xoa

I'd like to add some extra strong emphasis/support to your post:

Being ahead of the game is never a bad thing, especially when small towns are so easily exploited due to income and infrastructure. They just can't afford long legal battles.

It's not merely "never a bad thing", for certain tools like zoning it is, at least in the jurisdictions I know of, required to be well ahead and consistently enforced. It's not something towns are allowed to do retroactively, if you have no proper legal town plan/zoning setup in place as well as various ordinances like noise then by default the only controls are the relatively weak state ones. There are many things a government is allowed to do if it's part of an overall plan that applies to all equally, but not if it's "we just don't like those guys specifically", and the best way to demonstrate that is to be making no special moves around a given arrival at all but rather to have it all setup.

Of course, there are as you suggest lots of other good reasons to be ahead too. It's a lot easier to consider things thoroughly and get community agreement when there isn't massive time pressure or lobbying going on and emotions aren't running high. It's easier to get some expert consultation at reasonable prices (in some cases there may even be community members with the skills and willingness to volunteer if it's not a time crush), to enact longer term infrastructure plans, to get any state approval if needed, etc etc. But there are legally serious hard lines as well and if towns are caught napping they may just not be able to use them at all.

I can't think of any industry that has a market leader that only gets further away from their competition forever.

You're on Hacker News and you can't think of silicon fabrication? What brand new players do you think are about to catch up to TSMC or Samsung? Or what about advanced jet turbine engines, why is China still having such trouble matching the performance of existing leaders after decades of work? Or operating systems, it's been Apple, BSD, Google, Linux, and Microsoft (or derivatives of these) for a long time. Or web browser engined. Or...

Some things are just really hard and involve enormous amounts of specifics, sunk costs and so on. Even if you know it's possible the implementation is everything, the idea that everything is trivially RE'd/cloned seems to have its limits in the real world.

however using an old PC as a router almost certainly wastes an enormous among of power

I don't think you're quite right on this, or at least you're imagining using something inappropriate when the comparison here involves buying something new right? So it's not "OpenWrt One" vs "whatever you happen to have in your closet" but "OpenWrt One (~$110-130)" vs "whatever can be bought used for $110-130, if you have nothing appropriate". And while they won't go to near-zero like some ARM stuff might, idle power for PCs improved a ton after around the 2013 era. There are lots and lots of small systems available for equivalent prices on Ebay or the like made since then (like Intel NUCs or various other mini PCs) that will idle around 4-10W. Like to take something in the same price range as this OpenWrt One, I regularly see 7th gen era NUCs going for <$140. An i5-7260U will have single threaded performance about the same as the MediaTek in this unit and multi-thread close, but will also generally have 8-16 GB of RAM and often a 250-500GB NVMe drive as well. It'll probably have only one native ethernet, but USB or TB adapters work fine with Linux & FreeBSD at this point.

There's definitely a question of values and exactly what you're trying to focus on, but there are a lot of niceties in having lots of RAM on tap and extremely standard fallbacks to interface with a system, back it up, etc.

or an OpenWrt One which will possibly also have newer, faster WiFi standards (WiFi 6)

If you want an AIO style device that's definitely a consideration, though again USB WiFi dongles are a thing too. But regardless of router choice, for someone considering going beyond what their ISP offers at all I think it's usually well worth spending the $50-80 to get a dedicated wireless access point. It'll make a major difference in real world performance in most spaces I've seen to just physically have a unit in an ideal spot (on a ceiling or high up on a wall, away from metal). Aesthetically the clean disks or rectangles those tend to have also blend well and mean that various boxes can be tucked away. And of course you get to upgrade networking bits separately from your router.

Anyway, definitely good there are multiple approaches, this is an area of life where people can have very different needs driven by very different physical environments and "stakeholders" (like significant others). But I think OPNsense (or other bog-standard-PC FOSS alternatives like VyOS) can be competitive even in TCO, depending on how much value you place on pushing your networking stack and what else you have going on (like solar power).

Any service or product delivered at a loss seems pretty plainly anti-competitive.

You have to get into the weeds though on what exactly counts as a "product delivered". Like, Apple doesn't charge for new versions of macOS. But are "Macs" separate stacks together or are they the fusion of hardware and software, and if so on what levels? There are all sorts of products surrounding us that are running software that we still treat as unified objects after all, right down to smart light bulbs or a "plain" lithium battery pack which still requires controllers to manage charging and USB negotiation etc. Chips and software are in tons and tons of "basic" hardware stuff yet we just buy the object as a singular entity.

I'm not saying that dumping can't be a thing but the lines aren't always clear cut either. You also have to get into bog standard business scaling issues and profit vs investment. If you take on debt to invest in capital that you believe will lower per unit costs if you build enough volume and then turn a profit, you're "selling at a loss" but that's how tons of business works, that's why there is risk right? Doesn't seem good to discourage that.

It seems more fruitful to approach things from the perspective of monopolies, competition, corporate governance etc in general, granted not that a lot of governments have been great about that either in recent history.

Starlink satellites are just routers to ground stations.

You are very out of date on your knowledge here. When it first launched yes, Starlink sats purely acted as "bent pipes" so you needed a ground station within 300-400 miles or so. But inter-sat optical laser links went online quite awhile ago so now data can go from a terminal through the orbital network to ground across the planet. That of course was required for them to offer air/maritime global service (as well as extremely remote areas like polar), can't put a ground station in the middle of the ocean.

Incidentally that should allow them to beat the latency of standard fiber by quite a bit over a long enough distance, there was speculation it might become quite popular for HFT for example, but I haven't tried it.

Edit: So I went ahead and checked, and interestingly at least via a v1 land based terminal on a basic plan they don't make use of it. So must be a higher end option or something? Picking a random top 50 site in Japan tbs.co.jp (163.45.254.1), a streaming TV site iirc, I got around 186ms ping on a fiber connection in rural New England, and 192ms via Starlink, almost exactly the difference one would expect for adding purely a LEO leg up to the nearest ground station. Maybe they want to charge for that, or maybe they're still fleshing out bandwidth on the intersat network. If anyone has a maritime or portable terminal or something it'd be interesting to see some comparisons. In principle on a great circle the distance for me should be something like 10600km, so maybe 12000ish including sats, 24k rtt, which at the speed of light should be more like 80ms. Even with some routing lag that's a big enough difference seems like it'd be noticeable if it was going via orbital mesh instead of ground and kind of fun to test.

I also just tried this as well, sending an email from a Migadu-based account to one at both Gmail and MXRoute using Mail.app under macOS 15.7.7. Neither included any private IP address info I could find in either headers or raw source. That would be a good leak to know about and as sibling comment said saagarjha definitely knows their stuff, so any tips to replicate would be appreciated.

I’m in the “we should protect kids online” camp, but I am not sure there’s a real way to do it without compromising privacy for everyone.

Of course there is, it's easy! You take a white list approach instead of an auth one. The default is that the general Internet is exclusively for adults. Anonymous = adult. Then use the DNS system to make a set of .kids ccTLDs, with government controlled registries. Then legal standards can be set for who gets a .kids.cc domain and what content is allowed, what meta-data is required, what services can be provided (which could be blanket stops, like no ads or social media under age 7, or granular, like "age 7-11 can only talk to registered educators or other children within given domains"), and so on. Then everything is in place to have router manufacturers give parents a super easy interface (and technical ones can do their own easily) to add their kids, have a password for each kid, and either automatically filter by general age, or let parents drill in and select specific categories or the like. And it'll all Just Work. Yeah it'll be a lot less stuff then on the main internet, but with government money to fund things and parent-based payment all abstracted from what kids see there will be as much as there was on PBS or the like back in the day.

So specific ID/passwords/parental control is exclusive to those who haven't reached majority. Once they do they an just dispense with it and access everything like we do right now. The entire approach being taken everywhere is 100% backwards, because it's not about the kids at all it's about control over adults.

...yes, really? Gun fire is indeed stupendously, dangerously loud, which is why we have suppressors and heavy hearing protection for them. And there are indeed significant public/legal fights around outdoor gun ranges that end up near habitation (even if it's not the range's fault at all but rather because construction moved towards it).

So I'm not really seeing how that's an argument that people not wearing earpro would be fine with regular 108 dB booms over where they live/work. People aren't happy even about small engine noise and rightfully so, and it's one of a few core reasons for switching to electric.

Apple is a digital services company that happens to sell hardware. Their big money maker is their app store, and no Linux user is ever going to buy apps from the app store.

You do realize that Apple is a public company and one can just go look at their financials like their latest 10-Q [0] right? For the most recent 6 month half (ending March 28 2026) I'm seeing $194 billion for product sales and $61 billion for service sales. The gross margins are certainly higher on services, at 77%, but 40% product margins are nothing to sneeze at either, and the disparity in absolute sales means the absolute dollar gross margins are $77 billion for products vs $46 billion for services.

So I don't see how you can assert that their "big money maker is their app store" from those numbers. Hardware matters a lot, and furthermore Apple sells services (like AppleCare+) that are specific to hardware and thus even a Linux user might still be interested in.

And without their hardware, their services would evaporate. There is a much tighter link there than with many companies. So they're on the hook for continued R&D and capex on that no matter what, you can't really separate that out, and in turn it's always going to be useful to have more volume to amortize it with.

I think primarily it comes down to corporate DNA, which is powerful. There are plenty of Mac hardware, software and service markets in pro/business/enterprise Apple has neglected or abandoned over the years, including ones making oodles of money, not out of any 4D chess but just because it doesn't fit them as an organization.

----

0: https://d18rn0p25nwr6d.cloudfront.net/CIK-0000320193/37f5e9c...

A perfect theoretical filesystem can still have subjective user configurable choices though right? Like case sensitivity, UTF normalization, checksum hash function, extra copies of data/metadata to store for redundancy/healing, etc (as well as compression/encryption). I think ZFS is a pretty strong real world example of a CoW FS, but you can still set a lot of different properties between sub-fs and then need to copy when you go between them to get the structural changes.

Disk images are supposed to function as if they're attached storage I think, and have different properties from what FS you're running on boot or your home folder (which themselves can be different, I run my home folder on my main Mac off a NAS via iSCSI). I'm not sure any underlying FS would avoid a copy operation there in general?

OK, setting aside the possibility this is some sort of joke/sarcasm I can't quite get, and the absolute wtf of this "scenario" which doesn't exist and all the ways it cannot exist with nothing to with privacy, and taking it sorta seriously, your argument completely falls down here amongst other places:

Lets say military intelligence has multiple NATO hospitals compromised, and have assets in these hospitals which are being used for various black operations (including non-medical neurosurgery on literal children). In this scenario, maybe total societal surveillance, including radical transparency, would have been a nice thing to have in regards to bolstering national security?

Why the heck would you think that the first job of a hostile military intelligence wouldn't be TO COMPROMISE THE TOTAL SOCIETAL SURVEILLANCE NETWORK!?!? There is a sort of really fundamental common failure to this kind of conspiracy thinking, wherein simultaneously your opponent is this incredibly powerful and skilled entity, one that in this case can compromise lots of secured aspects of society and insert actual agents into a hospital for illegal child surgery and escape notice. Yet simultaneously they're complete idiots who don't do the obvious, obvious job #1, job #2, and job #3 of an intelligence agency which is seek to compromise your enemy's intelligence agencies! Duh. It always has been. Counter intelligence and trying to get inside the other agency's decision loops has rich history probably for as long as spying has been done.

Why do you think you can secure this incredibly invasive theoretical network, all evidence from our entire history to the contrary, yet not medical service providers? You've literally built something here that your enemy would desperately love to have! You've done their entire job for them, better than they could! Rather then having to try to compromise endless distributed independently secured private and public organizations, now they just have to compromise a single one and they get the keys to the kingdom.

Instead, we got HIPAA, and other medical privacy laws/standards, which are aiding literal mass atrocity to continue to proliferate.

This is such schizobabble that makes no sense (HIPAA has nothing to with law enforcement or medical ethics boards or a million other checks on the health system, just for starters) that I don't know what else to do beyond urging you to seek some alternatives to wherever you got this from.

privacy does not matter when there are rampant black operations being conducted which violates human dignity in every sense of the term.

You have this completely backwards. The threat and existence of such operations is one of the fundamental reasons privacy does matter so much. Privacy is to be protected heavily not just for the now but for what could happen in the future, and it's self-reinforcing. A more privacy preserving society is a harder one to oppress.

At the time I write this parent comment is grey and I don't think it deserves to be. Some people may be down voting around the blanket statement about "US elites" despite a lot of elites clearly not being ok with the horrendous actions taken this last year, but regardless of that the concerns around dependencies and abuse of power right now are very real and quite justified particularly internationally. There are hard business considerations here as well, the executive unfortunately really does have a lot of power under existing law, particularly with a supine GOP in Congress, to unilaterally disrupt trade and export relationships with other countries, allied or not. It is part of the new business climate.

How is it possible for a US startup with honest leadership to shine through all this bullshit?

Absolutely zero inside knowledge of course, but I think Oxide's approach has intermingled pros and cons. The only real con I can see, but it is a real one, is that one basic argument against unreliability at higher levels is standardization/commoditization. If some big player sells you a standard rack and setup, then gets blocked from further support or otherwise dies, you can just swap in whatever else. Vertical integration and customization offers real benefits but also more dependency, even if things are open unless the niche becomes big enough that other players get interested.

On the other hand, the Oxide approach is also positive thanks to that seem openness and integration. They can offer safe software and firmware up and down the stack in a way others cannot. They can offer assurance not just about one piece but around much or all of the stack. I think there's quite a few layers of insecure mystery meat in the standardized stuff most of us run when you start digging down into it. And of course there is no cloud dependency at all, a European organization can buy their kit have full on-premise control no matter what. While the answer for new "3rd party in another jurisdiction can be pressured to screw with you even if you aren't" worries will probably most often be "go to a cloud provider exclusively under your own jurisdiction instead" Oxide seems like they could have a window there as well. If they're honest and give their own customers the power that more and more of the industry has been trying to take away, while also keeping down the IT cost load as a cloud would, that seems like an argument for some?

And it raises the heat outside of buildings.

No it doesn't. Seriously, where does this meme even come from? It should be pretty obvious just from a solar insolation map that AC is just noise vs the sun. The energy usage is tiny vs vehicles or non-heat pump heating and only electric. What changes temperature overall is the balance of thermal retention by the atmosphere vs radiation into space, hence why net increases in GHG are so dangerous. And at the ground level similarly how heat is dumped to atmosphere. Greenery, whites, shade etc is good, asphalt, mass standard glass is bad (hence many cities being heat islands). Old, leaky units sure, we absolutely should work to reduce that. But it's astonishing how people claim AC makes the outdoors hotter so consistently.

Yes, at least in theory changing this is straight forward. Though:

You have to do it once per file type but it's once and done.

I will note I have one Mac with one old user account where it will not remember this anymore across reboots (across macOS 15, plan to skip 26 and hope 27 is acceptable). I haven't had time to try to get into why, but it's occasionally irritating.

shows just how bad it was

Goes to show that a year of anybody with any sort of clout complaining about the thousand little cuts of Liquid Glass on macOS will get a company to respond.

Worth remembering too that this isn't merely about "complaints", Apple has significant metrics on the rates at which users are upgrading to a new OS, or not. You can opt-out of sharing that data, but a lot of people (even technical people) may choose to check the box to share with Apple. Anecdotally, I myself and a LOT of other people have stuck with macOS 15 or earlier, but Apple should have a lot of hard data on it and adoption curves vs the past.

A real reaction does certainly suggest that this wasn't just a tempest in a teacup, but that they really weren't seeing the adoption on Macs they expected.

Adding to DNS block list immediately.

Just making a note here for anyone else with the same thought: I went to ping the domains listed ITT, and nothing went through. I'm running OPNsense and amongst other things using some of the hagezi DNS block lists [0]. It looks like brdtnet.com, bright-sdk.com and various subdomains were already in there, which is a nice sanity check.

That said, also worth noting that an Unbound or other resolver based DNS block list can prevent resolution but doesn't preventing connecting to the underlying IP, it's not the same thing as actually invoking your firewall itself. For that I think you need to stick the lists into something that will resolve them regularly and then actually Firewall that off. So for OPNsense you can setup an alias using the URL Table (plain text) or URL Table in JSON depending on format, or manage it externally directly if desired via external. Then the source will be updated and aliases will all be resolved on operator defined schedules, and can in turn be fed into regular firewall rules. Don't forget these can turn into massive lists, so make sure your internal resource limits (so for OPNsense that'd be Firewall Maximum Table Entries) are set sufficiently high and the hardware can handle it.

Other systems may handle it differently, just it's important to double check what is actually happening including if something malicious tries to be sneakier. And ultimately for these sorts of untrustable embedded devices that lack owner control, it's probably a lot better and more sustainable, if more effort upfront, to isolate them into their own vlan/subnet and then whitelist instead of blacklist. So they can only access what you decide they need to and nothing else, vs access everything except what is disallowed. Still, blacklisting bad actors as a final layer for everything may still be useful.

----

0: https://github.com/hagezi/dns-blocklists

The LLM approach is not dependent on system configurations

How is it not dependent? Like, help me out here: I'm writing something up in vim on my FreeBSD system using the built-in dictionary capability, maybe I've got grammar too with LanguageTool via the ALE plugin. I've added various words to my good words list over time. I save it to a network drive and want to keep working on it and do some graphical formatting as well for output to a different audience with a different tool on an iPad for a flight. How does "the LLM approach" uniquely slot into vim and the iPad app. "Uniquely" as-in a way that you couldn't slot in a shared sync'd dictionary file or whatever else. What if one of the developers doesn't want to and I don't have time or (if it's closed source) can't? How does it help all the other different software I use that are still using their own thing?

If by "LLM approach" you specifically mean "I copy/paste into this whole other software, and that software is what I use from different platforms" well, that's nice but it's not an "LLM approach" it's a "copy/paste into different software" approach which again could be done with whatever.

I explicitly noted that non-determinism doesn't need to be flawless, only better than the deterministic solution on average.

But how do you know what the "average" is? You can't get that from a single shot. And what's the upside vs downside of false positives or false negatives or meaning changes/hallucinations? That's also a point of contention, particularly when it comes to any problem space (coding of course, but also law, medicine etc) where precision in language is important even 1% of the time. And you clearly have an intense personal issue here around grammar/spelling that is not universally shared. Which is fine, but the tradeoffs you're willing to make are also going to be personal. It's also going to vary, just as with using LLMs for coding, based on the user. Some people are sufficiently capable with language to realistically be able to expect to double check an LLM and mostly do fine. It's a lot riskier though for someone with a weak grasp to depend on.

And "the given word" in that particular example means "well" and is spelled G R E A T. G R A T E is a misspelling of that word.

"Grate" is a real word, and it is correctly spelled. In fact, within the purpose of the joke, it's even correctly used! But even if someone were to write that sentence out with no joke meaning, because perhaps they had learned English as a second language purely phonetically and were just trying to write things as they sounded, it'd be a grammar issue not a spelling one. Same as more common IRL hiccups like their/there, or its/it's. We even have other words like in the English language specifically to describe that in turn, like "homonym".

Your position doesn't make any sense when you boil it down.

No, it's your position that makes no sense. You are effectively arguing that the word "grammar" shouldn't exist! There is in fact an objective difference between mechanically misspelling words and incorrectly using a homonym.

I write some word as some sequence of letters. Whether it's correctly spelled depends not only on how that word is spelled, but how all other words, completely unrelated, are also spelled?

As I said, you're free to invent your own special snowflake definitions. But what you are writing is not in fact the shared definition at all. You for some reason are very determined to conflate "spelling" with "grammar". I linked you a few major sources, but this is not an area of contention, it has been consistently used for a very long time including in computers. It's even had plenty of attention over the decades. I still remember when a grammar checker was added for the first time to Microsoft Word and the debates about its quality (or lack thereof). There are even whole UX patterns around this, like coloring the squiggly lines below writing differently depending on if it's a spelling check error (commonly red) or grammar check (often blue). Precisely because grammar checking is harder and has often been iffier many people will disable it but leave spell checking on, because they're confident enough in their grammar and don't trust the computer, but don't want to accidentally post or send a message with "great" or "grate" as "graeyte".

Edit: in reply to wat10000 doing the 'ol virtual "good day to you SIR!" below:

I said it was a snowflake definition, given it's completely contrary to every dictionary and historical usage. I didn't call you yourself a snowflake.

And what's actually really fucking infuriating is when people like you simply refuse to use standard, shared dictionary definitions of words and widely used established software tools in your conversation and then further refuse to acknowledge it when corrected. And also refuse to engage with any substance and instead storm off in a virtual huff. You could have just gone "right I meant grammar correction, present grammar correction really kind of sucks and that's what I think people need most vs spelling correction" and that'd be that.

LLMs don't seem to be doing a very good job of clarifying your basic thinking however, in this post or your earlier one. To reply to both:

I immediately disable spellchecking on every avenue it tries to approach because managing a bunch of dictionaries on every browser/device/application that has its own spellchecker for some godforsaken reason to not have squigglies spammed over every piece of jargon, slang, and slightly atypical spelling is incredibly annoying.

But this is a logic fail is it not? LLMs are irrelevant to this. Your stated problem is "not all software/devices I use has a single shared dictionary/grammar tool to my preferences". That's a very, very reasonable complaint. I agree with you that it's always been tremendously irritating that so many applications won't even make use of operating system dictionaries but rather recreate their own, really that the entire infrastructure around spelling or grammar dictionaries is so primitive.

But how do you think LLMs help? Even setting aside quality concerns they don't magically retroactively make every software/device use them, they're just another tool in the space something could use, or not. So you're still stuck with the exact same problem. You still don't have something sync'd/shared universally across your entire experience. I can see how you could just live within some single environment to avoid that (do everything in a browser, use the same browser company's products across platforms with sync supported, so you can use the browser language tools for everything), but again that's not unique to LLMs. That approach would work for conventional tools as well.

I just fed this entire thread to an LLM

This is a second logic fail. The entire point and meaning of "non-determinism" is precisely that you can't just do something once and then have that be evidence. If we all did the "same thing", feeding every thread to an LLM, thousands of times we wouldn't all get identical results every time. Sometimes we'd get something else. And the very fact it's rare is one of the core challenges of this entire space, because humans are very, very bad at dealing with things where it works 99% of the time and fails 1% of the time. This has always been true.

It's not clear whether using "grate" instead of "great" is a grammar mistake or a spelling mistake.

It actually is clear, because words have meaning. "Spelling" refers specifically to the order of letters forming a given word [0, 1]. The proper use of words with a sentence, the "the study of the classes of words, their inflections, and their functions and relations in the sentence" [2] is the definition of "grammar"!

I'd argue it's a spelling mistake.

Perhaps so, you're welcome to invent your own special snowflake definitions for words without much relation to decades/centuries of usage. It's a free country. But I would and will argue you are incorrect to do so and then expect to communicate with other humans.

----

0: https://www.merriam-webster.com/dictionary/spell

1: https://www.dictionary.com/browse/spell

2: https://www.merriam-webster.com/dictionary/grammar

Only if the problem is declared to be whatever it is that spell checkers solve.

The problem being misspelling, hence, "spell checker". Like, this seems pretty straightforward? Grammar checking if you cannot use the language properly is a pretty different problem space, and indeed has long existed and is exposed as a separate thing. And not just in fancy word processors either, if you go to something as simple as macOS TextEdit you'll see separate check boxes for "Check spelling as you type" vs "Check grammar with spelling". If someone wants to try out using LLMs for grammar no problem, but spell checking is purely about the mechanical and, importantly, deterministic aspect of typos or outright non-words.

As the classic joke goes, "Me spell chucker work grate. Need grandma chicken."

There is a genuine touch of irony/meta in you using that here in this context. That sentence has no misspelled words, and importantly gets across the exact humorous meaning the human who wrote it intended. The joke literally only works because a human was able to make creative use of language. If you had an LLM agent posting for you to HN and it automatically changed that to:

As the classic joke goes, "My spellchecker works great but could use some grammar checking."

Well, where would the joke be now!? This goes to the exact concern people have with powerful non-deterministic meaning-changing tools replacing deterministic meaning-preserving ones.

Sedov-Taylor-Rayleigh blast equation, though this video isn't high enough frame rate to more than ballpark it I think. Tower is ~180m high, so 0.2 sec would be a bit over 1 kiloton instead? But definitely not remotely 13 kt. Still serious of course, when SpaceX suffered launch complex damage during some of its incidents it took a solid 6-12 months to fix.

Everyone can be glad though that no hypergolics are involved at least!

And we're not going to hide from them through Cyber-Libertarianism.

Like we did for over 230 years? I'm not entirely sure why you choose to call that period before vast ALPR networks "cyber-libertarianism", I'm not a serious historian as perhaps you are but that's a label for the first few centuries of American history I haven't encountered before. But it sorta feels like we somehow made it through it and in fact did pretty well in much of it? Despite us simply forbidding cops from using certain tools or techniques. So what precisely do you think has changed such that if we don't enable an unaccountable panopticon, it'll mean things will be worse? And have you maybe considered that we should pursue your noble dream of "more accountability from agents of the state" first, and see success BEFORE we give them vast new powers? Like, how about the new powers after that works?

A .kids domain is not a useful approach.

I surprisingly seriously disagree, and think you're perhaps missing a lot of the contention in this whole societal debate. The point is to give people workable tools with some level of agreed sane defaults they can make use of, tweak, or ignore entirely, without imposing any burden at all on the existing internet and its adult (or children with parents who wish it) users.

The vast bulk of the internet is child neutral

First: by who's standards is one of the core questions! What's neutral to one parent may not be to another. You illustrate this with your very first example in fact, "For example my church a web site". There are religious parents (and no doubt atheist ones as well) who would quite strongly not want their young child to visit your church's website.

Second: there is a difference between simply wanting to be child friendly and taking on a legal obligation and liability to be child "safe" to some given standard. Parents would be perfectly free to whitelist whatever additional sites they liked, or to subscribe to lists that curated whitelists of various sorts, or to use other controls. But a politically significant number of parents clearly want assurance that their child will near-never (with actual enforcement mechanisms for failure) encounter something outside of bounds. Meeting that need requires either whitelists or the sort of restrictions that would wreck the current web (and probably still not work very well).

Does StackOverflow need to register a .kids domain just so children might get answers to programing questions?

If the parents of said kids want it to, then yes? Why would that be a big deal? I'd be surprised if like most places SO doesn't already have piles of domains purely for defensive purposes, and as something nationally regulated I certainly envision such a domain registrar being dirt cheap (or even free, paid for by tax dollars) for domains. Given the context and that it'd be very much not open to all there isn't any need to worry about cost to dissuade scammers and such, they'd be prevented from ever registering in the first place. Rules around use of trademark, business names and so on could also be very strict.

If my-bakery.co.uk and my-bakery.co.au both want to be visible to 16yo there needs to be at least kids.uk and kids.au.

Yes? DNS is not expensive. And again, parents don't need to make use of it. This would be for those who do, who are right now pushing for ID for everything. It's a safe default walled garden, but one with doors any parent can open.

Does OpenSSL.org or OpenSSL.com get to be OpenSSL.kids?

Which one chooses to get accredited by a regulator or child protection organization with insurance and so on first? Why are you asserting either would even bother? Which one would be happy about having to verify ID of users right now?

Sorry but duplicating the entire neutral internet domain space with yet another tld isn't a helpful approach.

Sorry but you haven't thought about this very clearly at all. This proposal is very explicitly a small subset of the entire neutral internet! Duplication is never something I suggested, rather the very opposite! The "entire neutral internet" is by default adult here, but parents would be able to allow children to browse it just as now. However, some are clearly unhappy with that, enough that we're seeing politicians respond with things that would be very bad.

Yes, exactly, this should be really simple as a foundation: by default the Internet is for adults. All of it. Where it's desirable for things to be available for kids, create the economic incentive and easy tools for parents to use and run on a white list, not a black list.

I'd actually go somewhat further though and ask whether it's a good idea to even do this via web pages at all. We have a great potential system for this already: DNS. Do something useful amongst all the ridiculous vanity and spam TLDs for once and set up a ".kids" gTLD, or ccTLD for that matter so that different countries can set their own regulatory standards naturally (ie, .kids.us, .kids.uk etc). Domains could also be used for some broad buckets for people who don't want to drill in, ie, .1-6.kids, .7-12.kids, .13-17.kids, or whatever is deemed appropriate, but simple age brackets that would offer some sane defaults. 1-6 could simply not allow any ads, user generated content or algorithmic feeds whatsoever for example. There are a lot of knobs to turn. And then at the registry level it can be ensured from the get-go that anyone getting a .kids domain is fully identified, located in the country in question, has valid ID, has specific credentials or is an accredited organization, or whatever other criteria makes sense.

But ultimately the point would be to create something that is built right from the ground up, and in turn that doesn't interfere with what has already been built at all. Something that can also be worked with at the gateway and thus cover every device on a LAN, and for that matter can easily be plugged into the vast number of powerful tools we have for working with that stuff. It'd be easy to put a nice UI on all this, even to make it higly automated. For example, have a setup wizard where you enter children, put in date of birth for each, and it'll spit out a password for each one. This then auto-provisions the network such that each kid has their own VLAN (password for PPSK or even wired connection) and is automatically limited to the domain groups of their age bracket, which then changes as their age changes.

Parents should be able to dig further in and get more granular with content categories, metadata for which could be required for anyone hosting a site within that domain, but I think there is the potential to make something both pretty bullet proof and pretty accessible, using existing tech stacks, and without impinging on the present internet at all including privacy and anonymity.

This. In fact I thought the government had long since gotten pretty serious about using smartcards and HSMs for everything? Why let anyone take any sort of accessible credential at all vs handing out hardware they can use but that cannot have the credentials taken off? At some organizations the extra cost would be a concern of course but that wouldn't be the case here.

Or maybe that'd have been the sort of project and standard CISA would have formerly done before the Republicans gutted it last year I guess, and this is just another symptom of rot? But yeah to your point technology certainly can absolutely help with this sort of thing. It's not some inevitable act of nature.

...where are, at a trivial minimum, the VLANs!?!? Or even outright separate physical architecture, but at the very least even the absolute cheapest prosumer Omada/UniFi/Mikrotik/whatever switches and WAPs made for the last decade+ will give you some simple segmentation for free. I don't understand, apparently they had cameras and other devices in a single flat network space that any rando BYD could cruise around in? Like, sure, absolutely change default passwords, better provisioning, consider what info DNS or other side channels (like certificate transparency if you use a public CA and don't use a wildcard) might reveal, use internal VPNs even for trusted devices to access certain stuff, etc etc. But it still feels like simply isolating security/surveillance and other restricted use devices should sorta be the 101 first layer of the onion and if that wasn't done yeesh.

If this was written 20-25 years ago sure, but in 2026? Wild.

I guess all those goverment actions should limit freedom of individuals more and more. Excellent strategy for tyranny.

...what?? Are you ok with murder and theft as well and whine about how laws against that limit your freedom and are "tyranny"? It's a pretty basic tenet of any groups of humans that's it's fully compatible with freedom to have limits on the extent to which people can cause harm to others. As with all complex dynamic things there are very debatable shades of gray at the edges, but total anarchy objectively does not work.

And it's a fundamental to a functional Free Market that costs be internalized, not externalized. Producers and consumers determine value and generate wealth by comparing the total price of production to the utility offered, but that only works if (amongst other things) the sticker price really is the total price (or at least quite close). If a producer is able to stick their costs onto others then their product will be artificially cheap even if they are less efficient, which will warp the market. That's what we are seeing in energy: fossil fuel producers are dumping cost (in terms of, global warming, ocean acidification, and other forms of pollution) onto the present and future world that they don't have to pay, artificially depressing the cost and alternative solutions that would be net more productive. We could for example be far along on the path of wind and solar power, with enough excess to generate net neutral synthetic hydrocarbons using atmospheric CO2 and water that could then be used in applications like jet engines where they might remain superior.

But the whole point is the market would then be able to determine that naturally, the cost would be built into the price so where and when syngas vs electric vs whatever else provided the best value could emerge. That's not "tyranny", to the extent there is tyranny in the market it's in allowing selfish actors to ruin other people's lives with pollution and preventing those harmed from retaliating.

Out of curiosity what do you find missing from the PoE sensor market?

I'd be unironically delighted if you could point me at some site helping me find what I've been missing like a goof, because it feels more like the question is "what isn't missing from the PoE sensor market?" It's pretty niche isn't it, with what little there is available also being at enormously increased prices? Take something as simple as "is there water where it shouldn't be", isn't there basically just the Aquo Proteus XE at $350 and, I think maybe one other I can't remember? Surely there are some "call us for a quote" industrial gear too but it's not exactly the common case vs z-wave/zigbee/wifi. Same with pretty much whatever else one might name. Like, what if you want a semi-permanent motion sensor (not a camera), are there any PoE options at all? I think I remember reading someone working on an mmWave one to get it work with HA but that's it. And yes 100% you can say that it's "overkill" or the like but looking at DigiKey's PoE controller pricing doesn't seem like it inherently has to be a huge premium, just isn't anything mass produced.

I mean, it is certainly very arguable that the entire IOT market is and always has been sort of a total mess more than not, and that PoE switches weren't the $50/8-port affairs you can get now either until pretty recently. I totally understand why it's not a thing, I want to be clear this is more of an idle wistful "that'd be a nicer world" along with all sorts of other areas of tech. And I know there are PoE splitters so sometimes you can get roughly the same effect if something has ethernet+power separately. Wireless is also certainly sometimes simply the most sensible option. Just would be nice to have more options when it counted is all. I've dealt with enough odd spaces where it's a pain to get any signal in and even if it's only once every few years it still sucks to have to have somebody work their way in there to replace a battery and sometimes things randomly fritz out, makes one long for good ol' hard wire with super easy ways to just power cycle the switch and eliminate lots of complicated stacks of networking. Ah well.