Log in
The People Holding Up the Internet. Amazing to see how much of the modern internet still depends on the volunteer work of individual people. 4 billion phones rely on the time zone database, a text file edited by just two people in their spare time.
We are, moment by moment, doing less sensing, navigating, remembering, walking, choosing, and attending
- by Melanie Challenger
A friend of mine was complaining this week that a school's website didn't work for her. It had an over-engineered anti-copying feature which prevented her from (legitimately) copy-pasting the school's postal address. She couldn't select the text, couldn't copy the text, and the content would blur itself right in front of her eyes.
"I can understand the need for this," she said, "but it’s just like annoying as am visiting the school for work."
Counterpoint: I can't understand the need for this. I'd argue that this kind of technology is (a) harmful and (b) pointless.
Webpage copy-protection is harmful
That it's harmful is pretty obvious: my friend's legitimate use of the website was impaired! These kinds of copy-protection scripts inconvenience everybody... but they're disproportionately troublesome for people with accessibility needs. For example:
- Blocking text selection prevents people with dyslexia from selecting-as-they-read1.
- Blocking right-clicks, mobile gestures, and keyboard shortcuts can interfere with the ability to modify text size or contrast.
- Attempting to detect and block developer tools (which can be the easiest way to bypass the above) can misfire for people with unusual screen sizes or who re-arrange their windows.
- Font-swapping/glyph-mapping prevents Find In Page and prevents search engines from indexing your content, as well as completely breaking screen readers.
Webpage copy-protection is pointless
For all that it does to inconvenience and infuriate legitimate users, this kind of copy-protection does (almost) nothing to stop a knowledgable and dedicated attacker from taking a copy of absolutely everything. Wanna see?
I've used the demo of the "Right Click Ban and Content Protection Pro" plugin for WordPress as a testbed. It's a pretty-typical example of the concept, and uses a suite of different blocking mechanisms to try to "protect" content.2
It can be bypassed, for virtually every site it's installed on, with a single line in your content blocker:3
# A simple bypass rule for the demonstrated copy-protection system:
/wp-content/plugins/right-click-disable-and-security-pro/js/*
Other systems can be more-complex. The most-annoying are those that weave their copy-protection JS in with the JS that writes their content to the page4. But they're all similarly-bypassable.
Nowadays, LLMs make bypassing is available even to users who don't know their way around their browser's development tools5:
Webpage copy-protection is impossible
Attempting to copy-protect webpages doesn't actually work, and harms legitimate users.
If you don't know better, you might think that this just means that the systems we use to protect sites just... aren't very good. But no, the problem goes deeper than that: webpage copy-protection is fundamentally impossible.6
The other year I wrote about the difference between downloading and streaming online and concluded that the fundamental difference is that when you're streaming, your browser is pinky-promising not to retain what it downloads. But once it's on your device, it's out of the author's control. The same is true for webpages and their content: by the time you're reading the page, you've already taken a copy of it.
...and that's great
There are those that will argue that, even though you can't stop everybody, it's still worthwhile to try to copy-protect webpages. It introduces a barrier that might dissuade some misuse.
I disagree with that. As I demonstrated above it's easier than ever for everyday folks to bypass copy-protection on the Web, so the barrier has never been lower. But the harms described earlier are still very-real. Copy-protecting webpages doesn't work, but still messes with your legitimate users.
If you're running a copy-protection script on your site... it's time to stop.
The Web was built to be transparent and reverse-engineerable. It resists efforts to shoehorn copy-protection into it, which ensures that it such protections can always be bypassed.
Don't bother trying: all you really achieve is to annoy legitimate users.
Footnotes
1 Selecting text to remind yourself where-you're-up-to can be helpful for everybody, but some people with dyslexia report that it's especially useful to mark your progress in this way
2 It even adds logging of how many times it's been successfully triggered! My friend expressed concern that her attempt to copy the address might have been logged, and I was sceptical that any site would do this, but it turns out that some do. But it seems a little pointless: what're you going to do with that information, anyway? Copying or saving some or all of a webpage for your own personal use isn't illegal! But adding logging opens a whole new vector for trolling: folks like me who know how to use their developer tools can - perhaps just for funsies - easily saturate your "who copied content" logs with spurious and meaningless entries, making them once-again useless, and people who bypass your copy-protection won't trigger the logging anyway.
3 I'm using uBlock Origin for Firefox as my content blocker; yours might differ.
4 Sites that require JS to write content to the page are already annoying for a bonus reason, of course: they're using JavaScript to do what HTML is better and faster at. But that's another story.
5 The big LLMs are instructed not to help you bypass copy-protections... but that can be trivially sidestepped by simply implying that that the site you're trying to extract content from is your own!
6 There's a slight exception/caveat to my claim that you can't meaningfully copy-protect a webpage. If your webpage embeds content that depends on closed-source extensions, e.g. using controversial tools like EME or, historically, the likes of Flash, RealPlayer, or (heaven forbid) Comet Cursor, then content might be well-protected. Except... not so much, really: the analogue hole always exists even if no other options are available.
💖 RSS is fantastic, and so are you for using it. 🎆
My community is under attack by commercial interests. Since last week, speedrun.com refuses to distribute our database of speedrun accomplishments under the agreed-upon Creative Commons license. This licensing dispute is a major breach of trust and an abdication of SRC's responsibilities to the community. Individual game's communities are all scrambling to find a new home for their leaderboards. SRC has the audacity to say its for our own good.
My other community is also under attack by commercial interests. OpenAI and Anthropic are telling their models to solve open mathematical problems, presumably to evaluate their models' capabilities. Sure, if that is productive then I won't judge that. What I do disapprove of, is that OpenAI is yeeting all their exhaust onto the internet.
When you prove a theorem, you are imparted a responsibility to the field. At minimum you need to explain what you did, including which steps required new ideas and which steps are already well-known. More substantively, you are expected to nurture the literature. If an important idea was poorly explained in its first incarnation, then you have to explain it better in your work. These demands are broadly accepted and are not controversial. Any time you meet the demands, the resulting paper is highly appreciated and valued.[1] The responsibility is yours because you have the opportunity to publish a paper on the subject.
OpenAI is doing the exact opposite. They do not care about their 'manuscripts'. They don't bother putting in appropriate attribution of ideas, their work contains errors, and they don't even bother with consistent presentation or formatting. This actively sets back the state of the literature.
Why are they doing this? Is there a benefit to their releasing this exhaust? Does science benefit? OpenAI says these results took 3 hours of LLM time on average with their internal model. Likely their public models can achieve the same outcomes when instructed by expert guidance. That's why they keep scooping their own customers.[2] A scooping that, I will add, is only possible because OpenAI outputs such sloppy work.
If an expert prompts a result, they take up the mantle of responsibility I describe above. OpenAI not only refuses to take their responsibility, but they prevent their own customers from doing so. And they have the audacity to say they do it for the good of science.
| [1] | One example of such a valued paper is Daniel and I's smoothed analysis paper. Yes we proved better running time bounds, but mostly using ideas that were in the literature already. The contribution of the paper was that it was nice to read, unlike the notoriously opaque literature that came before it. It would have been difficult to justify the time we spent writing this all up nicely if we hadn't also improved the result quantitatively, hence the responsibility. The paper remains my most visible piece of work, still accruing more citations per year than later follow-up work. |
| [2] | Here is one example from today of OpenAI customers who got scooped because they were spending their time writing up a nice paper instead of staking a flag on github dot com. |
How much cognitive offloading is too much?
The post Mere Minutes With AI Causes a Sharp Drop in Persistence appeared first on Nautilus.
Anyone who has even tangentially associated with computer programming knows that modern AI coding assistants and agents can be incredibly efficient at generating huge amounts of functional code. But coders making use of those tools also know better than to trust the accuracy of that code, meaning substantial effort needs to be spent reviewing any AI-generated output.
A recent study of actual coding practices across hundreds of firms finds that human code review forms a significant "bottleneck" for the overall efficiency of AI coding tools, resulting in "little evidence that firms increase software output or reduce employment" by using them. Any efficiency increased during the actual coding phase, the study authors find, is "absorbed by downstream constraints in the production process"; as "the code review process significantly increases in length, pull requests are more likely to require revisions, and reviewers leave more comments."
Cut once, measure twice
To come to these conclusions, Harvard University researchers Fiona Chen and James Stratton made use of aggregated analytics data from Jellyfish, which measures the granular output of engineering teams. That data encompasses 300 million individual "work events" (e.g., commits and pull requests) and issue management software data across more than 700,000 employees at over 700 relevant software development firms from 2021 through March of 2026.
Next Page of Stories