Was going to say that, depending on the device's age, this law may apply, where article 13 sub 9 specifies a decade of updates is the minimum: https://eur-lex.europa.eu/eli/reg/2024/2847/oj
But then it turns out that this "applies from" late 2027 :/
Simultaneously Wikipedia says the Act has "entered into force" in 2024. Does anyone know the difference between "enters into force" and "applies"? Is it like this 2016–2018 grace period for GDPR where it was "law" but not enforced? (The wording sounds backwards if it's that, but I'm not a native speaker)
That's how i'd read it but i'm not 100% sure. legal terms can have specific meanings in a legal context that's different from general use.
but also this is one of those cases where, ok you have a law, but, that's meaningless. It's not enforceable. It's not even monitorable. It's nice in theory to write down a bunch of regulations but at best you can make a bunch of EU companies do some paperwork. anything imported from outside the EU, the company can agree to everything and then dissapear. ALl the direct to consumer slop on amazon and whatever. How is the EU supposed to enforce a law against a random fly by night brand name in Shenzhen?
> As volumes rise, enforcement is weakening. In 2025, the EU control rate fell to 65 items per million items imported. The rate of goods ultimately refused at the border due to non-compliance or because they posed serious risks, also fell to below 10 items per million.
> A large-scale customs investigation launched by the Commission in 2025 highlights the scale of the problem. Over 60% of checked toys, small electronics, cosmetics, personal protective equipment and food supplements bought online from outside the EU failed to meet EU product compliance and safety requirements.
> the company can agree to everything and then dissapear.
Isn't that the case for every law related to commitments? Warranty, repair parts and battery longevity is a thing now iirc... haven't had issues with that being avoided so far, at least not in this way
A huge volume of purchases (including in the EU) are direct to consumer from Amazon. There are a lot of fly by night brands on there and you'd be surprised how many of them seem to no longer exist within a year or two. Your big company backed Samsung phone might get security updates, but the IoT junk in question is not likely to.
Re battery longevity - see the power bank bans by the TSA in the US. Maybe you are getting lucky or are only purchasing products from reputable long lived regulated vendors, but the sheer volume of vulnerable devices does not come from those products
Yes, you'd introduce a lot of new bugs because the code is newly written[1], but eventually you'll get to the same maturity as today except you can't have all these devastating memory-handling-related vulnerabilities
The question is whether your software will be in use long enough to be worth the cost of change more than whether it's a good idea in the long run. For Linux, I'd argue that that's likely. At least new code would ideally be contributed in a safe language, where practically possible (there'll surely be places where you need to deal with memory as a kernel)
Relevant article: reducing memory vulnerabilities through a combination of memory-safe languages and an exponential decrease of bugs as existing code ages https://security.googleblog.com/2024/09/eliminating-memory-s..., from which I'll also quote my reference for [1]: "A large-scale study of vulnerability lifetimes published in 2022 in Usenix Security [...] found that the vast majority of vulnerabilities reside in new or recently modified code"
... via mobile data or WiFi, you mean. Whether it uses GPS, Galileo, track measurement points, or even "driver calls the control centre to update their position" doesn't have much to do with it. What I assume you mean is redundancy so that two or more systems can communicate train positions independently, where the more relevant problem is how to get the data across in a timely manner. The driver of the stationary train called in their position and it wasn't used: it's a communication problem, not a "where am I" problem. Idk why the focus on GPS and using GPS for communication (which GPS can't do, and newer systems only do at very low speeds for emergency communication) but finding one's position is usually not the problem
I didn't vote on your comment but consider that people might just find the comment nonconstructive or uninteresting (which is what the guidelines say to base votes on) rather than that there is a "rule against criticising Gizmodo"
If nobody sees it, same thing in the end? Not that it can be relied on, you can nitpick the technicalities here about under whose control it is at that point, but that's not the point
what's the value of that when you can call it with any context? As a proof of concept, you could have it do the attack on a dummy target of your own, take the tokens up until the point where it decides you're authorised, swap out the dummy name with your desired target, and continue the session from there
Reminds me of 'NOBUS', where security agencies would believe that so long as you just don't tell anyone about a vulnerability that you discovered or introduced, nobody else would abuse that vulnerability to exploit a target while you can get access at any time. Training an LLM in such a way that it only generates the desired tokens if its memory demonstrates authorisation (surely nobody else could inject the right context otherwise) feels like a strange anthropomorphisation
Its a protection for the person who deploys the model and controls the context against some exploits, on the expectation that that operator will take steps to prevent large scale context manipulation.
It is not a protection for society against the person deploying the model.
yeah and it looks to be scoped toward L2 / L3 censorship rather than broader socialmedia censorship. could be interesting. thanks for highlighting that.
Especially for someone not "well exposed" to generated text, they might think the words carry meaning the way they do when someone thought about the question and came to an answer. If anyone can interpret this, it's the people who know what they're dealing with (be it from exposure or, better, from a conceptual understanding)
Simultaneously Wikipedia says the Act has "entered into force" in 2024. Does anyone know the difference between "enters into force" and "applies"? Is it like this 2016–2018 grace period for GDPR where it was "law" but not enforced? (The wording sounds backwards if it's that, but I'm not a native speaker)
reply