After extensive testing and benchmarking I discovered that when you ask one model to judge another's response you don't actually get a better answer. You are just asking it "how closely does this resemble the answer you would have given me." Additional rounds and all the "obvious" solutions that pop into your mind reading the proceeding sentence are essentially just cranking up the temperature.

I did find a solution, but it is insanely expensive. Maybe if this gains traction I'll release mine.

This is most likely OFAC. Lets Encrypt could apply for a license to do business with sanctioned entities, and given their use case it would most likely be approved.

https://ofac.treasury.gov/ofac-license-application-page

Differential parsing is a whole class of security bugs and they matter a lot. Take a look at HTTP Request Smuggling for examples.

Also, I am pretty sure there are more non-web x509 certificates out there than all the "browser trusted CAs" combined have signed. :)

The reason everyone came running when Cloudflare first started was obviously the "burn VC money to gain marketshare" but it was also the sheer simplicity. They had one product and a handful of features.

Until someone on the business side takes a step back and says "when I mouse over 'Products' on the homepage, why the fuck is there a 'See All Products' link" it will be impossible to have a usable customer experience. Start killing things and making them features.

"Alphabet announced that its 2026 capital expenditures are expected to be $180-$190 billion, and that it expects 2027 capital expenditures to significantly increase [...] over the 12 months ended March 31, 2026, Alphabet generated $174 billion of operating cash flow"

The fundamental flaw with this plan is if your fear is genuinely of the United States, your data is far more protected inside the US. The intelligence community has no restrictions operating on foreign networks and servers.

Rather than go to a FISA court for approval, we just hack your box and take your data. Or ask a European intelligence service to use the much more lax laws to compel its disclosure.

Yes, data collection happens on US soil. But ask anyone who has worked on the inside how much of a pain it is to view or process USPER data.

ChromeOS was honestly the best they could do.

Cloudflare spent a bunch of venture capital to give away expensive things for free and buy market share. If you convince all the grocery stores to move to your island, you can operate a den of criminal activity with no fear of everyone else shunning you.

Talk to anyone who fights botnets, malware, or online scams. Once you hit the Cloudflare dead end you just have to give up. Law enforcement isn't going to take up a case where only 7,000 peoples computers are infected, and Cloudflare isn't going to investigate and take action themselves.

From the perspective of someone working on the RF side of cellular networks, you are absolutely correct.

Modern cellphone baseband chips however are required to implement MT-LR, which allows the network to request that the device respond with its latitude and longitude. In the US this is legally required to be accurate to within 300 meters, so it comes from GPS or AGPS. By sending LAWFUL_INTERCEPT_SERVICES as the client type in the request, the phone is required to not notify the user in any way or log the request.

There is a reason China has been caught with their hand in the US "lawful intercept" cookie jar at least three times.

If the first tile you build is a lobby in the bottom left corner, it is supposed to double your starting money. :)

Security patches aren't like bugs or features where you can just roll a new version. Often patches need to be backported to older versions allowing software and libraries to be "upgraded" in place with no other change introduced.

Say you had software that controlled the careful mix of chemicals introduced into a municipal water supply. You just don't move from version 1.4 to 3.2, you fix 1.4 in place.

Something important to note here is informants aren't always in the organization or participating in the activity. It could be a truck stop attendant who texts you when the same guy stops in to buy a case of water and then slips it under the roll up door on his cargo van, or a dishwasher at a cafe who noticed a group of guys with the same tattoo. Things that on their own don't rise to the level of someone calling the police. Payments help people who otherwise would keep their mouth shut because they are in financial situations where they can't afford to lose their job.

The only "criminal" thing they did was encouraging non-white people to use their right to vote. How dare they do such a thing before the mid-term elections!

IPv6 just tried to do too much so it failed at everything. Putting letters in IP addresses made it near impossible to remember what your network settings were supposed to be.

It is nothing short of a miracle that devices can even get IPv6 addresses. SLAAC was supposed to replace DHCP, but it couldn't provide DNS server addresses. DHCPv6 was introduced to replace SLAAC, but this time they forgot to add a way to communicate a default route. This lead to Cisco, Microsoft, and Google all taking completely different approaches, and the IETF helpfully blocking any efforts at cross vendor standardization because of v6 zealots.

It is an app that sits in the background and provides connectivity. Occasionally you need to change a setting. Absolutely nobody wants a rich windowed UI, or a menu bar widget that drops down a complex detail card.

I hope they can see this is exactly what killed desktop anti-virus: something that was supposed to be quietly doing its job in the background started getting in the users way. It needed to poke its head up and scream "hey remember me?" at the behest of some product managers or growth hackers. Eventually it got so bad Microsoft just baked it into the OS. Tailscale is on even worse footing here because Apple is even quicker to act when you destroy user experience.