Hacker News, Distilled

What Developer Mode / MCP Support Provides

• Thread agrees this is effectively “full MCP client support” in ChatGPT, not a coding mode.
• Users can connect arbitrary MCP servers, including write-capable tools, via a hidden “Developer mode” toggle.
• Some confusion about whether this is for the web chatbot vs CLI; clarified as the main ChatGPT UI on the web, limited to Plus/Pro (not Team).

Early Technical Friction and Limitations

• Several reports of OAuth/connector failures when attaching existing MCP servers that work fine with other clients (Claude, LM Studio, etc.).
• Suspected causes include protocol differences (SSE vs HTTP streaming) and strict response validation.
• OpenAI’s Deep Research requires specific tools (“search”/“fetch”), so some MCPs are rejected as non‑compliant, which feels at odds with MCP’s generic design.

Ecosystem Tools and Use Cases

• People are building MCP gateways/control planes and “meta‑MCP” servers that bundle many tools behind a simple search/execute interface to reduce context pollution.
• Concrete use cases mentioned:
  • Replacing internal admin UIs with MCP tools over existing REST APIs.
  • Browser automation and UI testing (Playwright MCP, Storybook verification).
  • Personal workflows like finding fencing classes then writing to a calendar.
  • GitHub issue fixing, Home Assistant control, storage access (S3/SFTP/etc.), multi‑LLM “consensus” tools, card creation (Anki).

Security, Prompt Injection, and the Lethal Trifecta

• Large subthread on risks when LLMs have: (1) access to secrets, (2) access to untrusted data, and (3) an exfiltration channel.
• Core point: to the model, “instructions” from a web page, email, or log look similar to instructions from the user; so untrusted content can redirect the agent (e.g., leaking secrets via crafted URLs or triggering destructive commands).
• Role metadata and structured/constrained generation help but don’t offer hard guarantees; 99% robustness is framed as unacceptable for security.
• Attempts to filter “prompts” with another model are criticized as brittle and inherently cat‑and‑mouse.

Enterprise and Governance Concerns

• Worry that mainstream ChatGPT users will enable dangerous MCPs without understanding prompt injection or blast radius.
• Calls for strong auth, scoping, org‑level policies, and sandboxing (dev containers, no API keys, local-only tools).
• Others argue MCP is already common (e.g., Claude desktop, GPT Actions) and that over‑focusing on MCP obscures broader supply‑chain and agent‑security issues.

Comparisons and Overall Sentiment

• Many welcome OpenAI “finally” matching Claude’s MCP capabilities, but see ChatGPT’s implementation as less polished (no true local MCP in desktop, no mobile support yet).
• Some think the danger is overstated if tools are read‑only or tightly sandboxed; others see this as a major new attack surface released with only warnings and user checkboxes.

Tourist Gimmick vs. Real Transportation Value

• Many see the Vegas deployment as a tourist-friendly novelty, well-suited to a city built around tourism and gimmicks.
• Others argue that tourists are in fact a major unmet mobility market on the Strip, preferring on-demand point‑to‑point service over learning bus systems.
• Some commenters stress that a technology can be useful even if it doesn’t address systemic transit inequities or replace mass transit.

Public Transit vs. Robotaxis

• Strong thread debating whether robotaxis solve the “wrong problem” compared to rail/bus: they don’t reduce overall time in cars or congestion, and can’t match well-designed transit for city-scale capacity.
• Counterpoint: political, NIMBY, and environmental barriers make new rail vastly harder to build than AVs; in practice, AV rollouts are progressing faster than major transit projects.
• “Gigapod = bus” jokes recur; critics say AV hype ignores existing solutions, supporters say flexible, app-based, driverless fleets are socially and operationally distinct from buses and can complement transit.

Zoox Capabilities and Design

• Zoox is described as a full-stack Amazon-owned AV company, building custom bidirectional vehicles with no steering wheel and “campfire” seating.
• Compared to Waymo, Zoox appears less mature by one disengagement metric and has a smaller, more shuttle-like service area with fixed stops on/around the Strip.
• Front–back symmetry and four-wheel steering enable tight maneuvers (e.g., pull in and “leave in reverse”), but may confuse other drivers about orientation.

Safety, Speed, and Regulation

• Some expect robotaxis to strictly obey speed limits, improving safety; others predict eventual pressure to raise limits or “optimize” for throughput and profit.
• There is significant anxiety about allowing AVs to drive very fast (100–200+ mph), given software/sensor faults and lack of redundant hardware in some systems.
• Concerns raised about accountability: corporations face mainly financial penalties, whereas human drivers face personal legal consequences.

User Experience vs. Human Drivers

• Multiple riders report preferring robotaxis over human taxis/Ubers: fewer scams, no harassment, no tipping, predictable driving, and cleaner vehicles.
• Critics point out that some non‑drivers (e.g., people needing physical assistance) gain little, and that cleaning/vandalism/vomit are nontrivial operational issues but likely manageable with cameras, routing to cleaners, and charging offenders.

Vegas-Specific Considerations

• Vegas seen as ideal testbed: dense tourist demand, extreme heat, heavy drinking, but also complex back‑of‑casino road mazes, erratic drivers, sandstorms, and occasional snow.
• Strip pickup/dropoff rules constrain Zoox to something closer to a self-driving shuttle than a door‑to‑door taxi at launch.

Core value of internalized knowledge and intuition

• Many compare the issue to math: calculators are useful, but number sense and “back-of-the-envelope” skills are essential for spotting nonsense and quickly reasoning about the world.
• Similar arguments for other domains: you need enough background to gauge what’s plausible, sanity‑check outputs (Excel, AI, search), and not just trust black‑box results.

Critique of “you must remember everything”

• Several commenters think the article overreaches: you don’t need exhaustive knowledge to get good results in areas like fitness or exercise programming; “good enough” plus consistency often beats theoretical optimization.
• Others reframe it as hyperbole: you don’t literally need to remember everything, but the more you have internalized, the better you can think and the less you’re bottlenecked by lookup.
• Emphasis from many on conceptual models, tacit knowledge, and “knowing the map” rather than recalling all details.

AI, search, and the BS detector

• Broad agreement that firing and forgetting the first Google/LLM answer is bad; prior knowledge is needed to assess sources and detect hallucinations.
• Some argue AI is helpful for vague queries and as a brainstorming partner, but should be seen as a starting point that you verify, not a final authority.
• Distinction drawn between using AI to replace thinking vs. using it to automate rote work and free time for harder thought.

Phones, attention, and younger generations

• One subthread claims smartphones are damaging foundational abilities (attention, navigation, creativity), citing multiple studies and linking this to long‑term cognitive decline.
• Others push back: evidence is mostly about distraction, anxiety, or early childhood screen overuse, not clear IQ drops in teens; factors like weakened schooling and Covid disruption are proposed alternatives.
• There’s also debate over “digital natives”: some say they’re more skeptical of legacy propaganda; others counter they just shift trust to new influencers and niches.

Memory tools, education, and limits of memorization

• Mixed views on Zettelkasten, Anki, and rote learning: some find them powerful for building mental frameworks; others report burnout and little marginal benefit.
• Several note humans have always offloaded memory to tools (writing, books, songs), and that judgment, not raw recall, is now the key scarce resource.
• A recurring theme: internal training of the mind is unavoidable, but what you must remember is mostly foundations, patterns, and “BS filters,” not every fact.

Insurance as Market Signal

• Many commenters argue soaring premiums and insurer exits are exactly how markets should work: they signal that certain places are too risky to live or build in, and should shrink.
• Higher prices are seen as a corrective to decades of subsidized rebuilding in floodplains, hurricane zones, and wildfire areas.
• Some emphasize that in a rational system, expensive insurance should suppress land values in risky areas and deter new high-end construction there.

Personal Responsibility vs. Human Impact

• Strong strain of “you chose to live there, bear the cost,” especially for places like Florida where voters repeatedly opposed climate action and risk mitigation.
• Others push back that this ignores people with long-standing homes whose risk changed over time (e.g., new flood maps, shifting tornado patterns), and that wiping out 40–50% of their net worth is devastating.
• There is tension between dispassionate “market logic” and recognition that these are life savings, community ties, and support networks, not just financial assets.

Role of Government, Subsidies, and Relocation

• Broad criticism of federal programs (NFIP, FEMA) that repeatedly rebuild the same properties, effectively subsidizing risky coastal lifestyles for a minority at everyone else’s expense.
• Proposed fixes:
  • “Three strikes” (or even one-strike) rules where repeat-loss properties must be bought out, demolished, and rezoned (e.g., into parks).
  • Eminent-domain buyouts at partial value, turning unlivable areas into national parks or greenways, plus funded relocation assistance.
  • Stricter bans on rebuilding in known high-risk zones.
• Others doubt political will, expecting bailouts to continue, primarily to protect banks rather than homeowners.

Climate Change and Insurance Economics

• Many tie uninsurability to climate change making severe events more frequent and damaging, plus soaring rebuilding costs.
• Some note insurance as a “final arbiter”: companies don’t care about ideology, only data and losses.
• A minority stresses other drivers: regulation, litigation, fraud, inflation; they caution against attributing every rate spike solely to climate.

Land Use, Building Standards, and “Everywhere is a Disaster Zone”

• Suggestions to require much more resilient construction (concrete, stilts, elevated utilities) rather than banning habitation outright.
• Others argue that almost all regions now carry some labeled “disaster” risk, and premiums are rising broadly, not just in obviously extreme zones.

Site reliability and “HN hug of death”

• Multiple users report both SearchaPage and Seek.Ninja returning errors or being down, speculating it’s due to Hacker News traffic.
• The creator confirms usage spiked ~20x week-over-week, with context expansion (not search itself) as the main bottleneck, and calls it a “trial by fire.”
• Some users saw good, “impressive” results before the overload; others switched to using it as default immediately and praised speed and privacy.

DIY search engines: feasibility and scope

• Many are excited that someone is self‑hosting a search engine at home, seeing it as a welcome mix of innovation and cloud‑skepticism.
• Others argue that competing with Google is unrealistic: search now involves huge infra, advanced ranking, maps, and various verticals—far beyond “two people in a dorm.”
• Several note that repeating Google’s original success is unlikely because the web and user expectations are very different today.

Crawling and indexing challenges

• Commenters emphasize that the hardest part isn’t ranking but crawling an adversarial web: JS-heavy sites, logins, Cloudflare/CAPTCHAs, and big platforms that only welcome Google’s bot.
• The project reportedly builds on Common Crawl (~2B pages) plus a more targeted native crawler; freshness is cited as the main issue with relying solely on Common Crawl.
• Ideas discussed: open, non-profit web indices; crowdsourced crawling (Yacy, Common Crawl); domain lists (ICANN zone files, curated domain indices on GitHub).

AI, vectors, and user expectations

• One side claims the “underlying problem has changed”: PageRank is gamed, and modern search “needs” LLM-based assessment and synthesized answers.
• Others strongly push back, preferring raw results and paying for engines (e.g., Kagi) specifically to avoid AI overviews.
• There’s disagreement over whether ordinary users actually want LLM-style answers by default, with some asserting younger demographics increasingly prefer chat-style search, others skeptical.

Alternative search engines and sentiment

• Kagi is frequently mentioned as a polished, paid alternative; users praise its quality and customizability, while critics call it slow, expensive, or overhyped.
• Meta-discussion arises about “shilling,” effort justification, and how much advocacy is just happy users vs. marketing.
• Some note small, niche engines (e.g., Marginalia, news-focused engines) as valuable complementary efforts rather than Google “rivals.”

Code Generation vs Markdown-First Workflows

• Some argue that writing less code (or none) is ideal: use Markdown + CLI agents + MCP servers to drive behavior, enabling faster feedback and less “implementation noise.”
• Others counter that code you didn’t write is an even bigger liability: if AI goes off track, you still need to understand and debug it.
• Several see LLMs as “junior devs” useful for grunt work or prototyping; the hard part remains deciding what to build, not typing speed.

Reliability and Limits of Claude Code Subagents

• Multiple reports of subagents being “incredibly unreliable” on non-trivial or brownfield codebases, veering into mock or oversimplified solutions.
• Refactoring is a consistent weak spot: code goes missing, changes are inconsistent, and large files beyond context break the process.
• Some claim subagents don’t see the full system prompt/CLAUDE.md; others say their subagents obey CLAUDE.md-only instructions, suggesting inconsistent or opaque behavior.

Best Uses: Analysis and Context Management

• Many find subagents most effective for analysis-only tasks: test coverage evaluation, style-guide checks, doc/library lookup, or web/doc search that returns a short answer.
• A recurring pattern: use subagents to “open extra tabs,” consume lots of tokens, and then hand back a compact result so the main agent’s context stays clean.
• Strong consensus: create agents for tasks, not human-like roles. Role/persona prompting is seen as mostly theatrical.

Context, History, and Workflow Design

• Techniques discussed: “feature chats” per change, post-chat summaries saved to Markdown, “don’t-do” lists, DOC_INDEX/COMMON_TASKS docs, and structured CLAUDE.md hierarchies.
• Some experiment with context pruning, history rewriting with smaller models, or no history at all—rebuilding context every invocation. Results are mixed.
• Lack of logging and outcome tracking for agent runs is viewed as a major missing piece.

Cost, Parallelization, and Human Limits

• Subagents can explode token usage (e.g., one per package in a 1,000+ LOC transformation), making them slow and expensive.
• Debate over whether “it’s cheap to let it try”: small attempts add up quickly at scale.
• Several worry that managing many agents turns into casino-like gambling or endless code review, with human cognitive limits becoming the new bottleneck.

Overall reaction

• Strongly positive response; many call it “insane” in a good way and praise the craftsmanship.
• Several people admit they have no concrete need for it but love it as a delightful, borderline-useless hack that feels like “programming as art.”
• Some suggest they’ll install it purely out of respect, to keep around “for that one weird time.”

Relation to other projects and protocols

• Compared to Carbonyl, brow.sh, and similar browser-in-terminal tools; commenters note this goes much further by handling arbitrary GUI apps, not just the web.
• Mention of older/adjacent ideas: aalib/mplayer, text-mode video, X11 tricks (Xvfb + xwd + sixel), and a historic GTK “cursed” theme that rendered widgets as text.
• Some argue that this essentially re-invents remote desktop/X11, others counter that it’s more tightly integrated with the terminal and Wayland-era friendly.

Use cases envisioned

• Remote GUI over SSH where VNC/RDP/X11 forwarding are impractical or blocked by firewalls.
• Managing GUI apps in containers or on build machines and clusters (e.g., Firefox for kerberos auth, Hadoop UIs) from a terminal-only environment.
• Running GUI tools from low-powered or constrained clients (including iPad via SSH; VS Code-on-iPad is explicitly discussed).
• Possible testing harness for GUI apps without a full desktop environment.

Platforms, terminal support, and Wayland/X11

• Works on both X11 and Wayland hosts; includes a custom Wayland compositor without libwayland dependency.
• Uses terminal image protocols; note that kitty/iterm2-like protocols work but can be inefficient for high-frame-rate graphics.
• macOS support is desired; discussion centers on using virtual-display or accessibility/VNC tricks, with mention of a private virtual display API.
• Clarified that it’s “in the terminal,” not raw text mode, though some confusion about framebuffer/tty vs terminal emulator appears.

Performance, input, and limitations

• Performance highly dependent on terminal resolution; low-res is fine, 4K makes fans spin.
• Input is via stdin only: requires hacks for games (e.g., Doom) due to lack of key-up events and control-key conflicts, making continuous movement awkward.
• Copy/paste is planned via Wayland data-device; GUI text will remain pixel-based, with OCR suggested but considered out of scope.
• Skeptics question practicality versus simply using RDP/waypipe/etc., but even they often concede the hack value.

Government use of targeted ads as dystopian

• Commenters describe being inundated with coordinated, highly targeted political content on platforms like Facebook, often around trivial or polarizing stories.
• Many see direct government use of such microtargeting as dystopian and corrosive to public life, regardless of which party is in power.

Free speech, the Constitution, and political advertising

• Some argue the First Amendment makes bans on political ads or targeting effectively impossible without a “revolutionary” constitutional change.
• Others counter that amendments are meant to change power structures and that limiting microtargeted political ads could be reasonable.
• A faction insists U.S. founding documents are the “best available,” favoring less government and warning against empowering the state to restrict speech.
• Another faction stresses the slave-owning origins of those documents and rejects quasi-religious reverence for them.

Regulation vs. abuse of power

• Multiple threads debate regulating ad platforms: preventing surveillance-based targeting, restricting foreign propaganda, or requiring liable local entities behind ad buys.
• Critics worry any centralized “truth arbiter” (state or platform) becomes an oppression machine for the next authoritarian.
• Others argue that big tech’s current unregulated power is already an oppression machine, and that checks-and-balances plus bureaucracy are preferable to corporate abuse.
• There is disagreement over whether opposing specific regulations implies being “for” propaganda or child abuse; some push back against this “with us or against us” framing.

Ad platforms as propaganda infrastructure

• Several comments argue ads and propaganda are fundamentally the same tool for persuasion; ad platforms are auction-based systems for behavior change at scale.
• From this view, state propaganda campaigns (e.g., against UN agencies) are just another high-paying customer to the exchange—“propaganda-as-a-service.”
• Others note platforms already take editorial stances (e.g., on war content or Covid misinformation), so their choices around state propaganda are inherently political and should be scrutinized.

Corporate incentives and perceived bias

• Many see tech companies as amoral, chasing whichever side holds power or majority sentiment, not consistent principles.
• Some claim specific communities (e.g., major subreddits) are heavily moderated in favor of certain geopolitical narratives, with bans and deletions enforcing a party line.

Attention economy, manipulation, and personal defenses

• Commenters link pervasive ads and algorithmic feeds to rising cynicism, “slop” content, and addiction to outrage.
• There is skepticism that media literacy alone protects against manipulation; people still respond to primal triggers even when aware.
• Some advocate strict ad blocking as basic self-defense, arguing ads are now a primary vector for scams, malware, and state propaganda.

Marketing evolution and psychological exploitation

• One subthread traces marketing’s shift from demonstrating product value to manufacturing aspirational lifestyles and envy.
• Others respond that manipulation and propaganda have always been central to advertising; only the tools and reach have improved.
• Particular concern is raised about exploitative mobile games and microtransactions targeting children, described as frying their reward circuits.

Geopolitics and one-sided narratives

• The original article’s focus on Israeli government ad campaigns draws strong reactions.
• Some defend those campaigns as justified given allegations about UNRWA and the broader conflict context; others see them as “genocide propaganda” that platforms should refuse.
• One long comment accuses the article itself of being propaganda for omitting context like the initial attacks and the other side’s online operations.

Was It a “Sellout” or the Least-Bad Option?

• Some see the EU as clearly capitulating to Trump’s maximalist bluff: he demands extreme tariffs, then “backs down” in exchange for big concessions.
• Others argue that if the realistic alternatives were worse (e.g., high tariffs or trade chaos), accepting a suboptimal deal is not “selling out” but damage control.
• A minority suggests EU negotiators may be stalling and giving Trump a symbolic win on paper that will be watered down or blocked later, especially by the European Parliament.

Tariffs, Trade, and Who Really Has Leverage

• One side treats US import dominance as bargaining power: threaten punitive tariffs to extract better terms.
• Others push back that broad tariffs hurt both economies and that Trump’s trade approach is optics-heavy and economically incoherent.
• Some compare current US policy to a deliberate slide toward “third world” status via deficits, low rates, and protectionism.

Security, Ukraine, and Strategic Dependence

• Several comments frame the deal as de facto “security-for-economics”: EU accepts economic pain to keep US weapons and support for Ukraine flowing.
• Others doubt US reliability anyway, citing Trump’s NATO remarks and recent US behavior toward allies.
• Sharp disagreement over the claim that “European security depends on winning the Ukraine war”: some see it as existential; others call that exaggerated and highlight demographic and social costs.

EU Structural Weaknesses: Defense, Energy, Tech, and Welfare

• Many blame decades of underinvestment in defense and strategic industries, relying on US security and Russian energy.
• There is extensive debate over whether generous welfare, pensions, and shorter working hours inherently undermine competitiveness.
• EU’s lack of FAANG-scale platforms is tied to regulation, risk aversion, and political choices, not technical inability; opinions diverge on whether mimicking US-style tech capitalism is even desirable.

Political and Systemic Fallout

• Politically, commenters expect the deal to fuel anti-EU and anti-American forces on both far right and far left.
• Some say this episode exposes to Europeans what imperialism and US leverage feel like, and may eventually push the EU toward more autonomy—or deeper fragmentation.

Incident and npm response

• Malicious versions of several DuckDB npm packages were published after a maintainer was phished, similar to a Chalk/debug compromise the day before.
• Initial claim that “no one downloaded” the bad versions was walked back; npm download stats are delayed. Third‑party monitoring observed installs while they were live.
• Maintainers tried to unpublish but npm initially blocked it due to dependencies; they instead pushed newer safe versions and npm later removed the compromised ones.
• Multiple comments criticize npm/GitHub/Microsoft as slow to respond and inconsistent with their “security first” messaging.

How the phishing worked

• Maintainer received a convincing “npm security” email from a typo‑squatted domain (npmjs.help) with a realistic tone and layout.
• The site was a near‑perfect clone of npm, acting as a relay: credentials and 2FA codes entered on the fake site were forwarded to real npm, allowing the attacker to reset 2FA and create a new API token.
• People note the many missed red flags (weird domain, browser not autofilling credentials), but others argue real services routinely train users to ignore such red flags by using odd domains and link shorteners.

2FA vs passkeys, hardware tokens, and password managers

• Strong current in favor of passkeys/FIDO2/YubiKeys for “critical” packages, arguing they’re origin‑bound and effectively unphishable for this attack class.
• Counterpoints:
  • Passkeys historically had portability/backup issues and can feel tied to big ecosystems, though some say migration and multi‑device setups are now workable.
  • Hardware tokens need multiple keys and form‑factor compatibility (USB‑C, NFC, mobile).
  • Even strong auth can be bypassed via other flows (e.g., OAuth device code phishing) and doesn’t eliminate all account takeover.
• Several argue good password manager autofill (not copy‑paste) already gives strong phishing resistance by refusing to fill on the wrong domain; others note autofill often breaks, training users to override it.

Proposed registry/platform mitigations

• Enforce passkeys or FIDO2 (not TOTP) for high‑impact npm accounts.
• Freeze publishing for some period after 2FA reset, auth factor changes, or new token creation; require a second maintainer to re‑authorize.
• Quarantine new versions from being treated as “latest” for automation for N hours/days, while still allowing explicit installs.
• Require signed artifacts and provenance:
  • End‑to‑end signing from developer keys (ideally offline/HSM‑backed) to registry.
  • Verify that npm releases correspond to signed VCS tags; flag or block if not.
• Some suggest multi‑maintainer approvals (“maker‑checker”) for publishing popular packages.

Email and phishing‑surface issues

• Calls for signing all maintainer‑facing emails (GPG or similar) so unsigned “npm security” messages can be distrusted.
• Others argue SPF/DKIM/DMARC and even GPG don’t help if users ignore sender domains, and that real companies already use confusing third‑party domains, seed distrust, and normalize sketchy patterns.
• Several recommend treating all “pushed” messages (email/SMS) as untrusted: no clicking links, always navigating manually via bookmarks and trusted domains.

Broader ecosystem & dependency risk

• Many see this as another example that npm’s huge, fine‑grained dependency graphs amplify supply‑chain risk: one compromised maintainer infects millions.
• Comparisons to Debian/PyPI:
  • Debian’s slow, curated releases seen as much safer, though not perfect (e.g., xz and OpenSSL history mentioned).
  • PyPI is viewed as somewhat better due to stronger governance, simpler dependency graphs, and typo‑squatting defenses, but still has phishing incidents.
• Some suggest delaying auto‑upgrades and strictly honoring lockfiles (npm ci), avoiding tools that “helpfully” override locks, and possibly only adopting versions after a “cooling‑off” period.

DuckDB‑specific security criticism

• One commenter argues DuckDB shows a pattern of lax security, pointing to the recommended curl https://install.duckdb.org | sh installer.
• Others push back:
  • The real risk is ultimately trusting the project at all; whether you pipe to sh or download then execute is a marginal difference unless you verify signatures.
  • DuckDB binaries are also available via other channels (e.g., package managers, GitHub releases).
• Some still prefer distro packages or signed installers over remote scripts, emphasizing immutability, third‑party review, and reduced attack surface.

LavaMoat, Runtime Isolation, and Tradeoffs

• LavaMoat is presented as strong runtime protection that can block whole classes of npm malware regardless of how fast it’s detected.
• Main practical drawback mentioned: it currently doesn’t support Webpack HMR, so teams must juggle a “fast dev” build and a “secure prod” build; some see this as acceptable, others as too divergent and risky.
• It relies on SES/HardenedJS compartments: guest code sees only frozen intrinsics, not the real global object. Biggest risk is granting overly powerful capabilities, not breaking out of the sandbox itself.
• Very DOM‑heavy packages may simply not work under strict isolation.

npm’s Role, Scanning, and “Verified” Packages

• Several comments argue npm should run malware detection, delay or block suspicious releases, and offer some form of verified or delayed channel for enterprises.
• Others worry about false positives, liability, and “verified” badges giving a false sense of safety.
• Some note npm already has “trusted publishers” and provenance features and supports strong 2FA (e.g., hardware keys), though that doesn’t help when the original maintainer is compromised.

Detection Timing, Impact, and ROI for Attackers

• Tools like socket.dev and Blockaid reportedly detect many malicious packages within hours; some say that’s still “too late,” others counter that most organizations don’t update instantly anyway.
• In this incident, estimated attacker profit is around $500 and largely from one transaction; several commenters are surprised it’s so low given the potential blast radius.
• Reasons suggested for limited damage: fast discovery, many projects not auto‑upgrading immediately, and affected packages not being dominant frontend dependencies.

Version Pinning, Lockfiles, and Namespaces

• npm packages are immutable; lockfiles store hashes of tarballs, providing TOFU‑style stability.
• But if package.json uses semver ranges, upgrades can bypass previous hashes; true “locking” requires pinning exact versions and then using tools like Renovate.
• Some argue vendoring dependencies might ultimately be simpler.
• Namespaces/scopes exist but are not enforced and only partially adopted; unclear how much they would have helped here.

Detection Heuristics and CSP

• Several suggest heuristic scanning: flag large obfuscated blobs, long lines, sudden code size jumps, long‑dormant projects suddenly releasing obfuscated patches, etc.
• Others note malware authors will adapt, making this a cat‑and‑mouse game.
• For frontend malware that just abuses fetch, some argue a strict Content Security Policy (connect-src) can mitigate exfiltration, though CSP doesn’t help backend or lifecycle‑script attacks.

Other Mitigations and Ecosystem Concerns

• Lifecycle‑script malware (including DLL loading on Windows) is called out; suggested mitigations include controlling lifecycle scripts, doing dev in locked‑down environments, and using containers or tools like safernode.
• Some developers express a desire to avoid npm/JS entirely, but others argue all major ecosystems (e.g., pip) have similar supply‑chain risks.

What the Case Is Actually About

• Multiple commenters stress that this suit is not about training on copyrighted books in general.
• The judge has already ruled that using purchased and scanned books for training is fair use; the problem is Anthropic downloading pirated copies (LibGen, Pirate Library Mirror) and keeping them in a “central library.”
• The alleged infringement is at procurement / library creation time, not at model-training time. Whether using pirated copies for training is fair use is described as ambiguous or unresolved in this ruling.

Judge’s Rejection of the Settlement

• The settlement was rejected “without prejudice” mainly for procedural reasons, not because the dollar amount is clearly too low or too high.
• Concerns raised:
  • How authors are notified, how they file claims, and how payments are administered.
  • Whether Anthropic is properly protected from later, duplicative suits (“double dipping”).
  • Whether lawyers’ fees will consume too much of the $1.5B pool.
• Commenters expect the parties could fix these issues without changing the per-book amount.

Is ~$3,000 per Book Fair?

• One author in the thread (with 3 included books) feels ~$9k total is fair, especially for titles with low advances that never earned out.
• Others argue it’s too low relative to statutory damages (up to $150k per willful infringement), the value of models built on the corpus, and the deterrence needed so companies don’t just “steal first, pay later.”
• Some see it as a windfall: compared to a $30 book, ~$3k/book is ~100×, clearly punitive for one pirated copy.
• Disputes arise over who should get the money (authors vs publishers; impact of advances and rights arrangements).

Copying, Fair Use, and “Statistical” Learning

• Long subthread debates whether training is “copying” or merely learning statistics:
  • One side: training explicitly reproduces sequences during optimization; models can regurgitate text and code; this is causally linked to underlying infringement.
  • Other side: proper training is about aggregate statistics, not exact memorization; accidental verbatim output is overfitting, not the intent.
• Analogy battles: pirated Photoshop used to make a game; humans imitating style; music “substantial similarity” cases; whether style vs expression is protectable.
• Some insist copyright should hinge on outputs (substantial similarity), not internal representations; others say illegal acquisition itself is enough to trigger liability.

Humans vs Machines

• One camp warns: if “learning from copyrighted works” is treated as infringement, it logically extends to humans and would destroy normal artistic practice.
• The opposing view: law can—and should—treat corporate AI systems differently from human creators; scale, profit motive, and replace-all-creative-work ambitions matter.

Broader IP and AI Concerns

• Philosophical split:
  • Anti-IP voices say copyright is overlong, protects incumbents, and isn’t needed for creativity in many domains.
  • Pro-IP voices argue that large, risky investments (drugs, blockbuster films, complex software) depend on enforceable rights.
• Some predict generative AI will erode markets for books, news, and other writing by capturing value without paying sources; others doubt it has meaningfully replaced books for them.

Funding Structure and Scale

• Commenters clarify that “1.7B€” is a committed amount, typically drawn down via capital calls over time rather than wired all at once; some portion may be in services, not just cash.
• The round is large but still small compared to OpenAI/Anthropic/XAI levels; some see it as significant for Europe but “little league” globally.

Why ASML Invested & Potential Synergies

• Official rationale (from an interview shared in the thread): ASML wants AI models that can run in a tightly protected, fully in-house environment; Mistral’s business model is to adapt and deploy models on-prem without data leaving ASML.
• Technically, people speculate on uses in:
  • Computational lithography and metrology (analyzing huge machine datasets, defect patterns, recipe optimization).
  • Internal tooling: log analysis, ticket triage, code and performance analysis, support automation.
• Some argue LLM expertise is quite different from physics-heavy EDA/IC design ML; they doubt Mistral adds unique value vs funding specialized chip-design ML groups directly.
• Others think the move is more political/strategic: aligning with French leadership at ASML, deepening ties with France, and buying influence in an emerging “European AI stack.”

Mistral’s USP and Competitiveness

• Skeptical view:
  • Models are often behind leading US/Chinese offerings; best models are closed; open models rank below DeepSeek, Qwen, Kimi, GPT-OSS, etc. on community leaderboards.
  • Any EU integrator could fine-tune better open models; Mistral is “just another LLM API” without a clear moat.
• Supportive view:
  • Being EU-based is itself a major advantage for government and regulated enterprise: GDPR, CLOUD Act risk, fear of US sanctions or political interference.
  • Reported strengths include: fast, cheap medium/small models, strong OCR, edge models, decent multilingual EU language support, and a Cerebras partnership for very high token throughput.
  • Several commenters cite concrete production use cases (customer support, financial news summarization) where Mistral beats alternatives on cost–latency, even if not SOTA in raw benchmarks.

Sovereignty, Security, and Geopolitics

• Many see Mistral as Europe’s key bet to avoid total dependency on US/China AI, analogous to Chinese efforts to build domestic semiconductor capability.
• Hosting “in the EU” via US clouds is widely viewed as insufficient due to the CLOUD Act and examples of US firms cutting off services under political pressure.
• Debate around using Chinese open models:
  • One side: on-prem open weights can’t “phone home” and are technically safe.
  • Other side: risks of hidden backdoors, biased behavior, or subtle manipulations; papers on instruction-tuning poisoning and “sleeper agents” are cited.

Market and Strategic Context

• Some think AI quality is converging and scaling is hitting diminishing returns; survival will depend more on cost, speed, distribution, and integration than on tiny quality gaps.
• Others argue there is still significant headroom via more intensive RL and novel training methods (DeepSeek is mentioned as an efficiency precedent).
• Overall sentiment: mixed optimism. Many welcome a serious EU player backed by ASML; many also question whether this is a sound tech bet or primarily a geopolitical and political gesture.

YouTube Premium: Value vs “Pay to Undo Harm”

• Supporters say Premium is a great deal purely for ad‑free viewing; background play, downloads, higher speeds/bitrates, and bundled YouTube Music make it competitive with other streaming subs, especially for families.
• Critics argue those “features” mostly just remove deliberate friction (ads, sponsor segments, Shorts, interruptions) that YouTube itself adds, likening it to “pay us so we stop degrading your soup.”
• Some refuse to pay on principle, using ad blockers or third‑party clients, and instead support creators directly via Patreon, Nebula, etc.

Ads, Ad Blocking, and Who Pays

• One camp insists free, ad‑free video is unrealistic: creators, bandwidth, and infra must be funded; ad‑supported vs subscription is “fair price for hosted content.”
• Others counter that at massive scale per‑view costs are tiny, so the 45% platform cut is more “monopoly rent” than necessity.
• There’s concern that Premium mainly pays YouTube to stop annoyance, not to fund specific creators, though several replies note Premium revenue is pooled and 55% shared by watch time, often paying more per view than ads.

Monopoly, Network Effects, and Competition

• Many call YouTube a de facto monopoly: creators must be there for discoverability; viewers must be there for content; alternative sites (Vimeo, Rumble, PeerTube, Nebula, etc.) stay niche.
• Others argue it’s just a dominant player in a broader “online video” market that includes TikTok, Instagram, Netflix, Twitch, etc., and that dominance alone ≠ illegal monopoly.
• Strong network effects, Google’s ad machine, search integration, and CDN peering are seen as huge moats; past rivals bled cash on infra and lost.
• Some propose regulation: treating YouTube as a utility, splitting hosting from the front‑end, or forcing open access to its catalog/metrics.

Product Quality, Algorithms, and Policy

• Frequent complaints: degraded search (cluttered with Shorts and “people also watch”), aggressive Shorts promotion, autoplaying thumbnails, heavy/intrusive ads, anti‑adblock tactics, auto‑translation/dubbing that breaks multilingual use, and jump‑scare/low‑quality recommendations.
• Others praise YouTube as one of the last high‑quality platforms: rich educational/DIY content, lectures, music, and niche expertise.
• There’s frustration with opaque moderation/copyright systems, demonetization, and inconsistent enforcement; some note creators quietly getting suspended or throttled, others say they’ve never seen it.

Metrics, Views, and Creator Economics

• Several point to recent “view drops” with stable likes/revenue, suspecting YouTube quietly changed what counts as a view or filtered bots, with little transparency.
• Creators worry less about AdSense and more about sponsorship deals tied to visible view counts.
• Consensus: YouTube is a marvelous but fragile single point of failure; many creators now use it as a discovery funnel while trying to migrate income to paid communities elsewhere.

Reactions to the “No adblocker detected” notice

• Many like the idea of a discreet, non-blocking banner that educates users about uBlock Origin and similar tools, especially since major institutions (FBI, CERN) are cited as recommending adblockers for security.
• Some suggest tightening the message (naming only trusted blockers, avoiding third‑party promo sites) and warn about domain-squatting / fake “official” pages.
• Others see it as paternalistic: it adds yet another prompt, may train nontechnical users to install random extensions on website request, and “wastes attention” even if well‑meant.

Adblockers as security and sanity tools

• Many describe adblockers as the best modern “antivirus,” due to malvertising, phishing ads, fake download ads, and even targeted campaigns via ad networks.
• People report corporate environments disabling extensions despite security training, which commenters argue is backwards: adblocking should be standard in banks, defense, public sector, etc.
• DNS-level solutions (Pi‑hole, NextDNS, router blocking) plus browser extensions are common; some proxies even block any URL containing /ads/.

Ethics and the “social contract” around ads

• One line of argument: users who block ads are “freeloading” on an implicit ad-supported bargain, helping to push sites toward paywalls.
• The dominant counterargument: the ad industry broke any social contract first through surveillance, tracking, dark patterns, autoplay, malware, and SEO/enshittification. Blocking is framed as self‑defense, not freeloading.
• Several say they’ll happily pay directly, or accept simple static, non‑tracking ads, but refuse pervasive profiling. Others argue users aren’t responsible for fixing publishers’ broken business models.

User experience of ads and the modern web

• People heavily insulated by blockers describe unfiltered web/YouTube/news sites as “crack dens” or “unusable,” with content pushed below the fold and pages overrun by popups and autoplay video.
• Some note many users simply don’t know adblockers exist or how to install them; others selectively whitelist respectful sites.

JavaScript control and technical tricks

• There’s interest in browsers offering easy post‑load JS disablement or click-to-enable behavior.
• Users discuss NoScript/UMatrix, bookmarklets to remove iframes or sticky elements, and aggressive monkey‑patching of browser APIs to break tracking, canvas/WebGL, websockets, and popups.
• Tradeoffs are acknowledged: many modern sites (banking, travel, tax, GitHub) barely work without JS, making strict blocking impractical for nontechnical users.

Cookies, localStorage, and regulation

• The thread clarifies that law cares about tracking, not the specific storage mechanism: replacing cookies with localStorage doesn’t avoid consent requirements.
• There’s frustration with GDPR/CCPA popups, especially when cookie blocking prevents even “reject” preferences from being remembered. Some wish for a standardized browser signal for consent/preferences that sites must honor.

Causes of the Crash

• Many tie the downturn to the end of ultra-low interest rates and the broader post‑pandemic deflation of asset bubbles (tech, luxury watches, etc.). Treasuries now compete with speculative art.
• Others point to macro shocks: wars, recession fears, Chinese capital controls, and anti–money laundering rules that make anonymous high‑end deals harder.
• Some argue the article underplays these structural forces and over-focuses on insider narratives.

Gallery Model, Pricing, and Grift

• Commenters describe primary-market pricing as opaque and borderline gaslighting: galleries insist art “isn’t an asset class” while also justifying prices by future appreciation they themselves control.
• Perception that there is little genuine price discovery outside auctions, and that galleries actively resist comparisons to normal markets.
• Huge fixed overheads (six‑figure monthly rents, multiple spaces) are seen as obviously unsustainable; this looks like an art-dealer problem more than an “art” problem.
• Several see the high-end scene as heavily intertwined with tax arbitrage, wealth parking, and outright money laundering.

Speculation, Crypto, and NFTs

• Strong consensus that a big chunk of “new money” in art was really speculation; those gamblers have largely migrated to crypto, meme coins, and high-end watches.
• Disagreement on timing: some say NFTs siphoned off speculative and laundering demand before the crash; others note NFT markets peaked earlier, so causality is unclear.
• Long subthread trashes NFTs/blockchains as mostly scammy, solving little beyond providing another gambling vehicle; a minority defend provenance/timestamp use cases.

Shift to Direct and Grassroots Art

• Multiple commenters say the “art world” in the article is a narrow, elite slice. Meanwhile, there’s a boom in:
  • Local fairs and community shows
  • Direct sales via Instagram, Etsy, Reddit
  • Small commissions at accessible prices
• Buyers value personal connection with artists over gallery gatekeeping; disintermediation is seen as healthy and likely permanent.

Technology, AI, and Digital Art

• One data point (art-supply sales dropping after 2022) prompts speculation about AI image models reducing traditional production, but most call that a stretch.
• Several working in generative/digital art describe the real challenge as marketing, curation, and audience-building, not tools.

Status, Values, and the Future

• Split between “good riddance” to pretentious speculation and concern for how crashes hit working artists.
• Some think we’re entering a healthier era: smaller markets, more commissions, direct patronage, and less deference to galleries and “tastemakers.”

Market share, revenue, and growth

• Many distinguish sharply between falling EV market share and fundamentals like revenue and profit.
• Some argue declining share is inevitable as the EV market broadens; others counter that Tesla’s entire growth narrative depended on dominating EVs, so erosion of share plus flat revenue is serious.
• Several point out revenue has effectively stagnated for ~3 years, with 2024–2025 looking like a plateau or decline once inflation is considered. Two consecutive years of falling unit sales are framed as a major red flag for a supposed growth company.

Valuation, stock, and “meme” dynamics

• Widespread sentiment that Tesla’s valuation (very high P/E) is decoupled from its current auto business and driven by speculative hopes in AI, robots, and robotaxis.
• Multiple commenters describe Tesla as a meme stock, “product is the stock,” and note that shorting it has burned even skilled short sellers.
• The proposed trillion‑dollar pay package is seen by many as a stock‑pumping stunt or a desperate attempt to keep Musk focused on Tesla; others note that misrepresenting such a package would be securities fraud.

Competition, lineup, and product strategy

• Consensus that competitors have “caught up or passed” Tesla on many EV metrics (range, charging speed, comfort, features), especially from Hyundai/Kia, Toyota, Rivian, Lucid, Chinese makers (where present).
• Tesla’s lineup is widely called thin and stale: essentially a midsize sedan, a smallish SUV, and a niche truck. Lack of a cheap “Model 2” and absence of a compact/B‑segment car are seen as big strategic misses.
• Cybertruck is often labeled a design and QC failure and a poor allocation of resources, especially as it’s hard to sell outside North America.

Product quality, usability, and service

• Many anecdotes of poor build quality, rattles, water‑ingress concerns, difficult repairs, and high insurance/repair costs; others report recent service as fast and smooth.
• Strong criticism of Tesla’s removal of physical controls (stalks, gear selector, horn/button placement), seen as dangerous “techno‑poverty” favoring aesthetics and cost over ergonomics.
• At the same time, Tesla’s software, charging integration, and infotainment are often praised as still industry‑leading.

Charging network and EV market structure

• Some insist the Supercharger network remains a key moat; others argue that NACS adoption and adapters mean the advantage is rapidly eroding.
• Several note that many legacy EV competitors are selling at large losses and reliant on subsidies; they expect some brands or models to be pulled back, which could benefit Tesla later.
• The July sales bump is attributed largely to expiring tax credits pulling demand forward; Tesla underperforming the overall EV growth in that month is viewed by some as a bad sign.

Musk, politics, and brand damage

• A very large contingent believes Musk’s high‑profile far‑right politics, online behavior, and conflicts (e.g., unions, governments) have severely harmed Tesla’s brand, especially among the tech‑liberal early‑adopter base.
• Examples include owners adding “bought before Elon went crazy” stickers and people refusing to consider a Tesla despite liking the product. Others argue this is overemphasized or confined to certain demographics.

Robotics, FSD, and future bets

• Longstanding skepticism about FSD timelines (“next year since 2018”) and Tesla’s robotaxi narrative; some say Tesla is now pivoting hype from autonomy to humanoid robots.
• Debate over how real Optimus is versus remote‑controlled demos; some think Tesla is near the front of humanoid robotics, others think it’s mostly a marketing show and that industrial/non‑humanoid robots are more practical.
• Several compare the robotics bet to Meta’s metaverse: huge, early, and possibly badly timed, but central to justifying the current valuation.

Overall sentiment

• Opinions are sharply split: some find curved displays transformative (especially on large or ultrawide panels), others find them distracting, distorted, or pointless.
• Many argue “it depends” on panel size, aspect ratio, curvature radius, viewing distance, and use case.

Optics, distortion, and “correctness”

• Several comments challenge the article’s “looks like the original scene” claim, noting that:
  • Perspective is only “correct” from a specific viewing point and distance.
  • Flat vs curved doesn’t fix the fundamental mismatch between camera projection and human vision.
• Others point out that for ultrawides, flat panels put the edges at much greater distance and steeper angles, which can make sizes, brightness and contrast feel inconsistent; curvature reduces that variance.
• There’s discussion of rectilinear rendering in games and how neither games nor OSes commonly account for physical screen curvature.

Use cases: gaming vs productivity

• For gaming and immersive setups (e.g., 34–49" ultrawides, 32:9 “super ultrawide,” giant Odyssey-style panels), many say curvature “just feels right” and improves focus.
• For photo/video work, some argue flat is better for straight lines and geometry; others note panoramas/anamorphic images can actually benefit from curved projection.
• For coding and office work, complaints focus more on:
  • Low vertical resolution (1440p) on wide panels.
  • Low pixel density making text look coarse vs 27–32" 4K.
  • Scaling quirks across mixed-DPI UI toolkits.

Ergonomics and perception

• Some prefer curved ultra-wides over multi-monitor “V” setups to avoid constant neck turning; others think modest head movement is healthier than staring rigidly forward.
• Multiple people note that the brain rapidly adapts:
  • After using curved for a while, flat screens can look bulged outward, and vice versa.
  • This is compared to adapting to glasses, astigmatism correction, or old curved CRTs.
• A few mention eye strain from LCD non-uniformity; curve + better tech (IPS/OLED) can help.

Glare, sound, and practical annoyances

• One camp says curved panels worsen reflections and even “focus” sound back at the user; another says curve dramatically reduced glare compared to flat.
• Ultrawide/curved monitors complicate screen sharing and remote meetings because recipients see tiny, letterboxed desktops.

Buying, cost, and tech constraints

• High-res curved ultrawides (e.g., 5120×2160, OLED) are praised but considered very expensive with trade-offs in pixel density and lifespan.
• Several people emphasize that you really need to live with a display for days/weeks; short store demos or specs alone are poor predictors of comfort.

Implementation Approaches (CSS/SVG vs WebGL)

• Thread compares the blog’s CSS/SVG-based refraction to a WebGL shader demo.
• WebGL is seen as more naturally suited to real-time effects and cross‑browser support, but requires JS and rendering into a canvas, which detaches it from the DOM.
• The article’s approach is praised for integrating with regular HTML/CSS, allowing pre-rendered displacement maps and immediate first-frame rendering.
• Some argue this demo is “just a glass shader,” while Apple’s “Liquid Glass” also involves meta‑ball merging, tint modes, and layered controls; others link to “goo” filters that mimic those merges.

Performance and Power Concerns

• Multiple users report stuttery scrolling and high GPU/fan usage on powerful Macs; others say it runs smoothly on M1/M3 hardware or mobile.
• Comparisons between the SVG/CSS and WebGL demos show mixed results: sometimes the WebGL version is smoother, sometimes the SVG one is.
• There’s interest in benchmarking power efficiency versus OS‑native implementations and skepticism about heavy effects on ordinary sites (“why our much-faster computers still lag”).
• The author acknowledges current performance issues and has already shipped at least one optimization pass.

Browser Support and Spec Issues

• The main interactive demo is Chrome-only due to use of SVG filters as a backdrop-filter; other browsers partially render but miss key refraction effects.
• Some users initially miss the Chrome-only disclaimer or visually tune out the highlighted note.
• Debate arises over whether the technique is “out of spec”; others link to W3C drafts showing URL filters are in the Filter Effects spec, though implementation is inconsistent.
• On Firefox, some sub-demos and the playground work, but magnification and displacement are incomplete, especially on mobile.

Visual Quality & Technical Refinements

• Suggestions include better anti-aliasing, subtle blur, higher resolution for filters, and chromatic aberration along displaced edges.
• Some notice single‑pixel high‑contrast artifacts and slight text distortion under the magnifying glass.
• A few users correct or discuss math details in the article’s equations.

UX, Design, and Apple Discourse

• Many see the work as technically superb but question the usability of glass UIs: readability, distraction, and battery use are recurring worries.
• Several strongly dislike liquid glass and modern Apple design direction; others report that Apple’s implementation feels subtle and performant in current betas.
• Netflix’s glassy logged-out UI is cited as an example of a nice effect that degrades performance.

Article, Tooling, and Community Spin‑offs

• The writeup and interactive explanations receive extensive praise, often compared to high-end educational blogs.
• Tech stack mentioned: React, Motion, Tailwind, and vanilla SVG.
• People share related libraries and forks, and express interest in source code or a future open‑source library.

Allegations and WhatsApp’s Security Posture

• Whistleblower claims: ~1,500 WhatsApp engineers could access user data (contacts, IPs, profile photos) without adequate logging or oversight, potentially violating a prior FTC-style order.
• Complaint also alleges only ~6–10 engineers on security vs ~1,200+ on product/engineering, implying a weak security culture and constant firefighting rather than systematic risk reduction.
• Some point out that Meta publicly stresses strict auditing and zero‑tolerance for data snooping; others argue the company’s overall history with data abuse undercuts those assurances.

E2E Encryption: What’s Protected, What Isn’t

• Several commenters stress that WhatsApp messages are end‑to‑end encrypted and the lawsuit concerns metadata, not message content.
• Others argue E2EE is meaningless when the endpoints are closed‑source proprietary apps controlled by an untrusted company; client code could decrypt and secretly exfiltrate plaintext.
• Reverse‑engineering work is cited as evidence WhatsApp really does E2EE at the protocol level, but critics note this can’t prove Meta couldn’t push a backdoored client.

Metadata as a Serious Privacy Risk

• Strong pushback on “just metadata”: who talks to whom, when, and from where is seen as enough for most law‑enforcement or intelligence purposes.
• Examples raised include targeted killings, investigations, and social‑graph building; some argue metadata is often more useful than message content for profiling and ads.

Trust, Open Source, and System Design

• Repeated theme: E2EE is only meaningfully trustworthy if clients are open source, reproducibly built, and not web apps that can be silently swapped or scripted.
• Without that, any “secure by design” messaging is considered marketing, and E2EE claims are treated as unverifiable.

Alternatives and Comparisons

• Signal is frequently recommended, with caveats: phone‑number requirement, US funding, and centralization make some wary.
• iMessage is cited as closed‑source E2EE with additional weaknesses (iCloud backups, key recovery), and there’s debate over whether Apple’s public legal fights are genuine or “security theater.”

Scale, Ethics, and Regulation

• Many see WhatsApp as essential global infrastructure; that magnifies even “metadata‑only” issues into real safety risks (stalking, political repression, account takeovers).
• Meta’s broader history (privacy abuses, political manipulation, moderation failures) fuels a general stance of deep distrust and calls for stronger oversight and meaningful penalties.