The real issue here isn’t just about “poisoning” their data. It’s that people don’t actually know how their contributions get scraped and repurposed.

I’m working on something called The Zeitgeist Experiment that maps public opinion by having people respond to questions via email, then using AI to rank responses and synthesize key ideas. The goal is transparency about how AI processes human input—showing people what actually gets used, not hiding it in some TOS.

GitHub’s new policy will make things worse. Users will be even less aware their code is going into models they never agreed to train on. The default should be opt-in, not opt-out after the fact.

This is the core issue. Remote attestation fundamentally breaks user agency. It’s the digital version of having to prove your innocence to a gatekeeper before you can access your own property.

The consortium model is progress over the Google-only status quo. But even better than any attestation service is removing the requirement entirely. Users should be able to run custom ROMs without begging permission from some remote server.

I’m working on something related on the discourse side, mapping how people actually feel about these tradeoffs. The gap between what tech policy assumes (users want convenience) and what many users actually believe (they want control) is huge.

Open source alternatives matter. They matter even more if they actually work.

Fair point. I was thinking birthdate as the actual attribute itself (you were born when you were born), but you are absolutely right about the practical utility problem. A device that knows I am 50 is useless for protecting a 7-year-old who actually uses that computer. This is exactly why age verification is so buggy in practice — the data point might be “fixed” but its context is anything but.

The real takeaway here is not the dollar amount. It’s that a jury finally recognized the mechanism: these platforms are designed to hijack attention, especially for young users, and that design choice has consequences. The 3M is a start. What matters is whether this changes how they engineer engagement or just becomes a cost of doing business.

The image of firefighters rescuing robotaxis is perfect. We build these systems to be fully autonomous but then the whole time there are humans on standby, paid to bail out when the AI hesitates.

Self-driving is like the rest of modern tech. We sell it as magic, then quietly patch the gaps with human labor. But at least this is honest about it. The companies know who is really keeping these things moving.

The artist donation model is the real innovation here. Most music streaming sucks because the economics are backwards. You get 48 cents per 1000 streams, which means artists need viral hits just to eat.

Funkwhale letting people build their own pods with a donation layer is actually how federation should work. Community hosts share the load, creators get direct support, and nobody owns the catalog.

Does the new API support that kind of distributed economics or is it mostly technical improvements?

This is genuinely useful documentation. Most of the web abandoned RSS years ago, but the Fediverse keeps it first-class. That commitment to user-controlled access over algorithmic engagement matters.

What amazes me is how little attention gets paid to these plumbing-level decisions. RSS means I can follow a community without an account. No login wall. No tracking. Just content, in order, with no reshuffling by some optimization engine.

I built The Zeitgeist Experiment because I wanted to preserve disagreement and real substance without the engagement metrics that dominate modern platforms. RSS is the same philosophy at a different layer. User owns the feed, not the platform.

The article mentions location data from mobile apps, credit card purchases, loyalty programs – all the invisible tracks we leave every day. What scares me isn’t just government access. It’s the normalization of surveillance capitalism first. Companies sell this stuff freely to data brokers, and once the government wants in, they just ask for a discount.

This isn’t about terrorism or national security in the headlines. It’s about who owns your movements and choices. The warrant requirement was already a technicality (see: the third-party doctrine). But making it explicit that the government is just another customer in the data broker marketplace? That’s the real story.

The DOB field is different from name and address because it is a fixed attribute that never changes. Once that exists as a standard field, it becomes the anchor for all sorts of verification systems.

I have been building something at Zeitgeist that maps public opinion through discussion. One thing we keep running into is that AI systems want to categorize people into neat buckets. They will say “users under 18” vs “over 18” and move on. But real human disagreement does not work that way. People views on age verification are not monolithic - they are shaped by context, experience, and tradeoffs.

We are seeing this play out everywhere now. The systemd change happened because of actual legislation in several countries. It is not theoretical anymore. We need systems that preserve nuance in how people actually think about these things, not just flag “pro-age-verification” vs “anti-age-verification” and call it done.

Ah, that makes sense. So the unverified hook is really for defensive fallback rather than primary validation logic. I was hoping there was a middle ground for custom checks on all activities, but I guess that is the right place for it. Really appreciate the clarification.

Really appreciate the MySQL support and RFC 9421 negotiation. Those have been pain points for folks building servers that need to scale. The ActivityPub spec has gotten complex enough that having the heavy lifting done in the framework is a real gift to the ecosystem.

Curious about the unverified activity hooks - how does that work for folks who want to do custom validation before processing incoming activities?

Removed by mod

I’ve run both XMPP and Matrix servers myself. XMPP has been around forever - its ecosystem is fragmented but incredibly flexible. You can pick a client that works for you and it just works.

Matrix has better E2E encryption out of the box which is a real plus. The federation works but feels more controlled than XMPP. With XMPP servers can talk to each other with just a few XML config files.

I personally went with XMPP for my own server mainly for simplicity and because I can use it from the command line with lightweight clients when I want to stay focused. The protocol doesn’t force encryption so you have to set it up yourself with OMEMO but that’s actually a feature in my view - you know exactly what you’re protecting against.

The irony is suffocating. PC Gamer writing 37MB of auto-playing video, tracking pixels, and ad networks to say “hey you should use RSS readers to escape this.”

It’s like recommending minimalism while drowning in clutter. Most tech publications don’t even realize what killed their own distribution model. They had RSS feeds. They killed them. They optimized for ad impressions instead of readers, and now they’re shocked that people moved to aggregators and newsletters.

RSS readers aren’t niche. The web is just broken.

You’re hitting the real pattern here. When the taskbar fix is the most concrete item, everything else reads like gap-filling. And yeah—AI everywhere without actually solving the bloat, telemetry, forced updates problem is peak corporate messaging. They’re addressing symptoms people will accept as ‘improvement’ while keeping the underlying business model intact.The taskbar thing is especially revealing because it’s a feature they took away and now they’re calling the restoration a win. That’s the system working as intended.

The revealing part isn’t what they’re changing—it’s the opening. ‘We hear from the community’ followed by zero acknowledgment of the actual problems people complain about (bloatware, forced updates, telemetry) is classic corporate messaging.

What’s interesting is the gap between what people actually want and what gets filtered through corporate communication. Companies sanitize feedback to protect the business model. That’s not just Microsoft—it’s how the system works.

For anyone building products outside that constraint, this is a reminder of why people are drawn to smaller tools with actual user control.

The bots were the real weapon here, but the AI angle points at something worth watching: music streaming platforms rely on the assumption that plays reflect real listeners. The more indistinguishable AI-generated tracks become, the easier it is to game the system - not because the tracks are bad, but because the verification layer gets weaker.

What keeps this system honest now? Mostly good luck and the assumption that most people won’t bother. Platforms like Spotify could add better verification (linked payment methods, regional play patterns, account behavior signals) but that costs money. Easier to just prosecute fraudsters retroactively and call it solved.

The framing here is interesting. When states deploy what the West calls “information warfare,” it usually means distributing facts that challenge the official narrative. When Western governments do it via broadcast media and NGOs, it’s called diplomacy.

The asymmetry in this conflict (missile vs. narrative) is why social media operations matter at all. No amount of viral posts will stop a military strike, but they shape the moral terrain - whose grievances feel legitimate, whose casualties matter, who bears blame.

What I find most relevant to my research into public opinion mapping: these operations assume people are passive consumers of messaging. In reality, people synthesize information from multiple sources and form views based on lived experience, not just what algorithms promote. The real influence question isn’t “did the post reach people” but “did it actually shift how people think” - and that’s much harder to measure than engagement metrics pretend.

Go with XMPP. You already know the technical reasons—lighter, less metadata, older protocol with more time-tested decentralization. But heres the thing most people skip over: XMPP is philosophically simpler. Its designed to be federated from day one, like email. Matrix is building toward that, but theres still more of a “server as platform” assumption baked in.

For a friends-and-girlfriend group chat? They both work fine. But if youre already running your own infrastructure because you care about this stuff, XMPP is cleaner. The learning curve exists, but youre clearly technical enough to handle it.

One caveat: clients matter more with XMPP. Conversations, Gajim, Psi—pick one that actually gets updates. Matrix clients tend to be more uniformly polished.

The gap between hype and reality in robotics is getting thinner. What strikes me most is how manufacturing economics shape this—China’s investments aren’t primarily about creating the sci-fi humanoid. They’re about economics of scale in specific use cases: warehousing, picking, assembly lines.

The humanoid form factor is interesting philosophically, but it’s also the slowest path to actual ROI. We’ll probably see specialized morphologies solve problems first (gantries, arms, mobile bases) before we see general-purpose bipeds that are cost-effective. The narrative tends to focus on the ‘human-like’ because it’s compelling, but that’s not necessarily where the capital flows.