Additionally, egraphs express rewrites on a single language. Compilers are fundamentally translators between different languages; how do you write typechecking as an egraph rewrite rule? Or conversion to assembly?

A failure rate of only 50% is absurdly good for a system like this. If we have to:

> Imagine your phone scanning every conversation with your partner, your daughter, your therapist, and leaking it just because the word ‘love’ or ‘meet’ appears somewhere.

then apparently either there are so many perpetrators that regular conversations with partners etc. are about as common as crime, or such regular conversations don't have such a high risk of being reported after all.

I don't think chat surveillance is a good idea. But please use transparent and open communication. Don't manipulate us just like the enemy does.

[1]: https://en.wikipedia.org/wiki/CompCert

[2]: https://en.wikipedia.org/wiki/Xavier_Leroy

It would have been more interesting had people chosen the more expensive one. There is a folk theory that you can get people to do this if you add an even more expensive option -- the "middle" option is the most attractive.

> These scanning systems get it wrong most of the time. [...] Irish law enforcement confirms this: only 20.3% of 4,192 automated reports actually contained illegal material.

Wrong most of the time that they report something. Technically correct, although a somewhat tricky formulation.

Literally next paragraph:

> Even with hypothetical 99% accuracy (which current systems don’t achieve), scanning billions of daily messages would generate millions of false accusations.

This is a different accuracy percentage: here the author means 99% of all messages, not only the reported ones, which the previous 20.3% referred to. Furthermore, these two paragraphs together sound very fishy: if current systems are not accurate enough to generate "millions of false accusations", presumably (?) they generate at least that. But with the 20.3% true positives fraction, that would mean hundreds of thousands true accusations per day.

Which part am I misunderstanding?

While somewhat true, we are talking about a user who has installed Arch on their machine. If a user wanted to not bother with installation details, they would've installed Ubuntu.

1. If a target website (say important.com) sends poorly-configured CORS headers and has poorly configured cookies (I think), a 3rd-party website is able to send requests to important.com with the cookies of the user, if they're logged in there. This depends on important.com having done something wrong, but the result is as powerful as getting a password from the user. (This is called cross-site request forgery, CSRF.)

2. They might have a browser zero-day and get code execution access to your machine.

If you initiated the process that sent that email and the timing matches, and there's no other way than opening the link, that's that. But clicking links in emails is overall risky.

A server can use this to maliciously give you malware only if you're not looking at the code.

Though your point about trust is valid.