Posts by Francis Irving

Devs to Anthropic, OpenAI, Cursor, and friends: Make security and privacy the default

Re: It's been a problem for years

That and, e.g., security vulnerabilities that numerous projects are having to patch. The models really are capable - the problem is that isn't controlled.

Re: It's been a problem for years

Oh no, it's far worse than that.

The Hugging Face attack show lots of basic engineering failures at OpenAI (e.g. leaving models to run a long time with no monitoring).

Worse than that though, they let instances of the in-training model, being tested in different tests, communicate for weeks with each other. In that period they got reward for this, so were being trained to deceive humans, cheat at their tests, and so fundamentally not do as instructed.

The problem is far worse than it needed to be, but the model companies are in a race that humanity is struggling to break out of.

Hmm, and the hacks that the models did when being tested by AISI last week, they're marketing for the British Government?

At some point, it's important to accept that these models are highly capable, and their creators are not capable of controlling them. And as a profession, we need to stop their development now.

Mythos discovers 'Squidbleed,' a memory leak that's gone undetected since Clinton era

Re: More marketing

Not the first month it is used on a codebase - e.g. see numbers in this post by Firefox developers https://blog.mozilla.org/en/privacy-security/ai-security-zero-day-vulnerabilities/

Drones intone 'you must stay home,' eliciting moans from those in the zone: Flying gizmos corral Brits amid coronavirus lockdown

Alas, obeying the letter of the law won't guarantee we do just the right amount to get R < 1.

Britain's courts lurch towards Skype and conference calls for trials as COVID-19 distancing kicks in

Re: Improved access to justice

I'd expect younger lawyers would be more likely to be able to organise getting the kind of equipment YouTube stars always chat about having?

Curious how useful video is without eye contact, harder to interpret body language without a lot of practice. I guess we'll have the practice! But wonder if just audio - and indeed document sharing - would be fine or even better for cases in reality?

Re: https://jitsi.org/

It works for me on Firefox 74 on Ubuntu.

What browser are you using?

Brave accuses Google of trampling Europe's GDPR with stealthy netizen-stalking adverts

Re: "a two thousand character string"

Google could stop tracking individuals and still make lots of money. They used to do so - early AdSense didn't track you. The New York Times does so, making as much money with non tracking adverts in Europe after GDPR as it used to make with tracking ones.

There is a strange myth that this tracking is necessary for an advertising funded internet. It wasn't and isn't. Plus, as you say, might be nice if more people paid for things too!

US websites block netizens in Europe: Why are they ghosting EU? It's not you, it's GDPR

Re: Am I mistaken?

Also, they often are still holding data about EU citizens, so blocking them off from new traffic doesn't help at all - in fact it is worse, as they might not be offering info on how to make GDPR requests, or how data is processed about them.

Re: Overreach

Nonsense - you can ship your data abroad under GDPR still for whatever you like to be done with it. You just have to give informed consent to do so, with a really clear UX. That's fair and reasonable.

Also going back to the original comment in this thread - no it isn't over reach. Every other industry that exports things to Europe is regulated. Think, for example, about food safety regulation or car safety regulation.

This is absolutely standard stuff in every industry. It's only new for the internet because it is a new industry.

Basically, a bunch of whiners who don't understand that global capitalism only functions because of regulations. Like they just don't know that there are regulations that make the products they use every day actually any good.

Windows 10 will now automatically download and install on PCs

Re: They own you.

Yeah, but the fundamental difference is you can shift to a competitor (e.g. Mint), and all your software (even proprietary like Skype, Dropbox, Spotify...) will carry on working.

Microsoft in 2016: Is there any point asking SatNad what's coming?

Re: Screw Em

As an aside - if you install Chrome on Linux, then Netflix works fine on that.

Hillary Clinton says for crypto 'maybe the back door is the wrong door'

Jury-based encryption

This is a good suggestion from Clinton, because there *are* other solutions than "encrypt all the stuff so no matter what circumstance it can never ever be looked at" or "give 10,000 spooks access to everything everyone does and says".

This essay by Vinay Gupta explains the context, and gives examples such as a jury-based system where data could be decrypted but only if a genuine random jury approves.

http://vinay.howtolivewiki.com/blog/other/taking-a-crack-at-a-practical-system-introducing-the-escrownym-3004

There is a *long* way to go here both technically and philosophically, and a project to do so makes total sense.

Researcher claims Facebook tried to gag him over critical flaw

Re: why the hell not

Right - the further flaws he found were all significant. Off the top of my head:

* AWS keys which work outside the network IP addresses (any such you need should be short lived and built with 2FA)

* AWS keys found in history of a bucket

* AWS keys with excessive access

* Developers not using secure passwords

Esp. the AWS stuff is really important, there are so many ways to mess up security with AWS operational process. They should be nailing that stuff really thoroughly for a site like Instagram. Amazon does not make it easy.

Just because these are internal security holes doesn't mean they're not valuable. If I had been Facebook's CSO I would have paid him for finding those holes, and changed policy and process to fix them.

People will find access to systems, you have to make it as hard as possible to do anything useful with that access.

Whoever hacked Uber's driver database wasn't our CTO, says rival Lyft

Re: I'd say it's a pretty tenuous link

In particular, he'd want to understand how Uber had made that mistake, to be sure Lyft had processes in place to make sure they didn't.

e.g. I'd immediately write a regular expression to check my own github repositories in those circumstances.

Drill, baby, drill: HIDDEN glaciers ON MARS hold 150bn cubic metres of precious frozen WATER

Re: triple point...

I think the first stage of terraforming is to melt the carbon dioxide dry ice cap, to both increase pressure and warming, then allowing liquid water.

Gov.UK inhaled G-Cloud, spat out framework – ex-lead claims

GCLoud's UX has got better

To be fair, the user experience of the old GCloud software, from a suppliers point of view, was pretty shonky. New stuff is a lot easier to use. Those 14 developers haven't been for nothing!

The article is right that the frameworks are still problematic - better packaging up of projects for outsourcing, and nurturing ecosystem of good suppliers are where attention's needed (body shopping useful for some projects, but will only go so far)

If you're reading and think buying IT is easy, go join GDS and help them :) It's our job as an industry to improve things, not just whine.

UK.gov SLASHES ICT frameworks by more than HALF

Current system isn't great

Such cynicism!

I wouldn't mind if the current system was great, but it's not.

It takes up lots of our time (SME), and it isn't great at finding customers - have to do out of band networking to do that.

Europe may ask Herr Google: Would you, er, snap off your search engine? Pretty please

It's the search verticals like hotels, cinema

I agree with the EU that Google prioritize their own results above others.

e.g. Search for a movie https://encrypted.google.com/search?hl=en&q=interstellar#hl=en&q=interstellar+movie and there is a special Google service only box to find the film times - with a text entry field for city! Nobody else can get a text entry field on Google.com for their service.

Hotels https://encrypted.google.com/search?hl=en&q=interstellar#hl=en&q=hotels+in+new+york

See the special "Hotels in New York on Google", unlike anything any competitor can add to the page.

Mapping https://encrypted.google.com/search?hl=en&q=interstellar#hl=en&q=map+of+canada&spell=1

You get a freaking great graphical map of Canada filling most of the page linking to Google Maps. No competing product until way way below the fold.

This annoys me as a user - Google's services are often better now, but they're not always under all circumstances. They should have a marketplace for these special user interface popups, not just put their own in.

Whether they should be broken up is a more complex question. I'd say they should voluntarily break themselves up, as otherwise they'll get lazy over time, and somebody will beat them.

Pitchforks at dawn! UK gov's Verify ID service fail to verify ID

Re: Knowledge-based ID verification

Not really, as Verify has other identity providers too.

Personally, I'm going to use the Post Office option if I possibly can.

Two websites you should show your boss if you want to be paid in Bitcoin

Re: Sign me up!!

Think of it as a *protocol* (like SMTP but for money) rather than a currency, and you'll get further in understanding the impacts.

Also, BitCoin is but one Cryptocurrency. Whatever happens to it is irrelevant - the question is, what use will cryptocurrencies have in general?

Never mind bungled Universal Credit rollout, Maude wants UK to be 'most digital' gov by 2015

Beautifully cynical

Rightly so, meanwhile check out things like the Ministry of Justice's github account: https://github.com/ministryofjustice

There are lots of people at GDS trying to make Government IT better and more open, with some unheralded successes - please help them do it!

Bitcoin mining rig firm claims $3m revenue in just FOUR DAYS

Re: Huh?

Briefly, the "mining" is cryptographically provable work done, which is used to "sign" the network's view of who owns which coins. It's quite a subtle concept, and *genuinely new*. It takes time to understand.

Nothing you try and reason about the BitCoin algorithm will be correct without fully understanding how it works. It is a totally new category of substance, unlike anything else.

It can also be extended and used in other unusual ways, not just a currency. See this talk at a BitCoin London conference to get a feel for that. http://t.co/13FBILgAEv

In my view, if you're in IT or finance and you don't understand the BitCoin algorithm, the world will rapidly become a deeeply mysterious place to you over the next 20 years.

Silicon Valley 'no-hire pact' lawsuit gets class action status for tech workers

Re: Quite satisfied

It's not just about wages - it's also about lost opportunities to do something better or at least different at another company.

In defence of defenestration: Microsoft MUST hurl Gates from the Windows

Re: Always a PC

Sure, but corporate lifetime is less than 20 years these days, and all the new corporates are likely to be using Open Office w/ DropBox or Google Docs...

Dominant web ad giant (Google) possibly 'weeks' away from Euro slapdown

It's the user interfaces embedded in search results that are unfair

It's not the search results that I think are anti-competitive, it's the special user interfaces that lots of search terms give.

e.g. A stock ticker like "TSLA" half the page is filled with basically a Google Finance search result. However, it isn't a normal search result, it gets to have special formatting, a graph, and some buttons. Nobody else's service can do that!

Same with "fly to New York". Sure at the top you get some adverts marked as such, fair enough. Then the next hit is a special table callout box with a nice icon, completely different to a search result, more prominent and usable. No competitor can do that.

I wish they'd auction these GUI add-ons as well, so anyone could get in on the game. At least DuckDuckGo lets you write your own and send them a pull request.

Swartz suicide won't change computer crime policy, says prosecutor

Re: 4 Simple Points.

1) One who believes that academic articles funded by the taxpayer, and that are in the public domain, are most effectively used by society as a whole if they are freely available.

2) Yes it is - he had to plead guilty without trial to the charges to get that much reduced sentence. As far as we can tell, he both wasn't guilty (see 3 below), nor thought he was guilty. You also have to account for the cost of US federal court cases - unlike in the UK, the loser doesn't have to pay costs, and they cost millions.

3) It's not clear he committed any crime at all - see this account by an expert witness for the trial: http://unhandled.com/2013/01/12/the-truth-about-aaron-swartzs-crime/

4) How do you know what intervention they took, or what worked or didn't? Depression is a disease, and by no means a simple one for those suffering or their friends/family. We don't know exactly why Aaron died, however it seems likely to be a combination of clinical depression, along with the circumstances of his prosecution.

Greenplum opens up Big Data control freak: Chorus for all of us

Greengages are pretty good green plums, and fairly common!

Tesla drops veil on top secret solar Superchargers

Re: Just not suitable for longer distances

As many as electric cars would get sold if the dealer told you "you have to go to a special station to refuel when you're commuting, it doesn't just refuel at home at night" :)

Pinterest valued at $1.5 BILLION, bags $100m in funding

Re: But what's it for?

I use it to for interior design. I pin photos of a room, and products I'm thinking of buying to put in it, e.g. new curtains, paint colours etc. Others do the same thing for clothes. Basically it is a visual delicious, so just as useful as a bookmarking site, but more fun/comprehensible to non-geeks.

It is based on a popular US hobby called pinboarding. It is very popular, 80% of US users of pinterest are women.

As for commercials... They get lots of intent driven sales click throughs. http://www.shopify.com/blog/6058268-how-pinterest-drives-ecommerce-sales

The obvious business model is the same as Google's. Steal other people's content, let users organise it for you for free, then charge other people to get the resultant clicks.

Given all of the above, it seems a reasonable valuation.

Sky News admits two counts of computer hacking

Because for years they've lost traffic and revenue through not having juicy stories, by not breaking the law? Goodies always get pissed off when others cheat without punishment, so naturally gloat when a naughty kid gets found out.

Ubuntu hammers out Metal-as-a-Service tool for microservers

PushF12 - not at all!

There's a difference in performance in various ways between a virtualised EC2 image, and using an API to get the actual metal of a whole machine. Yeah, so I think this MaaS is a serviced, colocated server - with a crucial difference, you can access it using EC2-compatible APIs.

Sometimes you have to make up a new term for something that is genuinely new. Or can you point me to other places that offer the ability to get an entire machine (no virtualisation layer) using drop in compatible EC2-like APIs? And if so, what name do they use for that service?

BoJo backpedals on Twitter hijack in mayoral glory bid

The key thing here is the followers.

You can reasonably assume that the intent of people who followed @MayorOfLondon was to follow the Mayor of London. To then let the incumbent mayor be able to use the same people for marketing during the election is clearly unfair to other candidates.

It's quarter of a million people, so not insignificant in voting terms.

Skype brings per-minute Wi-Fi to iPad and iPhone

Foreign airports

I came across this (on a Macbook) by accident at Boston airport. Skype just popped up saying "you can pay for Internet access at this rate, click here".

I didn't have a mobile phone or 3G dongle that would charge at all reasonable rates in the US. And there was no free Wifi. All told, it was very convenient (no extra signup) and pretty good value considering.

Completely useless at home in the UK when I have a phone with data plan and tethering, of course.

Alpha.gov.uk – it's nearly a beta

Concept rather than a technical review

(Disclaimer: I run ScraperWiki, which Alpha.gov used for some of this project)

@The Wegie They've deliberately not made the prototype accessible, see Alpha.gov's blog post about that here. http://blog.alpha.gov.uk/blog/accessibility

@CD001, agreed the front page is deliberately flashy with its Olympics photo. But as soon as you dig into particular apps you're supposed to find exactly what you want - completely lack of flashiness, just the stuff that you need.

@Lamont Cranston, yep they haven't migrated all the content yet. It's a prototype. Makes it harder to tell just how good it would be in the end though.

@Bram, wouldn't it! There are lots of machinations going on inside the civil service. See last couple of pages of Simon Dickson's blog with directgov tag for a feel: http://puffbox.com/tag/directgov/

Testing and staff costs of just Direct.gov are 25 million a year http://www.guardian.co.uk/news/datablog/2010/jul/05/government-websites-costs

They've spent 1% of that on prototyping a radically redone user interface, with better citizen engagement, and cost savings.

Liverpudlians headbutt Cameron's 'big society'

Some details

A month or two ago I did an FOI request for the background to the original Liverpool Big Society Vanguard announcement. You can see some of the emails behind its original setup here:

http://www.whatdotheyknow.com/request/liverpool_big_society_vanguard#incoming-136595

Microsoft holds Androids hostage in open source wars

WebKit wasn't Apple's originally

@ThomH said "See WebKit, which is there's originally"

Not quite. WebKit was originally made by the KDE people - it's a fork of KHTML.

Yes, Apple gave it the name WebKit, have done lots of great work on it, and made first commercial use of it. But it was already an incredibly good, well written, debugged for the real world, HTML engine before Apple got to it.

http://en.wikipedia.org/wiki/WebKit#Origins

I don't think the KDE people get enough credit for this. Their web browser is on every fashionable mobile phone. Everyone thought I was quirky when I used Konqueror back in 2001...

Ubuntu 10.10: date with destiny missed

Hardware support

Bizarre criticism about partitions, when there is a much larger criticism lurking. That is, lack of certified hardware support.

I still can't buy a decent laptop from anyone, that is guaranteed to be supported (in full, including suspend/hibernate) for current and all future versions of Ubuntu.

Yes, Dell sometimes offer one for a few weeks, and apparently lots of others sort of work. But sort of is not good enough. There are also expensive specialists, which sell a limited range of laptops.

If only Ubuntu would do a paid service where I can subscribe to have them actually support a particular laptop (like Transgaming, where you can vote and they support a particular game)...

Mozilla 'cloud' code editor breaks with Lando Calrissian

Code wikis

There are lots of reasons you might need to edit code in the browser. Tweaking HTML or Javascript in a CMS is an obvious one. Making an interface for making Firefox addons is another.

Then there's more exotic code wikis, such as ScraperWiki for collaboratively developing and maintaining screen scrapers http://scraperwiki.com/ (that uses CodeMirror though)

Thomas and Maude stage open info Commons love-in

There's been more than one vote on ID cards

@dogged because there's been more than one vote in Parliament on ID cards. "Very strongly" is the most extreme TheyWorkForYou puts - actually he turned out on every vote on introducing ID cards, and voted in favour every time. Details from Public Whip here:

http://www.publicwhip.org.uk/mp.php?mpid=40646&dmp=1051

Gov ICT contracts to go online in July

Not available via FOI

@Mickey Porkpies - contracts generally aren't released under FOI, due to "commercial confidentiality". I'm guessing the coalition will later make a law change to reduce the power of that excuse...

Adobe gives up on the iPhone

Apple don't let you have a reliable business

This has really put me off wanting to develop for the iPhone.

Mainly because of the insecurity. I could spend lots of money developing an application, and then Apple suddenly whimsically decide that the technology I chose to develop it isn't allowed.

This isn't just theoretical - business apps like SugarCRM don't know what is going on, see earlier reg article http://www.theregister.co.uk/2010/04/13/sugarcrm_ipad_html5/

If Apple wanted to stop apps that had bad user interfaces, or were slow, or were memory hogs, or didn't cooperatively mulitask, or that drained batteries, that would make sense.

But they haven't.

They've stopped code converters, even ones that go via C and call all the right APIs properly. Which means it must be a business decision, rather than one about usability.

Government wastes millions on redundant cycle route planner

Worth helping CycleStreets

@lead352 "the route it just suggested to get from North to Central London was frankly bizarre"

Please do let CycleStreets people know about routes that are bizarre - and/or help fix the underlying data.

The main advantage of CycleStreets is that it is a community project. The data (stored in OpenStreetMap) is open, so we can all collaborate to make it generate good cycle routes for everyone. Not going to happen with TransportDirect, where you have no influence over the output.

Oops: Chief Climategate investigator failed to declare eco directorship

It's about risk, not certainty

@Ministry of Truth "To assume that any existing model covers all the bases is foolish." - Climate scientists have never claimed that. Their papers, and the summary reports from the IPCC, are full of risk analyses, of probabilities, of self-criticism.

The Climate Science is and always has been our current best knowledge. Yes, we should try and improve that knowledge. Yes, that means funding more science, doing more checking. It means paying for more temperature stations (see recent article in the Economist about lack of funding for that).

But meanwhile, we have to decide what to do next given what we know so far. We can decide to geoengineer the climate by digging up fossil fuels and burning them. Or we can decide to become more efficient and to use nuclear power, to use various sorts of solar power and wind power.

The current best peer-reviewed evidence we have, and economic analyses associated with it, show that the latter is the wise course in terms of sustaining our civilisation.

You will never have certainty about predicting the future. But it doesn't matter, you still have to choose an action.

Google redirects China to uncensored Hong Kong servers

Did they steal source code?

Scroll down to "The Truth About The Google Affair" on this page, to read an account translated from a Chinese blog of what happened to Chinese Google engineers when the hack attempt story first came out. There are also accusations of code theft by Communist party agents.

http://www.zonaeuropa.com/201001b.brief.htm

I've no idea whether the blog post is true - there's a battle going on here, so it is hard to tell. But what it does reveal is that Google might have sound, unspoken business motives for leaving China. If their network was compromised, and their source code stolen, it could damage their global operations.

Tories swallow Web 2.0, spit out £1m crowdsource prize

Missing the point (I hope!)

I hope that the Tories here want innovative solutions. We're not just talking another forum or petition site, that would be pointless. The best way I can explain is by analogy.

Looking at the poor programming Q&A sites a year ago, would you have expected StackOverflow to appear from nowhere and trounce them all, with better questions, better answers, easier to use and search? It doesn't do anything specifically new, but it gets the reward mechanism right with points and badges. It uses a nice mixture of voting and quality improving editing.

In the policy arena there'll be similar surprising improvements. Maybe it'll give you a simple basic questionnaire, before you can edit the policy on any subject. Perhaps its voting will use YouGov like demographic weighting. Who knows, but there's sure lots of things to try that are betting than just shoving a bill on a wiki, or making another petition site.

Stallman: open-source .NET 'danger' for Debian

Blackmail and patent pools

Why is Stallman letting the open source community be blackmailed by Microsoft - shouldn't an open source patent pool be defending us against this kind of threat by now?

Meanwhile, everyone continues to migrate to proprietary applications on the web (how many hackers do you know who would never use closed-source Outlook, but love closed-source GMail?), and basic features like suspend/resume continue not to be certified for Linux on common laptops (the Unix geeks I know seem to be slowly but surely fleeing to OSX).

I guess on the plus side the claim is that Google Wave is going to be open source, and perhaps we can all use open source Android on our laptops soon.

Google eyeballs planted on 92% of top websites

Open source Google analytics

If you're a privacy freak website owner, then take a look at open source http://piwik.org/ to use instead of Google Analytics - surprisingly good. Unlike other open source web stats tools, it uses a javascript webbug like Google Analytics.

Stallman warns open-sourcers on Javascript-browser trap

Easy to dismiss, hard to consider carefully

The main thing Stallman is wrong about is caring about the distinction between server side and client side web application code. If either side isn't open source, the application you are using isn't open source.

That's fine if you don't mind. But there are quite a few people who wouldn't dream of using a closed source, fully local email client, but happily use the utterly proprietary GMail.

I don't think open source is a panacea, or that all software should be open. But I think we should be aware that we are walking back into an entirely closed source world, via web applications, and do it consciously if that is what we want.

Meanwhile, of far more importance is that the service gives you full access to and control of your data. There are some attempts to promote that, or broader concepts. e.g. See the Open Service Definition.

http://opendefinition.org/ossd

Environmentalists greenmail Google, Dell

Yeah, bunch of hippies

If you're worried about Climate Change, but don't want to join Greenpeace, help build up the new Serious Change http://seriouschange.org.uk/ instead.