Why is the default assumption that these attempts to contest parking fines are frivolous? Have you never received a fine for parking legally? The fines are created by a human after all. If the system was perfect, they wouldn't offer a way to contest them.
Because that’s how the services were advertised? And that’s how people operate?
If you create a service that might get someone out of a fine via a loophole or by creating friction, many will take that opportunity to take the chance.
It would be very unreasonable to think that most of the people trying these services were simply wronged by the government and we must support them all.
> Have you never received a fine for parking legally?
I have not, but I have had to deal with another government problem that was a mistake. I would not want to have that process backlogged behind 1000 other automated requests from people trying their luck at getting out of fines they really deserved because they had ChatGPT start filing things for them because it didn’t cost them anything.
> If the system was perfect, they wouldn't offer a way to contest them.
At this point I think you’re just deliberately ignoring the problem we’re discussing.
We know a system exists for a reason. We are not talking about people using the system for legitimate reasons.
We are talking about the problem that occurs when the cost of filing a request goes to zero so everyone starts doing it automatically in response to any fine.
Finally... The CEF they used was 2 years out of date, and after RCE exploits [0] occuring in the wild getting big enough that they got picked up in the media [1], we finally have a fix 1 month later.
You can find why it was complicated [0] and why it took so long [1] on GitHub. I do wish I had been faster on it. That said, the RCE required the user to be using a vibe-coded web-based chat overlay that didn't properly sanitize chatter inputs, so has a (hopefully) limited scope.
Thanks for chiming in and linking that, that was an interesting read. As much as I understand CEF's reasoning for making this shift, it's baffling that they don't provide a universal way to implement what you now had to implement yourself.
> the original claim that lack of sanitization "required"* "vibe-coded" functionality*
That claim was ever made. The comment was about actual pieces of software that exist in the real world, not about all possible software that could exist in theory.
In real-world usage, for a user to be exposed, a necessary ingredient was to use a particular piece of software that actually exists and that happens to be vibe coded.
That does not preclude the possibility that a non-vibe-coded piece of software could have been vulnerable. It's just that such a piece of software did not happen to exist.
So why even mention vibe coding? Presumably it's relevant for some other reason. Perhaps the implication is this vibe-coded software is not an established piece of software with lots of users. (Since vibe-coded software is easier to create, maintainers may be less invested in it or committed to maintaining it. Vibe coding changes the economics and opens up the possibility of creating throwaway software.) Or perhaps the implication is that users should be more careful about using vibe-coded software.
Unfortunately, most streamers don't have the best IT security knowledge, and with AI tools now allowing them more and more than what was previously possible, it also opens the door for more vibe coded apps that could have serious security holes.
Should the streamers' apps be more secure? Absolutely, but the underlying tool should also strive to be secure enough for all use cases.
Anyway, thanks for the two links, they were interesting reads.
It also allows it to be much worse too. I can't wait to do tech support for my grandparents that followed the instructions to install ScamAppStore to install an app they saw on a Facebook ad.
I do tech support for my parents that both use Android. Haven't had a sideloading incident once in the decade+ they've used it (although I did show my dad NewPipe, which he uses constantly now).
The EU was actually on the path to forcing everyone to use micro-USB. Thankfully Apple (and others) pioneered USB-C (bringing what it learnt from developing the lightning connector) in the time it took the EU to go from making all of the phone makers sign a Memorandum of Understanding to making it legislation. Now the EU is frozen in time, stuck on USB-C for the forseeable future. The economics to make a device dual port (USB-C and something new) aren't there, so we're not likely to ever see an improvement on USB-C... in an alternative timeline, we could have been stuck on the even worse micro-USB.
Bringing it back to the topic on hand, this is very much an area I wouldn't want to see a heavy handed EU legislate something that just further cements the incumbants and makes everything worse forever... just like mandatory micro-USB would have been. I can totally see the EU legislating something like a mandatory Meta communication protocol with compulsory attestation from Meta servers.
And wikipedia runs off a tiny tiny fraction of what they raise. Almost all of the good on wikipedia comes in-spite of the organisation that owns it. Without the community pouring hundreds of thousands of hours into the project (unpaid) a year, wikipedia would be dead immediately. And if there was ever a time in its life that the project needed good leadership and innovative thinking, it would be now when AI is seriously threatening its survival. If people stop going to the site and instead go to the chat bots that scrape the site, there will be less and less incentive for the power users to continue maintaining wikipedia.
Canada effectively requires leaving and re-entering. It can take multiple months for an online visa to get processed, meanwhile leaving and reentering takes hours.
there were other dumb factors pushing people to do border runs, like your paperwork says "expired" but your status still being valid while being processed.
Except you had zero paperwork to show to an employer and they had no way to verify themselves. Even if an employer understood the process and accepted some proof that you submitted an application, they would have no idea if you were rejected and became out-of-status.
If you've run a site with CORS reporting enabled, you'd see that a significant fraction of your userbase have malware extensions running (prior to manifest v3). I was absolutely shocked when I looked at the logs a decade ago, and I bet the problem is far worse these days with the proliferation of malware buyouts of legit extensions.
Google has no shortage of options for serving up ads that can't be blocked by normal ad blockers across all their properties (youtube, search, etc.). They in-line the ads these days! And if they really cared about the fraction of a fraction of a percent of people that even install any kind of adblocker, they could make the served ad content un-blockable by serving it the exact same as the content.
reply