TechLich

I think they're saying that it's not generating slop from nothing. They take the artist's "structure data" as a "ground truth" and the generation is "guided" to generate slop that won't deviate too far from the original?

I thought so too. I seem to remember it almost being a selling point. Like: "Your adventures are being used to improve maps and train AI systems for the future of humanity! Yay!"

But I had a look at their old pages from 2017-2020ish in the Wayback machine and there's no mention of it. In fact, their privacy policies seemed to try to make it very clear that they don't sell or share user data except where needed to deliver the service or in anonymised aggregate to third parties (48 people went to your business while playing Pokemon!).

There's some mention of using it to advertise but none of them mention using it to build an advanced geo-spacial dataset for AI. Unless I'm missing something or reading it wrong?

Might be a Mandela effect.

Those things come with a big convenience and implementation trade-off that slows adoption.

If it's hard to export for technical reasons (eg. Needs to be in a tpm) then that adds hardware requirements and complexity and makes it difficult to log in on other devices. If it's a software thing, then it's rippable. Either way "install our government app to watch porn" is not an enticing prospect for people.

Aggressive rate limiting is also frustrating if you want to log into multiple things and it keeps blocking you because you're using your key too fast, but if it's not aggressive then it likely won't be effective unless all the kids sharing a key are trying to use it at once.

If it's a temporary thing where you have to auth with the government to get a fresh signing key that expires, you have the issue of having to sign into the government when you want 18+ content which is super uncomfortable.

I can see it being a browser-based thing set up a bit like video DRM but that would still need to talk to a government server each time for a temp key (like how licence servers work) and you'd need to be logged into their systems. It might still be the best option but it does still leak "X person wants to access 18+ content right now" to the government.

I'm really interested in seeing a technical/cryptographic solution that actually works but so far I haven't really and I'm starting to doubt that it's possible.

I think they supported the pixel fold which has the same sort of second flippy screen thing. I think the multiple screen stuff is just in the aosp base.

Whenever this comes up, this style of zero-knowledge proof/blind signature thing gets suggested. But the problem is that those only work if people care about keeping their private keys secret. It works to secure eg. "I own $1" but "I'm over 18" is less important to people and it won't be hard for kids to get their hands on a valid anonymous signing key on the web. Because the verification is anonymous and not trackable, many kids can share the same one too, so it only takes one adult key to leak for everyone to use. It's one of the reasons they push biometrics that at least appears to need a real human. Requiring ID has a lot of the same issues on top of being a privacy nightmare.

I'm starting to think that actual age verification is technically impossible.

What debarchery!

For the unprivileged container thing, containers tend to be lighter on resources than VMs at the cost of a little isolation (they share the same kernel as proxmox which could have security implications).

The ability for lxc containers to run unprivileged with all the restrictions that entails alleviates a bit of that security risk.

Both options are generally considered pretty secure but bugs/vulnerabilities could break isolation in either case. The only real 100% safe isolation is bare metal.

I tend to run containers unless I have a really good reason to need a VM, and run unprivileged unless I have a really really good reason not to.

My recommendation is a VPN server to connect in from outside and have the default gateway for the VPN clients be a server that acts as a router that's set up with your commercial VPN.

That way, you can be outside on a phone or a computer, access your internal network and still have your public internet traffic go out through your commercial VPN without having to be able to configure multiple VPN connections at once (eg. Android doesn't support that).

Eg. 2 debian proxmox containers. One that runs wireguard (head/tailscale might also work here?) for external access and one that runs mullvad(or whoever) VPN cli and IP forwarding to be the gateway for your clients.

Only downside is the extra hops to send everything through your home network first rather than straight to the commercial vpn which is probably fine depending on your speeds. You can always disconnect and connect directly to the commercial VPN for faster internet traffic if you need to.

But I don't want a bunch of huge images in my face. Isn't that what pixelfed and Instagramy things are for? I only want to click on the things I'm interested in, not be shown an ugly frustrating stream of giant, semi-traumatic political pictures one after the other. Thumbnails exist for a reason and claiming they're bad UX is incorrect, it's the industry standard design pattern for any control that allows a user to browse quickly through multiple images or to provide an impression to a user before they decide whether or not to open the full content.

Lemmie/piefed is more about text and conversations so titles should always be the largest clearest part so you can read them quickly to know whether you want to engage with the post or not. Otherwise, how is it different from pixelfed? Likes vs upvotes is not a big difference.

Their concept artists are allowed to use some generative AI tools to explore ideas and speed up their workflow. They're currently hiring a bunch more concept artists (both juniors and a senior character artist) so if you're trying to get a job: https://larian.com/careers/4fd694b3-ece7-4307-9949-15cac512a815

Great place to go if you're looking for a concept artist job.

This is very true, though I'd argue that Windows makes most of the same assumptions with user accounts. Also, the internal threat model is still important because it's often used to protect daemons and services from each other. Programs not started by the user often run in their own user accounts with least privilege.

You no longer have 10 different humans using the same computer at once, but you now have hundreds of different applications using the same computer, most of which aren't really under the user's control. By treating them like different people, it's better to handle situations where a service gets compromised.

The question is more about passwords which is mostly down to configuration. You can configure Windows to need a password for lots of things and you can configure Linux to not. They just have different defaults.

The big difference between UAC and Sudo is that you can't as easily script UAC. They can both require (or not require) a password but UAC requires user interaction. Sudo has no way of knowing if it's being interacted with by a person or a script so it's easier for applications to escalate their own privileges without a person doing it. UAC needs to have the escalation accepted with the keyboard or mouse.

There's still plenty of sneaky ways to bypass that requirement but it's more difficult than echo password | sudo -S