1. See a vuln domain reported, clone the site. 2. Wait for it to expire and snag it. 3. Republish the site with malware 4. Watch people dither about domain names and stuff instead of taking time to fix things.

GitHub.io domains, workers.dev domains, etc are all free domains.

Clever use and abuse of some startups can get you a free domain with a signup package that you can subsequently transfer out, but those are harder to find these days.

Seriously, the bad guys figure this out all the time.

The answer to Why is Congress concerned with details like this? is that the Supreme Court of the United States made it their concern by rejecting an established practice of deferring to expert regulators instead of electable people who probably lack the relevant knowledge and experience.

Turning off automatic software updates requires that you actively stay on top of what's installed and what's running, including patching with discipline to make sure your computer doesn't remain vulnerable. On the other hand, automatic updates is seen as writ large by software developers to install what they want without a clear and meaningful choice by users by bundling new features. See Google's integration of Gemini Nano in 2024 as an example.

I wonder what could possibly go wrong by setting the precedent for the state to execute people by firing squad on national news.

For me, boilerplate isn't scaffolding out getters and setters, or deferring to templated code generation; using refactoring tools that have been baked into IDEs or third party tools have been available for about 20 years deal with all of those nicely.

On the other hand, the "boilerplate" to stand up a secure web service with appropriate monitoring and scaling capabilities is a fair bit of work when you know that the immediate first users are enterprise businesses.

Building a service that meets or exceeds industry compliance requirements (internal or otherwise) is a lot of work! My harness, skills, and SOPs are set up such that if I spin up a new web-dev project, it gets all of the accessibility, internationalization, observability, authentication and authorization capabilities I would expect, appropriate to the tier. There is a lot of work done to build and implement those at the front end of a project, which I could skip over for experimentation, but for actual, deliverable work, it is a huge accellerator. In addition, by having that scaffolding and boilerplate in place, and a few skills and SOPs to support future feature growth, the agentic coding tools build with them in mind, and wire everything up as they go.

It doesn't replace the need to do the testing and validation, but it sure does break me out of the cycle of "fuck it ship" that takes over when I have my developer hat on, and the "holy shit, burn it all down and start over" that takes over when I put my security engineer hat back on.

shrug YMMV.

I don't trust any of the hyperscalers to place me as a user first, I expect them to guide me into a stall, strap on a feedbag, and start the value extraction process while they build the meatrix[1] around me.

I want tools like Muse, and Meta Glasses, Google Gemini and a horizontally integrated AI agent, but I want it on my terms, where I am in control and accountable, and without a layer of data collection and harvesting on top of it.

Fortunately I am skilled enough to assemble most of what I want, but I fear a world where people who lack the skills and resources I have available have no choice but to onboard and give up control in order to remain competitive, employed, and connected in the world to come :(

[1] https://www.youtube.com/watch?v=rEkc70ztOrc

Do you think the world is closer to or more distant from large scale global conflict today than it was 10 years ago, or even 3 years ago?

giving that code as a prompt to Claude yields:

Worked for 5s · done 8:30 AM

  10 PRINT "Hello World"; 20 GOTO 10

Still looping. Anything you'd like me to do for real?

After that, I gave it a second instruction: create a GW-basic interpreter in python

It's 5 characters longer, and gives me the interpreter I need to run the basic code (actually not - I had to change the Basic code to have a second line for the loop in GW-Basic; I should have used a more recent basic, but I actually wrote a GW-Basic interpreter many years ago).

It's especially the case as more non-Americans look to self hosted models and domestic cloud inference providers using open models that the US providers who are still leading the charge need to drastically drop their prices and find a path to profitability in order to maintain their lead and retain the advantage they had as AI turns into a commodity (which is happening faster than I think even the frontier labs initially predicted).

There is as much to criticize about American hyper scalers and AI labs and the lack of interest in helping humanity or contributing to open source, but that might not be as popular an opinions on this site.

Is it evil to introduce terms and conditions that restrict how you expect your users to use your product? No, it's probably more hypocritical than evil; I don't think my parents telling me not to smoke while they struggled with addiction was evil, but it sure didn't model the best behaviour.

Is it evil to lobby government to curtail the freedoms of individuals to protect your business model? Yeah, probably; in most cases I believe that reducing consenting adults freedoms is usually a pretty evil act.

Microsoft is guilty of both, but I prefer to save Evil to describe actions that actively cause harm, either physically, mentally, emotionally, or in terms of harming the freedoms that people enjoy, especially if that choice to cause harm is economically motivated.

I'm not advocating on behalf of Bill Gates or Microsoft, just on clear terminology so that we can focus on actual evil behaviour versus consenting adults entering into a valid contract for mutual benefit.