HorstG

I disagree. I really think doing an intentionally crappy job is acceptable. Not even pretend. I think it is okay to really half-arse it. Or break it. Or be lazy. Or whatever. Except maybe intentionally harm someone.

No. Just no. They may do so to the worst of their abilities. Thats their prerogative.

The only limit might be publishing something that is actively intended to do harm. But I can't imagine a plausible example of that...

GDPR binds an operator of a service. The developer can do as he likes.

Just as you shouldn't eat everything you just picked up from the sidewalk, you shouldn't just use any code thats available out there.

check, check and check again...

Security isn't a special license for being nasty. Criticism is fine, even with some urgency due to security being important.

But software done for free by volunteers carries no obligation of a legal or even a moral kind, whatsoever. This is completely different from selling software or doing work for hire or donations. There a moral and often even legal obligation exists.

Defense would actually be quite easy. Just undesirable. There are working antisat weapons in the major powers' arsenals. However, they would produce nasty debris clouds.

And then there is also the vulnerability of the lauch site and control center...

Launch capacity scaling isn't only possible through useless comsats.

And astronomy is still an extremely important component for becoming space-faring. No use in going somewhere blindly when you can have a look first. But if there is no-one looking because nothing to see, funding dried up, scientists demotivated,...

Theoretically yes, through interferometry. But that is really difficult when there is relative motion within the constellation such as with starlink.

one gets time signals from photomultipliers, but those are too bulky for traditional pixel sensors. And something as bright as a satellite flare might fry them at an unexpected moment. They are usually built and tuned to be able to observe few to single photons.

Well then, we should also have Elon pay rent for use of space...

Depending on the type of measureme t taken, a dark transient is also harmful. However, by far not as bad as a bright transient.

It will kill astronomy pretty good.

The key point is usable observation time. Our current handful of satellite telescopes provide 24h of time a day. Each terrestrial telescope provides maybe 8h. However, there are a magnitude more telescopes on Hawaii alone than in space. You would need to get a hundred satellite telescopes to begin to replace earthbased observation time.

And that doesn't even begin to talk about the possible instruments, mirror sizes, astronomical costs of buulding and running satellites, etc.

Modern astronomy works at the edges of whats possible, a single frame might take hours. Needing multiple frames would mean multiple days per observation. It would mean no longer seeing faint and distant objects, limiting us to younger, closer and frankly far more boring objects. It would make observing variability impossible for certain timescales.

You need old distant objects for cosmology, observing the structure if the universe, big bang and stuff. You need variability for finding exoplanets, measuring distance and observing transitions such as supernovae.

Oh, and then a huge part is taking spectra, which means bouncing the light directly off a grating. Filtering transients is hard to impossible there. You need spectra for relative motion, magnetic fields, composition of matter and radiation and of course temperature.

Needing such filters would set astronomy back a few decades

Yes, but stability against vibration and thermally induced warping is also important. So you could make the mirror thinner than on the ground, but not really thin.

Cherenkov telescopes for neutrinos do look down for reasons of schielding. Neutrinos can pass the earth, other particles not so much.

But those are a special case, air cherenkov telescopes are looking for "less weird" particles like photons or protons. Those can only be seen looking up, since the primary particles moving down focuses the cherenkov light down in a narrow cone.

Gravity is an issue for mirror production. But it is far less of an issue than tension and deformation during the months- to years-long cooling of the substrate. The temperature and environment control to do that is challenging on earth, fairly impossible in space. Except with maybe a really really huge spacestation as a thermal sink, which we won't get for the next few hundred years I'd guess...

Because cherenkov radiation is only observable in a transparent medium like air or water. Space doesn't work because the speed of light in space equals the speed of light in vacuum, therefore no cherenkov radiation.

There is CSS media query for exactly your use-case. No need for sniffing, round-trips or any server-side activity at all.

Sites need to be told to obey DNT with a legal sledgehammer. Still hoping...

Exactly. That is also why "logging in to Chrome" or rather Google is such an insidious misfeature. Soon they will be the only ones with cross-site tracking and third-party-cookie equvalents in the leading browser.

That would be check mate for all other advertisers.

I'm just not sure whether it's good or bad that antitrust regulators won't notice before it's too late.

Agreed, for things like autoplay. But dual-use features like feature detection that also enables fingerprinting cannot be replaced by randomized misinformation because that would really randomly break legitimate stuff.

The only privacy-conscious way would be no feature-detection at all or a very coarse-grained approach like "I support HTML2021".

Also, "please upgrade, then call back" is always the first point on any support call checklist.

Yes, but unfortunately using the user agent for only non-stupid reasons is a postcondition for the hell freezing over.

That would still cause pages to do evil things if users set their privacy budget to "0/paranoid" or anything below "11/just gimme all".

Just as with adblockers users will be nagged about "please turn that dial to 11". On average nothing will improve except for users who are able enough to get around those shenanigans even now.

Client hints are not any more useful than traditional UA for privacy or progressive enhancement. Its the same content, just split up. Any browser not sending everything will have atrocious permission UX, nagging websites or just get the broken IE5 version.

UA hints solve nothing, even after reading the spec

Yes, but the fear remains that all sites will just always request everything from ua-client-hints. It is also totally unclear how browsers will handle this. I think making this permissioned will just add to the PrivacyNagOverload. Also, browsers will continue to lie in the hints because sites will always make broken assumptions or even try to do mischief with the info.

I think the only winning move is not to play: Freeze the User-Agent and do not provide a replacement. Or at the very least, make the replacement based on actual feature bits, not version numbers and device models.

If you need a portable replacement, there is Perl. Available since the last century. If you don't care about obscure Unixes, there is also Python and a whole bunch of other scripting languages on more modern systems.

I agree that 5 to 10 lines might be a sensible upper limit where a shell can safely be used.

Basic does have Goto, but modern dialects do have all the usual control structures. Perl has weird syntax, but far less dangerous footguns: e.g. there are proper arrays, as opposed to many shells. One can distinguish between an empty and an undefined string. One can declare variables and there is the notion of data types. There are even things like taint mode. In shell, you can't even properly iterate over a directory without nasty surprises.

Same in C. Yes, there are memory safety problems, but those are outnumbered by far by shellscripts exploitable via some expansion or variable injection. Its just that thankfully nobody uses shellskripts as network services, so you don't see as many reports about that.

And yes, brainfuck was there as hyperbole. But I truly believe that there are very few things worse than shell for programming.

There are lots of those footguns in shellscript. One should always try to avoid any shell and rather use python, tcl, perl or powershell. Any criticism one might have about insecure and broken by design languages apply doubly to shell.

A short list of possible problems (of course depending on the shell in question):

spaces in filenames

newlines in filenames

nonprintables in filenames

empty variables and their expansion ([ x$foo = "xsomething" ])

errors in pipes

environment madness

/bin/bash ?= /bin/sh

Arrays or the lack of it

Space separates lists as arrays

#!bash vs. #!/bin/bash vs. #!/usr/bin/env bash vs. #!/usr/sfw/bin/bash vs. ...

Unwritable and unreadable control structures (if [], case, &&,...)

Information leaks via ps

and many others...

Never use shell except to search for and invoke a sensible language. And anything is more sensible, including C, Perl, brainfuck and Basic.

Depends. But usually being first author counts for more in most fields. However, e.g. in particle physics papers with hundreds of authors are common, alphabetically sorted. Sucks to be Z. Zymmer, nice to be A. Aaronson. People from the field of course know about this. Sometimes they might even act accordingly. But politicians and administrators far too often don't.

And then there is bibliometrics, the art of lying with publication statistics. Everything humans get wrong is even worse there. A. Aaronson is different from Al. Aaronson, right? No paper has more than 3 authors, right? Journals always count for something, conferences don't, right? etc.