10 interesting stories served every morning and every evening.




1 606 shares, 26 trendiness

Turn Dependabot Off

Dependabot is a noise ma­chine. It makes you feel like you’re do­ing work, but you’re ac­tu­ally dis­cour­ag­ing more use­ful work. This is es­pe­cially true for se­cu­rity alerts in the Go ecosys­tem.

I rec­om­mend turn­ing it off and re­plac­ing it with a pair of sched­uled GitHub Actions, one run­ning gov­ul­ncheck, and the other run­ning your test suite against the lat­est ver­sion of your de­pen­den­cies.

On Tuesday, I pub­lished a se­cu­rity fix for fil­ippo.io/​ed­ward­s25519. The (*Point).MultiScalarMult method would pro­duce in­valid re­sults if the re­ceiver was not the iden­tity point.

A lot of the Go ecosys­tem de­pends on fil­ippo.io/​ed­ward­s25519, mostly through github.com/​go-sql-dri­ver/​mysql (228k de­pen­dents only on GitHub). Essentially no one uses (*Point).MultiScalarMult.

Yesterday, Dependabot opened thou­sands of PRs against un­af­fected repos­i­to­ries to up­date fil­ippo.io/​ed­ward­s25519. These PRs were ac­com­pa­nied by a se­cu­rity alert with a non­sen­si­cal, made up CVSS v4 score and by a wor­ry­ing 73% com­pat­i­bil­ity score, al­legedly based on the break­age the up­date is caus­ing in the ecosys­tem. Note that the diff be­tween v1.1.0 and v1.1.1 is one line in the method no one uses.

We even got one of these alerts for the Wycheproof repos­i­tory, which does not im­port the af­fected fil­ippo.io/​ed­ward­s25519 pack­age at all. Instead, it only im­ports the un­af­fected fil­ippo.io/​ed­ward­s25519/​field pack­age.

$ go mod why -m fil­ippo.io/​ed­ward­s25519

# fil­ippo.io/​ed­ward­s25519

github.com/​c2sp/​wyche­p­roof/​tools/​twistcheck

fil­ippo.io/​ed­ward­s25519/​field

We have turned Dependabot off.

But is­n’t this toil un­avoid­able, to pre­vent at­tack­ers from ex­ploit­ing old vul­ner­a­bil­i­ties in your de­pen­den­cies? Absolutely not!

Computers are per­fectly ca­pa­ble of do­ing the work of fil­ter­ing out these ir­rel­e­vant alerts for you. The Go Vulnerability Database has rich ver­sion, pack­age, and sym­bol meta­data for all Go vul­ner­a­bil­i­ties.

Here’s the en­try for the fil­ippo.io/​ed­ward­s25519 vul­ner­a­bil­ity, also avail­able in stan­dard OSV for­mat.

mod­ules:

- mod­ule: fil­ippo.io/​ed­ward­s25519

ver­sions:

- fixed: 1.1.1

vul­ner­a­ble_at: 1.1.0

pack­ages:

- pack­age: fil­ippo.io/​ed­ward­s25519

sym­bols:

- Point.MultiScalarMult

sum­mary: Invalid re­sult or un­de­fined be­hav­ior in fil­ippo.io/​ed­ward­s25519

de­scrip­tion: |-

Previously, if MultiScalarMult was in­voked on an

ini­tial­ized point who was not the iden­tity point, MultiScalarMult

pro­duced an in­cor­rect re­sult. If called on an

unini­tial­ized point, MultiScalarMult ex­hib­ited un­de­fined be­hav­ior.

cves:

- CVE-2026-26958

cred­its:

- sha­har­co­hen1

- WeebDataHoarder

ref­er­ences:

- ad­vi­sory: https://​github.com/​FiloSot­tile/​ed­ward­s25519/​se­cu­rity/​ad­vi­sories/​GHSA-fw7p-63qq-7hpr

- fix: https://​github.com/​FiloSot­tile/​ed­ward­s25519/​com­mit/​d1c650af­b95­fad0742b98d95f2e­b2cf031393abb

source:

id: go-se­cu­rity-team

cre­ated: 2026-02-17T14:45:04.271552-05:00

re­view_s­ta­tus: REVIEWED

Any de­cent vul­ner­a­bil­ity scan­ner will at the very least fil­ter based on the pack­age, which re­quires a sim­ple go list -deps ./…. This al­ready si­lences a lot of noise, be­cause it’s com­mon and good prac­tice for mod­ules to sep­a­rate func­tion­al­ity rel­e­vant to dif­fer­ent de­pen­dents into dif­fer­ent sub-pack­ages. For ex­am­ple, it would have avoided the false alert against the Wycheproof repos­i­tory.

If you use a third-party vul­ner­a­bil­ity scan­ner, you should de­mand at least pack­age-level fil­ter­ing.

Good vul­ner­a­bil­ity scan­ners will go fur­ther, though, and fil­ter based on the reach­a­bil­ity of the vul­ner­a­ble sym­bol us­ing sta­tic analy­sis. That’s what gov­ul­ncheck does!

$ go mod why -m fil­ippo.io/​ed­ward­s25519

# fil­ippo.io/​ed­ward­s25519

fil­ippo.io/​sun­light/​in­ter­nal/​ct­log

github.com/​google/​cer­tifi­cate-trans­parency-go/​tril­lian/​ctfe

github.com/​go-sql-dri­ver/​mysql

fil­ippo.io/​ed­ward­s25519

$ gov­ul­ncheck ./…

=== Symbol Results ===

No vul­ner­a­bil­i­ties found.

Your code is af­fected by 0 vul­ner­a­bil­i­ties.

This scan also found 1 vul­ner­a­bil­ity in pack­ages you im­port and 2

vul­ner­a­bil­i­ties in mod­ules you re­quire, but your code does­n’t ap­pear to call

these vul­ner­a­bil­i­ties.

Use -show ver­bose’ for more de­tails.

gov­ul­ncheck no­ticed that my pro­ject in­di­rectly de­pends on fil­ippo.io/​ed­ward­s25519 through github.com/​go-sql-dri­ver/​mysql, which does not make the vul­ner­a­ble sym­bol reach­able, so it chose not to no­tify me.

If you want, you can tell it to show the pack­age- and mod­ule-level matches.

$ gov­ul­ncheck -show ver­bose,color ./…

Fetching vul­ner­a­bil­i­ties from the data­base…

Checking the code against the vul­ner­a­bil­i­ties…

The pack­age pat­tern matched the fol­low­ing 16 root pack­ages:

fil­ippo.io/​sun­light

fil­ippo.io/​sun­light/​in­ter­nal/​std­log

Govulncheck scanned the fol­low­ing 54 mod­ules and the go1.26.0 stan­dard li­brary:

fil­ippo.io/​sun­light

craw­shaw.io/​sqlite@v0.3.3-0.20220618202545-d1964889ea3c

fil­ippo.io/​big­mod@v0.0.3

fil­ippo.io/​ed­ward­s25519@v1.1.0

fil­ippo.io/​key­gen@v0.0.0-20240718133620-7f162ef­bb­d87

fil­ippo.io/​torch­wood@v0.8.0

=== Symbol Results ===

No vul­ner­a­bil­i­ties found.

=== Package Results ===

Vulnerability #1: GO-2026-4503

Invalid re­sult or un­de­fined be­hav­ior in fil­ippo.io/​ed­ward­s25519

More info: https://​pkg.go.dev/​vuln/​GO-2026-4503

Module: fil­ippo.io/​ed­ward­s25519

Found in: fil­ippo.io/​ed­ward­s25519@v1.1.0

Fixed in: fil­ippo.io/​ed­ward­s25519@v1.1.1

=== Module Results ===

Vulnerability #1: GO-2025-4135

Malformed con­straint may cause de­nial of ser­vice in

golang.org/​x/​crypto/​ssh/​agent

More info: https://​pkg.go.dev/​vuln/​GO-2025-4135

Module: golang.org/​x/​crypto

Found in: golang.org/​x/​crypto@v0.44.0

Fixed in: golang.org/​x/​crypto@v0.45.0

Vulnerability #2: GO-2025-4134

Unbounded mem­ory con­sump­tion in golang.org/​x/​crypto/​ssh

More info: https://​pkg.go.dev/​vuln/​GO-2025-4134

Module: golang.org/​x/​crypto

Found in: golang.org/​x/​crypto@v0.44.0

Fixed in: golang.org/​x/​crypto@v0.45.0

Your code is af­fected by 0 vul­ner­a­bil­i­ties.

This scan also found 1 vul­ner­a­bil­ity in pack­ages you im­port and 2

vul­ner­a­bil­i­ties in mod­ules you re­quire, but your code does­n’t ap­pear to call

these vul­ner­a­bil­i­ties.

...

Read the original on words.filippo.io »

2 413 shares, 18 trendiness

Across the US, people are dismantling and destroying Flock surveillance cameras

Silicon Valley is tight­en­ing its ties with Trumpworld, the sur­veil­lance state is rapidly ex­pand­ing, and big tech’s AI data cen­ter build­out is boom­ing. Civilians are push­ing back.

In to­day’s edi­tion of Blood in the Machine:

* Across the na­tion, peo­ple are dis­man­tling and de­stroy­ing Flock cam­eras that con­duct war­rant­less ve­hi­cle sur­veil­lance, and whose data is shared with ICE.

* An Oklahoma man air­ing his con­cerns about a lo­cal data cen­ter pro­ject at a pub­lic hear­ing is ar­rested af­ter he ex­ceeded his al­lot­ted time by a cou­ple sec­onds.

* Uber and Lyft dri­vers de­liver a pe­ti­tion signed by 10,000 gig work­ers de­mand­ing that stolen wages be re­turned to them.

* PLUS: A cli­mate re­searcher has a new re­port that un­rav­els the AI will solve cli­mate change’ mythos, Tesla’s Robotaxis are crash­ing 4 times as of­ten as hu­mans, and AI-generated pub­lic com­ments helped kill a vote on air qual­ity.

A brief note that this re­port­ing, re­search, and writ­ing takes a lot of time, re­sources, and en­ergy. I can only do it thanks to the paid sub­scribers who chip in a few bucks each month; if you’re able, and you find value in this work, please con­sider up­grad­ing to a paid sub­scrip­tion so I can con­tinue on. Many thanks, ham­mers up, and on­wards.

Last week, in La Mesa, a small city just east of San Diego, California, ob­servers hap­pened upon a pair of de­stroyed Flock cam­eras. One had been smashed and left on the me­dian, the other had key parts re­moved. The de­struc­tion was ob­vi­ously in­ten­tional, and ap­pears per­haps even staged to leave a mes­sage: It came just weeks af­ter the city de­cided, in the face of pub­lic protest, to con­tinue its con­tracts with the sur­veil­lance com­pany.

Flock cam­eras are typ­i­cally mounted on 8 to 12 foot poles and pow­ered by a so­lar panel. The smashed re­mains of all of the above in La Mesa are the lat­est ex­am­ples of a widen­ing anti-Flock back­lash. In re­cent months, peo­ple have been smash­ing and dis­man­tling the sur­veil­lance de­vices, in in­ci­dents re­ported in at least five states, from coast to coast.

Bill Paul, who runs the lo­cal news out­let San Diego Slackers, and who first re­ported on the smashed Flock equip­ment, tells me that the sab­o­tage comes just a month or two af­ter San Diego held a rau­cous city coun­cil meet­ing over whether to keep op­er­at­ing the Flock cam­eras. A clear ma­jor­ity of pub­lic at­ten­dees pre­sent were in fa­vor of shut­ting them down.

There was a huge turnout against them,” he tells me, but the coun­cil ap­proved con­tin­u­a­tion of the con­tract.”

The tenor of the meet­ing re­flects a grow­ing anger and con­cern over the sur­veil­lance tech­nol­ogy that’s gone na­tion­wide: Flock, which is based in Atlanta and is cur­rently val­ued at $7.5 bil­lion, op­er­ates au­to­matic li­cense plate read­ers (ALPR) that have now been in­stalled in some 6,000 US com­mu­ni­ties. They gather not just li­cense plate im­ages, but other iden­ti­fy­ing data used to fingerprint’ ve­hi­cles, their own­ers, and their move­ments. This data can be col­lected, stored, and ac­cessed with­out a war­rant, mak­ing it a pop­u­lar workaround for law en­force­ment. Perhaps most con­tro­ver­sially, Flock’s ve­hi­cle data is rou­tinely ac­cessed by ICE.

If you’ve heard Flock’s name come up re­cently, it’s likely as a re­sult of their now-can­celed part­ner­ship with Ring, made in­stantly fa­mous by a par­tic­u­larly dystopian Super Bowl ad that promised to turn reg­u­lar neigh­bor­hoods into a sur­veil­lance drag­net.

Meanwhile, abuses have been preva­lent. A Georgia po­lice chief was ar­rested and charged with us­ing Flock data to stalk and ha­rass pri­vate cit­i­zens. Flock data has been used to track cit­i­zens who cross state lines for abor­tions when the pro­ce­dure is il­le­gal in their state. And mu­nic­i­pal­i­ties have found that fed­eral agen­cies have ac­cessed lo­cal flock data with­out their knowl­edge or con­sent. Critics claim that this war­rant­less data col­lec­tion is Orwellian and un­con­sti­tu­tional; a vi­o­la­tion of the 4th amend­ment. As a re­sult, civil­ians from Oregon to Virginia to California and be­yond are push­ing their gov­ern­ments to aban­don Flock con­tracts. In some cases, they’re suc­ceed­ing. Cities like Santa Cruz, CA, and Eugene, OR, have can­celled their con­tracts with Flock.

In Oregon’s case, the pub­lic out­cry was ac­com­pa­nied by a cam­paign of de­struc­tion against the sur­veil­lance de­vices: Last year, at least six Flock li­cense plate read­ers mounted on poles lo­cated in Eugene and Springfield were cut down and de­stroyed, ac­cord­ing to the Lookout Eugene-Springfield.

A note read­ing Hahaha get wrecked ya sur­veilling fucks” was at­tached to one of the de­stroyed poles, and some­what in­cred­i­bly, broad­cast on the lo­cal news.

In Greenview, Illinois, a Flock cam­era pole was sev­ered at the base and the de­vice de­stroyed. In Lisbon, Connecticut, po­lice are in­ves­ti­gat­ing an­other smashed Flock cam­era.

In Virginia, last December, a man was ar­rested for dis­man­tling and de­stroy­ing 13 Flock cam­eras through­out the state over the course of the year. He’s ap­par­ently al­ready ad­mit­ted to do­ing so, ac­cord­ing to lo­cal news:

Jefferey S. Sovern, 41, was ar­rested in October af­ter de­tec­tives say he intentionally de­stroyed” 13 Flock Safety cam­eras be­tween April and October of this year. He was charged with 13 counts of de­struc­tion of prop­erty, six counts of pe­tit lar­ceny and six counts of pos­ses­sion of bur­glary tools. Sovern ad­mit­ted to the crimes, ac­cord­ing to a crim­i­nal com­plaint filed in Suffolk General District Court, go­ing as far as to say he used vice grips to help him dis­as­sem­ble the tow-piece polls. He also ad­mit­ted to keep­ing some of the wiring, bat­ter­ies and so­lar pan­els taken from the cam­eras. Some of the items were re­cov­ered by po­lice af­ter they searched the prop­erty.

After his ar­rest, Sovern cre­ated a GoFundMe to help cover his le­gal costs, in which he sheds a lit­tle light on his in­ten­tions:

My name is Jeff and I ap­pre­ci­ate my pri­vacy. I ap­pre­ci­ate every­one’s right to pri­vacy, en­shrined in the fourth amend­ment. With the lo­cal news out­lets find­ing my le­gal is­sues and cre­at­ing a story that is start­ing to grow, there has been com­mu­nity sup­port for me that I humbly wel­come.

Sovern points his GoFundMe con­trib­u­tors to DeFlock, a web­site aimed at track­ing and coun­ter­ing the rise of Flock cam­eras in US com­mu­ni­ties. It counts 46 cities that have of­fi­cially re­jected Flock and other ALPRs since its cam­paign be­gan.

In fact, it’s hard to think of a tech prod­uct or pro­ject this side of gen­er­a­tive AI that is more roundly op­posed and re­viled, on a bi­par­ti­san level, than Flock, and re­sis­tance takes many forms and stripes. Here’s the YouTuber Benn Jordan, show­ing his view­ers how to Flock-proof their li­cense plates and ren­der their ve­hi­cles il­leg­i­ble to the com­pa­ny’s data in­ges­tion sys­tems:

In re­sponse to such Flock counter-tac­tics, Florida passed a law last year mak­ing it il­le­gal to cover or al­ter your li­cense plate.

In his GoFundMe, Sovern also men­tioned the sup­port for him he’d seen on fo­rums on­line, so I went over to Reddit to get a sense for how his ac­tions were be­ing re­ceived on­line. Here was the page that shared news of his ar­rest for de­stroy­ing the Flock cam­eras:

There was, in other words, nearly uni­ver­sal sup­port for Sovern’s Flock dis­man­tling cam­paign. Bear in mind that this is r/​Nor­folk, and while it’s still red­dit users we’re talk­ing about, it’s not like this is r/​an­ar­chism here:

The San Diego red­dit threads car­ry­ing news of the de­stroyed Flock equip­ment told a sim­i­lar story:

There were plenty of out­right en­dorse­ments of the sab­o­tage:

Off the mes­sage boards and in real civic life, Bill Paul, the re­porter with the San Diego Slacker, says anger is boil­ing over, too. He points again to that heated December 2025 city coun­cil meet­ing, in which pub­lic out­rage was left un­ad­dressed. The city, per­haps aware of the stigma Flock now car­ries, ap­par­ently tried to high­light that their fo­cus was on the smart street­lights” made by an­other com­pany, while down­play­ing the fact that those street­lights run on Flock soft­ware.

San Diego gets to hide be­hind a slight fa­cade in that their con­tract is with Ubicquia,” the smart street­light man­u­fac­turer, Paul says, but the soft­ware layer is Flock. You can eas­ily see Flock hard­ware on re­tail prop­er­ties, look­ing at the same cit­i­zens, with zero over­sight, and SDPD can claim they have clean hands.”

Weeks later, pieces of smashed Flock cam­eras lit­tered the ground.

Across the coun­try, in other words, mu­nic­i­pal gov­ern­ments are over­rid­ing pub­lic will to make deals with a prof­i­teer­ing tech com­pany to sur­veil their cit­i­zens and to col­lab­o­rate with fed­eral agen­cies like ICE. It might be taken as a sign of the times that in states and cities across the US, thou­sands of miles apart, those op­posed to the tech­nol­ogy are re­fus­ing to coun­te­nance what they view as vi­o­la­tions of pri­vacy and civil lib­erty, and are in­stead tak­ing up vice grips and metal cut­ters. And in many cases, they’re get­ting hailed by their peers as he­roes.

If you’ve heard sto­ries of smashed Flock cam­eras or dis­man­tled sur­veil­lance equip­ment in your neigh­bor­hood, please share—drop a link in the com­ments, or con­tact me on Signal or at bri­ancmer­chant@pro­ton.me.

Thanks to Lilly Irani for the tip on the smashed Flock cams in San Diego.

In case you missed it, I shared my five take­aways on the most re­cent round of ul­tra­heated AI dis­course here:

The ex­change was filmed and recorded on YouTube:

Police in Claremore, Oklahoma ar­rested a lo­cal man af­ter he went slightly over his time giv­ing pub­lic re­marks dur­ing a city coun­cil meet­ing op­pos­ing a pro­posed data cen­ter. Darren Blanchard showed up at a Claremore City Council meet­ing on Tuesday to talk about pub­lic records and the data cen­ter. When he went over his al­lot­ted 3 min­utes by a few sec­onds, the city had him ar­rested and charged with tres­pass­ing. The sub­ject of the city coun­cil meet­ing was Project Mustang, a pro­posed data cen­ter that would be lo­cated within a lo­cal in­dus­trial park. In a mir­ror of fights play­ing out across the United States, de­vel­oper Beale Infrastructure is at­tempt­ing to build a large data cen­ter in a small town and the res­i­dents are con­cerned about wa­ter rights, spik­ing elec­tric­ity bills, and noise.The pub­lic hear­ing was a chance for the city coun­cil to ad­dress some of these con­cerns and all res­i­dents were given a strict three minute time limit. The en­tire event was livestreamed and archive of it is on YouTube. Blanchard was warned, barely, to respect the process” by one of the coun­cil mem­bers but was clearly fin­ish­ing read­ing from pa­pers he had brought to read from, was not bel­liger­ent, and went over time by just a few sec­onds. Anyone who has ever at­tended or watched a city coun­cil meet­ing any­where will know that peo­ple go over their time at es­sen­tially any meet­ing that in­cludes pub­lic com­ment.Blan­chard ar­rived with doc­u­ments in hand and ques­tions about pub­lic records re­quests he’d made. During his re­marks, peo­ple clapped and cheered and he asked that this not be counted against his three min­utes. There are ma­jor con­cerns about the pub­lic process in Claremore,” Blanchard said, ref­er­enc­ing com­pli­ance doc­u­ments and ir­reg­u­lar­i­ties he’d un­cov­ered in pub­lic records.

Blanchard was then ar­rested as the crowd jeered in dis­be­lief. Also dis­con­cert­ing was the way the lo­cal news framed the event, with a lo­cal an­chor de­fend­ing au­thor­i­ties by claim­ing he was warned mul­ti­ple times.” Seems like a pretty sure­fire way to make peo­ple hate data cen­ters and the gov­ern­ments pro­tect­ing them even more!

On Wednesday, I headed to Pershing Square in down­town Los Angeles, where dozens of gig work­ers and or­ga­niz­ers with Rideshare Drivers United had as­sem­bled to de­liver a pe­ti­tion to the California Labor Commission signed by thou­sands of work­ers, call­ing on the body to de­liver a set­tle­ment on their be­half. Organizers made short speeches on the steps of the square while lo­cal ra­dio and TV sta­tions cap­tured the mo­ment.

The Labor Commission is su­ing the gig com­pa­nies on dri­vers’ be­half, al­leg­ing that Uber and Lyft stole bil­lions of dol­lars worth of wages from dri­vers be­fore Prop 22 was en­acted in 2020. The com­mis­sion is be­lieved to be in ne­go­ti­a­tions with the gig com­pa­nies right now that will de­ter­mine a set­tle­ment.

I spoke with one dri­ver, Karen, who had trav­eled from San Diego to join the demon­stra­tion, and asked her why she came. It’s im­por­tant we build dri­ver power” she said. Without dri­ver power, we won’t get what we need, and we just want fair­ness.” She said she was hop­ing to claim at least $20,000 in stolen wages.

We’re fight­ing for wages that were stolen for us from us and con­tinue to be stolen from us every sin­gle day by these app com­pa­nies from hell,” RDU or­ga­nizer Nicole Moore told me. So we’re march­ing in down­town L. A. to de­liver 10,000 sig­na­tures of dri­vers de­mand­ing that the state fight hard for us, and don’t let these com­pa­nies rip us off.”

According to Tesla’s own num­bers, its new RoboTaxis in Austin are crash­ing at a rate 4 times higher than hu­man dri­vers. The EV trade pub­li­ca­tion Electrek re­ports:

With 14 crashes now on the books, Tesla’s Robotaxi” crash rate in Austin con­tin­ues to de­te­ri­o­rate. Extrapolating from Tesla’s Q4 2025 earn­ings mileage data, which showed roughly 700,000 cu­mu­la­tive paid miles through November, the fleet likely reached around 800,000 miles by mid-Jan­u­ary 2026. That works out to one crash every 57,000 miles. The irony is that Tesla’s own num­bers con­demn it. Tesla’s Vehicle Safety Report claims the av­er­age American dri­ver ex­pe­ri­ences a mi­nor col­li­sion every 229,000 miles and a ma­jor col­li­sion every 699,000 miles. By Tesla’s own bench­mark, its Robotaxi” fleet is crash­ing nearly 4 times more of­ten than what the com­pany says is nor­mal for a reg­u­lar hu­man dri­ver in a mi­nor col­li­sion, and vir­tu­ally every sin­gle one of these miles was dri­ven with a trained safety mon­i­tor in the ve­hi­cle who could in­ter­vene at any mo­ment, which means they likely pre­vented more crashes that Tesla’s sys­tem would­n’t have avoided.Us­ing NHTSAs broader po­lice-re­ported crash av­er­age of roughly one per 500,000 miles, the pic­ture is even worse, Tesla’s fleet is crash­ing at ap­prox­i­mately 8 times the hu­man rate.

-“The Left Doesn’t Hate Technology, We Hate Being Exploited,” by Gita Jackson at Aftermath.

Meta drops $65 mil­lion into su­per PACs to boost tech-friendly state can­di­dates,” by Christine Mui in Politico.

-A great new re­port from cli­mate re­searcher Ketan Joshi, The AI Climate Hoax: Behind the Curtain of How Big Tech Greenwashes Impacts,” has been mak­ing head­lines and is well worth a read. Perhaps we’ll dig deeper into it in a fu­ture is­sue.

-The LA Times re­ports that the Southern California air board re­jected new pol­lu­tion rules af­ter an AI-generated flood of made-up com­ments. Here’s UCLAs Evan George on how AI poses a unique threat to the civic process.

Okay okay, that’s it for this week. Thanks as al­ways for read­ing. Hammers up.

...

Read the original on www.bloodinthemachine.com »

3 286 shares, 71 trendiness

What Not To Write On Your Security Clearance Form

Date: 01 Apr 88 1620 PST

From: Les Earnest

Subject: The previous ac­count” re­ferred to in RISKS-6.51

Reading a book got me into early trou­ble–I had an FBI record

by age twelve. This bizarre in­ci­dent caused a prob­lem much later

when I needed a se­cu­rity clear­ance. I learned that I could ob­tain

one only by con­ceal­ing my sor­did past.

A friend named Bob and I read the book ``Secret and Urgent,‘’ by Fletcher Pratt [Blue Ribbon Books; Garden City, NY; 1942] which was an early pop­u­lar ac­count of codes and ci­phers. Pratt showed how to use let­ter fre­quen­cies to break ci­phers and re­ported that the most fre­quently oc­cur­ring let­ters in typ­i­cal English text are e-t-a-o-n-r-i, in that or­der. (The let­ter fre­quency or­der of the story you are now read­ing is e-t-a-i-o-n-r. The higher fre­quency of ``i’′ prob­a­bly re­flects the fact that _I_ use the first per­son sin­gu­lar a lot.) Pratt’s book also treated more ad­vanced cryp­to­graphic schemes.

Bob and I de­cided that we needed to have a se­cure way to com­mu­ni­cate with each other, so we put to­gether a rather elab­o­rate jar­gon code based on the prin­ci­ples de­scribed in the book. I don’t re­mem­ber ex­actly why we thought we needed it–we spent much of our time out­side of school to­gether, so there was am­ple time to talk pri­vately. Still, you never could tell when you might need to send a se­cret mes­sage!

We made two copies of the code key (a de­scrip­tion of how to en­crypt and de­crypt our mes­sages) in the form of a sin­gle type­writ­ten sheet. We each took a copy and car­ried it on our per­sons at all times when we were wear­ing clothes.

I ac­tu­ally did­n’t wear clothes much. I spent nearly all my time out­side school wear­ing just a baggy pair of ma­roon swim­ming trunks. That was­n’t con­sid­ered too weird in San Diego.

I had re­cently been given glasses to wear but gen­er­ally kept them in a hard case in the pocket of the trousers that I wore to school. I fig­ured that this was a good place to hide my copy of the code key, so I care­fully folded it to one-eighth of its orig­i­nal size and stuck it at the bot­tom of the case, un­der my glasses.

Every chance I got, I went body surf­ing at Old Mission Beach. I usu­ally went by street­car and, since I had to trans­fer Downtown, I wore clothes. Unfortunately, while I was rid­ing the trol­ley home from the beach one Saturday, the case car­ry­ing my glasses slipped out of my pocket un­no­ticed. I re­ported the loss to my mother that night. She chas­tised me and later called the street­car com­pany. They said that the glasses had­n’t been turned in.

After a few weeks of wait­ing in vain for the glasses to turn up, we be­gan to lose hope. My mother did­n’t rush get­ting re­place­ment glasses in view of the fact that I had­n’t worn them much and they cost about $8, a large sum at that time. (To me, $8 rep­re­sented 40 round trips to the beach by street­car, or 80 ad­mis­sion fees to the movies.)

Unknown to us, the case had been found by a pa­tri­otic cit­i­zen who opened it, dis­cov­ered the code key, rec­og­nized that it must be­long to a Japanese spy and turned it over to the FBI This was in 1943, just af­ter cit­i­zens of Japanese de­scent had been forced off their prop­erty and taken away to con­cen­tra­tion camps. I re­mem­ber hear­ing that a lo­cal gro­cer was se­cretly a Colonel in the Japanese Army and had hid­den his uni­form in the back of his store. A lot of peo­ple ac­tu­ally be­lieved these things.

About six weeks later, when I hap­pened to be off on an­other es­capade, my mother was vis­ited by a man who iden­ti­fied him­self as an in­ves­ti­ga­tor from the FBI (She was a school ad­min­is­tra­tor, but hap­pened to be at home work­ing on her Ph. D. dis­ser­ta­tion.) She no­ticed that there were two more men wait­ing in a car out­side. The agent asked a num­ber of ques­tions about me, in­clud­ing my oc­cu­pa­tion. He re­port­edly was quite dis­ap­pointed when he learned that I was only 12 years old.

He even­tu­ally re­vealed why I was be­ing in­ves­ti­gated, showed my mother the glasses and the code key and asked her if she knew where it came from. She did­n’t, of course. She asked if we could get the glasses back and he agreed.

My mother told the in­ves­ti­ga­tor how glad she was to get them back, con­sid­er­ing that they cost $8. He did a slow burn, then said ``Lady, this case has cost the gov­ern­ment thou­sands of dol­lars. It has been the top pri­or­ity in our of­fice for the last six weeks. We traced the glasses to your son from the pre­scrip­tion by ex­am­in­ing the files of nearly every op­tometrist in San Diego.‘’ It ap­par­ently did­n’t oc­cur to them that if I were a real Japanese spy, I might have brought the glasses with me from head­quar­ters.

The FBI agent gave back the glasses but kept the code key ``for our records.‘’ They ap­par­ently were not fully con­vinced that they were deal­ing just with kids.

Since our com­mu­ni­ca­tion scheme had been com­pro­mised, Bob and I de­vised a new key. I started car­ry­ing it in my wal­let, which I thought was more se­cure. I don’t re­mem­ber ever ex­chang­ing any cryp­to­graphic mes­sages. I was al­ways ready, though.

A few years later when I was in col­lege, I got a sum­mer job at the Naval Electronics Lab, which re­quired a se­cu­rity clear­ance. One of the ques­tions on the ap­pli­ca­tion form was ``Have you ever been in­ves­ti­gated by the FBI?‘’ Naturally, I checked ``Yes.‘’ The next ques­tion was, ``If so, de­scribe the cir­cum­stances.‘’ There was very lit­tle space on the form, so I an­swered sim­ply and hon­estly, ``I was sus­pected of be­ing a Japanese spy.‘’

When I handed the form in to the se­cu­rity of­fi­cer, he scanned it quickly, looked me over slowly, then said, ``Explain this’’–point­ing at the FBI ques­tion. I de­scribed what had hap­pened. He got very ag­i­tated, picked up my form, tore it in pieces, and threw it in the waste bas­ket.

He then got out a blank form and handed it to me, say­ing ``Here, fill it out again and don’t men­tion that. If you do, I’ll make sure that you never get a se­cu­rity clear­ance.‘’

I did as he di­rected and was shortly granted the clear­ance. I never again dis­closed that in­ci­dent on se­cu­rity clear­ance forms.

On an­other oc­ca­sion much later, I learned by chance that putting cer­tain provoca­tive in­for­ma­tion on a se­cu­rity clear­ance form can greatly speed up the clear­ance process. But that is an­other story.

Edited and con­verted to HTML by Dan Bornstein.

...

Read the original on milk.com »

4 285 shares, 12 trendiness

Every Company Building Your AI Assistant Is Now an Ad Company

Pre-orders for the Juno Pioneer Edition now open, re­serve your Juno to­day!

On January 16, OpenAI qui­etly an­nounced that ChatGPT would be­gin show­ing ad­ver­tise­ments. By February 9th, ads were live. Eight months ear­lier, OpenAI spent $6.5 bil­lion to ac­quire Jony Ive’s hard­ware startup io. They’re build­ing a pocket-sized, screen­less de­vice with built-in cam­eras and mi­cro­phones — “contextually aware,” de­signed to re­place your phone.

But this is­n’t a post about OpenAI. They’re just the lat­est. The prob­lem is struc­tural.

Every sin­gle com­pa­nyWe can quib­ble about Apple.

build­ing AI as­sis­tants is now funded by ad­ver­tis­ing.

And every one of them is build­ing hard­ware de­signed to see and hear every­thing around you, all day, every day. These two facts are on a col­li­sion course, and lo­cal on-de­vice in­fer­ence is the only way off the track.

Before we talk about who’s build­ing it, let’s be clear about what’s be­ing built.

Every main­stream voice as­sis­tant to­day works be­hind a gate. You say a magic word — “Hey Siri,” OK Google,” Alexa” — and only then does the sys­tem lis­ten. Everything be­fore the wake word is the­o­ret­i­cally dis­carded.

This was a rea­son­able de­sign in 2014. It is a dead end for where AI as­sis­tance needs to go.

Here’s what hap­pens in a real kitchen at 6:30am:Anonymized from one of our test homes. The real ver­sion was messier and

in­cluded a tod­dler scream­ing about Cheerios.

Nobody is go­ing to pref­ace that with a wake word. The in­for­ma­tion is wo­ven into nat­ural speech be­tween two flus­tered par­ents get­ting the fam­ily ready to leave the house. The mo­ment you re­quire a trig­ger, you lose the most valu­able in­ter­ac­tions — the ones that hap­pen while peo­ple are liv­ing their lives, not think­ing of how to give con­text to an AI as­sis­tant.

You can­not build proac­tive as­sis­tance be­hind a wake word. The AI has to be pre­sent in the room, con­tin­u­ously, ac­cu­mu­lat­ing con­text over days and weeks and months, to build the un­der­stand­ing that makes proac­tive help pos­si­ble.

This is where every ma­jor AI com­pany is head­ing. Not just au­dio — vi­sion, pres­ence de­tec­tion, wear­ables, multi-room aware­ness. The next gen­er­a­tion of AI as­sis­tants will hear and see every­thing. Some will be on your face or in your ears all day. They will be al­ways on, al­ways sens­ing, al­ways build­ing a model of your life.

The ques­tion is not whether al­ways-on AI will hap­pen. It’s who

con­trols the data it col­lects. And right now, the an­swer to that

ques­tion is: ad­ver­tis­ing com­pa­nies.

Here’s where the in­dus­try’s re­sponse gets pre­dictable. We en­crypt the data in tran­sit.” We delete it af­ter pro­cess­ing.” We anonymize every­thing.” Ads don’t in­flu­ence the AIs an­swers.” Read our pri­vacy pol­icy.“With cloud pro­cess­ing, every user is trust­ing:

• The com­pa­ny’s cur­rent pri­vacy pol­icy

• Every em­ployee with pro­duc­tion ac­cess

• Every third-party ven­dor in the pro­cess­ing pipeline

• Every gov­ern­ment that can is­sue a sub­poena or na­tional se­cu­rity

let­ter

• Every ad­ver­tiser part­ner­ship that has­n’t been an­nounced yet

• The com­pa­ny’s fu­ture pri­vacy pol­icy

OpenAI’s own ad an­nounce­ment in­cludes this lan­guage: OpenAI keeps con­ver­sa­tions with ChatGPT pri­vate from ad­ver­tis­ers, and never sells data to ad­ver­tis­ers.” It sounds re­as­sur­ing. But Google scanned every Gmail for ad tar­get­ing for thir­teen years

be­fore qui­etly stop­ping in 2017. Policies change. Architectures don’t.

When a de­vice processes data lo­cally, the data phys­i­cally can­not leave the net­work. There is no API end­point to call. There is no teleme­try pipeline. There is no anonymized us­age data” that some­how still con­tains enough sig­nal to be use­ful for ad tar­get­ing. The in­fer­ence hard­ware sits in­side the de­vice or in the user’s home, on their net­work.

Your email is sen­si­tive. A con­tin­u­ous au­dio and vi­sual feed of your home is some­thing else en­tirely. It cap­tures ar­gu­ments, break­downs, med­ical con­ver­sa­tions, fi­nan­cial dis­cus­sions, in­ti­mate mo­ments, par­ent­ing at its worst, the com­pletely un­guarded ver­sion of peo­ple that ex­ists only when they be­lieve no­body is watch­ing. We wrote a deep dive on our mem­ory sys­tem in

Building Memory for an Always-On AI That Listens to Your Kitchen.

Amazon al­ready showed us what hap­pens. They elim­i­nated lo­cal voice pro­cess­ing.

They planned to feed Alexa con­ver­sa­tions to ad­ver­tis­ers.

They part­nered Ring with a sur­veil­lance net­work that had fed­eral law

en­force­ment ac­cess.

What hap­pens when those same eco­nomic in­cen­tives are ap­plied to de­vices that cap­ture every­thing?

The coun­ter­ar­gu­ment is al­ways the same: Local mod­els aren’t good enough.” Three years ago, that was true. It is no longer true.

You can run a com­plete am­bi­ent AI pipeline to­day — real-time speech-to-text, se­man­tic mem­ory, con­ver­sa­tional rea­son­ing, text-to-speech, etc — on a de­vice that fits next to a ca­ble box (remember those?). No fan noise. A one-time hard­ware pur­chase with no per-query fee and no data leav­ing the build­ing. New model ar­chi­tec­tures, bet­ter com­pres­sion, and open-source in­fer­ence en­gines have con­verged to make this pos­si­ble, and the sil­i­con roadmap points in one di­rec­tion: more ca­pa­bil­ity per watt, every year. We’ve been run­ning al­ways-on pro­to­types in five homes. The com­plaints

we get are about the AI mis­un­der­stand­ing con­text, not about raw model

ca­pa­bil­ity. That’s a mem­ory ar­chi­tec­ture prob­lem, not a model size

prob­lem.

Are lo­cal mod­els as ca­pa­ble as the best cloud mod­els? No. But we’re usu­ally not ask­ing our smart speaker to re-de­rive the Planck con­stant.

Hardware that runs in­fer­ence on-de­vice. Models that process au­dio and video lo­cally and never trans­mit it. There needs to be a busi­ness model based on sell­ing the hard­ware and

soft­ware, not the data the hard­ware col­lects. An ar­chi­tec­ture where the

com­pany that makes the de­vice lit­er­ally can­not ac­cess the data

it processes, be­cause there is no con­nec­tion to ac­cess it

through.

The most help­ful AI will also be the most in­ti­mate tech­nol­ogy ever built. It will hear every­thing. See every­thing. Know every­thing about the fam­ily. The only ar­chi­tec­ture that keeps that tech­nol­ogy safe is one where it is struc­turally in­ca­pable of be­tray­ing that knowl­edge. Not pol­icy. Not promises. Not a pri­vacy set­ting that can be qui­etly re­moved in a March soft­ware up­date.

Choose lo­cal. Choose edge. Build the AI that knows every­thing but phones home noth­ing.

...

Read the original on juno-labs.com »

5 265 shares, 22 trendiness

Andrej Karpathy talks about “Claws”

Andrej Karpathy talks about Claws”. Andrej Karpathy tweeted a mini-es­say about buy­ing a Mac Mini (“The ap­ple store per­son told me they are sell­ing like hot­cakes and every­one is con­fused”) to tin­ker with Claws:

Andrej Karpathy talks about Claws”. Andrej Karpathy tweeted a mini-es­say about buy­ing a Mac Mini (“The ap­ple store per­son told me they are sell­ing like hot­cakes and every­one is con­fused”) to tin­ker with Claws:

I’m def­i­nitely a bit sus’d to run OpenClaw specif­i­cally […] But I do love the con­cept and I think that just like LLM agents were a new layer on top of LLMs, Claws are now a new layer on top of LLM agents, tak­ing the or­ches­tra­tion, sched­ul­ing, con­text, tool calls and a kind of per­sis­tence to a next level.

Looking around, and given that the high level idea is clear, there are a lot of smaller Claws start­ing to pop out. For ex­am­ple, on a quick skim NanoClaw looks re­ally in­ter­est­ing in that the core en­gine is ~4000 lines of code (fits into both my head and that of AI agents, so it feels man­age­able, au­ditable, flex­i­ble, etc.) and runs every­thing in con­tain­ers by de­fault. […]

Anyway there are many oth­ers - e.g. nanobot, ze­ro­claw, iron­claw, pic­o­claw (lol @ pre­fixes). […]

Not 100% sure what my setup ends up look­ing like just yet but Claws are an awe­some, ex­cit­ing new layer of the AI stack.

...

Read the original on simonwillison.net »

6 240 shares, 10 trendiness

CERN 2019 WorldWideWeb Rebuild

In December 1990, an ap­pli­ca­tion called WorldWideWeb was de­vel­oped on a NeXT ma­chine at The European Organization for Nuclear Research (known as CERN) just out­side of Geneva. This pro­gram – WorldWideWeb — is the an­tecedent of most of what we con­sider or know of as the web” to­day.

In February 2019, in cel­e­bra­tion of the thir­ti­eth an­niver­sary of the de­vel­op­ment of WorldWideWeb, a group of de­vel­op­ers and de­sign­ers con­vened at CERN to re­build the orig­i­nal browser within a con­tem­po­rary browser, al­low­ing users around the world to ex­pe­ri­ence the rather hum­ble ori­gins of this trans­for­ma­tive tech­nol­ogy.

This pro­ject was sup­ported by the US Mission in Geneva through the CERN & Society Foundation.

Ready to browse the World Wide Web us­ing WorldWideWeb?

Select Document” from the menu on the side.

Click here to jump in (and re­mem­ber you need to dou­ble-click on links):

* History — a brief his­tory of the ap­pli­ca­tion which was built in 1989 as a prog­en­i­tor to what we know as the web” to­day.

* Timeline — a time­line of the thirty years of in­flu­ences lead­ing up to (and the thirty years of in­flu­ence lead­ing out from) the pub­li­ca­tion of the memo that lead to the de­vel­op­ment of the first web browser.

* The Browser — in­struc­tions for us­ing the recre­ated WorldWideWeb browser, and a col­lec­tion of its in­ter­face pat­terns.

* Typography — de­tails of the NeXT com­put­er’s fonts used by the WorldWideWeb browser.

* Inside the Code — a look at some of the orig­i­nal code of WorldWideWeb.

* Production Process — a be­hind the scenes look at how the WorldWideWeb browser was re­built for to­day.

* Related Links — links to ad­di­tional his­tor­i­cal and tech­ni­cal re­sources around the pro­duc­tion of WorldWideWeb.

* Colophon — a bit of info about the folks be­hind the pro­ject.

...

Read the original on worldwideweb.cern.ch »

7 212 shares, 8 trendiness

Scan Gallery

DISCOUNTS: Instead of ran­dom dis­counts we pre­fer keep­ing the prices sta­ble (already since early 2022)

US Shipping - Now all taxes and fees are in­cluded in the ship­ping cost at check­out

DISCOUNTS: Instead of ran­dom dis­counts we pre­fer keep­ing the prices sta­ble (already since early 2022)

US Shipping - Now all taxes and fees are in­cluded in the ship­ping cost at check­out

DISCOUNTS: Instead of ran­dom dis­counts we pre­fer keep­ing the prices sta­ble (already since early 2022)

US Shipping - Now all taxes and fees are in­cluded in the ship­ping cost at check­out

DISCOUNTS: Instead of ran­dom dis­counts we pre­fer keep­ing the prices sta­ble (already since early 2022)

US Shipping - Now all taxes and fees are in­cluded in the ship­ping cost at check­out

DISCOUNTS: Instead of ran­dom dis­counts we pre­fer keep­ing the prices sta­ble (already since early 2022)

US Shipping - Now all taxes and fees are in­cluded in the ship­ping cost at check­out

DISCOUNTS: Instead of ran­dom dis­counts we pre­fer keep­ing the prices sta­ble (already since early 2022)

US Shipping - Now all taxes and fees are in­cluded in the ship­ping cost at check­out

DISCOUNTS: Instead of ran­dom dis­counts we pre­fer keep­ing the prices sta­ble (already since early 2022)

US Shipping - Now all taxes and fees are in­cluded in the ship­ping cost at check­out

DISCOUNTS: Instead of ran­dom dis­counts we pre­fer keep­ing the prices sta­ble (already since early 2022)

US Shipping - Now all taxes and fees are in­cluded in the ship­ping cost at check­out

DISCOUNTS: Instead of ran­dom dis­counts we pre­fer keep­ing the prices sta­ble (already since early 2022)

US Shipping - Now all taxes and fees are in­cluded in the ship­ping cost at check­out

DISCOUNTS: Instead of ran­dom dis­counts we pre­fer keep­ing the prices sta­ble (already since early 2022)

US Shipping - Now all taxes and fees are in­cluded in the ship­ping cost at check­out

...

Read the original on openscan.eu »

8 204 shares, 16 trendiness

New law on more sustainable, circular and safe batteries enters into force

A new law to en­sure that bat­ter­ies are col­lected, reused and re­cy­cled in Europe is en­ter­ing into force to­day. The new Batteries Regulation will en­sure that, in the fu­ture, bat­ter­ies have a low car­bon foot­print, use min­i­mal harm­ful sub­stances, need less raw ma­te­ri­als from non-EU coun­tries, and are col­lected, reused and re­cy­cled to a high de­gree in Europe. This will sup­port the shift to a cir­cu­lar econ­omy, in­crease se­cu­rity of sup­ply for raw ma­te­ri­als and en­ergy, and en­hance the EUs strate­gic au­ton­omy.

In line with the cir­cu­lar­ity am­bi­tions of the European Green Deal, the Batteries Regulation is the first piece of European leg­is­la­tion tak­ing a full life-cy­cle ap­proach in which sourc­ing, man­u­fac­tur­ing, use and re­cy­cling are ad­dressed and en­shrined in a sin­gle law.

Batteries are a key tech­nol­ogy to drive the green tran­si­tion, sup­port sus­tain­able mo­bil­ity and con­tribute to cli­mate neu­tral­ity by 2050. To that end, start­ing from 2025, the Regulation will grad­u­ally in­tro­duce de­c­la­ra­tion re­quire­ments, per­for­mance classes and max­i­mum lim­its on the car­bon foot­print of elec­tric ve­hi­cles, light means of trans­port (such as e-bikes and scoot­ers) and recharge­able in­dus­trial bat­ter­ies.

The Batteries Regulation will en­sure that bat­ter­ies placed on the EU sin­gle mar­ket will only be al­lowed to con­tain a re­stricted amount of harm­ful sub­stances that are nec­es­sary. Substances of con­cerns used in bat­ter­ies will be reg­u­larly re­viewed.

Targets for re­cy­cling ef­fi­ciency, ma­te­r­ial re­cov­ery and re­cy­cled con­tent will be in­tro­duced grad­u­ally from 2025 on­wards. All col­lected waste bat­ter­ies will have to be re­cy­cled and high lev­els of re­cov­ery will have to be achieved, in par­tic­u­lar of crit­i­cal raw ma­te­ri­als such as cobalt, lithium and nickel. This will guar­an­tee that valu­able ma­te­ri­als are re­cov­ered at the end of their use­ful life and brought back in the econ­omy by adopt­ing stricter tar­gets for re­cy­cling ef­fi­ciency and ma­te­r­ial re­cov­ery over time.

Starting in 2027, con­sumers will be able to re­move and re­place the portable bat­ter­ies in their elec­tronic prod­ucts at any time of the life cy­cle. This will ex­tend the life of these prod­ucts be­fore their fi­nal dis­posal, will en­cour­age re-use and will con­tribute to the re­duc­tion of post-con­sumer waste.

To help con­sumers make in­formed de­ci­sions on which bat­ter­ies to pur­chase, key data will be pro­vided on a la­bel. A QR code will pro­vide ac­cess to a dig­i­tal pass­port with de­tailed in­for­ma­tion on each bat­tery that will help con­sumers and es­pe­cially pro­fes­sion­als along the value chain in their ef­forts to make the cir­cu­lar econ­omy a re­al­ity for bat­ter­ies.

Under the new law’s due dili­gence oblig­a­tions, com­pa­nies must iden­tify, pre­vent and ad­dress so­cial and en­vi­ron­men­tal risks linked to the sourc­ing, pro­cess­ing and trad­ing of raw ma­te­ri­als such as lithium, cobalt, nickel and nat­ural graphite con­tained in their bat­ter­ies.  The ex­pected mas­sive in­crease in de­mand for bat­ter­ies in the EU should not con­tribute to an in­crease of such en­vi­ron­men­tal and so­cial risks.

Work will now fo­cus on the ap­pli­ca­tion of the law in the Member States, and the redac­tion of sec­ondary leg­is­la­tion (implementing and del­e­gated acts) pro­vid­ing more de­tailed rules.

Since 2006, bat­ter­ies and waste bat­ter­ies have been reg­u­lated at EU level un­der the Bat­ter­ies Directive. The Commission proposed to re­vise this Directive in December 2020 due to new so­cioe­co­nomic con­di­tions, tech­no­log­i­cal de­vel­op­ments, mar­kets, and bat­tery uses.

Demand for bat­ter­ies is in­creas­ing rapidly. It is set to in­crease 14-fold glob­ally by 2030 and the EU could ac­count for 17% of that de­mand. This is mostly dri­ven by the elec­tri­fi­ca­tion of trans­port. Such ex­po­nen­tial growth in de­mand for bat­ter­ies will lead to an equiv­a­lent in­crease in de­mand for raw ma­te­ri­als, hence the need to min­imise their en­vi­ron­men­tal im­pact.

In 2017, the Commission launched the Eu­ro­pean Battery Alliance to build an in­no­v­a­tive, sus­tain­able and glob­ally com­pet­i­tive bat­tery value chain in Europe, and en­sure sup­ply of bat­ter­ies needed for de­car­bon­is­ing the trans­port and en­ergy sec­tors.

...

Read the original on environment.ec.europa.eu »

9 196 shares, 44 trendiness

How far back in time can you understand English?

A man takes a train from London to the coast. He’s vis­it­ing a town called Wulfleet. It’s small and old, the kind of place with a pub that’s been pour­ing pints since the Battle of Bosworth Field. He’s go­ing to write about it for his blog. He’s ex­cited.

He ar­rives, he checks in. He walks to the cute B&B he’d picked out on­line. And he writes it all up like any good travel blog­ger would: in that breezy LiveJournal style from 25 years ago, per­haps, in his case, try­ing a lit­tle too hard.

But as his post goes on, his lan­guage gets older. A hun­dred years older with each jump. The spelling changes. The gram­mar changes. Words you know are re­placed by un­fa­mil­iar words, and his at­ti­tude gets older too, as the blog­ger’s voice is re­placed by that of a Georgian di­arist, an Elizabethan pam­phle­teer, a me­dieval chron­i­cler.

By the mid­dle of his post, he’s writ­ing in what might as well be a for­eign lan­guage.

But it’s not a for­eign lan­guage. It’s all English.

None of the story is real: not the blog­ger, not the town. But the lan­guage is real, or at least re­al­is­tic. I con­structed the pas­sages my­self, work­ing from what we know about how English was writ­ten in each pe­riod.

It’s a thou­sand years of the English lan­guage, com­pressed into a sin­gle blog post.

Read it and no­tice where you start to strug­gle. Notice where you give up en­tirely. Then meet me on the other side and I’ll tell you what hap­pened to the lan­guage (and the blog­ger).

You’re read­ing The Dead Language Society, where 35,000+ read­ers ex­plore the hid­den his­tory of the English lan­guage. I’m Colin Gorrie: PhD lin­guist and your guide through 1,500 years of English be­ing weird.

I pub­lish every Wednesday. Paid sub­scribers get every is­sue, the full archive, and the con­tent I’m most proud of: prac­ti­cal guides to read­ing his­tor­i­cal texts your­self, hon­est takes on how lan­guage re­ally works, and live book clubs where we read texts like Beowulf and (up next!) Sir Gawain and the Green Knight.

Well, I fi­nally got to the town every­one has been talk­ing about lately. Wulfleet. And let me tell you, it was not easy to get here. It’s ridicu­lous how close this place is to London, and yet how hard it is to get here. I took a train to some place whose name I can’t pro­nounce, and then from there I had to hop on a bus. The whole day was shot just get­ting here.

Not go­ing to lie though: so far, it’s to­tally worth it.

Yes, it’s the typ­i­cal English coastal town: the seag­ulls, the cob­ble­stone streets, the works. But there’s some­thing about it that just makes me want to dress up in a cape and walk around like I’m in a Gothic novel. Although, let’s be hon­est, do I re­ally need an ex­cuse to do that? :)

Everyone seems re­ally nice here, al­though I did have one re­ally weird en­counter on the way to the B&B. A guy was fol­low­ing me for a while. It kind of freaked me out. Anyway, if you go to Wulfleet, just watch out for this one weird guy who hangs out near the bus stop. I know, real spe­cific. But any­way, that was just a bit odd.

Speaking of which, the B&B is also… in­ter­est­ing. LOL. It has sep­a­rate hot and cold taps and every­thing. I’m about to see how the bed” por­tion works. I’ll up­date you on the breakfast” to­mor­row morn­ing. If I can find an in­ter­net cafe around here, that is.

My plans for an un­trou­bled sleep were up­set, how­ever, when I woke with a start be­fore dawn. The win­dow had, it seemed, come open in the night, though I was per­fectly cer­tain I had fas­tened it. I sprang up from the bed to see what was the cause, but I could see noth­ing in the dark­ness — noth­ing, that is, that I could sat­is­fac­to­rily ac­count for. I closed the win­dow again but was en­tirely un­able to fall asleep due to the shock. I am not, I hope, an eas­ily fright­ened man, but I con­fess the in­ci­dent left me not a lit­tle un­set­tled.

When dawn fi­nally came, I went down­stairs to find a well-ap­pointed din­ing room in which there was laid out a mod­est but per­fectly ad­e­quate meal. After I ate, and thanked the land­lady — a re­spectable woman of the kind one ex­pects to find in charge of such an es­tab­lish­ment — I de­cided to take a stroll around the town. The sea air did some­thing to re­vive me af­ter the events of the pre­vi­ous day, not to men­tion the night, al­though a ques­tion still weighed on me. Do win­dows sim­ply burst open in the night? Or was there some­thing else afoot? I re­solved to make en­quiries, though of whom I was not yet cer­tain.

After spend­ing the day wan­der­ing around the en­vi­rons of the town, and, find­ing my­self hun­gry, I sought out an inn, where I might buy some sup­per. It was not dif­fi­cult to find one, and, sit­ting alone, I called for sup­per from what the pub­li­can had to of­fer. I con­fess I gave no great thought to the qual­ity of the fare. Hunger, that great lev­eller, makes philoso­phers of us all, and ren­ders even the mean­est dish agree­able.

The place was ad­e­quately charm­ing. The ta­bles were cov­ered with gut­ter­ing can­dles, and the lo­cal rus­tics seemed to be amus­ing them­selves with great jol­lity. Reader, I am not one of those trav­ellers who holds him­self above the com­mon peo­ple of the places he vis­its. I saw fit rather to join in with their sport and we whiled away the hours to­gether in good cheer. I found them to be as hon­est and ami­able a com­pany as one could wish for.

The only thing that dis­turbed my good hu­mour was when I thought, for a brief mo­ment, that I saw the man who ac­costed me yes­ter­day among the crowd. But it must have been a mere fancy, for what­ever I thought I saw van­ished as quickly as it had ap­peared. I chided my­self for the weak­ness of my nerves, and took an­other draught to steady them.

When, at long last, the en­ter­tain­ment was spent, I un­der­took to re­turn to my lodg­ings; how­ever, find­ing my­self quite un­able to find my way, a fact which owed some­thing to hav­ing im­bibed rather im­mod­er­ately in the hours prior — and here let me cau­tion the reader against the par­tic­u­lar hos­pi­tal­ity of coun­try innkeep­ers, which is lib­eral be­yond what pru­dence would ad­vise — I soon found my­self at the har­bour’s edge.

When I was firſt come to Wulfleet, I did not see the har­bour, for I was weary and would ſooner go to the inn, that I might ſleep. It is a truth well known to trav­ellers, that wearineſs of body breeds a kind of blind­neſs to all things, how­ever re­mark­able, and ſo it was with me. But now that I be­held the ſight of it, I mar­velled. In the inky black­neſs I could see not a ſtar, nor even a ſliver of the moon. It was in­deed a won­der that I did not ſtum­ble on my way, and per­iſh in a gut­ter, for many a man has come to his end by leſs.

Finally, with my mind much filled with re­flec­tion, I found my way through dark ſtreets to a fa­mil­iar al­ley. This was a wel­come sight, as an ill fore­bod­ing was lately come into my mind. I en­ter­tained for a mo­ment such un­manly thoughts as are far from my cuſ­tom, and which I ſhould be aſhamed to ſet down here, were it not that an honeſt ac­count re­quires it. I felt eſpe­cially that I was purſued by ſome thing un­known to me. I glanced back­wards, to ſee if I might eſpy that man. But there was no one, or at least no one that I could diſcern.

At laſt, I found the door­way of the inn, as much by chance as by deſign, and re­tired to ſleep with a mind ad­dled half by drink and the other half by a fear for which I could not well ac­count. I com­mended myſelf to Providence, and reſolved to think no more on it.

That night I was vn­trou­bled by such eu­ents as I had vn­der­gone the night be­fore, for I had barred the door ere I ſlept, and so for­ti­fied, that so no force might open it. This town of Wulfleet was paſſing ſtrange, as ſtrange I dare ſay as any place whereof Plinie wrote, or any iland dis­cov­ered in the voy­ages of Sir Walter Raleigh. But I was bound to my taſk, and would not flinch from it. I would record the oc­cur­rents in Wulfleet, howeuer ſtrange they might ſeem, yea, though they were ſuch things as would make a leſſer man forſake his pur­poſe.

But I ſoon for­got my ear­lier dread, for the morn­ing brought with it ſo fair a ſight as to diſpel all feare. The peo­ple of the town had erected ouernight a mar­ket of ſuch va­ri­ety and abun­dance as I haue not ſeen the like. Animals walked among men, and men among an­i­mals, a true maruel!

As I looked on this aſſem­bled throng, greatly pleaſed and not a lit­tle amazed, a man ap­proached me. He ſtar­tled me, but I quickly saw he was noth­ing but a farmer come to hawke his wares. Would you haue a fowl, sir?” ſaid he, My hens are fat and luſty, and you may haue them cheap.”

I said in re­ply, No, I thanke thee,” He was a churliſh fel­low, rude of ſpeech and meane of aſpect, and I felt no ſhame at thouing ſuch a man as that.

I went forthe among the peo­ple, and as I paſſed throughe the mar­ket and the ſtretes of the towne, euer lokyng aboute me with grete care, leſt I ſholde agayn en­coun­tre ſome peryl, thee ap­peared, from oute of the prees that ſame man whom I ſo dredde. And he was passyng foule was of vyſage, as it ſemed to me, more foule than ony man I had ſene in al my lyf.

He turned hym to­warde me and ſayd, Straunger, where­fore art thou come hy­d­der?”

And I anſw­erd hym nott, for I knewe nott what I ſholde ſaye, ne what an­swere myght ſerue me beſt in ſuche a caas.

Than hee asked me, Was it for that thou wouldeſt ſee the Maiſter?”

And verely this name dyd me ſore af­fright, for who was this Maiſter wherof he ſpake? And what maner of man was he, that his very name ſholde be ſpo­ken wyth ſuche reuer­ence and drede. I wolde haue fledde but he purſued me and by myn avys he was the ſwifter, for he caught me full ſoone.

I sayd to him, What meaneſt thou? Who is the Maiſter?”

And he sayd, I ſhall brynge the vnto hym, and thou ſhalt ſee for thy ſelf what maner of lorde he is.”

But I wolde not, and cryed out ayenſt hym with grete noyſe, leſt he ſholde take me thy­der by vi­o­lence and ayenſt my wille.

Bot þe man wolde me nat aban­done þer, ne suf­fre me to passen forþ. I miȝt nat flee, for hys com­pan­iouns, of whom þer were a gret nom­bre, beſet me aboute, and heelden me faſt þat I ne scholde nat as­capen. And þei weren stronge menn and wel douȝti, of grymme con­te­naunce and fiers, and armed wiþ swerdes and wiþ knyues, so þat it were gret foly for eny man to wiþston­den hem.

So þei bounden me hond and foot and led­den me to þe one þei callede Maiſter, of whom I hadde herd so muchel and knewe so litel.

Þe sayde Maiſter, what that hee ap­perid bi­fore me, was verely a Deuill, or so me þouȝte, for neuer in al my lyf hadde I be­holden so foule a crea­ture. Hee bore a blak clok þat heng to þe grounde, and ſpake neuer a worde. Bot his coun­te­naunce was hi­dous and so dred­ful þat my blood wexed colde to lo­ken on hym. For he hadde nat þe vis­age of a man bot of a beest, wiþ þe teeþ and ſnoute of a wulf, scharpe and crueel. And his eres weren longe eres, as of a wulf, and bi­hynde him þer heng a gret tayl, as wulf haþ. And hys eyen schon in þe derk­nesse lyke bren­nyng coles.

Bot þei maden no an­swer, neyþer good ne yuel. Þei weren stille as stoon, and sto­den about me as men þat wayte on þeir lordes com­man­de­ment.

Þanne af­ter muchel tyme spak þe Maiſter, and his wordes weren colde as win­tres is. His vois was as þe cry­ing of rauenes, scharpe and schille, and al þat herde hym weren adrade and durst nat speken.

I deme þe to þe deeþ, straunger. Here ſchal­tou dyen, fer fram þi kynne and fer fram þine owen londe, and non ſchal knowen þi name, ne non schal þe bi­wepe.”

And I sayde to hym, wiþ what bold­e­nesse I miȝte gaderen, Whi fareſt þou wiþ me þus? What treſ­paas haue I wrouȝt ayeins þe, þat þou de­meſt me so harde a dome?”

Swie!” quoþ he, and smot me wiþ his honde, so þat I fel to þe erþe. And þe blod ran doun from mi mouþe.

And I swied, for þe grete drede þat was icu­men vpon mee was more þan I miȝte beren. Mi herte bi­cam as stoon, and mi ly­mes weren heuy as leed, and I ne miȝte namore ston­den ne spo­ken.

Þe eu­ele man louȝ, whan that he sawe my peine, and it was a crueel louȝter, wiþouten merci or pitee as of a man þat haþ no rewþe in his herte.

Allas! I scholde neuer hauen icu­men to þis toune of Wuluesfleete! Cursed be þe dai and cursed be þe houre þat I first sette foot þerinne!

Hit is muchel to seggen all þat pi­n­unge hie on me uuroȝten, al þar sor and al þat sorȝe. Ne scal ic ne­fre hit forȝeten, naht uuhiles ic libbe!

Ac þer com me gret sped, and þat was a uuif, strong and stiþ! Heo com in among þe yuele men and me nerede fram heore hon­den.

Heo sloȝ þe heþene men þat me pyne­den, sloȝ hem and fælde hem to þe grunde. Þer was blod and bale inouȝ And hie fe­ollen leien stille, for hie ne miȝten namore ston­den. Ac þe Maister, þe uuraþþe Maister, he flaȝ awei in þe de­or­c­nesse and was iseon namore.

Ic seide hire, Ic þanke þe, leoue uuif, for þu hauest me ineredd from dæðe and from alle mine ifoan!”

Þæt ƿif me andsƿar­ode and cƿæð, Ic eom Ælfgifu gehaten. Þu scalt me to ƿife ni­men, þeah þe þu hit ne ƿite gyt, for hit is sƿa gedon þæt nan man ne nan ƿif ne mote heonon faren buten þurh þone dæð þæs Hlafordes.”

Ac þær is gyt mare to donne her, forþi ƿe nabbaþ þone Hlaford of­s­la­genne. He is strong and sƿiðe yfel, and manige gode men he hæfð for­done on þisse stoƿe.”

And þæt heo sægde wæs eall soþ. Ic ƿifode on hire, and heo ƿæs ful scyne ƿif, ƿis ond ƿælfæst. Ne gemette ic næfre ær sƿylce ƿif­man. Heo ƿæs on gefeo­hte sƿa beald swa ænig mann, and þeah hƿæþere hire andƿlite wæs ƿyn­sum and fæger.

Ac ƿe naƿiht freo ne sin­don, for þy þe ƿe næfre ne mi­h­ton fram Ƿulfesfleote geƿitan, nefne ƿe þone Hlaford finden and hine of­slean. Se Hlaford hæfþ þisne stede mid searo­cræf­tum gebun­den, þæt nan man ne mæg hine for­læ­tan. Ƿe sin­don her sƿa fu­glas on nette, swa fixas on ƿere.

The blog ends there. No sign-off, no thanks for read­ing.” Just a few sen­tences in a lan­guage that most of us lost the abil­ity to fol­low some­where around the thir­teenth cen­tury.

So, how far did you get?

Let me take you back through it.

Written English has been re­mark­ably sta­ble over the last 300 years. Spelling was stan­dard­ized in the mid-1700s, and gram­mar has barely changed at all. This means that, if you can read Harry Potter (1997–2003), you can read Robinson Crusoe (1719), which is good news to fans of the English novel.

What has changed is the voice.

Blog post be­came di­ary en­try be­came travel let­ter. The for­mat changed much faster than the lan­guage. Compare the very first line, Well, I fi­nally got to the town every­one has been talk­ing about lately” with the line from the 1800 sec­tion, Hunger, that great lev­eller, makes philoso­phers of us all, and ren­ders even the mean­est dish agree­able.”

They’re both per­for­mances of a sort: the 2000s pro­tag­o­nist is per­form­ing for his blog’s au­di­ence, so the tone is chatty and per­sonal. The 1800s pro­tag­o­nist, with the mind of a Georgian di­arist, is per­form­ing for pos­ter­ity, so he phi­los­o­phizes.

The one vis­i­ble change in the lan­guage it­self is the ap­pear­ance, in the 1700 pas­sage, of the long s (ſ). This was­n’t a dif­fer­ent let­ter, just a vari­ant form of s used in cer­tain po­si­tions within a word. It dis­ap­peared fully from English print­ing in the early 19th cen­tury, al­though its use was dwin­dling even be­fore that, which is why it does not ap­pear in the 1800 pas­sage. It’s a ty­po­graphic change rather than a lin­guis­tic one, but it’s the first un­mis­tak­able sign that the text is get­ting older.

This is where the ground starts to move un­der our feet.

Before the mid 1700s, there was no such thing as stan­dard­ized spelling. Writers spelled words as they heard them, or as they felt like spelling them, which is why the 1500s and 1600s sec­tions look so alien, even when the words, un­der­neath the sur­face, are ones you know.

For an­other dif­fi­culty, take the word vn­trou­bled from the 1600 sec­tion. This is our fa­mil­iar un­trou­bled, but the u is re­placed by a v, be­cause u and v were not yet con­sid­ered sep­a­rate let­ters. They were vari­ants of the same lat­ter, used to rep­re­sent both sounds. The con­ven­tion was to write v at the be­gin­ning of words and u in the mid­dle, which give us spelling like vnto (unto), eu­ents (events), ouernight (overnight), and howeuer (however). It looks weird at first, but once you know the rule, the words be­come much more read­able.

Another new ar­rival — or, more ac­cu­rately, late de­par­ture — from the lan­guage is the let­ter thorn (þ), which first ap­pears in the 1400 sec­tion. Thorn is sim­ply th. That’s it. Wherever you see þ, read th, and the word will usu­ally re­veal it­self: þe is the, þei is they, þat is that. If you’ve ever seen a pub called Ye Olde” any­thing, that ye is ac­tu­ally þe, an at­tempt by early print­ers to write a thorn with­out hav­ing to make an ex­pen­sive new let­ter.

Thorn’s com­pan­ion, yogh (ȝ), is more com­pli­cated. It rep­re­sents sounds that mod­ern English spells as gh or y — so miȝt is might, ȝe is ye. The rea­sons for this are a story unto them­selves.

But the most in­ter­est­ing change in this pe­riod is­n’t a let­ter. Rather, it’s a pro­noun. Notice the mo­ment in the 1600 sec­tion where our blog­ger meets a farmer and says, No, I thanke thee.” Then he adds, I felt no ſhame at thouing ſuch a man as that.”

Thouing. To thou some­one, or to use thou when talk­ing to them, was, by the 1600s, a de­lib­er­ate so­cial state­ment. Thou was the old sin­gu­lar form of you; you was orig­i­nally the plural. Over the cen­turies, you came to be used as a po­lite sin­gu­lar, much as French uses vous. Gradually, you took over en­tirely. By Shakespeare’s time (1564–1616), thou sur­vived in two main con­texts: in­ti­macy (as in prayer) and in­sult. Our blog­ger is be­ing a lit­tle rude here. He’s look­ing down on a man he con­sid­ers be­neath him, and his lan­guage gives him a way of mak­ing his feel­ings per­fectly clear.

Somewhere in this sec­tion — and if you’re like most read­ers, it hap­pened around 1300 or 1200 — the lan­guage crossed a bound­ary. Up to this point, com­pre­hen­sion felt like it was drop­ping grad­u­ally, but now it’s fallen off a cliff. In one sec­tion, you could get by by squint­ing and guess­ing; in the next you were ut­terly lost. You have hit the wall.

There are two rea­sons for this. The first is vo­cab­u­lary. As you move back­wards in time, the French and Latin loan­words that make up an enor­mous pro­por­tion of the Modern English vo­cab­u­lary grow fewer and fewer. When you pass 1250, they drop off al­most al­to­gether. Where a mod­ern writer would say he un­der­went tor­ture, a 1200-era writer must say that he suf­fered pi­n­unge in­stead.

The far­ther back you go, the more the fa­mil­iar Latinate layer of English is stripped away, re­veal­ing the Germanic core un­der­neath: a lan­guage that looks to mod­ern eyes more like German or Icelandic than any­thing we’d call English.

The sec­ond rea­son for the dif­fi­culty is gram­mar. Old English (450–1100) was an in­flected lan­guage: it used end­ings on nouns, ad­jec­tives, and verbs to mark their gram­mat­i­cal roles in a sen­tence, much as Latin or mod­ern German do. Alongside these end­ings came a greater free­dom in word or­der, which makes sense given that the end­ings told you who was do­ing what to whom.

English lost most of these end­ings over the course of the pe­riod lin­guists call Middle English (1100–1450), and it tight­ened its word or­der as if to com­pen­sate. When you look at these fi­nal sec­tions, if you can make out the words, you will see the ef­fects of this freer word or­der. For ex­am­ple, in 1200 we read monige gode men he hæfð for­done many good men he has de­stroyed’, where we’d ex­pect a Modern English or­der more like and he has de­stroyed many good men.

To make mat­ters worse, a few un­fa­mil­iar let­ters also ap­pear: wynn (ƿ) is sim­ply w, eth (ð) means the same as thorn (þ) — both rep­re­sent th, and ash (æ) rep­re­sents the vowel in cat and hat.:

All of these fac­tors com­bined likely made it dif­fi­cult, if not im­pos­si­ble, to fol­low the plot. So let me tell you what hap­pened. In the 1400 sec­tion, the blog­ger was seized. He was dragged be­fore a crea­ture they called the Master, and the Master was no man. He had the teeth and snout of a wolf, as well as a wolf’s long ears and great tail. His eyes glowed like burn­ing coals. Wulfleet was once Wulfesfleot the Bay of the Wolf.’

In the 1300 sec­tion, the Master con­demned our hero to death. In the 1200 sec­tion, a woman ap­peared and killed his cap­tor. The Master, how­ever, fled into the dark­ness. In the 1100 sec­tion, the woman re­vealed her name: Ælfgifu gift of the elves.’ She told the blog­ger — can we still call him that in 1100? — they would marry, and she shares the ter­ri­ble truth about Wulfleet: no one leaves un­til the Master is dead.

In the 1000 sec­tion, they are mar­ried. She is, he writes, as bold as any man in bat­tle, and yet fair of face. But they are not free. Together, through the dark streets of Wulfleet, they hunt the Master still.

The English in which I write this para­graph is not the English of fifty years ago, and it will not be the English of fifty years in the fu­ture.

Go back far enough, and English writ­ing be­comes un­recog­nis­able. Go for­ward far enough and the same thing will hap­pen, though none of us will be around to no­tice.

Our poor blog­ger did­n’t no­tice ei­ther, even as he and his lan­guage trav­elled back in time through the cen­turies. He just kept writ­ing even as he was car­ried off to some­where he could­n’t come back from. Some say that, far away in Wulfleet, he’s writ­ing still.

...

Read the original on www.deadlanguagesociety.com »

10 192 shares, 10 trendiness

What is OAuth?

I des­per­ately need a Matt Levine style ex­pla­na­tion of how OAuth works. What is the his­tor­i­cal cas­cade of re­quire­ments that got us to this place?

There are plenty of ex­pla­na­tions of the in­ner me­chan­i­cal work­ings of OAuth, and lots of ex­pla­na­tions about how var­i­ous flows etc work, but Geoffrey is ask­ing a dif­fer­ent ques­tion:

What I need is to un­der­stand why it is de­signed this way­con­crete ex­am­ples of use cases that mo­ti­vate the de­sign

In the 19 years (!) since I wrote the first sketch of an OAuth spec­i­fi­ca­tion, there has been a lot of minu­tiae and cruft added, but the core idea re­mains the same. Thankfully, it’s a very sim­ple core. Geoffrey’s a very smart guy, and the fact that he’s ask­ing this ques­tion made me think it’s time to write down an an­swer to this.

It’s maybe eas­i­est to start with the Sign-In use-case, which is a much more com­pli­cated spec­i­fi­ca­tion (OpenID Connect) than core OAuth. OIDC uses OAuth un­der the hood, but helps us get to the heart of what’s ac­tu­ally hap­pen­ing.

We send a se­cret to a place that only the per­son try­ing to iden­tify them­selves can ac­cess, and they prove that they can ac­cess that place by show­ing us the se­cret.

The rest is just ac­cu­mu­lated con­sen­sus, in part bikeshed­ding (agreeing on vo­cab­u­lary, etc), part UX, and part mak­ing sure that all the spe­cific mech­a­nisms are se­cure.

There’s also an his­tor­i­cal rea­son to start with OIDC to ex­plain how all this works: in late 2006, I was work­ing on Twitter, and we wanted to sup­port OpenID (then 1.0) so that ahem Twitter would­n’t be­come a cen­tral­ized holder of on­line iden­ti­ties. After chat­ting with the OpenID folks, we quickly re­al­ized that as it was con­structed, we would­n’t be able to sup­port both desk­top clients and web sign-in, since our users would­n’t have pass­words any­more! (mobile apps did­n’t ex­ist yet, but weren’t far out). So, in or­der to al­low OpenID sign-in, we needed a way for folks us­ing Twitter via al­ter­na­tive clients to sign in with­out a pass­word.

There were plenty of so­lu­tions for this; Flickr had an ap­proach, AWS had one, de­li­cious had one, lots of sites just let ran­dom other apps sign-in to your ac­count with your pass­word, etc, but vir­tu­ally every site in the Web 2.0” co­hort needed a way to do this. They were all in­se­cure and all fully cus­tom.

Rather than build­ing TwitterAuth, I fig­ured it was time to have a stan­dard. Insert XKCD 927:

Fortunately, the charg­ing one has been solved now that we've all stan­dard­ized on mini-USB. Or is it mi­cro-USB? Shit.

Thankfully, against all odds, we now have one stan­dard for del­e­gated auth. What it does is very sim­ple:

At its core, OAuth for del­e­ga­tion is a stan­dard way to do the fol­low­ing:

* The first half ex­ists to send, with con­sent, a multi-use se­cret to a known del­e­gate.

* The other half of OAuth de­tails how the del­e­gate can use that se­cret to make sub­se­quent re­quests on be­half of the per­son that gave the con­sent in the first place.

That’s it. The rest is (sadly, mostly nec­es­sary) noise.

Obviously, the above elides ab­solute vol­umes of de­tail about how this is done se­curely and in a con­sis­tent in­ter­op­er­a­ble way. This is the un­en­vi­able work of stan­dards bod­ies. I have plenty of opin­ions on the pros and cons of our cur­rent stan­dards bod­ies, but that’s for an­other time.

There are very cred­i­ble ar­gu­ments that the-set-of-IETF-stan­dards-that-de­scribe-OAuth are less a stan­dard than a frame­work. I’m not sure that’s a bad thing, though. HTML is a frame­work, too – not all browsers need to im­ple­ment all fea­tures, by de­sign.

OIDC it­self is an in­ter­est­ing thing — im­me­di­ately af­ter cre­at­ing OAuth, we re­al­ized that we could com­pose OpenID’s be­hav­iour out of OAuth, even though it was im­pos­si­ble to use OpenID to do what OAuth did. For var­i­ous so­cial, po­lit­i­cal, tech­ni­cal, and op­er­a­tional rea­sons it took the bet­ter part of a decade to write down the bits to make that in­sight a thing that was true in the world. I con­sider it one of my biggest suc­cesses with OAuth that I was in no way in­volved in that work. I don’t have chil­dren, but know all the re­mark­able and com­pli­cated feel­ings of hav­ing cre­ated some­thing that takes on a life of its own.

More gen­er­ally, though, au­then­ti­ca­tion and au­tho­riza­tion are com­pli­cated, sit­u­ated beasts, im­pos­si­ble to sep­a­rate from the UX and ar­chi­tec­tural con­cerns of the sys­tems that in­cor­po­rate them.

The im­por­tant thing when im­ple­ment­ing a stan­dard like OAuth is to un­der­stand first what you’re try­ing to do and why. Once that’s in place, the how is usu­ally a simple” ques­tion of me­chan­ics with fairly con­strained re­quire­ments. I think that’s what makes Geoffrey’s ques­tion so pow­er­ful – it digs into the core of the rea­son why OAuth is of­ten so in­scrutable to so many: the com­pli­cated ma­chin­ery of the stan­dard means that the ac­tual goals it en­codes are lost.

Hopefully, this post helps clear that up!

...

Read the original on leaflet.pub »

To add this web app to your iOS home screen tap the share button and select "Add to the Home Screen".

10HN is also available as an iOS App

If you visit 10HN only rarely, check out the the best articles from the past week.

If you like 10HN please leave feedback and share

Visit pancik.com for more.