Someone reading the blog the first time might well be willing to read through the large amount of text.

But returning to it at a later date ? A quick reference TL;DR table would not go amiss IMHO.

Zero data retention is also "trust me dude".

There is no viable way of checking they are actually doing that.

That's assuming they don't put carve-out clauses in, like Anthropic did with Fable, which means data retention is back on the cards, no exceptions.

Also don't forget a zero data retention clause is still subject to the good old "law, or court or administrative order" contract clauses. :)

To get properly close to real zero-retention in a hosted model, you would have to use one of the verifiably private AI that runs in enclaves, e.g. Tinfoil (US) or Privatemode (Germany)[2]. Yes, still not the same as running on your own hardware, but a million lightyears ahead of "zero data retention" "trust me dude" clauses.

[1]https://tinfoil.sh/ [2]https://www.privatemode.ai/

OR you need to make a blog post that is deemed worthy.

If someone features a blog post you wrote, then you automatically qualify for access. Sort of a "right of reply".

(Features as in "new post about", not "mentioned in some thread")

Chinese-scale manufacturing cities in the US at $36/hr ? Yeah, that ... ain't happening.

And willing to work long hours at the minimum-wage rates required for US-based manufacturing ....

P.S. 18-25 and 54+ ... its actually 16–25 and 54+ I don't think you'll find many 16–18 year olds biting your arm off for a job in manufacturing either...

Ok, being generous and accepting your point at face value ....

What about the people staffing those manufacturing cities ? Is the state creating them too ?

I seem to recall reading somewhere that – at most – the US could "find" 200,000 people for new manufacturing plants.

Sounds about right to me, no ?

I think even with a generous mind the US would struggle to "find" much more than that, let alone getting to or exceeding 1 million which is the value you would need for seriously thinking about >1 manufacturing city.

"look at China" what ? Have you seen the population size of China ? Have you seen the geographic size of China ?

Remember what is often said when Mr Trump talks about bringing tech manufacturing back to the US ....

Yes great idea Mr Trump. But even with the most generously optimistic figures, due to the lack of available workforce and space the US could only ever provide the capacity equivalent to one Chinese manufacturing town of which the Chinese have dozens.

Indeed and ironically most British people refuse to eat the species commonly found in UK waters, e.g. mackerel etc.

Because the Brits are so fussy, most fish eaten in the UK has always been imported, e.g. Icelandic cod.

And the fact the UK fishermen were die-hard pro-Brexit is odd given they should have been aware that the majority of their regular catch was sold to EU buyers.

Well, yes. But not many of them worship the generation who were mostly responsible for voting in favour of Brexit (60% support among those aged 65 and over at the time of the vote).

"Zombie politics: how Dead Man dominates British politics"[1]

Two prescient paragraphs related to today's news:

    If British politicians worship voters who are no longer among the living, it is natural that they do the same to a version of the British economy that has long departed. “There are people in this country who love to talk down our manufacturing,” said Sir Keir Starmer, the prime minister, while speaking in Jaguar Land Rover’s (JLR) factory in Birmingham. During the 1970s, one in four people worked in manufacturing, like Sir Keir’s dad, who died in 2018. Now fewer than one in ten do.

    Manufacturing, a small part of the economy, plays a big role in politics everywhere. Britain is no exception. A speech at a JLR plant has become a rite of passage for any leading politician in recent years. Dead Man’s old job comes first for Britain’s politicos. The lives of workers in Britain’s services economy come second. True, manufacturing’s weak performance after the financial crisis is one reason for Britain’s woeful productivity growth. Yet politicians cling on to a primitive vision of it. “He made things with his hands,” said Sir Keir of his father. That modern manufacturing requires oodles of educated workers is ignored. Living graduates play little role in political discourse beyond politicians moaning that there are too many of them. After all, Dead Man did not attend university. Why should his grandchildren bother?

My gut feeling is on them loosing that one.

Stop most people on the street and ask them about "OpenAI". I suspect your average Joe would say "Who ?".

Continue the discussion with "have you heard of ChatGPT" and I suspect the answer would mostly be "Yes, I have".

OpenAI are applying for "OpenAI" in this trademark application. The fact they have a widely known product called "ChatGPT" which they actively market under the name "ChatGPT" does not and should not come into the thought process of any appeals judge.

IANAL but it AFAIK it does not work like that....

Yes, IN THEORY a registered EU trade mark can be attacked at any time through an invalidity action based on absolute grounds (Article 59(1)(a) EUTMR). If the mark should never have been registered because it was descriptive under Article 7(1)(c) or devoid of distinctive character under Article 7(1)(b), any person can file to have it declared invalid.

But, and its a big BUT...

Even if a mark was registered in breach of Article 7(1)(b)–(d) — i.e., it was descriptive or non-distinctive at the time — it cannot be declared invalid if, through use after registration, it has acquired distinctive character. This is confirmed in the case law, e.g., Adapta Color v EUIPO (T-225/17, 2019), which explicitly references this provision

So "Open Systems" might have started life as a descriptive registration, but if the holder can show that, through years of market use, consumers now associate the term with them specifically (as a badge of commercial origin rather than a generic descriptor), the mark survives.

This is exactly the defense that OpenAI itself tried — and failed — to mount in its application, but the evidentiary burden in an invalidity action against an established mark with years of use evidence can be quite different from a fresh application.

I suspect OpenAI's lawyers told them this but they were instructed to proceed anyway towards the inevitable loss ....

P.S. Is "Open Systems" even registered in the EU as a trademark ? I did a very quick search on EUIPO and could not find it ?

Interesting, thanks for pointing out the insane workflow.

Although looking around, footguns still remain in terms of relying too much on iOS and Tailnet Lock, e.g. https://github.com/tailscale/tailscale/issues/20475

I would humbly suggest that you are moving the goalposts.

It was implied in your what-if post, i.e. "I fractured my femur in the skate park, but what if I was in a remote location".

You can also get cheap satellite dumb-phones with pay-as-you-go SIM cards. No need to be tied to a Starlink sub if your primary concern is about being able to summon help in an emergency in a remote location. All you need is your location and you can get that from any satellite dumb-phone.

Also with multiple humans there are other options. Unless you are somewhere truly remote, a casual walk a few minutes back down the trail will likely find you some other humans who can assist and summon help.

Stating the obvious but also in a remote location, 911 will not turn up instantly, so people in the group should have suitable training for remote first aid and be prepared to give it for an extended period whilst waiting for 911.

It isn't out of the question to have a major injury in a remote location.

But the fundamental problem would be being on your own in a remote location, not being unable to call 911.

Yes in your skating example, you "only" fell and shattered your femur.

But what if you fell and hit your head or landed and hit your spine ?

Or what if you had a heart attack ?

You would not be in a position to call 911 then, would you.

Being on your own in a remote location is not a risk problem that you can solve with any amount of technology.

Its better than it used to be.

But the fundamental problem is that the Wireguard app is a simple GUI around `wireguard-go` built as a static C library via cgo. But Tailscale uses a fork of `wireguard-go` and then adds control client, DERP, NAT traversal etc. on top of it.

So there's quite a lot of "bloat" on top of the Wireguard code in Tailscale iOS and therefore your problem might not be Wireguard vs Wireguard implementation question but something happening elsewhere in the Tailscale code.

Don't you fucking dare.

Might I point you to the words "We would like to thank Anthropic and Ada Logics for reporting this issue.".

It was not commissioned by Tailscale. It was DONE BY OTHERS AND REPORTED TO TAILSCALE. Just like the fucking disclosure tells you.

Tailscale should not be relying on the random goodwill of others to do random audits of unknown coverage at random intervals.

That is not a serious approach to security.

They should be commissioning their own, paid out of their own pocket, at regular intervals, and publishing the results.

Well, they clearly don't if they have an "insecure argument handling" vulnerability.

As others here have said already here, its an "venerable and ancient class of bugs".

Its the sort of thing that should be picked up by modern defensive programming that includes fuzz testing.

And it is CERTAINLY the sort of thing that should be flagged by any competent security audit. "insecure argument handling" is bread-and-butter for security auditors.

> I can't take this seriously. If you were a customer you could, you know, ask them? Or inspect their SOC2 documents?

SOC2, ISO27001 and all that shit is not the same thing.

As I said, anyone serious who is proud of having had their software audited as clean would publish their reports in public. Nothing to hide. And it strengthens your case with customers.

It can always be a suitably redacted management summary written by the auditor. That's what everyone else does.

Am aware of them but IIRC they are both unaudited which kind of brings us back to square one ? We would still end up running them at arms-length as we do with Tailscale at the moment.

Isn't Headscale server-side only ?

Also a bit strange that "Tailscale vs Netbird" doesn't feature more prominently on their "Compare Netbird" page. It is hidden behind "Load More". ;D