Is the update cadence of CAs that different between the sources? Is the list of CAs included so different from OS vendors and the package managers?

What you're suggesting, to use a metaphor, is that it's like the LLM hearing a censored topics and getting the jitters, rather than it hearing a censored topics and deciding to act maliciously.

I run jellyfin on the open internet through caddy. I've done a few things to the configuration to secure it, like user-agent restrictions and fail2ban for login failures, and excessive 400 series errors. I keep it up to date.

I don't think anyone will be able to avoid AI assisted software entirely. They can avoid contributions to those projects, and projects are free to have their anti-AI policy.

I use AI a lot, but am highly skeptical of its net benefit to society. I'm more concerned with the omnipotent surveillance state we're barrelling toward without regulations. I'm concerned with the jobs apocalypse that no politician is taking seriously. I'm concerned with the dissociation from reality that it will cause with audio and video being as believable as real recordings.

>whose responsibility is to at least point that out?

Not the military. I agree that work needs done but when you dance close to taking down sites or possibly removing actual human Americans' posts surreptitiously, it should be done with civilian mechanisms and with oversight.

If it were really a good idea; if it were really supported by Congress and people really needed it, the ruling party with Present + Congress wouldn't condition it on them winning more elections.

Any comparison to policies like "elect me and get free education and free healthcare" are statements based on policy positions, and usually coming from people who don't have the power to make that happen alone. Trump and GOP have the power right now to try to do what he said, but they won't.

It seems naive to think that there aren't massive information warfare campaigns targeting all political wings in the United States, and that no looking should be done to uncover it.

The military and CIA can muck with explicitly foreign actors, but they shouldn't be doing any kind of domestic law enforcement. Really bad precedent.

One might say "just use a password/credentials manager", but all these passkey prompts don't emphasize that you should use one that is not tied to hardware, or that you should backup your passkey to a thumb drive, or anything like that.

Same reason I hate TOTP that is tied to a device. If you require me to have proprietary 2FA apps on my phone to login to your account, I don't use 2FA. Looking at you, Steam.

I see all the things I listed are there. "Risk management" was a hand-wavey term meaning "cybersecurity stuff".

Disclaimer, I work for a competitor. Never thought I'd say that to Mozilla people! I wish you good fortune. The space is still relatively new, and not working a SME on the space, it seems there aren't a ton of competitors but some are entrenched.

If one thinks of frameworks, particularly ones like Rails, as higher-level languages, it makes sense. Why aren't we coding everything in assembly? Models know how humans use programming languages and existing frameworks. Some languages are becoming even more popular (rust, go) because of their performance, and because agents can write the boilerplate without the user needing to be an expert.

Frameworks are (ideally) distilled, opinionated best practices that both humans and agents can understand and implement as another layer of abstraction. I don't think that goes away entirely.

I'm not FIRE by any means. I could quit and live happily for a few years. But I'm have vanishing faith that I could get back into the field without a 50% paycut vs how things were five years ago.

I think more seriously now about buying a modest house, or buying land with water access and decent soil.

That said, I'm seeing enterprise security companies selling soft forks of Chrome with all sorts of inspection and policy built in. Basically, instead of doing DLP/URL filtering/risk management on a MITM box, they're pushing it to the browser. This helps remove the need for TLS decryption, and the need to funnel their browser traffic to any particular tunnel endpoint.

I guess what I'm saying is... Firefox might want to take a look at what those companies are doing to Chrome and figure if there is a way to make it easy to plug that kind of security into their browser.

edit: just noticed this is a paid service. So I triple down on what I said. Companies that are "buying" browsers are buying browsers with deep inspection and security features baked in. I don't know if they'll buy support for FF when Edge is free.