>I’m not sticking up for car manufacturers, but at what size or capacity should you be required to document and publish these things? It requires employer time and effort and has a cost associated with it.
You're talking about things that by definition have to be documented and internally published in order to design and build the powertrain in the first place. You can't design a computer-controlled automatic transmission without documenting the shift points.
The cost is therefore essentially nothing, because the information already exists. Just copy paste it into a PDF and put it on your website.
Well you see, requiring companies to let farmers fix their own tractors is Socialism. And the USSR had "socialist" in the name, so Socialism bad. In the big, beautiful Land of the Free(tm) they don't do Socialism because that's commie shit.
The American Way is to let corporations fuck you over in any way that increases profits. Sure, they have the least efficient healthcare system in the world, ineffectual public education, massive wealth disparity, crumbling national infrastructure, and a different school shooting every week.
Yep and they were fined a paltry 6 million dollars or so. For actively distributing and infecting users with malware. This on annual sales exceeding $3B.
That case sure put Mark Russinovich on everyone’s radars, at least.
The size and scale of that problem absolutely pales in comparison to the number of people who will be screwed by a better ability to enforce unpopular or rarely enforced laws.
And the sick part is how many useful idiots will go to bat for all of it because "well they broke the law after all"
No, I know this is a minority opinion on HN but I think violence towards women is a larger problem than seldomly enforced laws being enforced more often.
You can repeal a law. The courts can strike it down. The same cannot be said about cops abusing women, which is statistically well established.
Whatever appeal to emotion crime you want to cook up, violence toward women, unfair targeting of minorities, etc, etc. That's all already not allowed either by law or rule.
Fixing that stuff by enforcing the existing rules against it wouldn't make these systems fine. The fundamental point of these systems is to let the government screw the people.
Sure, but the quote I was responding to was not "what will the government do", it was "what will cops do". Well, Flock and countless other examples have shown us exactly what cops will do.
35 years ago we didn’t have the cultural precedent/zeitgeist of getting cancelled for some stupid shit you wrote on a message board in 1991 so we were less guarded with our opinions.
No, and we don't really have a culture of cancelling things for people they say now, either, when it comes down to it because if that were true, Trump would not be president given his long history of [waves hands], a large number of Republican politicians would also be out of work, etc.
There is no atmosphere to speak of, so only if directly exposed. Hence that's a solvable issue.
The whole thing is incredibly expensive though, while it may be doable with current technology, the amount of money they'd have to set aside may be a hard sell for the miniscule potential of this research - at least from the lens of 2026... So the original position of the article makes sense, it may become functionally impossible, even if technically possible
It definitely precipitated the surveillance state and the erosion of civil liberties across not just the USA but large parts of the west, but it's not about body count.
Everyone knew, even in the immediate aftermath, that a copycat situation would never happen again, because passengers now knew to fight back and risk possible death vs certain death being used as living munitions inside a flying death tube.
Don't forget that in 2004 when traumatic memories of 9/11 were still raw and on everyone's daily consiousness, we had the Madrid bombings, the London bombings I think the following year, and then the Charlie Hebdo attack in Paris.
The world felt like it was rapidly becoming more unstable, and people feared that surprise terror attacks were the new normal. That kind of loss of confidence in security services can cause a rapid unravelling of the social fabric in ways that car accidents can't.
Nobody was talking about starting pogroms against people with brown skin because of car accidents.
Most of that fear was driven by the response, not the attacks themselves. The government could have tried to calm the people down, but instead it amped them up and treated terrorism as the most dangerous thing imaginable. You can't say that the ridiculous over-the-top response was justifiable because people were terrified, when that is a big part of why people were terrified.
HN is particularly notorious for armchair aviation experts. I am an aerospace engineer having worked in airworthiness & certification as well as maintenance/repair/overhaul on multiple different aircraft types both fixed and rotary. I mention this only to establish my bona fides as someone who knows their shit:
The comments here during the 737 MAX MCAS thing were fucking wild. So many randoms spitting out confidently incorrect nonsense.
That’s all forums in a nut shell. Any time you read about something you’re not personally familiar with it’s “look at all these people who know what they’re talking about… “, as soon as it’s something you are personally familiar with it’s “wtf are these people on about?!”
“Gell-Mann Amnesia“ - usually applied to media when experts scoff at stories they know to be sometimes woefully inaccurate but still accept all the other pages as gospel.
I've worked on several engine families engine certification, I can't read threads about aviation on HN because my brain hurts too much from people who know nothing posting like they are experts nonstop.
It actually causes me stress because a) I need to prevent myself from posting corrections and b) from knowing that these people are everywhere and are posting fud about trains or something
HN is notorious for armchair <insert-topic> experts for <insert-topic> you actually know, outside of software, computing/computing-adjacent electronic hardware and startups. “Fucking wild” “confidently incorrect nonsense” is likely the norm on most fringe topics, judging by the few I know about.
Quite so. When it first took off, I took no end of flames and downvotes for suggesting that WebGPU is a terrible idea. HTML and the browser were originally conceived to render documents, not serve as a bastardized application distribution platform.
The only arguments I've ever heard in favor of wasm/webgpu were that using native graphics/GUI toolkit APIs are a pain. That's definitely true, because I've written stuff with gtk and it sucks, but that doesn't mean we should just shovel an entire tech stack into the browser.
Just because we can, doesn't mean we should. I'm tired of these BigCos shitting everything up.
So, I kind of agree, but I don't know what a better solution looks like.
Is it really better for users to download and run straight up executables with no security model? We tried that in the 90s and 2000s and it was pretty bad. We can have OSes introduce a security model, like Android and iOS do. But then what about desktop Linux users like myself? Am I just to be excluded because I don't use a popular (and proprietary) operating system?
Okay, we can invent a standard, cross platform app distribution mechanism with a security model. And that's... exactly what web browsers are. In the end it seems like the least-bad solution to me. I quite like that I can run GPU accelerated programs without the dev having to put in special effort to support my Linux distro.
>Is it really better for users to download and run straight up executables with no security model?
Yes. Unambiguously, a system where the only code that runs is code that you explicitly run is more secure. Social engineering and basic tricks of telling someone an app does A while it really does B are not solved on the web, because social engineering cannot be solved. In the supposed safe gardens of app stores, apps do exactly that all the time and are not well moderated. Apple's supposed moderation approved a "Lastpass" password manager app that was not made by the actual Lastpass company. If that can get through, then anything can get through.
Meanwhile, the webapp solution is for any site you visit to be able to download and execute whatever they want, rather than whatever you want, and most sites also set a third party to have the ability to download and run whatever they want, and Google wants that system to have as much control over your local hardware as the OS does, so how is this better at all? It's strictly worse. The web security model is worthless. It depends on random third parties you have no affiliation with to not get hacked themselves, and not make stupid choices.
It's fine to just not have "Web bluetooth" actually. 800 "Partners" just don't need to be able to access that.
What is the "Security Model" of the web, that every random person willing to pay a few cents for an advertisement should be able to run code on your machine without your authorization? That anyone should be able to target individuals for RCE through advertising infrastructure?
> Unambiguously, a system where the only code that runs is code that you explicitly run is more secure.
I don't think so? If I want to run a 3D modeling program and I download their executable and run it, it has access to everything on my system. All my local files, open access to my network connection, whatever's going on with my internal network, etc. If they want to read all my files and upload them, they can just do that. This is not true for web applications.
Programs that run in a browser are sandboxed and only have access to what web standards say they have access to. They can open a file select dialog to get a file from my machine with my permission, but they don't just have access to all of my files like a local program does. Web standards developers put a lot of effort into finding a balance between security and capabilities for new web APIs.
> What is the "Security Model" of the web
Unlike locally running programs, web applications don't have access to everything on the system by default. Interactions with the local system are intermediated by the browser. Usually the user has to approve access, or there are limitations on what types of access a web app can have.
If you head into your Firefox settings and select "Permissions and data", you can see what kinds of things given websites are allowed to access. Usually when they first try to use one of those APIs, the browser will pop up some kind of browser-level dialog asking the user for permission to perform that type of action (eg "access local devices" or "show notifications"). These are all examples of the web app security model (and there's a whole lot more that is not as user-facing).
Local applications on the other hand, do not have any kind of security model. The 3D modeling program I downloaded can just package up all of my files and upload them to their server, completely silently. That's way worse than what web applications can do!
> It's fine to just not have "Web bluetooth" actually. 800 "Partners" just don't need to be able to access that.
People don't want documents. Almost everything useful you do on the web is some form of interactive app from a simple forum with no JS to Figma or 3D games.
I think we need to go the other way, all in on apps. The browser only has to expose permission based I/O, WebGPU and a way to build a11y semantic trees. Globally cached libraries can handle everything else. That would reduce the attack surface and core complexity while making the platform more flexible. HTML can run as a legacy layer on top.
Yeah in the end I probably agree on WebGPU, I haven't really seen a single use of it, except for running shader code examples in browser, which might as well be replaced by a looping video.
For WASM though, I do not agree at all! It's genuinely a great system for high performance browser code. So much stuff I use now had WASM as the backbone, and I even started applying it outside of the browser in some of my architecture. I wish we had way more enthusiasm behind things like WASM, and way less for something like WebUSB.
Hey you’re right, we should gladly accept every decision the big corps make. They know best, after all. We should probably lick their boots too, in gratitude for their benevolence.
The application delivery thing was done as far back as Netscape threatening to relegate Windows to "a poorly debugged set of device drivers" so Web-whatever is simply another step in that direction. Like I said, if you purists want just document delivery, you can use links or w3m or maybe Gemini.
Some kind of market forces kept Netscape in check back then. Now they aren't.
Like, Tesco would prefer that my operating system was a roast chicken, Baowu Group would prefer it was made of steel, Berghain would prefer that it had to queue for hours to possibly get in, and Jagex would prefer it was an in-game GUI within RuneScape. None of those companies got their way, what makes Netscape special?
The point is that browsers have been made and funded by BigCo, and treated as app delivery platforms at least for the last 20 years. Netscape, Microsoft, Apple, Google (for Mozilla and then Chrome). The last non BigCo mainstream(?) browser was probably Opera.
It's silly to complain now about BigCo, WebGPU, and ignore the past 20 years of history. The WWW has not been about document delivery only for the last 20 years. Instead of tiring themselves out complaining about the Web and modern browsers, they can use something else.
You're talking about things that by definition have to be documented and internally published in order to design and build the powertrain in the first place. You can't design a computer-controlled automatic transmission without documenting the shift points.
The cost is therefore essentially nothing, because the information already exists. Just copy paste it into a PDF and put it on your website.
reply