ghxst

The proxy you suggested sounds similar to a WAF, I don't doubt there's use for it but I would assume it comes with similar downsides.

My fear is that platforms that will go to great lengths to enforce this will become an RL playground for some devs to train their chatbots.

I would say you can get to this point far below 100 million people, especially on web. Some people are truly special and have some kind of setup you just can't easily reproduce. But I agree, you do really have to be confident in your ability to control rollout / blast radius, monitor and revert if needed.

Highly recommend this video as well, he has a bunch more worth watching. https://youtu.be/rdlZ8KYVtPU?si=wgjkkNDSzuuS3lVK

How does it compare against tshark?

Any docs on this? I didn't know this was a thing.

The use of "storage.googleapis.com" is probably because it's an "authority" domain that apps can't easily ban without side effects. Buckets can typically be used as a static site host where u can host a client side redirect, depending on how you set it up you can make it almost impossible for an app to ban a campaign in real time.

I'm working on a shared remote box for AI assisted development, will definitely look at this for some inspiration.

Don't forget color bots!

Most of them abuse the ip pool attached to lambda from my experience.

They do KYC when you want to unblock certain domains.

That really sucks. Any advice on how to "negotiate properly" to avoid a situation like this?

Is this constitution derived from comparing the difference between behavior before and after training, or is it the source document used during training? Have they ever shared what answers look like before and after?

If you go http native, could you leverage range headers for offsets?

I've used wireguard for a while, not sure why I never considered doing BGP over it, might make for a fun weekend project.

And patients can use it to improve communication with their doctors (which, given the short duration of an appointment can make a big difference.)

Unfortunately, I feel like I'm in the minority here, but AI has been really helpful to me and my doctor visits when it comes to preparing for a ~10-minute appointment that historically always felt like it was never long enough. I can sit down with an LLM for as long as I need and discuss my concerns and any potential suggestions, have it summarize them in a structure that's useful for my doctor, and send an email ahead of the appointment. For small things, she doesn't even need me to come in anymore and a simple phone call to confirm is enough. With the amount of pressure the healthcare system is under, I think this approach can free up a lot of valuable time for her to spend with the patients who need it most.

IMO eliminating as much client side authority as possible is a very good foundation for MMOs where the latency is acceptable or factored into all aspects of the game (looking at old school runescape as an example). Very cool project!

Just short of 300k members on discord (almost 17k online) at the time of writing this. It's their Google Labs discord.

Not dismissing your first argument but we had good success hiring talent through Discord servers. If you want to reach the same audience that attends hackathons and such it's in my experience the best platform.

They've used discord for a while for things like GSoC but in general it's becoming more widespread seeing that even Copilot has a Microsoft owned discord server, Valdi from Snapchat as well.

Please consider allowing the user to modify the TLS handshake / ClientHello. Out of all proxies I have used only Burp offers this through a plugin / extension.

I went from charles to mitmproxy to proxyman and am currently using Reqable. Something all of these miss imo is a way to modify TLS handshakes.

I'd say Reqable is a worthy mention as well.

Assuming a secure connection this isn't possible without terminating TLS and re-negotiating.

Maybe a stupid question would TOR be classified as a VPN in this context?

Pin the public key (SPKI) or CA.

From a security perspective it is best to assume everything in a GET query is public, it's not always your server logs that you have to worry about, it could also be logs on the clients system (as an example).

Not all websites work well, and you get a lot of captchas last time I tried it. From memory the way they make this work is pretty cool though, they capture Skia draw commands and send those over the network and use a wasm library to replay them.

Browser data points can make it easy to identify a browser or in some cases even a specific machine, but that doesn’t necessarily equate to identifying a user. What frustrates me is that it takes a service I trusted with my personal data to be the one that attaches an identifier to those metrics. The best practice for privacy is to always keep profiles and identities separated, rotate P.O. boxes, email addresses, phone numbers, and payment methods so that when someone identifies your browser or device, the accuracy of linking it to you stays low. Of course, this approach comes with its own problems...