Posts by The Mole

How the GNU C Compiler became the Clippy of cryptography

Optimizers optimize

"Meusel ran a constant-time implementation through GCC 15.2 (with -std=c++23 -O3"

The -O3 is telling the compiler to to optimization and then he is complaining about it doing optimizations?

Most of the suggested options are, well dumb, they are trying to trick the optimizer with a hope that it won't get more intelligent in a later release, if you don't want the optimizer to optimize than the best thing to do is explicitly tell it not to - looks like that functionality exists by declaring the function with __attribute__((optimize("O0")))

Linus Torvalds keeps his ‘fingers and toes’ rule by decreeing next Linux will be version 7.0

Re: Frostbite ?

There is a third choice which is mandate fixed width minor numbers (eg 2 digits) and include the trailing zeros. Then x.01 and x.10 are clearly different

Tories vow to boot under-16s off social media and ban phones in schools

Re: Smartphones should never have been allowed in the classroom to begin with

There is a deep flaw in your logic that a political party wouldn't announce a law to cover something that is already happening anyway. The best (and cheapest) policy to introduce is one that is already being done.

Headteachers have had the power to do this for a long time, and from the constant stream of news stories about it being done it seems like many (most?) already are in one form or other. I

n the schools that it isn't being done in, the question that has to be asked is why? Is the head teacher incompetent, lazy, have other more important priorities, or perhaps used their professional judgement that there are better ways to tackle the root of the issue, or that broad and simplistic rules often miss nuances?

GOV.UK to unleash AI chatbot on confused citizens

Doomed to failure

"it has since addressed these issues by adding filters and rules to prevent from it answering certain questions."

Well if blacklisting questions that it gets wrong is the approach it is taking then it is doomed to failure.

X sues to protect Twitter brand Musk has been trying to kill

Re: Trademarks

I'm pretty sure having an active website on the twitter domain name would be sufficient to count as usage given it means they and their customers are still using it.

Not registering your trademark makes it harder to prove knowledge by a person infringing it and harder to prove the domains the trademark covers. A social media startup 'randomly' calling themselves bluebird and trying to register the twitter trademark is going to have an extremely hard time disproving prior knowledge of X.

Microsoft quietly shuts down Windows shortcut flaw after years of espionage abuse

WT...

Why would an email filter let a lnk file through at all? I can't see a legitimate use of sending one (either send a url, send the file to be opened or give instructions on how to open the file).

If someone is going to open a lnk file received in an email then I very much doubt that they would go to the effort to view its properties to see what it opens anyway.

BOFH: Forward-facing AI brand experience meets forward-facing combustion risk management

Re: Be prepared!

Alongside their bomb shelter that was mandatory to be installed in new buildings for a while, plus the rather numerous army bases dug into the sides of mountains.

UK asks cyberspies to probe whether Chinese buses can be switched off remotely

Re: Remote access would be expected

I do clearly remember reading in Computer Weekly someone challenging it on the grounds its just a windows PC of course there is remote access.

Though to be fair I believe most people assumed bugs and updates were installed in the the normal way - via the floppy disk drive.

AWS outage exposes Achilles heel: central control plane

Re: The fragility of the system

A ruptured fuel line on a motorway will stop all cars on the motorway so the analogy seems accurate to me.

Of course it's only the road closing ruptured fuel line you hear about, not all the other ones that have no impact...

Is GitHub a social network that endangers children? Australia wants to know

Re: There's more than just GitHub

I agree, by that list of definitions they are clearly both caught up in the category of social media. Perhaps not what the legislators were intending but it appears to be what the enacted. Which makes sense given that subscribing to usenet or email groups were how a lot of online social interaction was done in the 90s.

Biden broadband benchmarks are BS, says Trump FCC

100% coverage

So all it needs is for someone to offer broadband to every house in the US and they get 100% coverage - let say at $10 billion dollars per house - price doesn't matter as long as the network is being deployed?

Wanted: IT manager for UK government agency – £60k

Re: Monkeys and Peanuts

Haven't you just advices people to become a doctor - which involves going to university doing a STEM course?

BOFH: The Boss meets the unbearable weight of innovation

Nice, though I was expecting the machine to start dispensing 'healthier' options which happens to be the PFYs favourite snack, and that the accuracy of the of the recognition would result it dispensing for anyone...

Microsoft tells abandoned Publisher fans to just use Word and hope for the best

Re: Just use Serif Publisher

That makes me feel old, think the last time I used Serif was approaching 25 years ago. Glad to see it is still going as it was great software then and I still regularly groan at the limitations of Powerpoint whenever I want to layout larger blocks of text in it.

Apple drags UK government to court over 'backdoor' order

Re: Put up or shut up

I thought the Axe was all the master key the fire departments needed to open doors (other firefighting equipment for tougher doors may also be available).

Hurrah! AI won't destroy developer or DBA jobs

Re: Yeah, 'AI' can't do engineering

This is a pretty good summary. The challenge however is what you describe is a senior engineer. The jobs that are currently delegated to juniors are often the ones that an AI will be able to manage (though just like a junior it will need guiding and prompting). This gives the challenge of who will actually hire juniors to give them the opportunity to become seniors?

DBA is a job that I can see declining rapidly. Much of what it seems they bring is the knowledge of the arcane configuration setting and rules of the database software and performance tuning methods. That type of knowledge is what AI is/will be good at as it is essentially following patterns and basic inference. For many other tasks other engineers will probably pick up the slack aided by the AI.

China's DeepSeek just emitted a free challenger to OpenAI's o1 – here's how to use it on your PC

Re: story - depends on where you are in the world

Agreed I'd agree with the answer 0, it has a ground floor, 2 basement levels and no stories.

,

Just when you thought terminal emulators couldn't get any better, Ghostty ships

When scanning through log files you don't need comprehension or retention. Frequently you can just look at the shape of the text and spot if it suddenly goes abnormal - eg pages of stack traces or error messages at the start of the line,

Other times it is the speed of the console rendering that actually slows down a noisy build tool, a console using less CPU and rendering more efficiently might actually make the build run faster.

SpaceX will try satellite deployment on next Starship test

Re: Important

You might want to brush up on your history - for instance the East India Company and their rule of India - https://en.wikipedia.org/wiki/Company_rule_in_India

UK watchdog launches inquiry into IBM's HashiCorp acquisition

Re: Error

My reading was that in August they told the parties they were planning to do a phase 1 enquiry, which then only actually started at the end of December.

Even Netflix struggles to identify and understand the cost of its AWS estate

Re: I would have imagined...

The costs at the edge are relatively constrained. They make deals with with all the major telcos to place Netflix boxes inside their networks which has the massive advantage to the telcos that their interconnects and core routes aren't being saturated with Netflix traffic.

Cruise robotaxis parked forever, as GM decides it can't compete and wants to cut costs

Re: Reality is at fault

Stone in fire gets hot it doesn't burn.

Drop hot stone in water, it sink and heats water.

Water get hot and cook food.

Now Online Safety Act is law, UK has 'priorities' – but still won't explain 'spy clause'

Re: But the most important thing ....

Typically the lawyers can interpret the law how they want. The action can be done. Then years later if you have deep pockets and will power it may reach the courts and be challenged.

Musk, America PAC sued for allegedly rigging $1M election prize

Re: Tricky

All of which require you to pay a stake to enter. A key question is whether signing the petition can be considered any form of payment and so any sort of contract was entered. At most the only remedy I can see is that the personal data has to be deleted to prevent future harm - but even then it was uncertainly covered in the terms of signing the petition.

That position you just applied for might be a 'ghost job' that'll never be filled

Re: USA

I would argue it may violate GDPR, a CV contains lots of personal information, some of it sensitive (various hint or explicit mention of religious, medical or other protected information).

Gathering data with inaccurate details of how it will be stored and processed (e.g. claiming you are processing it for a job advert that doesn't exist) would contravene it.

Not that I'd expect the ICO to do anything about it.

Ransomware forces hospital to turn away ambulances

Re: Reversionary Method of Operation?

A reversionary method is good, but pretty much by definition it will be less efficient and have much lower capacity and likely significantly more error prone. At best for a hospital that involves pen and paper, telephoning requests through spelling details out phonetically and radiographers having to physically sit at the xray machine terminal to review test results.. At worst it probably involves porters having to run round miles of hospital corridors delivering prescription requests, patient notes and other instructions, and some tests being impossible to perform/analyse the results of.

Turning away patients, particularly in the early stages is entirely rational and the only sensible thing to do

Fujitsu wins spot on £600M framework after vowing to sit out public sector

Re: Is fujutsu really the problem

No, a significant part of the problem was senior Fujitsu employees perverting the course of justice and down right lying in court, to parliament and to the Post Office. Claiming things like remote access wasn't possible (when it was) and that they weren't aware of defects (when they were regularly manually fixing data).

AI stole my job and my work, and the boss didn't know – or care

Re: "Stored in a retrieval system"

In the UK at least that isn't legally correct. There are also database rights. Despite just being 'facts' it was upheld the collation and reporting of the days football results do have some legal copyright protection - another newspaper couldn't just copy and reprint them on the same/next day.

Junior techie had leverage, but didn’t appreciate the gravity of the situation

Agree that the wrong person was suspended. Purely from a manual handling/H&S perspective that surely should have been a two person job.

Bad eIDAS: Europe ready to intercept, spy on your encrypted HTTPS connections

Not just limited to the EU

Government agencies have a history of skirting round the rules of not spying on their own population by asking a friendly foreign agency to do it for them. I'm certain that if this came to pass the NSA/CIA would have a fast track route to getting these certificates, whilst China would quickly compromise all these government run CAs.

The browsers on the other hand I'm sure will strictly follow the rules and not ban the CAs, they will just provide straight forward integrations to third party open source databases which may cause the CA to be banned completely independently of the browser manufacturer.

X looks back at year of so-called 'engineering excellence' under Musk

Re: Going the way of Dodo bird

Think I might have to Ask Jeeves about this

City council Oracle megaproject got a code red – and they went live anyway

Re: A drop in the ocean

Without the ERP system it seems like they have no way to even know if the books are balanced let along work towards balancing them. Its not the only factor but is no doubt a big contributory factor and example of how the council was running everything. As they have said on other stories it isn't the whole but it is the part of the story the technical audience of El Reg are most interested in.

How to spot OpenAI's crawler bot and stop it slurping sites for training data

Re: The risk with Robots.txt

Fundamentally it shouldn't matter if you tell all and sundry that directory Y exists. If you want to protect it you need to have appropriate security to protect it, just hoping nobody guesses / finds out the directory name isn't security.

Now you do need to ensure that merely knowing the directory name doesn't give information away (CompanyXTakeoverBid would be a bad name) but a directory name like secure doesn't tell people much.

Quirky QWERTY killed a password in Paris

Re: On Screen Keyboard

On windows I don't believe this, but in the days of DOS it does sound much more realistic. They didn't want the keys to display whilst the user was typing so avoided the standard APIs and so used a low level API which returns the key codes. (That era would also explain why someone though a hard coded password was a good idea).

Now, either this was a dos program running in windows, or the part about remoting in was complete embelishment.

Fresh GDPR ruling says even 'minor anxiety' could mean payouts for EU folks

So they don't want to set a minimum level of seriousness before a claim is made as that may fluctuate by judge.

However the amount of compensation you may get is completely up to and may fluctuate by judge.

The only winners are going to be lawyers (but that's generally a given)

Microsoft to move some Teams features to more costly 'Premium' edition

Re: "will reveal the actual price only once the tool becomes generally available"

Its sensible practice. Now they've pre-announced the price they can see how bad the outcry is before deciding whether to stick with it or pick another value - whilst avoiding headlines about u-turns and the like.

University students recruit AI to write essays for them. Now what?

Re: Critical thinking

Why so negative about language evolving? You say that Monetize is lazy, I'd argue its much more efficient (and according to here https://www.etymonline.com/word/monetize#:~:text=monetize%20(v.),%2B%20%2Dize. the word has been around since 1856).

Longer more complex sentences are harder for the brain to process, hence why the English language has such a large corpus of words. Normally their are also additional connotations laid onto the word which may not be reflected in its basic definition. E.g. listicle isn't just an article being a list, it implies it is probably a list of something trivial, full of adverts and likely just read for pleasure or amusement, rather than for more academic purposes.

North Korea using freelance techies to fund missiles and nukes

I'm not sure what the point of them avoiding or firms insisting on video calls actually is? All they need to do is fake a Korean/appropriate Asian identity and fake the id documents to match, then just do the interview. Or alternatively as they said just get a go between to do the initial interviews/id checks and then do the work.

More effective is surely to trace the money. Presumably these people are being paid in currency into a bank account (if it is crypto then there's your first problem). Surely checks must be in place to make sure the account name matches the freelancers name. Banks are much better placed to verify id documents and make sure fake accounts aren't being created. Of course it still doesn't help again mules but finding, paying and trusting them surely reduces the effectiveness.

Royal Mail customer data leak shutters online Click and Drop

Re: "The root cause is now under investigation."

Not wanting to defend the Royal Mail but what you have forgotten is that total volumes of mail has dropped significantly (https://www.statista.com/statistics/1006816/royal-mail-volume-of-parcels-and-letters-delivered-uk/).

The universal service obligation means many of RM's costs are fixed - the time to deliver 100 letters to a street or 200 letters to a street is pretty much identical so the cost would be fixed but the revenue half. Cost increases are an attempt to keep sufficient revenues coming in, not making excess profit.

Its a deadly spiral though, The fewer letters posted the more it costs per item, which in turn means fewer letters get posted. Not helped by competitors not having a universal service obligation so can cherry pick just the profitable areas without the loss making ones.

AI recruitment software is 'automated pseudoscience', Cambridge study finds

Re: Dear Personnel Department

The odds are that picking x applications at random (that meet basic criteria) and just employ them may not have any statistical difference to doing an interview process (AI aided or not).

Re: Human-like AI

The biggest problem is that you only get feedback for the candidates that you do select. Most candidates being interviewed will be at least 'ok' were you to employ them. You might think a recruitment process is good (and train your AI on that data) because all the people you recruit are good. In reality it may be that all the candidates you rejected would actually have been excellent but you will never know that.

Scanning phones to detect child abuse evidence is harmful, 'magical' thinking

Re: Sponsorship...

Low to zero. He's not exactly been favourable to them in the past, and his research focus over the years make it clear about his views: https://www.cl.cam.ac.uk/~rja14/

Besides Google, Facebook and their ilk probably wouldn't be that bothered by doing mandatory client side scanning as that gives them the slippery slope to include additional data into targeted advertising

Hi, I'll be your ransomware negotiator today – but don't tell the crooks that

Re: That $2000 job

My guess is somebody asking for a quote.

If assume it's only an hour's work, or perhaps even no fee to confirm if there is a free encryptor to decrypt the files.

That emoji may not mean what you think it means

Re: Too bloody many

Not really, in the Roman arena it meant agreement/acceptance of the gladiator holding the sword over someone's neck to kill him. Except (apparently) sometimes the gladiator asked the opposite question of should he be spared and then thumbs up meant agreement to him being spared.

IETF publishes HTTP/3 RFC to take the web from TCP to UDP

Re: QUIC can do what TCP cant

Not quite. The issue that QUIC tries to resolve is where client A and server B both support feature X of TCP, however because box x in the middle does some 'manipulations' they can't actually use it due to the box in the middle breaking the situation, even though the negotiation to activate the feature succeeded.

See comment above. UDP doesn't do head of line dropping, it does packet dropping. The protocol designer on top of UDP is free to implement their own flow control and retry mechanisms just as TCP does over IP.

The benefit is sometimes head of line blocking is what you want, other times skipping lost packets is what you want, QUIC can allow both modes of operation by the client unlike TCP which mandates the behaviour whether you like it or not.

But the implementation of TCP acknowledgement is implemented as a single stream with head of line blocking. One lost packet effectively pauses everything until the retransmission happens. (Well ok its a bit more complicated than that but the simplification is close enough to reality).

QUIC builds acknowledgement on top of UDP (in the same way TCP builds it on top of ip). This means it has greater flexibility to evolve more complex acknowledgement protocols - such as allowing traffic for other substreams to continue and only holding up the subs-stream with the lost packet, or deciding its a real time video stream and its better just to continue and let the error handling in the video decoder handle some missing data.

The designers of QUIC basically had 3 choices:

1. Build it on top of TCP just like HTTP and HTTP2. This meant all the problems and limitations of TCP, especially related to flow control.

2. Create a new protocol on top of IP alongside TCP/IP and UDP/IP (QIC/IP), Architecturally this would have been the cleanest approach, but would require all networking equipment and stacks to be updated to support it, we have seen how that has worked for IPv6

3. Layer it on top of UDP so that it can be used on the existing internet infrastructure, but create a new connection orientated protocol - QIC/UDP/IP

Option 3 was definitely the wisest decision, but it does cause confusion as people assume that means it 'is' UDP with its limitations, rather than the reality of its building something new on top of UDP for convenience.

Internet backbone provider Lumen quits Russia

Missile vs hot air

Which raises an interesting question.

Are hot air balloons hot enough for a heat seeking missile to get a lock?

Google blocks FOSS Android tool – for asking for donations

Re: App Store Pricing

Historically Apple phones have been premium purchases and brought as a fashion icon rather than purely on technical merits. People choose android are more likely to be price sensitive and either

a) don't have enough money to spend on an iPhone or apps, or

b) are more careful with their money so don't waste it on apps

Of course some apps are good value, and some android users will part with cash, but demographically iphone users are likely to spend more due to it being bigger spenders who buy into the platform.

Japan's Supreme Court rules cryptojacking scripts are not malware

Re: Theft of electricity?

The difference is that with phone tappers there was physical electricity flowing from A to B. There was a positive charge they could charge you for so to speak.

In this case there is no direct flow of current. It may induce extra electricity to be used by your device, a tiny amount of packets may flow up the phone line (or fibre optic cable) but that's immaterial. You're into the realms of saying that if someone triggers your PIR security light then they owe you for the electricity.

Ultimately if you go to a website you run the risk of them having an animated gif, large jpeg, autoplaying video, ad tracking or other javascript code. Trying to distinguish legally from a poorly written site using excess CPU cycles, through ads and tracking scripts to other more dubious operations would be near impossible and ripe for political abuse