Posts by Richard 12

Microsoft closes the book on Publisher and unplugs Project Online

It was perfect for small amateurs

There's millions of small organisations who use it to produce their weekly or monthly newsletters.

They never send anything to a print shop, they just opened their standard template, added the text and photos, and printed fifty, maybe a hundred copies on their secondhand laser printer - some even using "mail merge" to customise them for their members.

Because it was simple to use, the church warden could do it once a week.

Because kids had it available via school volume licences, they did the class newsletter.

Yes, professional print shops hate it - but they see less than 0.1% of the print runs.

The more important question is:

What's the replacement?

Microsoft say to use Word - which is utterly insane for everyone.

ASCII smuggling isn't just an AI security risk

Where's the news?

This has been standard spam practice for over a decade, possibly two decades.

The presence of any non-printing Unicode used to significantly raise the spam score. Heck, non-printing codepoints within a word used to raise the score to infinity and either bounce or immediately erase it.

JavaScript installer pnpm recast in Rust because ECMAScript can't keep up

Shock result!

Native code faster and less memory intenstive than JIT or interpreted code!

Having a local cache reduces downloads!

Frankly, I'm more surprised at how long it took before anyone in the Node.js community decided to optimise the thing they use hundreds of a times a day, every day.

Google engineer unplugged every fiber they could see and – surprise! – took down a chunk of the G-Cloud

Re: The way they've written this is so Doublespeak

Um actually, the drop rate is the one most places normally measure.

Describing it as the percentage "successfully delivered" would be misleading, because you don't know if the receiver actually accepted and processed the packet.

Re: WTF?

It means the fall guy in the datacentre didn't answer the phone, and it took the security guard too long to go yell at them.

Most likely the real cause is lone working. Had there been two technicians they might have noticed the mistake or taken the phone call before everything got unplugged.

CERN moves thousands of accelerator control computers to Debian

It's custom hardware

These aren't off-the-shelf desktops, laptops, blade servers or supercomputers.

They're custom hardware controlling all the parts of a one-off machine.

Three years is utterly useless, it'd be out of support before the first units even deployed. The forced upgrade might immediately obsolete half the kit - same problem that Red Hat created.

Yocto LTS is currently four years, so also nowhere near long enough.

For this kind of thing, a ten year supply and support is the absolute minimum, CERN want 15 to give them time at the other end. A decade from now they need to be able to swap something out and have the replacement still work exactly the same.

Spurs boots VMware, cites 85% licensing saving

Re: 840+ under seat access points

It's less than 20W max. total dissipation, probably under half that.

They're also not aimed at your bum, because people are mostly water and there isn't anyone in the sky. They're aimed at where the phones are.

Windows 11 update sends some desktops into an unwanted goth phase

Re: Again?

"A limited number"

Meaning fewer than around 1-1.4 billion, give or take.

Microsoft devs rejoice: Union types coming to C# in November

Why wouldn't you use an exception for failure, as the C# gods intended?

This C# 'union' is what C++ calls Variant

It's not a union in the C/C++ sense, because it knows the current type of object in the box. I guess they called it "union" to avoid a name collision with the "var" keyword.

Success-or-error-object is usually done via exceptions, and having to recompile to add new types to the box makes it a lot more cumbersome than the widely used interface "IObject" base class technique.

I guess this is actually intended for functions like deserializing that could return a specific two to three types. Eg a function that returns one of two IObject derived classes, or perhaps a single object vs container of objects where the single object case is common enough for IEnumerable overhead to matter.

So yeah, rather specific edge cases.

Microsoft update disarms Outlook and Teams on Arm PCs

Yay, Fake Electron!

At least, that's what Teams and (New) Outlook have in common - the MS fork of Electron.

I wonder if Discord or Edge works.

Nvidia is building an IP licensing empire on the back of NVLink

Re: Nvidia is selling everything they can make

On top of that, they know the bottom is going to fall out of the market pretty soon. No doubt they'll still be due their quarterly IP licence fees for a good while, even if nobody is selling any kit at all.

The balkanization of virtualization will de-throne VMware, which doesn't mind a bit

Re: When you lose the bottom end, you lose the top end eventually

Indeed. VMware is a dead product line walking.

It will receive no investment whatsoever, merely the absolute bare minimum of maintenance as Broadcom sweat the remaining customers, cranking up the fees for the remainder as the others leave.

Support will effectively have ended within three to five years when all the VMware staff have left along with their institutional knowledge. A couple of years later they'll take it out behind the woodshed.

It's a very old playbook, and one Broadcom know well.

Any customers who aren't already planning to leave are remiss in their duties. They won't go immediately, but nobody even vaguely sane sticks around for the second set of usurious price increases.

Energy biz SSE smacked around in court by a guy and AI

They're still harassing him

Which means it's now explicitly harrassment, and possibly also contempt as the court explicitly ordered them to pay up and leave him alone.

Check your household contents insurance, it often covers this kind of legal advice - especially as it's now a slam-dunk case.

Turns out Brits would quite like their private messages to stay private

Re: Dissonance??

The first rule of cryptography is to get an expert to do it.

I know a fair amount, but am definitely not an expert. So I use libraries and tools that are made by experts, and package them up. Which means trusting the groups that made said libraries and tools.

The average Clapham Omnibus traveller knows less about this than me, so they need prepackaged libraries and tools.

Which means trusting some group to have chosen libraries and tools, and to have packaged them well.

So yes, the vast majority of the public have to trust Apple, or Google, or Signal etc. Which means everyone has to, because otherwise nobody can talk to the knowledgeable or the experts.

Green Party wants to slam the brakes on UK datacenter construction until water and energy use are sorted

Re: Disingenuous

Construction is short-term. Once it's built, that's it. The builders move on somewhere else.

Running and maintenance is roughly 5-10 FTE jobs at most.

A single Tesco Express creates more jobs than a datacentre complex, and also serves the local community.

Cybercrooks jet off with Manchester Airports Group customer data

I've seen a few places where they disconnected me after a few minutes, presumably for not confirming the imaginary email address.

This one was definitely stolen from parking or lounge, as that's the only reason I've ever given this company a valid email.

Microsoft warns that transitioning Excel workbooks to new Exchange connectors might not be smooth sailing

To be fair

Surely nobody should have ever done this in the first place.

Of course, several companies now rely on it entirely.

'We let you down': GitHub pledges to scale up before developers give up

It's Runners

Most companies using Github.com commercially are using it for the runners.

Runners tend to get very bursty usage, so it's a significant cost saving to share runners between teams - very unlikely that all the teams in a mid-sized company are building at the same time.

Github offers many runners across the major platforms - though the Mac ones are expensive.

Codeberg doesn't have Windows or Mac runners, you have to bring your own. At which point, it's probably better to just bring private repos back on-prem as the git storage and a web UI for those is a pretty small load.

Open source is different of course, because you want everyone to clone it.

Almost nobody pays attention to web standards anymore

Re: There's hardly any free tools.

Those tools are extremely limited, sadly.

Re: There are websites that pass validation??

There's a lot of perfectly reasonable style choices which that tool calls an error.

For example, it calls it an error to skip heading levels! It's perfectly reasonable to have h2, h4 on a page - especially a dynamic one assembled from parts. You absolutely don't want a footer to change size when the content above changes.

Unfortunately accessibility is far more difficult to check than it should be. There's hardly any free tools.

Be a hater all you want, AI's here to stay

Re: 95% of AI isn't financially viable.

The industry is ~$1.2 trillion dollars in the red and accelerating. Not one AI cloud supplier is anywhere near breaking even - the only winner is nVidia.

OpenAI lost over a hundred million USD a day last year according to leaked financials.

Anthropic's figures are well hidden, however they appear to have lost at least 11 billion over the last five years.

You are right that it's not going to fade. It's going to shatter when the loans become due.

It will be interesting to see what happens when the first full public xAI financials are published to the SEC.

LLMs absolutely won't go away though, as there are several companies with more than enough reserves to pick up the pieces. The real question is how much damage will have been done to the real economy when the dust settles.

There's plenty of historical analogues - tulip mania, dotcom bust, railroad mania, NFTs... Sometimes there is a useful residue.

Autonomous AI attacks pose 'clear and present danger' to critical infrastructure

Re: Offensive uses of AI appear to be advancing faster than autonomous defenses

A successful attack does not mean everyone dies.

It means a very large cost to the organisation, and potentially a lot of people lose a service they rely on.

If one water pumping station is taken down, within hours a few tens of thousands of people have no drinking water.

The water company then has to arrange and supply bottled water and/or tankers to that area, while also fixing whatever broke.

Repairs alone could easily cost millions of USD if plant was physically damaged.

And yes, in some people may die. Lose your power and thus aircon in hot weather and people do die.

Meanwhile, an attack campaign aimed at every single water supplier in the country costs the attacker a few hundred bucks total. They only need one of them to cause chaos and/or pay a ransom for it to be a roaring success.

Re: Where cyber becomes kinetic

"Physical" is a much better word. It's much clearer to the layperson - and has the added advantage of being correct.

Re: Offensive uses of AI appear to be advancing faster than autonomous defenses

An attacker only has to succeed once, the defenders must succeed every time.

AI "works" less than half the time, which makes it almost useless for defence, but definitely sufficiently effective for attack.

The only aid AI offers the defenders is better fuzzing. However fuzzing for defence requires a (usually complex) test harness - fuzzing for attack does not.

Microsoft tosses Teams Live chat into its feature graveyard

Re: I won't miss it.

You likely won't see the replacement either, because nobody will be able to trust that it still exists by the time they're ready to launch anything that might use it.

Microsoft have completely lost the plot when it comes to actual product lifetimes. Two years is now "long term"!

Gym rat asks AI agent to book him a class, it hacks a waitlist API to bump him up the list

These agents ignore such constraints

Saying "don't break the law" has no visible effect.

There's an example a few posts up of running an agent in "Plan" mode, yet it acts anyway and erases the disk.

The fact "Plan" mode is accomplished via a system prompt is a massive red flag of course, clearly indicating that this tool cannot be safely used for anything ever under any circumstances.

Re: people

Actually it isn't.

The default state of the vast majority of humans is to be kind, courteous, and occasionally generous.

There's plenty of evidence of this. Walk down a crowded street and count how many people commit tiny unenforceable infractions, such as pushing you out of the way to pass. Then count how many people make tiny sacrifices that assist you, like pausing before a narrow section of sidewalk or holding a door open.

There's no legal consequences to any of these actions, good or bad, and you'll probably never meet again so no social ones either.

"Andrew" is liable

There's existing case law in at least one jurisdiction - the operator is liable.

Prosecute him "por encouragement les autres".

The sentence should be commuted according to the strength of his apology, but having the case law on the books will be useful for the next few thousand times.

Microsoft tells engineers to curb their token-burning enthusiasm

Re: Tokenmaxxing as an indicator of your worth

Swamp cooling is indeed by far the cheapest method, especially in locations prone to drought. Weirdly it's not banned.

ShinyHunters called cancer diagnostics biz and tricked staffers into giving them access. Now they've dumped 10.9M email addresses

Re: NEVER pay a ransom. Period.

Multiple organisations have paid considerable sums to "delete the data".

There are definitely many suckers out there.

As Larry Ellison bets the farm, Oracle says it loves AI-written code, just not in OpenJDK

Re: Is this them not "eating their own dog food"...

Many years ago I worked at a petfood factory. Petfood is generally required to be human-edible, just in case.

The "product appreciation" training involved making a small batch of the dog food, then tasting it.

However, the ingredients were supermarket bought, rather than the tanker-delivered that went into the normal production lines.

Enterprise cloud infrastructure uptake shows no sign of slowing

A lot of on-prem licenses are terminating

I'm pretty sure that this is a one-shot increase, driven almost entirely by the fact that a lot of corporate tools are no longer possible to buy on-prem and existing users are being forced onto the cloud version.

The on-prem revenue of these companies has dropped to near zero, but that's a different graph.

Once everyone has either moved to cloud or on-prem open source by the end of 2027, there will be no new customers and any future revenue growth will be entirely driven by turn of the screw "it'd be terrible if you lost access to all your data" increases. If that's much above inflation most businesses will be looking at going back to on-prem the moment server prices return to something more like normal. It'll be interesting to see what happens in the EU - US businesses will no doubt follow when the savings start to stack up.

Scotland's university procurement center confirms cybercrooks broke in

Re: Dare I ask

It may not have been.

It sounds like the miscreant acquired administrator rights. Many system protections permit admins to export large blocks of data to disk (eg make a backup), even if plebs cannot.

Once exported it'd be trivial to upload it all somewhere.

UK wants datacenters to pay a fee for grid connection requests

There's a massive difference

A car plant or steelworks employs thousands of people.

A bakery employs hundreds.

A datacentre employs five, at most

Dev who gave HashiCorp its name returns with a faster terminal multiplexer

Re: I mean really...

Agents can't do that either, give them that much context and they hallucinate that the sky is green and the grass is pink.

US bank places trust in ransomware crew that promised to delete its data

Re: Moronic idiots

That won't work.

Paying the criminals just exposes the bank to even greater risk.

The majority of corporate IT is now off premises for the first time

Factually incorrect headline

That "10% in closets" is also on-premises.

So 54% of corporate IT is still on-prem, and last time I checked, 54% is a majority.

No longer a supermajority though.

Amazon's Q2 was great, but the earnings release is packed with baloney

Same revenue booked thrice?

Or possibly four times?

I seem to recall multiple court cases about accounting techniques that sound remarkably similar. I'm sure this is nothing like Autonomy though.

JFrog's 0-days let OpenAI's models hack Hugging Face

Re: why would their own artifactory server be exposed?

It's sold as an on-prem filtering download cache, so of course it needs Internet access.

The intent is that build servers can be fully isolated from the Internet while still being able to use package managers like Maven.

When an internal build needs a package, it tries to download it from the Artifactory server. The Artifactory server (supposedly) checks whether the download is permitted, and if so either serves it directly or downloads it from the Internet and passes it on.

This is supposed to ensure builds can only use authorised resources - blocking "known bad" packages, and limiting build users to some subset to limit the splash damage of a poisoned build.

Trouble is, it didn't work. The CVEs mentioned in the article meant an isolated machine could download (and probably upload) absolutely anything from the Internet by bouncing it off Artifactory.

It is odd that OpenAI never noticed this massive traffic spike until Hugging Face complained.

Dev accidentally commits Copilot binary to FreeBSD ports repo

In my experience, git only really gets tricky when people forget that branches in git are almost free and entirely disposable.

In many other tools branches are expensive, hard to create and delete. Anyone used to that will try to keep branches around forever - and run into trouble because they try to reuse or even move a branch instead of just making a new one where they want.

Git expects you to create, merge (or not) and delete many branches every week.

Unfortunately some of the popular front-ends still don't auto-prune local tracking branches, which does mean manually doing so.

It's still around

But barely.

It has a few limitations compared to git while being otherwise basically the same - eg it can't do an octopus merge.

What's almost killed it - along with pretty much everything else - is the network effect of git being free, open source, and how Linux is developed.

TBH, if gitmodules actually worked properly then everything else would have ceased to exist a decade ago. Dependencies are the real bane of git, and there's no decent solutions yet.

Perforce almost got them right, only to snatch utter defeat from the jaws of victory by hiding the history of "imports" away entirely. I gather they finally grew a brain a couple of years ago. Far, far, too late - if they're not already dead, they will be momentarily.

Re: backport hell

The core problem space is seriously complicated.

File-based version control is the worst possible architecture for software, because you nearly always want the entire state of the project at a given point in time.

Large parts of a codebase depend on the specifics of other files - to call a function you must know its signature. Moving blocks of code from one file to another is also an extremely common action.

This interdependence is why some places go with "monorepo", because it seems simpler - until it's not.

Merges require the history of the entire project back until the two branches last diverged, or they rarely work.

Backporting is painful in every tool, as that common history is a long way in the past.

FOSS smashed one Microsoft monopoly. After 20 years of failure, it's time to smash another

Re: Becoming irrelevant

Confluence is a Markdown flavour underneath, which is how it manages to sort-of support almost collaborative editing - as long as there's never more than one person editing at once, anyway.

You'd think the fact that all the on-prem versions are about to cease to exist would drive migration away, but apparently not.

Google meets the neighbors and gets both barrels over its new UK datacenter

Re: 77 MW of IT capacity

If it's genuinely 77MW of IT capacity, then it's roughly double that in actual draw as it also needs to run the cooling system.

So it's a 140MW fan heater.

Burnham wants Big Ecommerce to bankroll Britain's pubs

Re: Sometimes.......

Did the flavour change though?

I don't drink that brand, but several 0% beers and ciders are just as good as the alcoholic ones, so it's possible reducing the alcohol content didn't affect it. Very few people drink to get drunk, so arguably lower alcohol is better - as long as the flavour is still good.

Some 0% is awful, but that's mostly the ones where the normal strength version is terrible as well.

ChatGPT wants access to your health records so it can be a better not-doctor

Re: NOPE NOPE Nope Nope nope nope (nope nope)

That advertising does however mean the court should find them liable and fine them out of existence.

Codeberg gives vibe-coded projects the toss, promotes human FLOSS

Many groups argue that the act of feeding anything into LLM training is infringement, unless the work was explicitly licenced for that use.

After all, if it's not infringement to train an LLM on stolen data then all copyright everywhere is entirely destroyed, for the reasons you just described. But if it is infringement, then the entire LLM industry is unlawful and owes a few trillion in royalty payments and punitive damages.

This is still slowly grinding through the courts. One suspects they may never rule on it, as the LLM pedlars may cease trading first.

Bravo

Whether you like vibe-coding or not, it is good to know whether a given project actively uses or actively avoids using it so you can make an informed decision.

Vibe-coding puts a very heavy load on CI compared to a human team. LLM agents tend to produce much larger generated codebases, with lots of repetition and reinvented wheels, and unnecessarily rewrite large sections.

So not only are the builds far more often and much larger than a human would do, there's also more cache misses and a larger repo overall.

Incidentally, AI generated code is explicitly excluded from copyright - there is legal precedent in more than one jurisdiction - and so any "vibe coded" project has no copyright whatsoever.

As to that AI-pedlar's comment - well, they would say that, wouldn't they. Why did you even ask?

LG kills McAfee pop-up after Windows boss steps in

Re: Windows is just a bloody advertising platform now.

McAfee almost certainly approached LG with the offer. McAfee have been doing this type of thing since the brand was founded - their poor reputation is well deserved.

This is entirely on LG for not immediately slamming the door on them, and whichever LG exec approved this needs to be publicly tarred and feathered.

Microsoft did LG a huge favour by telling them to stop their reputational suicide.