It kind of seems like an insane TLD structure to begin with, right? I always thought .co.uk was bad (you're just pinning yourself to whoever owns the .co. part, but at least browsers have some suffix list where you can't, I don't know, hijack some login cookie for all of .co.).
Joe Smith and John Smith can independently register joe.smith.name and john.smith.name, do browsers have a wildcard suffix list for the 2nd level of `.name` specifically, or can Joe set a cookie on all of .smith.name?
I know about the public suffix list - I was wondering about the wildcard specifically. In the very issue you linked to, as of 2025, it seems this was still unresolved...:
> We have no plans to modify the .name entries at this point in time. We are aware of the implications of adding a wildcard, therefore we won't.
Yeah, apparently they both (used to) offer unbounded registrations of 3LDs and unbounded registrations of 2LDs? So if I see j.doe.name, the only way to find out if "doe.name" is a public suffix or not, i.e. if I should (not) be able to set a cookie on it, would be to email the registrar?
So does that mean that in practice, .name domains were always treated by browsers like regular 2LDs, meaning the cookie and origin protection was always broken for those domains?
Doesn't sound like good news for the guy in the OP...
I'm just saying that they have discussed the situation. They seem to have no answer and for cookies and similar things the answer probably is "maybe don't run security critical web stuff in the third level under .name".
IIRC orgs like letsencrypt also use the PSL for rate limits, so there are probably more issues that are not browser-based.
There end up being some weird edge cases where there are some countries which have both the equivalent of .co.uk but also allow registrations directly under the two-letter country code as well. .mx is one such case where most business are, e.g., costco.com.mx, but it’s also possible to register directly under .mx as well so Toyota Mexico is toyota.mx and not toyota.com.mx (the latter is registered, and ostensibly to Toyota, but the whois and nslookup records give very different results and the website doesn’t load when I try to visit it).
This isn't so bad as .com.mx and .mx should be on the public suffix list then.
But letting arbitrary customers take arbitrary 3 level domains, and others take 2 level domains, seems like a mistake as it's not very reasonable for every 3LD customer to put the 2LD on the public suffix list, but mixing 3LD and 2LD registrations means you can't public suffix *.name.
Seems the whole idea of having both was always misguided.
The .us domain should’ve been universally useful for state and municipal governments, but most of those began registering directly under .gov, and not even in an orderly hierarchy under .st.gov
But that was simply the easiest way to market your website as a trusted government entity. And now nobody has ever heard of .us domains in active use.
.us was primarily a hierarchy structure which in practice made confusing and hard to remember domain names, whereas .gov addresses hand out single domains which are generally easy to remember.
Personally, I never saw anything confusing about city.state.us; the hierarchy was organized perfectly logically in the 3-tier jurisdictional structure that every American schoolboy knows by 3rd grade.
But your point about them being rather longer and difficult to remember stands, and the same for a .gov, which could be shorter and catchier.
However amusingly, .us opened up second-level registrations 24 years ago, which means that any qualifying entity could have their name registered directly under .us, which is obviously recognizable, and also one character shorter, than a .gov registration. However, by that time, I believe that .gov had increased in stature so that registering governmental entities under .gov carried more certainty of conveying official status than anything under .us.
Also sadly, QR Codes and URL shorteners today sort of obviate the need to directly register the shortest possible domain name. I don't know: I was always kind of fond of the .us hierarchy, and I'm just personally sad that it's fading away.
City/state/US is logical, the problem is most other hierarchies confuse people. For instance k12 subdomains for schools couldn't use that nomenclature because school districts do not map cleanly to towns. And that's before you talk about fire departments, townships, libraries, park districts, and countless other governmental bodies and districts which have overlapping boundaries of their own.
.gov certainly cares a level of exclusionary access that isn't really true of .us. Only one entity, the US federal government, can decide to hand someone a .gov address. And generally there is few signals harder to fake or impersonate than one.
It’s not something anyone else in the world seems to struggle with, where there are *.gov.uk, *.edu.au etc.
If anything the .gov, .mil and .edu being just American is confusing, as well plainly inappropriate (it feels like an American cultural imperialist thing to people from outside the US). It would have been much better if those had been retired decades ago and moved to under the .us TLD, so e.g. whatever.edu would become whatever.edu.us like every other country. Any existing domains on .gov, .mil, .edu etc. should only be allowed to exist as 301 redirects.
It's imperialist to own and control the thing you created?
If .gov had been an international TLD that was at some point available to everyone, or had been created by everyone, ok. But .gov was created as part of the work the US government did to build out the initial DNS structure. It probably wasn't even a given at the time that arpanet would be international in nature
Also, 301 redirects are not a DNS thing, that is an HTTP thing. Not sure how that would solve your problem since HTTP is intrinsically at the base of it tied to just A or AAAA records. DNS does a lot more than pointing to websites
It used to be that only Japanese corporations could register a .co.jp while anyone else anywhere could register for a .jp. So I had several .jp domains registered through Gandi.net.
The issue is that .jp registered outside of a few Japanese registrars are legally not allowed to offer Whois privacy.
Based on my small sample of schools, all of the ones that were using locality based names under ca.us have migrated elsewhere, including to 2nd level domains under .us.
Since neither smith.name nor the wildcard *.name appear in the Public Suffix List (https://publicsuffix.org/), browsers would likely allow any page on a *.smith.name domain to set cookies for .smith.name.
There was an effort to properly handle the .name 2LDs, but it was never resolved because there’s no easy way to tell a reserved 2LD (open for 3LD registrations only) apart from a normal 2LD on .name: https://github.com/publicsuffix/list/issues/2306
So yes, this TLD’s setup is in fact pretty insane.
I think this says more about how the cookies security model is stupid. They should always have been scoped to the single, exact name they were set from and nothing else. Websites would have had to be designed a bit more thoughtfully.
It seems like it would be easily resolvable with TXT records these days. Anyone could try, say, on www.google.com to set a cookie for all of google.com, and the browser can fetch TXT records on google.com to see what, if any subdomains, it wants to allow this privilege for. Google could return a list or a wildcard; co.uk wouldn't allow any.
In a world without advertising, there's no reason why google.com couldn't also allow *.youtube.com to set cookies for it, but of course that would cause a tremendous privacy freakout. Though in practice they can and do just send every login/logout through a 302 redirect roundtrip to take care of the cookies on youtube.com.
Totally agree that a DNS based replacement to the suffix list would make sense. Especially with more secure forms of DNS like DoH or Dnssec.
That said I don't know about making cookies shareable across TLDs. That seems like allowing more privacy nightmares; at least today if you want to share you need complicated redirect dances that make you question if the user perf hit is worth it. I think there was some proposal for a mechanism for allowing non partitioned 3rd party cookies which seemed more sane to me, forget what the details were and if it ever made it beyond just a proposal.
An “administrative structure” seems fine, but the fact that a subdomain gets any sort of privilege over the parent has always seemed absurd to me.
Surely a better solution would involve an actual request. login.foo.com could send a request to foo.com with Origin: login.foo.com asking to set a cookie, and foo.com could make its own decision.
That might be reasonable today, but it's not really reasonable at the time the policies were formed.
If you require domain wide cookies be set from a webserver on the domain apex, the domain apex (for high volume destinations) needs to be set up for high volume webserving. High volume webserving often means at least geotargetted DNS, maybe a CDN, often anycast in today's reality.
Back in the day, it was common for high traffic domains to run their DNS with a normal DNS server and then delegate (typically via CNAME) high volume subdomains off to a 3rd party DNS server for geotargetting (usually Akamai DNS, but there were others). But you can't CNAME the apex domain away. You'd have to delegate the whole domain to your DNS provider and then you have no way to manage an outage of your fancy DNS provider. Especially if you go back to the days where NetworkSolutions did a single daily zone update for .com ... if you wanted to switch to a new DNS provider for your domain, you would submit the change request and hope it happened in the 24 hours, but sometimes you'd miss the window (or there would be some process error) and it would happen much later.
Less of a problem in today's world, where registries typically update the glue records in near real time (although many TLD servers have a 2 day TTL for glue, so you can't switch off a dead provider very quickly) and lots of domains seem comfortable with delegating the whole thing to their CDN.
that seems strange to me: why shouldn't policy leverage name resolution? sort of like dkim, but taken further. for instance, for site.com, I'd much rather retrieve its public key from DNS (some DNS++ version, of course).
There are use cases for cookies to affect multiple domains, like shared logins. Keep in mind multiple domains let's you run completely independent servers for different parts of your web presence but that doesn't mean that you want them to act independently.
That said the dumbest thing with cookies is not sending their attributes in the cookie header which makes it impossible to distinguish expected cookies from tampered cookies set by insecure subdomains. __Host prefix is basically a workaround for this but took more than a decade to get into browsers. Samesite similarly was bolted on after the fact.
Cookies aren't the only web security feature that follow sites instead of origins but they are the only one that was clearly designed without thinking through the consequences.
No, we wouldn't, you're right. We'd just replace LetsEncrypt and the ISRG with the security track records and policy integrity of the major DNS providers, many of which are state-controlled, and the largest of which are too important to revoke.
Really hard to understand why that hasn't happened yet!
You can chose under which registry you can register your domain. You cannot choose which (in many cases also state controlled) web PKI certificate authority can sign certificates for your domain name. And Web PKI revocation is a joke that many clients don't check at all and others do using privacy-hostile mechanisms.
But sure, keep spreading FUD like you always do on this topic.
For the last 2 years, I've tracked the Tranco Top 1000 sites, continuously checking DNS to see if any major sites have turned on DNSSEC (6% of the Top 100 do --- many of them government sites). Over those last 2 years, a total of 8 sites in the Tranco list have enabled it. It happens so rarely I could reasonably call them on the phone and share my misinformation about how moribund DNSSEC is to them directly.
You're talking about DAME (which email uses). It has it's own issues like not having transparency logs, and if a DNSSEC signing keyholder goes rogue, there is no easy way to revoke trust (unlike CRLs for Web PKI).
Web PKI also has not had transparency logs until fairly recently. And Web PKI revocation is a joke as well. At least a "rogue" DNSSEC signer can only sign domains they have been delegated authority over and not literally everything.
So, this kind of thing happens all the time, and there's the Public Suffix List for exactly this problem.
There would be no issue at all if Verisign, or maybe Global Name Registry, decided to stick to the 3rd level registrations exclusively. Problem is, the chucklefucks over there decided it was a good idea to also hand out 2nd level registrations. Those 2nd level registrations outnumber the 3rd level registrations by an order of magnitude, so the PSL decided to just let joe.smith.name and john.smith.name share cookies. Which, IMO, was not a good decision, but it is what it is.
Yes, but you have to admit that the existence of these SLDs (like co.uk) is always going to be a point of confusion for anyone with a basic knowledge of how the domain hierarchy _usually_ works.
Needing to be familiar with all the special cases (like the VERY special case of x.y.name which I previously knew nothing about) kind of ruins everything and introduces yet more security risk.
> but you have to admit that the existence of these SLDs (like co.uk)
I'm sorry, what ? Admit ? Confusion ?
In the case of .co.uk it has been around since 1996. HN is a technical forum, most people here should be well aware it is a serious SLD. I honestly can't believe it even needs clarifying.
Hell, if you use AWS Route 53 you'll see they use co.uk as one of their nameserver suffixes[1].
I'm not referring to the HN audience; I mean the larger evergreen cohort of people in the world who are still building their mental model of how the web works. They will each eventually be doomed to the same misconceptions because it's a system full of inconsistencies and special cases.
About 20 year ago I registered {lastname}.name and have dozens third level domains below it. So there are "privately owned" second level domains under .name for quite some time...
I'm working on same for my family since I want to properly degoogle a bit. One thing I think long term - if I give my kids first-name @ last name , that means that I forever hold power over their email. Which isn't great. But what's the alternative? Register one full domain name per kid? Even ignoring the cost, the ergonomics are awful.
Imho email is missing a feature for nameless email addresses for when somebody just buys their full name as a domain name. If I get "firstname-lastname.name", having the email be "firstname@firstname-lastname.name' kinda ruins it.
A child born today sees email like we see the telegraph...
they'll grumpily sign up to gmail just so they can get a verification email, and that'll be all it gets used for. Messaging their irl friends will be done in apps like Discord.
lol I ran a sizeable team around 2020 and I had to educate a couple of our new hires straight from college that they actually needed to check their work email, after they missed important HR related stuff and they had just completely not realized it was an avenue for company communication, with an assumption that everything was available on our heavily used slack.
tbh I'm with the zoomers on this one. Work email is 99% junk. Newsletters from every SaaS product we use, "A meeting started", invitations for calendar events that I can just accept ON the calendar, notifications for every transaction on every system ("X posted a comment on Y,") and spam from salespeople, recruiters, etc. And then 1% of it is actionable important stuff that I don't get through Slack.
Email died because of the junk/spam issue. And it's self-fulfilling - when most emails are junk, nobody sends a love-letter or party invitation by email because the recipient probably won't notice it, which in turn lowers the usefulness even further.
If email was a commercial product, the company would have done something about that. Email died because it was an open platform, with nobody to address this systematic issue.
They probably didn't realize why they needed multiple apps to communicate inside the company.
I was in a situation where we had slack for communication between teams, email for corporate stuff similar you described, zoom for calls, personal messengers like WA for communicating with people in the company who didn't have slack, SMS/phone calls for alerts and various on-call staff. Total nonsense. No surprise I missed something.
Funnily I did exactly this, so the {lastname}.name is now legacy for me and nobody else of my family ever picked up the offer to have {firstname}@{lastname}.name adresses anyway.
Later (but before my name change) I managed to secure {lastname}.de which I stupidly missed during the early internet due to being a stupid teenager with stupid convictions. If I had secured this back in the day I think they would happily started using it but now they are all too settled in their provider/free webmail addresses.
Nice twist: The father of my wife owned {newlastname}.de since the dawn of the internet. So I'm still fine on that front. ;)
Aside: I'm honestly bewildered that Google doesn't have the ability to handle that in gmail accounts. If somebody gets married or otherwise needs to change their name, their answer is "just make a new google account" when all your stuff is still tied to the old account.
They rolled this out in March this year in the US (and December last year in India).
I've successfully renamed an old account with an email address I no longer liked. It works quite well on everything 1st party, but does have the potential of causing issues with OAuth on poorly-coded websites that key on email instead of user ID (ie. most of them). You do get to keep your old email address though, so it still ends up working fine in practice.
The feature is about fifteen years too late for me, unfortunately. By this point I need this feature to let me "merge Google accounts". But then I barely use Google anything anymore anyways.
> It kind of seems like an insane TLD structure to begin with, right?
It's been around for years. I seem to remember this issue coming up around 2001 where originally .name was for third level registration (i.e. john.doe.name) and changed to second level it a few years later and caused some problems... https://publicsuffix.org/ talks about it in light of architectural limitations of domain names.
> can Joe set a cookie on all of .smith.name?
That can happen. I seem to remember ancient browsers made it so .name (and other non-generic TLDs) required three periods. I think country code domains and new generic TLDS caused the browsers to change it.
It's pretty screwed up, but a lot of the people with .name domains have had them for a very long time. Sad to see them all lose their identity online that way.
What does Verisign care though? It's been that way for way over a decade since they started allowing 2LD registrations. I very highly doubt they are suddenly so worried about random individuals' personal internet security.
It has to be a money problem. Something they want to do will be simpler if this is no longer a quirky registry. And they know they'll get the money back that they lose from not having bob.smith pay -- probably by throwing all the "last names" once registered this way into some "premium name" bucket and selling them for $1000 and up instead of the ~$10 that zyzgdhaf234.name fetches.
In fact, I'm not sure that scheme isn't the reason itself.
> The first appearance of reversed DNS strings predated the Internet domain name standards. The UK Joint Academic Networking Team (JANET) used this order in its Name Registration Scheme, before the Internet domain name standard was established. For example, the name `uk.ac.bris.pys.as` was interpreted as a host named `as` within the UK (top level domain .uk)
But I don’t know if uk.co.somethingsomething did or did not exist at that time. Or if it was only introduced after the Internet domain name standards we use today existed and so was .co.uk from the beginning.
Oh, uk.co definitely existed for companies. The other 2nd-level domain (besides the academic uk.ac and uk.co) was uk.mod (Ministry of Defence), equivalent to the US .mil. And then, because life is never this simple, things appeared that were neither universities nor companies nor military, so uk.bl was given to the British Library. There might have been others as well, I don't remember.
Back then the code in various pieces of software had hand-written exceptions for domain processing. The joke was that all Computer Science departments in the UK (uk.ac.university-name.cs) ended up in Czechoslovakia.
Agree that the .name 3rd level domains are silly, disagree on .co.uk being a problem.
If .gov and .mil and .com make sense, then .gov.cc and .mil.cc and .com.cc make sense.
Of course, I think having more than one non-cc TLD was a mistake, but that's just me. If it makes sense to have topical TLDs for international and US institutions, it make sense to have national ones.
Nominet and therefore .co.uk has been around since 1996.
.co.uk is not going anywhere, and neither is Nominet.
The only "problem" is the original poster did not do their homework. I suspect they were inferring `uk.co` which is a completely different kettle of fish. The original poster should urgently correct their post.
.uk and .co.uk are both run by Nominet, the UK registry.
Quirky stuff like .co.uk / .org.uk / .sch.uk 2nd level domains partly come around from .uk being the worlds first CCTLD outside the US (and as other parts of this thread say, .us isn't that popular a CCTLD).
Everything was new and different people tried different hierarchy and structures to 2LD and 3LD's. .co.uk is also far from unique, I know this is common in many other places (UK/NZ/IN/ZA/KR/MX).
The UK now allows directy foo.uk registrations as well, but many people still have SLD's registered and will continue to do so.
In the UK Nominet (the UK domain namr registrar - nic.uk) only permitted 3rd domains - co.uk. org.uk, me.uk. then there were "prove your status" ones such as ltd.uk, plc.uk and ac.uk plus ones like gov.uk, mod.uk, sch.uk, nhs.uk etc.
It definitely makes sense for stuff like (non-US) gov domains. Have a federal agency control the `gov.<ccTLD>` domain and hand out subdomains to other agencies. See https://dachmarke.gov.de/ for example.
But I agree it makes no sense for public sales to the wider world such as `co.uk`. At least have the registrar be the govt company register and hand out subdomains to each registered company.
To me that sounds like reasonable structure. I hold that every single edu, gow and mil domains should be moved under respective ccTLDs. After this sort of move that doesn't seem unreasonable thing.
Ok, co.uk was perhaps a bad example, because it's owned by the same registry as the TLD, but perhaps there are other 2nd level TLDs where that is not the case. My point is both that it's hard to tell, and more broadly why would anyone want their domain to be tacked on to some 3rd level subscript anyway, when there's so many plain top level domains available. Surely most of us (present company excluded perhaps) do not feel so passionately about the reverence of `co.uk`
I don't have some nefarious desire to scare people away from the TLD of their choosing. Really I'm bringing it up to be like "why would you even, like, want some 3rd rate domain instead of getting a .com" so I don't think there's anything to correct
It's not reverence? I think that you're missing that it was a requirement. Basically every country (that followed ICANN's original rules) does this: .com.au, .co.nz, .co.jp, .com.mx, .co.ke (+ the org/net variants for each country)
The US is the only country where registering .com was allowed by ICANN (and not .com.us or something).
ICANN relaxed these rules in the 2010s I think, so now you can register 2LDs at most/all of those country TLDs.
Sovereignty? If you live in the UK, choosing a registry in the UK is a pretty good idea even if they only offered 3rd levels. You’ll have someone to contact and possibly sue locally. Your domain will be subject to UK law and standards, not those of a foreign registry.
Its not hard to tell for things like ".uk" or other serious suffixes.
It only (maybe) becomes hard(er) to tell for all the vanity ccTLDs that came along in the 2000s. But even then 10 seconds on WHOIS and Google should fix any doubt.
> about the reverence of `co.uk`
What are you on about ? Lots of other countries do it too. Japan is one example given already here, but there are dozens. It is very common practice for country tlds.
You're absolutely right, when it's Nominet's actions that actually inspire a lack of trust in .co.uk, given they've been a bit of a hot mess since the early 2010's-ish.
;)
(Edit: although I should add that I'm hopeful that things have improved there over the last few years).
Actually, the fact that you have to cite official registrar docs is exactly the problem. There are 200+ country TLDs, and by now probably thousands of other self-governed TLDs like .name.
For instance, in Serbia, there is a similar scheme to UK: .gov.rs, .co.rs, edu.rs, but also in.rs (for individuals) and top-level .rs. So someone has registered "iz.rs" and offers free subdomains to individuals.
The fact that there is implied hierarchical trust is what the problem is, and keeping track of individual rules for each TLD is prone to errors.
What the author describes here is hard because it's "simple."
What's simple because it's "hard" is replacing parts 2 & 3 with a network appliance like TrueNAS running a zfs pool that syncs to backblaze every night. Yeah you have to learn a bit but it won't fall in weird ways like the hard drive part here will just fail to mount one night and not back things up for 3 months until you notice. My 2¢
> like the hard drive part here will just fail to mount one night and not back things up for 3 months until you notice
I think the author is having trouble because he is conflating concepts and roles that should be distinct. Sync, rotating snapshots, and deduplicated backups need to be kept entirely separate if you want any hope of maintaining your sanity.
So he's got sync but he's missing some sort of rotating snapshot system which would solve the stated concern of guarding against syncthing replicating corrupted data. Such automated snapshots can then be used as the source to feed the backup pipeline.
That hard drive doesn't make a good backup because it seems that it is always online. You need an offline backup that you manually plug in to run the job once every so often.
He's also making this more difficult than it needs to be by insisting that the backup drive be compatible with windows. Plug the drives for both snapshots and backups into a linux box, format them with a modern filesystem, and get on with life.
Sync is its own clusterfuck and I have yet to arrive at a satisfactory solution myself despite wasting inordinate amounts of time on it. IMO you either go with a network share or you make due with the "least bad" option of syncthing. Personally I've more or less settled on sshfs at this point not because it's particularly good but because it works well enough and doesn't add any additional complexity.
Personally I use btrfs snapshots on all my devices, those get streamed across the network to a NAS, and the contents of the NAS are periodically (every few months) stuffed into borgbackup on redundant offline devices. Aside from sync the other problem you'll run into if you're a data hoarder is how to split backups across multiple drives once you exceed a few TB. Because external drives only get so large but the NAS will inevitably keep ballooning.
> Scaling to hundreds of thousands of files is not a problem, scaling beyond that and git will start to get slow.
So that's probably insufficient for me by at least a couple orders of magnitude. I'm able to maintain my sanity because snapshots simply capture device state, the NAS collects all snapshots while maintaining their independence, and (so far) borg has been sufficiently scalable to deduplicate any collection I've thrown at it.
Less hard these days. AI is a game changer for learning new technologies. It's like having a highly paid expert available to answer all your questions about your little USB backup. Makes learning how to use properly a new software trivial. And priceless when troubleshooting.
I agree I think one of the main things I learned from all this was that I should probably buy / set up a real NAS. I’ll look into zfs pool thanks for the comment!
This caused all sorts of grief at day job where dedupe was useful for a big cache. Conversely I've run ZFS at home for like 15 years at this point without trouble. But this one is an absolute nightmare.
Yes, who would have guessed that the <textarea> element, designed specifically for this use case and built into browsers for 3 decades, would be the most performant and behaviorally consistent way to implement editable text.
I'm kind of sad the author stopped shedding unneeded complexity there though... we're not really building a text editor yet, we're building a website with a fancy input field. If we want to build a proper text editor we must eschew the bloat that is the web browser too.
The browser-standards-or-bust moment has past, hasn't it?
If you want your app to work the same way across platforms, using browser defaults is not the way to achieve that.
If you want users to have a consistent experience within their browser across the web, I get it, but that's not how the Web has worked for a long long time.
So we take a web browser and trim it down to only ever show a single <textarea> element you say? That's what I'm taking away from this. All the hard work for accessibility is already done then right?
My charitable read is a legal cartel that allows the small club to switch to Marathon instead of Sprint mode, and drip feed us frontier models at inflated prices, while preventing open source and overseas labs from releasing models because they're unsafe (for the Blessèd Fews' profits).
My uncharitable read is somehow even less constructive..
> generated text being watermarked is universally good.
If it worked perfectly, maybe you could make this argument in a vacuum.
It does not work perfectly. (It cannot. It is by definition a heuristic). That means there will be false positives. There is a chance those false positives ruin someone's career. See [0] for just how easy it is to push SotA "AI text detectors" in one direction or another.
Now, with watermarks, instead of everyone to some extent understanding that AI text detectors are wishy washy woo, they are now Anthropic certified to detect an official AI watermark.
With that kind of false confidence in hand, the people who trust the "computer says you plagiarized" machine are never going to believe you when you say "it can make mistakes," they're just going to fire you/take away your scholarship/cancel your grant/...
This is all beside the fact that we should demand our tools work for us and not for some shadowy master. "Universally good," absolutely not.
Watermarking the outputs themselves is very different and much more effective compared to how tools like Pangram work.
Obviously false positives will inevitably happen (even though, they are incredibly unlikely with SynthID), but even still, that doesn’t somehow make good faith watermarking attempts bad.
Also, a watermark doesn’t stop your tool from working for you. It just stops you from passing of its work as yours.
Maybe it is distributing your private keys it read into your public repo as a way to exfiltrate data later? What does the watermark actually say? How much data is in there? So much for zero retention policies. Makes you wonder why Claude likes to be so wordy, especially in comments -- it must do so in order to watermark!
Also, this kills me! "It is harder to watermark factual answers because the model has fewer alternative word choices available without altering accuracy." Hilarious! So the models need to hallucinate more due to the EU AI Act.
I go the other way on images and video, though easy enough to strip as part of a pipeline.
> Also, a watermark doesn’t stop your tool from working for you. It just stops you from passing of its work as yours.
I think we fundamentally disagree on what "working for me" means, but I remain steadfast in saying we should not accept tools that have ulterior motives beyond producing the output desired of them by me, the user.
> Watermarking the outputs themselves is very different and much more effective compared to how tools like Pangram work.
At the end of the day the only artifact is text that you can do statistics on. It's the same problem as today, with the probability shifted slightly more in one direction. This does not assuage my concerns at all.
> they are incredibly unlikely with SynthID
I kept my commentary focused on text watermarking specifically because I agree, a synth ID image watermark false positive is highly improbable. There's plenty of noise to robustly hide whatever you like in an image. Text is simply too capital I Information-sparse and fragile.
> good faith watermarking attempts bad.
I would sooner call it "ignorant faith" (if they don't know what they are emboldening) or worse "don't care" faith (there will be false positives and they accept this to further some illustrious and arbitrary goal of Text Purity). Whether that be to prevent model collapse or help you not waste time arguing with bots online, to me the principled stance of "tools work for the user" wins..
Why is that so clear? I can think of hundreds of real daily problems I'd rather my legislators be focused on than deciding how old my kids have to be before they're allowed on some website.
I would like affordable groceries and public transport, not whatever this is.
If they really want to "do something" then require an 18+ ID at a cell phone points of sale. That'll be something that won't affect me and actually will temper a ton of underage Internet use. Then they can study the actual effect of that and whether the harms were exaggerated after all.
And, reminder, so no one here loses the plot: this is a backdoor feel good measure lobbied for by big tech to push us into a world with mandatory device attestation so their ad impressions are worth more. They could care less about your kids.
Right? If I had to come to with like, five problems that I felt like they were both urgent enough and and significant enough that we should literally implement the least bad policy immediately rather than do nothing until we come up with something better, I don't think this would be on my list, and it definitely wouldn't be the top of my list if it was. There are things I think that are more harmful and have been going on a lot longer where people don't seem to have any desire to push back as hard against letting the perfect be the enemy of the good, so it's hard for me to take legislation like this at face value rather than suspecting that there's something less direct that the government is getting out of it (and I say this as someone who is pretty much invariably very far to the left and often in favor of heavier government involvement in various areas).
I have basically the same reaction to this framing: if I had to list the five largest threats to our functioning democracy in the US right now, social media use by teenagers would not make the list.
What are your five largest threats to functioning democracy in the US right now?
Because I question any list that doesn't include a substantial chunk of voters being ignorant on concerns of critical importance to the country.
And if that's a problem now, as a result of a couple decades of low-brow, high-emotion 80s and 90s conservative talk radio and tv, then what do you think better-engineered algorithmic slop is doing to the next voting cohort's brains?
Democracies succeed or fail on the average voter's ability to somewhat understand matters.
Nothing is not politically viable for the parents who want controls to limit their children's access. It's funny watching HN constantly berate parents for not parenting while parents' material conditions don't change. Same environment, same result, and frankly there's more of them and they're better organized. All it takes is parents to win once. You have to not lose every time.
The problem is strict controls is not helpful. My kids teachers often assign homework which is watch some YouTube video - which means I have to give my kids access to all of YouTube including channels i don't approve of. In turn i have to stare at my kids screen - a very creepy move - instead of working on whatever my own project is when they are doing homework.
I constantly find something as a parent where I can block way too much, or nothing at all. There is no middle ground. Mind you a middle ground for something the size of YouTube is probably impossible just because of the quantity of things there that I might or might not want my kids to see - but the current situation is not working.
When my kids got to an age they started asking for YouTube videos, I found it entirely frustrating that Youtube Kids was just not feasible to setup like you describe. It was a choice between 3 things, everything, the "kids" section whatever that meant for YouTube, and just tell them sorry, not happening. Within the kids section there seemed to be some controls to help, but I found they did not work well at all and I could easily watch anything in the expanded kids section. I'd have been happy with a whitelist for channels.
The existing parental control features are deliberately mis-designed, because there's a lot of money at stake and Meta / Google aren't stupid.
Does anyone really think they didn't run uptake and engagement impact tests on various proposed parental control options... and then ship the one that impacted their revenue least?
The only reason there are controls, in any sense, is as a fig leaf when the lawsuits inevitably started flying (read: now), so they can say 'See, we take this very seriously...'
Thanks, that’s the type of details I was looking for, as I’m not a parent myself. That does sound like a bad situation, indeed. Though it’s also a bit strange that watching a YouTube video is a homework. I would have assumed that schools have their own platform
Yep. All I want is allow/deny permissions on particular channels. For my little guy I'd set up a blanket Deny rule, with a few channels allowed; for older kids parents might want to go the other way.
All of the "parent better" messages are useless (not to mention out of touch) when technical tools to do so are not made avaliable to us. And, of course, those tools are not given because YouTube wants to drop kids into the endless algorithmic feed of slop. The age verification laws are stupid, and will nowhere address the actual problem. YouTube (and the like) - not parents - will still have full control.
It’s useless as a blanket statement, but not if you go in specifics. With enough public pressure targeted specifically at YouTube it’s completely possible they would add more controls, and is more reasonable than a complete ban of social platforms
I understand what you mean, but I do not, at this point, think "public pressure" is sufficient. I once did, but that was before ad companies (and they're all ad companies, at their root) unlocked the full potential (if they even have) of data-mining and algorithmic targeting. They know us better than we know ourselves, and make too much money hijacking our dopamine systems to respond to anything we say we want. Legislation is the only thing that will reign them in.
I'm not saying that social media can't be good, or shouldn't exist, or shouldn't be able to make money. Early-YouTube and early-Facebook and early-Twitter (and their fallen predecessors) were good communicative platforms. I used them, and by-and-large thought they made my life, and society at large, better.
It's the data-mining and algorithmic targeting / feeds that need to be regulated.
The controls I'm referring to limit all kids access simultaneously. Turning off just my kid's access doesn't change the social conditions under which kids interact. It just cuts off them from their friend groups while nothing else changes.
Where in the settings do I go to turn off every kid's access at once? As far as I know, that setting is only accessible through my legislative representative.
> Where in the settings do I go to turn off every kid's access at once?
It might be worth re-reading this particular sentence again, out loud, and really consider what you're asking for here. And why stop at internet access once you're starting to think like this?
The above poster isn't saying Internet access; they're saying access to the ad-filled Skinner boxes that are trying to position themselves as necessary for communication through network effects.
Incidentally, the bill doesn't even say they can't use them; it just says the platform has to tone down the Skinner box part for children.
> This subdivision does not prohibit a covered platform from permitting a user who is under 16 years of age to create or maintain an account on the covered platform if that user is not provided with any addictive feature.
So it's not a social media ban. It's an addictive features for children ban. And it seems kind of obvious that running an optimization algorithm with engagement/attention as the objective is going to be bad? If that optimization works, you would almost necessarily have to be detracting from other parts of the person's life (interfering with study, exercise, socialization, etc.), which seems to be exactly what we see in aggregate (lowering test scores, increased isolation, etc.).
The poster seems to be asking to limit access to the platform, not change the platform to be non-addictive. I understand what you are saying is what the law is trying to accomplish, but I think they are clearly expressing the desire to limit all kids access to social media apps.
>Turning off just my kid's access doesn't change the social conditions under which kids interact. It just cuts off them from their friend groups while nothing else changes.
If you don't teach them to resist peer pressure when they're younger then they won't know how to when they turn 16 or 18 either, and they'll end up as losers with an external locus of control who blame other people and apps for their own failures of willpower.
Peer pressure is one thing. The entire commercial might of the US tech and cultural industry is harder to resist. It’s not fair to put responsibility on children to have willpower in their use of SM when thousands of PHds are actively researching how to make the services more addictive and increase their network effects.
It would appear that is exactly what is being proposed : to not place that responsibility on the children, but for the parents and other adults to shoulder that burden by not allowing the children to become victims of the addictive Social Media empire.
It seems like this EFF article is suggesting that sort of political action and attempting to coordinate it. Why exactly are you “spinning your wheels” here on HN?
I don't understand, could you rephrase your answer to his question? I read his question and read your response, but don't see a connection between the two.
Sorry, but that's not an answer to my question. To be honest, I'm starting to feel like you're not really talking to me, you're just responding to me.
If you're asking for evidence of people changing their minds, I've done that, though I will admit I haven't done it in the past page of comments on hackernews.
Normally it's not a wholesale change of opinion, but a shift in nuance or a changing of details.
But even if I found such a thing, that doesn't answer my question.
Most of my interactions in age gating discussions on HN have pushed me toward indignation, rather than nuance. It's arguing against someone's hypothetical dystopian nightmare. I'm tired of the game. If they want to affect change, they can do it financially as I am.
Looking forward to seeing this same treatment on the privacy folks and how they respond.
Vaccination has a very reasonable public health argument, even ignoring the fact that it has been massively eroded, and comparing vaccination to social media is disingenuous.
If Timmy is on Instagram, John’s health isn’t at risk. If Timmy comes to school with measles, John’s health is at risk, and vaccination has been shown to reduce the risk to both Timmy and John.
You cannot regulate peer pressure, even with the complete ban you would still have kids using other platforms for social interaction and have peer pressure, like on roblox or whatever
This has never stopped anyone. For example, Climate change legislation makes little sense unless implemented worldwide. War crime or anti-terror legislation doesn't really make sense unless it's implemented across borders (and pretending doesn't count. Nobody's even talking about arresting Putin, or anyone else for that matter). Taxation ...
The point that HN libertarians miss is that the whole point of social networks is that they benefit from network effects. This is what makes them profitable. But it’s also what makes it necessary to subject them to democratic accountability and makes them a legitimate target of public policy.
If my teenagers entire peer groups spends 90% of their waking life on addictive social networks and a ‘normal’ social life is impossible without it then the parent is faced with a Hobsons choice. It’s easy enough to band my 10 year old from social networks. It’s much more complex doing that to 14 year olds and potentially does have negative effects for them unless their friends are similarly limited. This is why we need regulation.
One obvious solution is of course to break these companies up. Set a maximum user count that a communication network operator is allowed to have before we break them up (say, 10M). Require some kind of good-faith open federation for any communication provider over a certain size (e.g. if a user adds a user from another provider as a friend/contact/follow, you must allow that and cannot claim you are "blocking spam" or something to act as a gatekeeper).
Then your friends could use the evil instance, you could talk to them on it through your good one as a federating relay (e.g. yours might operate on a friend whitelist), but the parent could otherwise block access to the wider content pool and ad-filled addictive UI of the evil instances.
This would actually work well for ISPs and phone companies too while we're at it. And email providers. Actually a statutory maximum size (customers, revenue, etc.) could make sense for companies in general, probably. Revenue above 0.1% of GDP? Breakup.
If your 14yo spends 90% of their waking life on any device it should be pretty obvious for a parent. If you let your kid spend that much time on a phone, then any government ban in place isn't going to do what you think it will.
I wish the author got more into the weeds of anitcheat and how it evolved over time. Jagex was banning bots based on mouse movement heuristics in like 2005. 20 years later and there's some JS framework on the front page here heralding that same kind of analysis as some revolutionary new approach. I can only imagine what the modern anticheat engine entails, especially in the era of LLMs that can reliably emulate a human player. (Some of them can even write quite technical blog posts that almost escape detection ;)
On the contrary. I played the game heaps. If someone with no knowledge of a game beyond its engine and anticheat develops a bot, they become solely reliant on 3rd party developers ("scripters") to develop the content-specific automation programs for the bot. These are usually sold or rented on a form of UGC marketplace within the bot vendor's platform. This is tricky to balance and can produce situations that many teenagers/young adults who are running these platforms have not envisioned.
One such situation:
A particularly competent "scripter" writes automation programs for the most complicated content in the game. As such, they sell at a premium. It makes you and him considerable money for many months. Eventually, the community starts to develop a free version of this same automation program. You are now in a situation where you've likely built your business around the expectation of revenue from this one "scripter" and his/her products. Maybe you've even given them a more favorable revenue share model.
Another issue that can pop up from this, especially in lower pop games, is that it's very obvious from a statistics point of view. The game developer will easily take notice if the hardest content in the game is suddenly being done many times per day by players who have never showed an affinity for such content. This in turn increases ban numbers which hurts your product's reputation.
All of this is to say: Having thousands of hours in the game you are working on is a massive benefit at every turn. It is best to work on games you genuinely enjoy.
Modern RuneScape was a pit of whale hunting mtx pay2progress nonsense. As soon as they started to make an effort to restore integrity to the game, I stopped farming gold and selling the bot. Got a regular job. Now I enjoy the game as a fan and am very excited to see how far the new Jagex CEO can take the company and its titles.
I don't have any regret for profiting from a game being bled dry by bankers. When that stopped, so did I.
It is false. They don't need them by any means. In some specific cases, bots do help, but this is usually a result of poor design. An example would be any expendable resource that is required in large amounts, but is very boring and unrewarding to gather. In these instances, bots can be argued to be a positive. But for bots to exist to farm these boring resources, they must also exist to farm end-game content. If they exist at all, the negatives will always out weigh the positives. The positives exist, sure. But they're few and far between.
From a regular player's perspective, if they want to kill a boss for 3 hours, they must use X amount of Y resource. If the cost of Y resource is very high, or worse, the market has not enough supply, the game becomes less fun for them.
This is addressed by bots, but is better addressed by a design solution from the developer.
All of that being said, if bots exist, the reward for going and farming that boss is going to be far less than if bots didn't exist. So still, negative.
Honestly, I dont know why "xbox mode" isn't this for PCs. Instead of anticheat, reboot into a stripped down mode just for playing the game that has a secure boot chain that the app can attest and report to the servers about and then reboot back into normal windows.
booting is so quick today that its hardly a friction point as it used to be.
If it lets people play League on Linux thats a deal most will take. Tech people overestimate how much a normie cares about the anticheat or their data being sent to wherever.
This is where we're heading. But just like anything else, there will be an equal and oppsite reaction. Either side of the aisle making one large leap is bad. Regular users lose at every turn.
In reality since the new CEO, they have been much more strict with antibotting and they have virtually disappeared from the game. It’s been an incredible 6 months without major botfarms in the game. Botting subreddits have been on suicide watch since.
It's gotten pretty good (finally good enough that you can observe it in the game's macroeconomics), but if you're any good as a programmer then it's no work whatsoever to build something which can bypass it indefinitely.
Sadly, the anti-cheat is not something I'm too knowledgeable in. Half of the story is visible in the client: which data is tracked, and when (as well as some visual adjustments to defeat older colour-recognition bots such as SCAR) - as well as the data scrambling I mention in the article, though this was more likely meant to break all third-party clients and packet sniffers.
Knowing how Jagex used this data once they'd tracked it isn't something I have much of an idea about, though.
On the wink: I wrote this article by hand over a couple of weeks back in May; I used AI to provide wording review on some of the more technical sections, and to create the SVG diagrams from my specs.
The evolution for Old School RuneScape was to just make cheating a built-in feature. It only takes a couple clicks every ten minutes to "play" the game.
I don't think you are wrong, per se, but at the same time the skill level of late-game (or even mid-game) encounters has also been increasing. Plus, they usually aim to strike a balance between less intensive but also less efficient activities vs. the ones requiring frequent clicks and full attention but offering quicker progression.
this was the evolution of most online games, same reason why every action/shooter game that's online at the moment has a mechanic that allows players to see through walls : if players have that mechanic available to them then there is a likely scapegoat to believe killed you rather than realizing that it's a hacker with invisible textures or wall hacks; lessens the work for the developer answering hate mail from people that got killed by hackers.
Which was added because people were already doing that on the normal crabs, but fighting over the spots. So they made a crab that any number of people can fight at the same time (combat is ordinarily one to one), and it always lives for ten minutes no matter how many people are fighting it or how hard.
> You have the power, and should exercise it, to rate limit bad actors
It's well known, and it was the point of the OP, that we don't have that power. If you know a solution, please share it - the world would love to hear it.
reply