticism of gemini/gopher throws the baby out with the bathwater?

When you browse to a pristine html page containing zero adtech it contains links. Those links you might click on without first thoroughly vetting them for behavioral exhaust.

Hyperlinks are a vector for contagion. A new protocol creates isolation. What's wrong with both existing? Defense in depth at all levels, I say. You think https can't enshittify, maybe you just haven't waited long enough.


AI slop


I mean, you're not wrong. I did use AI to run the analysis, and it is some marketing-oriented content that I'm using to learn how to do B2C marketing, since I'm a guy who know how to sell $200K of software engineering services, but hasn't the first clue how to sell 1,000 copies of a free (IAP) app.

So, I don't disagree. The app's worth a look, though, if you're fishing in AK. It's definitely not AI slop. And it's got 25 years of count data in it that you can muck around with.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: