Can someone who works in commercial web dev explain how companies even end up with this much crap pulled into their websites?

When you try to maximize ad revenue, you add multiple advertising SDKs to your website, each of which can often do live bidding with hundreds of ad/data brokers

You can usually check the ads.txt file on a website to see which companies are allowed to bid for ad space on there. For example, for dict.cc, the website in question:

https://dict.cc/ads.txt

The ones labelled "RESELLER" will probably share your data with even more ad companies.

How have I not heard about this. I am both impressed and horrified.

I am one of those.

It generally goes like this:

When we launch a site it is seldom more than perhaps Hotjar, Google Analytics, and two-three other services connected.

And then through the years product managers and other stakeholders gets sold on adding LinkedIn, Instagram, Meta, and so on. So we add those.

Next a specific service ”to better track the sales funnel from in-store salespeople to the web” gets added. Then another ”analyse the data quality versus bounce rate” tracker gets added. And so on.

Before long the developers have streamlined the process of adding new scripts/analytics/trackers that editors can add them on their own, and that is when the floodgates open.

two main sources

analytics: A/B testing, "if x does user click y"?, unique page visits, etc.

ads: integrating with an ad provider comes with hundreds of trackers, because they want to - know if you bought a product after clicking on an ad - show you targeted ads for shoes after you googled shoes - build a profile of you (age, gender, location, profession) to show relevant ads across different websites

Likely has little relationship to what is actually in the page. They had to do GDPR, didn't or couldn't spend a lot of time on it -- or had an especially conservative corporate counsel -- and ended up just getting a list of every company they've ever worked with, for any reason, "to be safe".

For most companies this can easily be thousands of partners, and going through that list and figuring out exactly who might get data in reality, through every possible permutation of workflow, is a horrendously expensive proposition.

You might be surprised how many well-meaning regulations leave even the best-intentioned implementers in an impossible situation.

Oh yeah, that combination of fear and lack of knowledge probably plays a big part. I was once involved with creating a privacy policy for a B2B(!) web application. What a farce. In the end, the process was cut short (counsel too expensive and not nearly familiar enough with tech). The resulting document was at least 50 % stuff the app simply does not do.

> or had an especially conservative corporate counsel

And once again we shall see how being conservative sounds like it might save you money but costs you dearly in the long run.

Yeah, but again, see the other part of what I wrote -- doing it "right" can be insanely expensive, and so you get an incentive to be conservative.

I read what you wrote.

Ultimately that is what they are having to do though, it's just costing them twice as much by pretending that being conservative and not actually looking at the problem saved them.

The averaged-over-usage-lifetime software quality for things like cars or video games is worse today than it was before OTA updates

Arguably the peak quality after a few months/years of fixes is better, but that doesn't really matter because usage is front-loaded

I remember my parents needing to buy very expensive map DVD disks in order to update the car’s navigation system to update their car’s navigation computer.

The disks were very expensive and if you didn’t update them it wouldn’t know about new roads (slower trip, missed turns, etc).

That's why we have Android Auto: move the updates to a thing that already has frequent Internet connection, and if the update goes wrong it's clearly the fault of this other company, plus the car itself still works fine.

Jeep already had an OTA the broke the ability for the car to be driven.

Did those updates ever break the navigation software?

I've had map update packages brick head units before, yes. Largely because they also shipped some software updates in that map update package.

> EU funding brought fiber to my farm area

Yes, boondoggle subsidies allow you to un-economically bring fiber to a subset of random places. I say this as the beneficiary of one such boondoggle. It doesn't scale well

> the very architects of AI are the people whose jobs are most easily automated by AI

Think very hard about what this implies for the future pace of AI R&D

It's going to turn into slop, exponentially fast, any moment now.

No but seriously it could imply grinding to a halt, turning into a laughing stock of slop, or, imho much less likely given the current state of AI (barring huge technological breakthrough and a couple of other assumptions) you were probably implying an intelligence explosion.

There's a company in Austin that uses sound for drone localization, although I forget the name

ZFS makes this completely trivial except for the "beeps and lights a led" part

To be fair, the "beeps and lights a led" part is very important in case of a dead disk in an array. The only time, I disrupted a service in production for longer than a few hours was when I didn't get the email of a degraded raid 1 array and the second disk died a few weeks later.

smartmontools makes this trivial and can email you which might be better than beeping and lights if you’re not always near your server.

I use that plus smartctl_exporter so I can do metrics and alerting off that.

That’s awesome. But a guide that does not include a howto for alerting (such as the one linked) is incomplete.

smartmontools misses data corruption at the drive layer, as it trusts the drives to report faithfully.

"In hashes I trust"

Yeah, for that I use periodic scrubs and zfs event daemon

Does Synology with its beeps and bops catch that?

FYI it looks like some of your comments are getting auto-flagged by the HN moderation system and marked as dead

99.9% of normies have a router NATing all their traffic

It takes active effort to expose a camera publicly

Unless that camera uses UPnP and has no auth configured by default.

Or admin/1234 which is about 90% of them

You’re saying f the camera will talk to the firewall using a username and password and open a hole/port forward?

I don't think the username as password is required.

Open a Bittorrent client and it will try and port forward port 6881 using UPnP.

Which doesn’t matter about the password. If you have a faulty router which allows unauthorised inbound connections then you have a bigger problem than weak credentials

huh? The camera pokes the hole in the "firewall" (NAT in 99% of cases, which isn't a firewall, hence why it's so easy for bits of software to poke holes in it.

You don't even need to do UPnP, if you're okay with a random port, you can just do STUN.

No, I mean the cameras have these settings.

Some cameras do also open ports with UPnP but it's rare in my experience. I think these cams are more users who are a bit technical but not too much to realise the implications.

Ok so aside from some malware running inside your security perimeter what’s the threat?

Yes weak passwords are bad, but if nobody can access it it’s not the end of the world.

Well this very site is why it's bad. And things like Shodan.

It's the swiss cheese model. I'm sure most of these people didn't mean to make their cam accessible to the internet. If there had been a unique username/pw they wouldn't have got exposed.

which cameras do this?

Very exited about WASM/WCM as a portable format for capability-secure applications.

I had a spec file sitting around for an OS project idea I had, where the kernel would just be the WASM compiler + a few small shim drivers, and everything else (including e.g. PCIe device drivers) would be WASM modules with WIT interface specs. I handed the spec off to Fable and it seems to have made a working proof-of-concept. Has a maximally-WASM OS running on browser/QEMU/Orange Pi. https://eo9.org

I'm curious if people have a good story for why WASI will succeed where Java failed

My main one is that WASI has benefitted from an additional 31 years of accumulated industry-wide experience compared to when Java was first released.

Plus, Larry Ellison doesn't own WASM: "Lawnmower Not Included"!

So where has the experience gone in the support of C and C++ for WASM?

Programs written in Java require installation of a middleware called Java runtime. It adds extra friction for end-users. And even if one has Java runtime installed, a newer version may be necessary for a recently-published application.

With WASM it may be the same, unless al major OS vendors integrate a WASM runtime so that it doesn't need to be installed separately.

It is exactly the same for WASM outside of the browser, and Java has Android as counter part to built in runtime.

Yes, but inside the browser is a freaking big use case.

Not really, I don't need COM / CORBA on the browser.

Good for you! In other words, you don't write compute heavy applications for the browser?

I never used COM or CORBA, by the way, just too freaking ugly.

Java's vm does not start in milliseconds nor has dozen independent implementations in every ecosystem

Folks tend to think only Oracle does Java, and the only place to get it is from https://www.java.com.

Maybe they should broaden their horizons.

https://en.wikipedia.org/wiki/List_of_Java_virtual_machines

And some like PTC or microEJ are missing from the list.

> It adds extra friction for end-users

It doesn't have to, the program can bundle its own jre as its often the case, and then you also don't have to worry about jre compatibility. Downside is then you have many jres installed and of course you can't trust their sandboxing.

>And even if one has Java runtime installed, a newer version may be necessary for a recently-published application.

WASM doesn't remove version churn, the linked article literally discusses a newer version. Oh and the wonderful web compat story.

> Programs written in Java require installation of a middleware called Java runtime. It's possible to link or embed a Java runtime in an existing application.

Because Java was doing nothing similar, a better comparison would be .NET CLR that actually tried to be a decent compilation target.

Also security, Java has reflection so you cannot reliably sandbox java libraries

My main one is: distribution & access. If major browsers implement the WASI runtime then using and distributing a WASI app will be way simpler than the Java equivalent ever was.