You make claims like "that means one website can take over your entire phone" and I reject that. I know what these isolation layers do and I also know that they're not going to make a difference in practice for the vast majority of people. For instance, same-site isolation, which you specifically mentioned, is not a defence against anything but CORS bypasses and maybe some memory leaks. Firefox not having it is suboptimal, but it's hardly the end of the world. Just rather annoying to let them open themselves up to the risk of side channel attacks and such.

The Android sandbox is designed to sandbox entire binaries. That alone should withstand any malware that enters the phone, or at least constrain it within a sandbox. If that sandbox is broken, GrapheneOS itself is broken. There are CVEs and CVE chains to break out of that sandbox in unpatched version of Android and there are probably a few that are present but haven't been discovered by the good guys yet, but that's the part that prevents any app from taking over your phone. It's also why rooting your phone is such a hassle if you don't have an unlocked bootloader.

That's also what Firefox is supposedly "crippling" by not using Googles process sandboxing API. That just shows that GrapheneOS assumes their sandbox to be broken to the point where every app is crippling their security by not calling the APIs used for process isolation.

The kind of browser protections you're arguing for are defence-in-depth measures. They lengthen the kill chain of certain families of exploits by requiring more workarounds and making exploits less stable and efficient. That's no doubt good for security in general, and I'm not denying Firefox has work to do here, because Google is ahead of them.

However, their browsing recommendations are only valid for their threat model. That includes "always disable USB", "always hide your IP address", "sacrifice RAM and performance for better ASLR", "break API compatibility to enforce better malloc rules", and tons of other modifications that are protections against the most advanced kinds of malware. Of any if this were a problem, the average Android user with their four month old copy of Chrome on their two years outdated Android phone would get hacked every single day. Writing reliable Android exploits is actually quite hard because every manufacturer likes to alter their ROMs in tiny but annoyingly significant ways. Your ROP chains don't line up anymore, your kernel exploit needs to call a different method, the ROM comes with a different version of a driver for no good reason, it's almost security-through-annoyance.

The protections Graphene provides are similar to those of an iPhone in lockdown mode (a severely underused mode, in my opinion, one that mainline Android should include). It protects against vicious malware that's made by people with vast resources through several levels of defence in depth and sacrificing usability for security where necessary, to the point they call themselves "an operating system with Android app compatibility". It's why only GrapheneOS and the latest (well-configured) iPhone were shown to be resistent to hacking tools such as Celebrite. Excellent for journalists, human rights activists, and other potential targets of such directed advanced malware. Hardly a problem for the majority of the population whose malware exposure is "your WhatsApp is outdated click here to install WhatsApp.apk" and "download super gambler from the Play Store and Elon Musk will send you free crypto".

For some perspective, compare GrapheneOS' opinions on Gecko with those of DivestOS, which provides a more nuanced recommendation. They recommend their Mull and Tor for privacy reasons, despite the lack of the two isolation features GrapheneOS is so adamant about. They also mention dynamic first party isolation, which Firefox implements but Chromium doesn't, and which even Vanadium doesn't have a comparable implementation.

You said users should understand the risks associated with their browser choices, and I agree. I just don't think the risk is as high as you seem to think. And no, I'm not developing an Android ROM, and even if I should, that wouldn't make me more or less reliable on a forum like this. When it comes to browsers, my recommendation would be "use Mull for privacy against advertisers and data brokers, buy a Pixel and use Vanadium or buy an iPhone and put it in lockdown mode if you're afraid of one or more governments".

I still don't really see what "that kind of security concern" is in this context. Same-site isolation protects two websites from each other, nothing more. The isolation API Chromium uses to drop permissions on some of its threads are used to limit the potential of a single exploit, but they don't prevent things like the Qualcomm vulnerability from being abused.

It's not like any website can just break a web browser, they need to exploit the browser in the first place.

For unpatched people, that means they're in trouble. Luckily, Android is so fragmented that there is no exploit that'll get root access on all devices. It's hard to even get root access on the same model of phone. In practice, drive-by malware is actually quite rare for how many unpatched Android phone are out there.

There is probably more risk in using Firefox than there is in using Chromium, but the additional protections here are quite overstated in my opinion. You can't get enough layers of defence when you're a human rights activist or whatever (but then you'd use an iPhone in lockdown mode anyway), but just because Firefox doesn't implement a particular API doesn't mean your phone can be taken over by any website you visit. You need a complex chain of exploits directly targeting your phone's hardware and software configuration to get anything more than a force closed browser tab.

As for the attack surface, Chromium implements a significantly larger API and provides a significantly larger attack surface, with permissions and code to do things like access USB drives and open serial ports. I'd say the huge chunk of Chromium-only browser features leave Chromium with a larger attack surface, not a smaller one.

I personally prefer the additional privacy improvements Firefox brings over the two layers of malware protection that patched versions of Chromium provide. I'm no Khashoggi and I don't work on any nuclear plants, I'll probably be Fine™️ and so will you.

People like to pretend stocks are some kind of scheme by the big bad CAPITALIST MACHINE to oppress the workers and enrich the wealthy but that's not what the stock market is about. It's what happens when people who have no idea what they're doing throw their money into financial products and lose everything, but whether you know it or not, your money is probably tied to the stock market at some level. The profit you make at the stock market is directly tied to the amount of money you're risking, and the amount of risk you're willing to accept. No risk means no reward, lots of risk means you can be billions in the hole.

Stocks are essentially lending money in exchange for a tiny bit of a company. If the company does well, you get paid back an amount depending on how much of the company you own. You can sell that bit of the company and then someone else will get paid instead, but you get to keep the money off your sale. You usually also get to have a say in how the company works if you own enough stocks, as you own part of the company now.

Selling stock allows a company to expand more than if it had to slowly save up its profits. You can only mortgage your assets once, but as long as you can convince people to lend you money, you can make money with stocks. The more a stock is worth (=the more trust existing or prospecting lenders have in you), the more likely people will be willing to buy parts of your company.

By not selling every part, or keeping a small set of parts for employees, the company can also directly profit off of price increases.

There are also companies like co-ops where the workers all own part of the company. That means they get a say in how the company is run, as the workers collectively have more power than even the CEO, for better or for worse; convince the majority of a terrible business plan and the entire coop goes to hell, even if the CEO warns everyone about how bad an idea something is. On the other hand, when someone tries to cut costs by doing mass firings, the workers can come together and put a stop to that. This also motivates workers, as the stock they get paid is worth more when the company is doing well. This doesn't have much to do with the stock market, as these stocks usually aren't traded publicly, but it's just an example of stocks being used to improve the position of the working class. Unfortunately, co-ops like these can't use stocks to attract investment, so these companies don't grow as much, and you don't see too many of them as a result.

You can do a lot of things with stock if you enter the stock market. Most of that is actually contracts about how you're going to treat a stock you own or want. For instance, you can borrow a stock from someone else for a modest fee, sell the stock off, wait a bit for the price to drop, then buy it back, pocketing the difference. If you misjudge the price difference, you end up paying more than you've sold the stock for.

You can also do the inverse, basically buying someone's promise to sell you a stock for a certain amount of money in a certain amount of time, hope the stock is actually worth more than what you've paid by the time the exchange happens, and get expensive stock for cheap. Once again, this can lead to a situation where you make a loss, for instance when the stock drops in price and you've paid more than if you would've bought the stock directly.

It's basically all betting and betting on other people bettings. Making money through normal stocks takes a long time, as the company you've bought stocks of may take years to reach the growth you've funded, and these bets can make you a lot more money in a shorter amount of time. However, you're not obligated to do anything crazy with your stocks; you can just buy them, hold on to them, and make a small profit over the money the company pays back.

Companies that don't sell stock and still compete with stock based companies often have other investor deals. Without these kinds of loans from people with free capital, it can take decades to collect enough money to pull off growth that would take a year with stocks or other loans. If you're starting a business, they can help you achieve your goals and bring your products and services to everyone for affordable prices. If you've got more money than you need, you can use stocks to help someone else get their business running, and you get a bit of cash in return. If you think you've got a good idea for how to run the business, you can buy a significant chunk of stock and weigh in on how that business can work best.

Stock also has another upside: the stock market allows you to take money you have pooled (be it retirement funds or just some money you've got floating in your bank account) and invest it in some safe bets which make about 2 or 3 percent profit over a long time. If you don't do that, the amount of money you've saved will remain the same, but because of inflation, that money will be worth less over time. A million dollars was enough to retire on a few decades ago, but if you've saved a million and stopped back in the day, you won't have enough to retire now because everything has gotten more expensive. That's why pension funds usually invest part of their money into stock markets. Minor fluctuations over time (like a company losing a quarter of its value this year and making everything back next year) aren't very important if you're saving money for 30 years in the future.

There is a massive downside to stocks, though: they're a quick way to lose money, and way too many people get sucked into complex financial contracts they have no understanding of. Take the Robinhood traders that didn't realise they were signing contracts that could make them owe tens or hundreds times the amount of money they put in. You could also make a mistake and loan a lot of money to a company in exchange for stocks and end up with nothing when the company goes bankrupt. You could also sell too early and lose all of your profits to the minor fees stock brokers demand to do the actual stock trading for you, as everything needs to be registered properly.

Another problem with the stock market is that large funds, such as hedge funds and pension funds, need people to run them. There's an incentive for those funds to make as much of a return as possible, regardless of what happens to the companies they buy parts of. When these funds come into control of a company, making decisions that only make a profit in the short term and screw over everyone in the long term can make those funds a lot of money, at the cost of the businesses they buy. Businesses can protect themselves from this (by not selling more than 49% of their stock, for instance, or by having 51% or stocks in the hands of their CEO/leadership, so any decision can be overruled). However, companies often like the idea of making money more, plus the more control they give to stock holders, the more their stock will be worth.

This stuff is also why there are rules about all of this. Look at the lives ruined by cryptocurrencies to see what happens when you don't have them. In the end it's just people making mistakes and ruining their own lives, but as a society we're better off protecting each other from making those mistakes.

When it comes to anticipating rise in/fall of value, you don't need stocks. There was a massive prospective market on pogs and beanie babies. People still buy action figures, Pokémon cards, and action figures to hopefully make a profit one day.

If a third part web browser "bypasses or cripples" OS sandboxing, then any app can. Seems like Graphene's hardening isn't very good for third party apps in that case.

Firefox doesn't use Android's API for sandboxing processes from each other, but that sandboxing isn't what's protecting your phone from getting taken over. There are many layers of security present within Android and process isolation for web content is just one of them.

I'm sure Graphene's fork of Chrome is more secure than Firefox (especially with JIT turned off) but that doesn't mean running Firefox presents any risk.

Android's design is such that I should be able to install a random app and see no adverse effects other than battery drain/high network load without clicking through dozens of security prompts. If that's not the case, there's a vulnerability in the Android layer that needs patching, such as the Qualcomm vulnerability that was released recently.

With open security holes like that, not even Chrome's site isolation is going to protect you

No it doesn't? It means that a malicious site that can take over a browser process can also take over connections/accounts on websites that share the same browser process by bypassing mechanisms such as CORS.

This isolation mode is also pretty effective against things like side channel attacks, though real mitigations of those bugs require kernel/microcode updates.

To take over your phone, you need at least a sandbox escape exploit to break out of the browser app space, a privilege escalation exploit to get past selinux and other such protections, and even then the damage you can do is quite limited unless you've gained root access. Site isolation exploits can be used as the first step in a chain of exploits, but it's not a very important part when it comes to preventing privileged RCE.

I see. I don't think missing that is enough of a problem for me to switch browsers, it is rather unfortunate that it's still missing on Android.

Then there really are no excuses left for those supermarkets. Just a weird Americanism, like using imperial units.

Interesting. What security risks are you talking about exactly? Do you have a link?

I know Chromium is faster and more responsive on Android but I haven't read much about security differences yet. With Chromium being pre-installed and signed by the OS vendor, I always assumed the risk of exploiting the Chromium process was higher instead of lower.

I'm not sure what threat model you're protecting yourself from if the Android sandbox isn't good enough for either to be honest, but I suppose there's risk in hijacking the browser too.

Heuristics? We call that AI now!

I don't know what brand the author got, but Google's own software has a setting to get rid of the Google stuff: https://support.google.com/googletv/answer/10408998?hl=en

As for the performance: TV manufacturers have used terrible SoCs ever since the first chip hit TVs. That's why you shouldn't buy TVs online without evaluating them in a store. I have a TV where all of the smart crap died of years ago and it was sluggish our of the factory. But it's not just that; even devices like Chromecast slow down over time as more features get added, higher bitrates are being decoded, and more advanced video formats start to get used.

Set up your TV in basic TV mode, don't buy bottom of the barrel TVs expecting a premium experience, and use some kind of replaceable, external device if you want smooth media playback. TVs and TV hardware are ridiculously cheap these days (just check the inflation correction on a VHS back in the day, VHS players and DVDs went for what equates to about 2000 dollars today!).

You get what you pay for. And if you're using ad driven stuff, you're getting a discount, so don't expect anything to get cheaper by kicking out all the data collection software.

Sending the labels from a central location seems wildly inefficient when label printers are as cheap as they are.

Plus, prices are already adjusted at the state level at the very least, if you're gonna ship every store their labels from a central location you may as well update the tax info on them.

Even the budget stores here are switching to a digital display system with those small e-ink displays. When that technology hits the US, there really won't be an excuse not to label things including tax anymore.

Most expats leave after a few years. They only move in to make a quick buck with tax advantages and then move back/on to another country.

I suppose they're a form of immigrant, but a very specific subgroup. One that often also doesn't intend to integrate with local culture, so their approach is quite different from most legal immigrants. You can't really compare the experiences of war refugees with Americans that come work in another country for five years, even though they're both forms of immigrants.

I don't just consider the Brits and Americans to be expats, I've also met expats from eastern Europe, India, and South East Asia. Maybe the rich expats don't like to be grouped together with them, but I also consider the cheap eastern European labourers that do jobs like working the fields for half a year to be expats.

I mean I guess stores in places with 0% sales tax don't, technically. American stores just don't want to bother doing the math while labeling and make you do the math in your head (and then they do it at the till).

Another consequence of the crazy American tax system.

They know the price to charge at the till so they definitely can show the full price. It's just convention not to at this point. Why go through the effort when it only makes you look more expensive compared to the competition, after all?

As someone whose native language has a "vee" and a "wee", the whole "double u/v" always seemed kind of weird.

I know the history of the letter (v turning into u later after being the same letter for centuries) but I never got why some languages stuck with the "double" letter for this long.

It's a bit hard to articulate the difference I've noticed with Americans when talking about work. It's not like America is stuck in the 60s with executive toilets and executive lunches, but office culture definitely seems different.

What probably makes a difference is the difference in management styles.

Some people don't like to receive help from others without getting something in return, because it makes them feel pitied. If you think this applies to you and they're refusing help because they don't want to be a burden, ask for a little favour yourself every now and then, even if you don't really need to borrow that lawnmower/hammer/bucket. That way, they don't feel as burdened asking you when they need help.

If you've got money leftover for them, you can't go wrong with keeping some funds reserved in case they need it. It sounds like they're doing fine, so an emergency fund is all the monetary aid they may need. If that doesn't get used, you can always invest it and have it ready for them when they age and run into stuff like healthcare bills.

You could also spend the money another way, like giving nice birthday/Christmas gifts. Save up for holiday vouchers, or get them a roomba or a dishwasher to sneakily help with cleaning.

Also consider that maybe they really are fine, and would be happier seeing you invest your money in yourself and your future. Most likely, they'll appreciate spending time with you much more than the money you may be able to provide.

First of all, a practical item that people sometimes forget: traffic laws are different in every country. Even if your driver's license is valid in other countries, take a moment to read up on traffic rules.

If you live in a city, give public transport a serious consideration. It's not for everybody and not every place has good connections, but you'd be surprised how little you need a car if you live in an area well-served by public transport.

As with any foreign country, you'll do well to learn the language. Written Danish probably isn't too difficult to learn when you already know English (they share a heritage after all) but spoken Danish is quite peculiar. You'll probably get by with just English just fine, but most people will prefer to speak their native language.

What I've heard from family moving to Denmark: check and double check your tax information and registration. The bureaucratic process can take a while, even when moving within the Schengen zone. Also: America has some weird laws where you need to pay taxes regardless of if you live there or not, as long as you're a citizen. Make sure you know how much taxes you need to pay to what government! You generally don't need to pay tax in both countries unless you make a boatload of money but it can't hurt to check.

Speaking of, you'll pay a lot of taxes. You get a lot in return, but make sure you know what your net income is going to be like and what taxes are hiding around the corner. The amazing Danish welfare state needs to be funded somehow!

If you live near any borders (European definition of "near"), check any visas you may have for what you're allowed to do. Some visas allow you to move freely within a single country but not leave it for x amount of days consecutively/in a year, for instance. Denmark is actually one of the few countries with border checks (Germany too these days).

What I've heard from other Americans visiting Europe: it's smaller than you think and everything seems closer than you think. That's very nice when it comes to stuff like grocery stores, but some people feel a little claustrophobic because of the lack of free, open space.

Make sure your credit card is set to allow for international payments, unless you already have your money in a Danish bank account. You don't want to arrive and find out you can't pay for anything.

Get yourself a local SIM card. It's probably a lot cheaper than carrying your American number in general, but roaming charges between the US and the EU are Not Fun.

Most Danes speak English well, in my experience. However, don't let that fool you into thinking they share the same cultural norms. Things common in some American subcultures (calling everyone "dear", saying stuff like "we should hang out some time" without actually meaning it) can cause some humorous/awkward interactions when misinterpreted. Knowing the words isn't the same as knowing what you actually mean!

Prepare to do a lot of currency conversions in your head. You can get tricked into spending more money than you thought if you don't know what amount of DDK translates to USD. 1 USD is about 6.8 DDK, so yeah, good luck with that, multiply by seven and subtract a bit I guess?

Stores in Denmark will often show prices including tax, so don't do too much mental math. You generally don't need to apply the 25% VAT on listed prices unless you're buying business to business.

Based on experience from expats: immerse yourself into the local culture and language. Making connections with strangers is hard, likely harder than in the US, but you'll end up quite lonely if you only hang out with coworkers and other expats.

Also read up on punctuality expectations. Some cultures expect you to be five minutes to half an hour "late" to an agreed upon time, others expect you to be there much earlier, and then other cultures expect you to arrive right on time. That applies both professionally and socially!

On a similar note, make sure you read about the expectations your coworkers may have of you, culturally. If you work for an American company you may end up with an American style corporate hierarchy, but Danish companies are a lot more egalitarian on average. Not just office wise, but also "only addressing the boss by their first name" wise.

Working overtime may not be appreciated as much, and may even be seen as a bad thing in some contexts (i.e. constantly working after 5PM to finish your work, implying you can't finish in time when you're really trying to show your work ethic or something like that). Work/life balance is important and every country has different standards.

From what I can tell, the Danes are quite strict in not wanting to spend too much of their life working, so don't be that person that brings work into every conversation. As a foreigner, you probably have much more interesting topics to talk about!

I've only head good things about Denmark from people who worked/moved there, so I hope you enjoy your time there!

I'm pretty sure crabs are only the final stage of evolution for water animals. Unless we go back into the water and live there, we'll end up free of scales.

No manager is willing to sign off on the risk of jail time for something like this.

They're probably a bunch of dumb teenagers trying to make a splash. Professionals would've sold the data without informing anyone.