Posts by ovation1357

Claude Code's prying AIs read off-limits secret files

Running claude in production?

What are these people doing with Claude?

I agree that if it's failing to ignore excluded files then this is a serious bug but it shouldn't matter because none of the "secrets" development code should actually be sensitive. Are they letting it run again live data?

Use the LLM to ensure your development site has data seeders that can make realistic database content, mock any external APIs and once that's looking good and passing tests then release that code to a staging environment which might have some real secrets but no LLM to read them .

And if you get an error in production, you can tell Claude about it in dev and it will try to diagnose the dev code. Just say "I got this exception in production" and paste the error and backtrace.

Please please please tell me that people aren't using Claude or any other LLM directly against live data!?!

AI-authored code contains worse bugs than software crafted by humans

Dealing with some Laravel code (PHP) I found that chat GPT sent me round in circles and mainly suggested solutions which were either wrong or might work but though a convoluted and terrible bit of code.

On the other hand I've been really impressed with claude code running in a shell. It's helped me to root cause and fix a couple of tricky bugs and to generate some really useful, well structured front end components. It's saved me loads of time compared to writing it myself and when I review its diffs they're mainly very sensible.

Occasionally it still completely missed the point of suggests a really complex solution instead of something obviously much simpler - I would certainly agree that for it to be useful you need to understand the code it's writing so you can steer it when it makes bad choices - juniors or non technical managers trying their hand at a bit of vibe coding will probably still create an unholy mess.

I like it so much I'm actually paying them real money for it

Re: Generates greater output...

This wins best comment award!

UK.gov accused of Grinching Christmas by ignoring phone theft scourge

Nobody has mentioned the BBC's recent article highlighting that some of the gangs are barely interested in the phone hardware itself but have devised ways to snatch phones and drain the victims bank account, credit cards and crypto wallets within minutes of the theft.

It's turning pretty nasty out there and it's an especially bad time to be an iPhone owner as they're by far the most targeted [citation needed].

I personally don't get the iPhone craze and carrying something worth over £1000 in your pocket seems far too risky to me - I mean forget the theft issue for a moment, that's a lot of money if you happen to lose it by accident and still potentially hundreds to fix if you fumble it and smash the screen.

The gangs doing this need to be stopped but it doesn't help the temptation when people are walking around flouting highly valuable, easily grabbable devices whilst failing to pay any attention to their surroundings. If the gangs get into your phone then the losses could be much greater.

Personally, I've got the amazing Ulefone Armor 20T Mini which does everything I need and not only is (hopefully) too small and odd-looking for the thieves to target me but has a wrist strap and is heavy and solid enough to wound a would-be thief if it happened to come into contact with them at speed.

OBR drags in cyber bigwig after Budget leak blunder

Re: I'll wait and see

I wonder if I'll ever understand this mentality of sacking the top dog when somebody numerous layers beneath them cocks something up.

Firstly, unless there is evidence to suggest they are directly involved in the cock up, then you're sacking the wrong person.

Secondly, all too often senior people get the luxury of just fucking off after something like this. Surely the much harder path is to make them stay in post and deal with the aftermath.

(And don't call me Shirley)

Microsoft's lack of quality control is out of control

Re: The Legendary Legend

Exactly!

I was going to comment on the author's use of "robustness" when referring to NT.

I think that statement needs qualifying with the word "relative" because it was more robust when compared to previous versions of windows, but compared to most about anything else it was still an unstable crock of excrement.

A good friend of mine was working for an insurance company around the time of NT and the execs wanted to migrate the whole business from a mainframe to a cluster of NT servers. Needless to say it never happened - partly due to complex migration issues from a bespoke solution to an off-the-shelf product but NT's uptime was nothing short of pathetic when compared to the mainframe, which was also a significant factor.

China uses Mars orbiter to snap interstellar comet 3I/ATLAS

Re: Captain

https://youtu.be/FCARADb9asE?si=UuBjZqZKGnaQsXlU

You're welcome.

UK agri dept spent hundreds of millions upgrading to Windows 10 – just in time for end of support

Re: Solution for low salaries in gov IT

"Most commercially free Unix has a *much* shorter lifecycle than Windows"

Aside from disputing "much shorter" as there are notable long-term release examples which fare pretty well, (e.g. Ubuntu LTS gives you 5 years of free updates and a further 5 available with commercial support, which still works out hugely cheaper than Windows licensing)....

I think the more important fact is that the next version of your chosen Linux distro is unlikely to have significantly different hardware requirements unlike Windows which has already been so bloated that you end up needing to buy new hardware - not just a faster machine with more RAM but this time the whole TPM debacle has seen lots of fairly new machines needing to be replaced.

I'm comfortable that the latest and greatest release of any of the big name distros will run perfectly well on 10+ year old hardware and be fairly performant, whereas I couldn't even install the latest Windows editions.

I'm sure many organisations could save a small fortune by ditching Microsoft products in favour of open source alternatives where feasible.

New Linux kernel patch lets you cancel hibernation mid-process

If only suspend to RAM actually worked :-(

Regular comment readers will know that I have a bitter hatred of Microsoft and all its products - this extends to the latest generation of CPUs where MS appears to have used its monopolistic powers to bully lobby manufacturers to completely ditch hardware support for the 'S3' sleep state we knew as 'suspend to RAM' in favour of Microsoft's catchily named 'S0ix' a.k.a. 'Modern Standby'... This has the objective of making standby near-instant because, shocker, S0ix isn't really standby but instead pushes full responsibility onto the OS to pretend to sleep by suspending services and/or switching them in to power-saving modes.

This means that the relatively stable and quick alternative to hibernating to disk is no longer available on modern hardware. All my previous Lenovo laptops have happily suspended to RAM multiple times per day for months on end (sometimes after a few initial teething issues), however now my Laptop (a P14s Gen4 with an AMD Ryzen 7 PRO 7840U) comes out of my bag ranging from feeling warm to the touch, to scalding hot and completely dead. I am lucky to see an uptime of more than 30 days before something causes the machine to overheat and drain the battery when I'm not using it.

Rumour has it that this method of standby has caused a lot of pain and frustration for Windows users too, with many reporting similar issues of laptops cooking themselves whilst in standby. Certainly my latest corporate-issued Win 11 laptop seems to be begging for a charger every morning when I wake it up.

After a lot of pain (and a fair bit of swearing) I managed to isolate Bluetooth as the main cause of my pain on Ubuntu, although disabling it also means I then can't use it, but lately I found out that if I suspended after using my built-in cellular modem then this will wake the machine up and cook it in my bag. Basically, anything could wake the laptop up at any time because it's really still awake.

So the suggested alternative is hibernating to disk - great; except that I've since upgraded my RAM and have nowhere near enough swap space, plus hibernation is known to be problematic (not to mention fairly slow, and possibly still not ideal to be dumped onto NVMe/SSD storage) - At some point I'll get around to migrating to a bigger drive so I've at least got the option to try it.

Yet again this seems to me like Microsoft abusing its dominant position to force everyone to do things its way - In the same way they tried to force a tablet/touch-centric UI onto all users, they now want to force a tablet/phone style 'standby' onto everybody, even though laptops/desktops are arguably running far more complex tasks without the constraint of everything being an app in a sandbox. Why did they have to push for the removal of legacy S3 standby!?

Seriously, I don't mind nor care if they want to dabble with their own 'modern standby' implementation - good luck to them! But they should not be allowed to remove or break core hardware (and firmware) the ones relied upon by other users.

Where will this end? We've already got dedicated Microsoft buttons on our keyboards (thankfully just Windows keys on mine and no 'co-pilot' button), enforced 'upgrades' to TPM v2.0 because of Windows 11 requirements, Secure Boot (which last time I read about it was controlled entirely by Microsoft - e.g. non-MS OSes need to obtain a certificate from MS if they want to use it).

Back on topic - I can see the ability to cancel hibernation as being useful on those occasions when I put the machine to sleep and then remember something else I meant to do - this happens often. I'm just hoping that when I finally sort it out (which may also involve making a jump to Devuan Linux to rid myself of systemd) that hibernating to disk will work 100% of the time and won't take too long to sleep/resume.

Is PHP declining? JetBrains says yes. And no

It's a tool and it's ubiquitous

Whether or not there's any real change in its usage, PHP is likely to be here to stay for the foreseeable future. The PHP community amuses itself by sharing 'PHP is dead' jokes to highlight that it's really still very much alive and whilst versions <=5.4 are quite deserving of harsh criticism, there have been huge improvements to the language since then and it generally holds its own these days, especially for anything web-based.

Is is perfect!? Absolutely not! But it's easy to learn, performant, relatively secure (when used correctly - established frameworks help a lot in this regard) and probably its biggest selling point is that it's pretty much universally available out of the box on any hosting platform you can think of, partially due to the huge uptake of (love it or hate it) Wordpress but also the fact that it seamlessly integrates with Apache, NGINX, LiteSpeed and probably most other HTTP servers.

I run a few things using Laravel and maintain some legacy Drupal 7 (spit!) sites, all based on PHP. Apart from XDEBUG being a major pain in the ass to configure and use reliably, and the promised support for ENUMs which came in PHP 8.1 being little more then bastardised classes which do not meet my needs, it's a decent enough language for what it does.

And what's the alternative?

Ruby? No thanks - I've had to work with a few snippets of Ruby and I find its syntax to be all upside down and arse-about-face. It's a weird language.

Python? Maybe, but I personally have a very strong dislike of using whitespace to determine hierarchy and flow - I'm not sure Python has every really made much headway in this space either. I tried Django framework a while back but found it hard to get started.

Perl? Ha. Ha-ha! Ha ha ha ha ha ha! Yeah, erm, nope!

So what about something like Java or a JVM-based language such as Groovy? Well, in an enterprise environment maybe, but show me any cheap shared hosting which supports running a JVM. These days virtual private servers are relatively cheap but generally you're going to need to allocate 2-4GB RAM to the JVM in order for it to do what PHP will manage happily within a fraction of that.

I don't like the syntax of PHP's 'composer' package manager, but I'm yet to find a package manage which I actually do like.

And at least is isn't JavaScript!

At the end of the day it's all a case of using the right tool for the right job. I wouldn't write a native application in PHP just as I wouldn't write a website in C.

Whether or not there's any real change in its usage, PHP is likely to be here to stay for the foreseeable future. The PHP community amuses itself by sharing 'PHP is dead' jokes to highlight that it's really still very much alive and whilst versions <=5.4 are quite deserving of harsh criticism, there have been huge improvements to the language since then and it generally holds its own these days, especially for anything web-based.

Is is perfect!? Absolutely not! But it's easy to learn, performant, relatively secure (when used correctly - established frameworks help a lot in this regard) and probably its biggest selling point is that it's pretty much universally available out of the box on any hosting platform you can think of, partially due to the huge uptake of (love it or hate it) Wordpress but also the fact that it seamlessly integrates with Apache, NGINX, LiteSpeed and probably most other HTTP servers.

I run a few things using Laravel and maintain some legacy Drupal 7 (spit!) sites, all based on PHP. Apart from XDEBUG being a major pain in the ass to configure and use reliably, and the promised support for ENUMs which came in PHP 8.1 being little more then bastardised classes which do not meet my needs, it's a decent enough language for what it does.

And what's the alternative?

Ruby? No thanks - I've had to work with a few snippets of Ruby and I find its syntax to be all upside down and arse-about-face. It's a weird language.

Python? Maybe, but I personally have a very strong dislike of using whitespace to determine hierarchy and flow - I'm not sure Python has every really made much headway in this space either. I tried Django framework a while back but found it hard to get started.

Perl? Ha. Ha-ha! Ha ha ha ha ha ha! Yeah, erm, nope!

So what about something like Java or a JVM-based language such as Groovy? Well, in an enterprise environment maybe, but show me any cheap shared hosting which supports running a JVM. These days virtual private servers are relatively cheap but generally you're going to need to allocate 2-4GB RAM to the JVM in order for it to do what PHP will manage happily within a fraction of that.

I don't like the syntax of PHP's 'composer' package manager, but I'm yet to find a package manage which I actually do like.

And at least is isn't JavaScript!

At the end of the day it's all a case of using the right tool for the right job. I wouldn't write a native application in PHP just as I wouldn't write a website in C.

Thunderbird 142 lands with modest upgrades – plus talk of Pro service ahead

I would like to completely agree with this but I can't because HTML in emails has been completely normalised in all forms of marketing and for any messages using even basic formatting.

If I simply want to include some bold text in an email then thunderbird immediately converts the entire message to HTML and in turn causes all the text to shrink to an unacceptably tiny font - this conversion is also irreversible so far as I can tell. The same applies when replying to an html email and quoting back the original message.

I'd be all for using markdown instead but the fact of the matter is that all the mainstream webmail providers and Outlook make HTML the default format and my clients expect to be able to send messages with their logo embedded in the message and use the message editor like a word processor..

Does HTML email suck!? Yes! Massively, but it's what we've got. And whilst thunderbird mainly does a good job of rendering incoming HTML emails, the message editor really sucks at editing them and it needs to improve because everybody else's editor is better.

I'm still hanging on with Thunderbird even though they did hideous things to the UI a while back, which broke my long standing workflow in a single update.

I tried Betterbird but IIRC it didn't work properly for me, nor did it fix the UI issues that were bugging me, so for a while i pinned TB to the version before the "upgrade". But alas I eventually (I think initially by accident) relented and installed the current version with a few tweaks to help my sanity.

It still irks me that TB decided to force a major change to the UI onto established users without any choice in the matter. They should take a leaf out of Libre Office's book here, which tends to leave established layouts alone whilst offering the latest whizzy UI to new users.

I still miss the old UI but for now I'm coping with the new one. Meanwhile they're developing stuff in the background and thankfully, day to day, it rarely affects me... I wish they'd fix the HTML email editor as it's really clunky and buggy... For starters, when i begin an email in plain text (my default) and happen to add an element such as emboldened text which triggers it to convert the message to HTML, the text size instantly (and irreversibly) shrinks to a tiny font meaning I have to select all and enlarge it again.

And if you've ever tried inserting a table.... That's excruciating!

Still I'll take TB over Outlook or Gmail any day - Outlook is so shockingly bad I don't think TB could even deliberately become worse. But then again I'm often faced with businesses and users who are ditching thunderbird for Outlook (or worse, Apple Mail; or worse still, Windows Mail!) and I honestly can't get any coherent answers from them as to why.. I've been told that Thunderbird "looks too old fashioned" or that "I just prefer Outlook" even through there's never any compelling reason. Sad but true, unfortunately.

For me, nothing has ever come close to the lightning fast search in Thunderbird. Let's just say that I'm not the best at organising my email, yet the quick search in the inbox, easily expanding to a full search across folders and mailboxes means that I can always find what I need within moments. Meanwhile I can never find anything in Outlook, including recently the search bar itself which they've permanently moved into the goddamn title bar (seriously everybody, stop doing that!)..

Senator blasts Microsoft for 'dangerous, insecure software' that helped pwn US hospitals

Re: "needlessly exposes its customers to ransomware and other cyber threats."

Is that thirty four thousand or thirty four point zero to three decimal places?

I always find it mildly concerning that some locales use a decimal point as the thousands separator ;-) It must cause some pretty spectacular mistakes between countries.

Laravel inventor tells devs to quit writing 'cathedrals of complexity'

He's a fine one to talk when we have all sorts of complexity in Laravel which is barely documented (I mean, yes it's 'documented' but telling you the names of parameters doesn't necessarily explain how to use them).

The worst offender for me is the "Eloquent" ORM (which is technically separate but all examples are based on it) where the names of Model relationships such as HasOne and BelongsTo aren't immediately clear how they relate to the database and then getting into polymorphic relationships such as MorphedByMany get very complicated - the "English" name of the relationship sounds simple enough but I have to refer to a cheat sheet every time I use them, especially if working table and column names which buck convention.

I'm all for keeping things simple whenever possible but I feel like people in glass houses shouldn't throw stones in this case.

LibreOffice 25.8: Faster, leaner, and finally speaks PDF 2.0

Re: Still no usable database

Is Base even still relevant?

I've always seen it as attempt to include an alternative to MS Access but who uses that these days?!

Access was always awful too, and it led to businesses and organisations having pockets of critical business functionality and/or data being locked in some undocumented Access database (or worse, Excel spreadsheet plus macros) created (and only understood) by Barry from Sales.

These days Access seems to have fallen out of fashion. One of my clients has decided that they didn't suffer enough pain trying to mitigate numerous fragmented Access databases onto something supportable and have now had the bright idea that non-technical end users are all going to develop Microsoft "Power Apps" in the Cloud!

Do any of the commenters here actually use LO Base for anything? Perhaps it should be quietly taken round behind the barn and dealt with?

TL;DR Complaining about Base doesn't seem very relevant to me.

The plan for Linux after Torvalds has a kernel of truth: There isn’t one

"Windows UI has been dumbed down to Linux levels,"

s/Linux/GNOME/g

Then maybe I'll agree, but using the word Linux isn't just wrong; it's fighting talk!

The current GNOME desktop certainly isn't made by amateurs - it's mainly controlled by professionals employed by RedHat/IBM... It's also utterly terrible and feels like it's been created by total amateurs. Interesting....

It's not really fair to point at Linux GUIs and Desktop Environments when you've got the "professionally" designed and developed clusterf**k of Windows 8, 10 and 11 and Office applications. Awful, awful GUI (although not quite as awful as GNOME) - flat, low contrast, ugly mess which can barely be customised and often has oversized text and/or masses of wasted whitespace, and even a smattering of amateur errors such as text alignment problems.

Microsoft keeps adding stuff into Windows we don't want – here's what we actually need

Re: What's he smoking?

Have a beer for supporting MATE it's the absolute best desktop environment for anyone who wants a sane, unobtrusive desktop with no nonsense *

I currently use Ubuntu MATE edition and even pay a monthly Patreon subscription to support it because (amongst other things) I don't like to way Mint messes with the stock theme of MATE - I get that they're trying to appeal to Windows users but the last thing I want is a desktop like Windows.

However systemd has touched me in bad places recently and I'm seriously considering switching to Devuan + MATE.

*Sadly, some nonsense from GNOME is leaking in via changes to GTK and MATE's use of a few GNOME applications such as "simple scan" (now called "document scanner").

Re: The answer to almost all those is...

I'm with you on the leading zeroes - my understanding has always been that 24 hour times always need leading zeroes...

E.g. 8:00 is wrong and could be a 12 hour time missing its suffix, so it should be 08:00

Is there a difference between written and verbal numbers here? E.g. i would say oh-eight-hundred but would write 08:00

I'd completely forgotten about the use of Zulu!

Re: The answer to almost all those is...

"I've never encountered a representation of time with a separator"... I meant WITHOUT (facepalm)... When autocorrect completely changes the meaning of a sentence :-(

Re: The answer to almost all those is...

Military time?

Is this an international military thing or just US Military?

To me 1643 is a year and I've never encountered a representation of time with a separator of some kind except in files named something like output -20250815-1643.txt

No criticism here, I'm just curious.

Re: A couple of things

The fact of the matter is that you shouldn't have to go to such lengths to make the machine half useable :-(

It's all the grand dumbing down of everything and the sad thing is that the next generation of users won't be aware of what they're missing.

Microsoft wares may be UK public sector's only viable option

Re: Grand Enshittification

It's a very very long time since I set up any kind of domain joined Windows machines and the ones I ever did would only have signed in on the local network and not via an remote solution.. So it's useful to hear that it's now possible for business machines to boot and login quickly.

Until today I've only witnessed or experienced poor start up and login times. And my friends working for a variety of organisations from Banks to Government generally seem to moan that their computers take forever to start up so it's certainly not unique to where I'm based.

I'm pretty sure mine is still using an on-prem AD for authentication and I think my home drive is now running on OneDrive (although the previous on-prem shared storage home drives were no better).... I wonder if the user experience is better if you're using Azure AD or a Microsoft online account?

There's little to nothing I can do at my organisation to influence or change the IT which is all outsourced to a big company which is, no doubt, charging top dollar for delivering the bare minimum. So like many users (in addition to the thousands in my organisation) I'm stuck having to use a corporate laptop which is slow and horrible :-(

To be fair, I'm sure a Linux based environment could also get bogged down in things which make it run very slowly but I'm sure I've only ever seen one example of that in my whole career.

MS software and tools seem to make it extremely easy to deliver a poor experience.

I'd personally love nothing more than to live through the fall of Microsoft. It has relentlessly abused its position of power over the years and its current fluffy warm stance on open source and loving Linux all of a sudden is merely a wolf in sheep's clothing. Mark my words - if I were into betting I'd place money on it - one day, Microsoft is going to bite FOSS really hard in order to strengthen its dominance.

Grand Enshittification

I've always hated Microsoft and pretty much everything it does, but in the present day it's just going from bad to worse.

Just this evening I i caught a brief part of a programme on the radio where a lady was saying that doctors are leaving the NHS because of the terrible IT - I think the example cited by the interviewer was reports of systems taking 30 mins just to log on.

Whilst I happily run a Linux-based laptop which isn't even the latest and greatest but boots and it's ready to use in under 30 seconds, my 'corporate' Windows laptop can take anything from 5 minutes to to an hour to boot and fully log in. I see this all over the place in both public sector and private sector devices.

Window is pretty rubbish at booting and even worse at logging in - connect it to a domain, add a load of group policies and q bundle of "security" software plus Office 365 and OneDrive and you've got yourself a total clunker.

It would seem (from taking to colleagues who have recently been 'upgraded') that Win 11 is even slower and worse than 10 was.

Now I know that some of this will be down to the way the image was built in house (e.g. resetting default file associations at each login, where the default program for opening PDFs is Adobe Acrobat for which there's no licence, so it blocks you even from just reading the open document), however its all built upon a pretty awful foundation to begin with.

I personally despise the modern UI in Windows which began back with Win 8 and Metro and i think Outlook is an appalling bad email client. But even if i were to overlook all that, there's still the fact that the whole experience is persistently excruciatingly slow! Logging in presents a spinning circle for an indefinite (but usually long) time and then trying to open my documents on OneDrive takes 10+ seconds to open the folder view and 30+ seconds to open a word document. All on a recent laptop with an SSD and 16GB RAM! It's like walking through treacle.

Meanwhile my Ubuntu machine with Thunderbird and Libre Office happily opens even remote file shares within a split second and takes no more then a few seconds to open a document in Libre Office, meanwhile Windows is still trying to log in.

It's got to the point that Microsoft has enshittified the end user experience so much that people are quitting their jobs because of bad IT. Put some clunky, over engineered business application on top and it's easy to see why people can't cope any more.

FOSS could help enormously in this case but it would need a huge shift in corporate attitudes to even think about using it. Microsoft has a very powerful monopoly and it's not about to roll over and give up all that juicy pubic money.

After 30 years PHP still evolving: Team adds pipe operator, considers generics

Re: "PHP will be stuck forever with half-baked feature"

I'd say that a lot has changed since a couple of decades ago and the typical pairing of PHP with either Nginx, Apache or Litespeed is much tighter than it was previously.

The language itself still has some horrible quirks, inconsistencies or half-baked/missing features but then show me a perfect language.

WordPress is still poop but it's loved by many and i believe it tends to be the plugins that introduce vulnerabilities these days.

Frameworks such as Laravel or Symfony (on which it is based) tend to have a decent security model out of the box and are now very widely used.

It's a different world and all web applications are so damn complicated that regardless of the underlying language there will be holes in all of them.

Re: "PHP will be stuck forever with half-baked feature"

Oops "genetics" LOL I did, of course, mean generics! Spotted too late to edit.

"PHP will be stuck forever with half-baked feature"

I got really excited at the prospect of PHP introducing support for ENUMs a few years back but sadly this was a big disappointment and something which is half-baked too in my opinion..

I was expecting to be able to able to define a simple ordered list like:

enum Position { FIRST, SECOND, THIRD }

And do comparisons such as:

If $position == Positions::SECOND

or

If $position > Positions::FIRST

But in reality there's no automatic enumeration and it's really just a glorified class in disguise, much like all the hacky class-based workarounds we've been using for years.

E.g.

enum Position { FIRST = 1, SECOND = 2, THIRD = 3 }

Then the ugly syntax of:

If $position == Positions::SECOND->value

I'm still craving "proper" ENUMs on a daily basis and i almost wish they simply hadn't added them rather than this half-baked hack.

In spite of this I actually rather like PHP and I think it gets a lot of very unjustified hated... The team behind it has put in immeasurable amounts of time to improve both the language and the runtime which has taken it from being purely interpreted to JIT-compiled and including a helpful level of type safety.

Over the years they've done a lot to try and get away from some of the issues that famously made people sneer at it, such as the bad old days where variables defaulted to having a global scope.

In this case I'm with the nay sayers regarding genetics. I used them extensively in a C# project years ago and they were extremely useful but i think that unless the language can support a full implementation then it's best left without them.

Russia's RomCom among those exploiting a WinRAR 0-day in highly-targeted attacks

Re: Email ... contains a CV that appears to be benign

Hiding the file extension was one of the most stupid things Microsoft ever did in Windows. It's been continually exploited over the years and serves no benefit to the end users, but is of great benefit to miscreants trying to fool them.

Long live the nub: ThinkPad designer David Hill spills secrets, designs that never made it

Re: Today I learned...

The T520 is brilliant! I used one for many years and only "upgraded" to a P14s Gen 1 when Zoom (during the pandemic) seemed to be overwhelming the T520. In reality it wasn't much better on the new one.

I got used to the much smaller form factor so the old T520 feels huge now but it was definitely more reliable. Suspend to RAM worked flawlessly unlike my P14s G1 which would occasionally wake up inside my bag and cook itself, or my newer P14s G4 which is even worse thanks to the Microsoft initiative of removing the hardware level sleep states and relying on the OS to disable services like a phone/tablet does.

It took a while to discover that the Bluetooth service was waking my laptop and cooking it in the bag! The recommended solution? Use suspend to disk instead!

Re the mouse button thing - glad I could share. Please don't curse me when you next use Windows or macOS and find yourself trying and falling to middle click.

Today I learned...

I had no idea that my "middle" mouse button did this and I've been using ThinkPads for 20 years!

I still use (and heavily rely on) the "middle click paste" feature of X Windows on Linux - it's one of those features that you can't really live without once you've used it: Two separate clipboard buffers - one for the CTRL+X/C/V cut-copy-paste and another which captures whatever text you just highlighted on screen and pastes it wherever you middle click. It's super fast and convenient, plus it allows actions such as copying both a username and a password in one window and pasting both in another, without skipping back and forth.

One of the reasons i continue to buy ThinkPads is because they're the only laptop on the market which ship with three physical mouse buttons!

I understand that the buttons actually belong to the "nub" even though I use the touchpad to point (really never could master the nub , like many others have said) so I also recognise the losing the nub would cost me my cherished buttons and I really don't know what I'd do without them!

I've looked at alternatives such as Dell XPS and System76 but the mouse/touch pad is always a total deal breaker.

Vive la nub (and mouse buttons) de la ThinkPad!

Re: While I love my thinkpad, I really can't use the nub

"neither Linux nor Windows lets you enable that in settings"

Hold on a moment, "Linux" is a big generalisation as there are so many distros and desktop environments.

If you're using something with GNOME then the lack of a setting then it really doesn't surprise me because it's an unholy abomination (e.g https://woltman.com/gnome-bad/ )

I use Ubuntu MATE edition and on the touchpad settings I've got "Disable touchpad while typing" - I rely on this and would hate to lose it.

I've got a feeling you might be able to do this on Windows if you install the full Synaptics driver set and go into the advanced settings, but I don't use Windows so can't be sure, and be aware that some newer ThinkPads use a different brand of touchpad.

What if Microsoft just turned you off? Security pro counts the cost of dependency

Re: Choosing risk

> it's quite rare for Microsoft products to stop working randomly

Have you never used Windows before? It stops working randomly all the time! Aside from weird problems like known good networks suddenly failing to connect or printers suddenly failing to print you can add in a good share of botched Patch Tuesday updates which break features or occasionally brick the whole machine.

If you also consider how bloated and excruciatingly slow modern corporate Windows deployments seem to be (bogged down with 3rd party security tools, employee tracking software, lockdown/control etc) I really don't understand why corporate bigwigs tolerate it :-(

The rise and fall of the standard user interface

Re: Efficient interface

Urgh! Nano!

Long time vi / vim user here... Am I alone in hating nano and hating even more when systems have EDITOR set to nano.

Forked-off Xlibre tells Wayland display protocol to DEI in a fire

Wow! That's a pretty damning list of issues and I find them entirely believable based on other bad encounters with the zealotry pouring out of the Wayland/GNOME teams.

The post-quantum cryptography apocalypse will be televised in 10 years, says UK's NCSC

Re: SMS

Except that a number of cards now print the "secret" CVV on the same face as the card number and expiry date.

I don't get it: However tenuous/weak the CVV may be, it does still add a layer of protection e.g. one "attack" might be obtaining a photo of the card so having the code on the back slightly reduces the risk of this being useable.

I'd love to know why some banks have decided it's okay to do this.

Oracle Cloud says it's not true someone broke into its login servers and stole data

Re: Encrypted passwords?

"Even with salting, it makes cracking expensive but not impossible"

This blows my mind! Unless there's some known weakness in the salt and/or the hash then the only way to crack this is to brute force it by generating hashes of what, billions? trillions? of possible combinations using the salt which is (or at least should be) unique to that individual password.

Please correct me if I'm missing something here. I'm struggling to comprehend a scenario where the amount of time and computation would be worth it.

Encrypted passwords?

"The SSO passwords are encrypted, they can be decrypted with the available files,"

Why on earth are passwords being encrypted rather than hashed?

I've only seen this in really poor, old (like 20 years old) software.

People are creatures of habit and there's every chance that a chunk of users are using the same password elsewhere :-|

China's EV champ BYD reveals super-fast charging that leaves Tesla eating dust

Re: Recharging = needed break anyway?

I'm happy you rolled with 7kw - I used it as the notional best rate you'll get on a single phase charger... I believe 3-phase can go up to about 22kw BUT I'm not sure how many cars are compatible with it... My old Citroen e-C4 certainly only supported single phase :-|

In my opinion multiple phases in a grazing setup would be better used to support more single phase chargers.

Re: Recharging = needed break anyway?

I acknowledge that the cumulative cost will be greater although I question whether you'd really need as much as 50% coverage - there's a lot of EVs on the road these days, I've no idea of the percentage but the few hotels I've been to have had between 0 and 2 chargers and those which had chargers generally didn't seem to have much contention.

I'm sure the demand will increase but not every EV is going to need charging - e.g. I occasionally have to travel about 100 miles away for work and I choose to stay in a hotel when I work late. With my current EV I easily have enough range to drive the return journey plus local running around without needing to charge.

Assuming the charging isn't free and assuming it is more expensive than at home, I wouldn't use the hotel's chargers even if it had them. I can't be alone in this situation.

There's already standard technology to dynamically limit the rate of 7kw chargers so I'm sure there's also scope for a fair degree of "over commitment" - e.g. loads of 7kw chargers safely running off a supply which is smaller than the sum of them. Not all cars will need the same amount of charging nor will the pull the same current so over a longer, slower "graze" everybody can get sufficiently "fed".

Re: Recharging = needed break anyway?

I don't know about "allowed" - manufacturers seem to have stopped shipping them at standard but I think that's more because they're deemed too slow to be useful.

I don't have one and there are a tiny number of times when it would be of use to me. I keep toying with the idea of getting one but they are quite expensive and mine would likely sit unused for 364 days of the year

Re: Fast charging

I was that guy once or twice, although never knowingly with a queue of people waiting... Quite simply, my previous EV could only manage a measley 120 motorway miles from 100% so charging to 80% (~96 miles) simply didn't yield enough range on a long journey.

It was rare that the 80% was achieved in 30 mins too - anything from 40 to 60 mins was more normal. And then the final 20% was more like an extra 20-30 mins so not all that bad if it meant not having to stop and mess about with yet another charger.

In my experience it takes an absolute minimum of 10 mins just to come off the road and stop somewhere very briefly.

Then on average it probably takes 10 mins to get the charger to interface with the car and actually start charging. This bit is hugely variable and it's taken me as long as 40 minutes (in the pissing rain) to successfully pay and start charging - thankfully some other chargers take mere seconds to set up but it's a lottery right now.

So when an extra 20-30 mins gets enough charge to reach the destination Vs another 40+ mins stop later on seems a better bet to me.

Fortunately my current EV has a great range and 80% (~180 miles) will be more likely to cut it on most journeys. I also haven't needed a rapid charger since getting a long range car so I've never tested how quickly it charges but it supports 150kw charging so in theory should get to 80% even quicker than the previous car.

Re: Recharging = needed break anyway?

"Charging (or refueling) points are expensive to install" :

In the case of rapid chargers, yes - they cost a fortune (I believe you're talking about £80k+ for ultra rapid). But for single-phase 7kW AC chargers the cost is a fraction of that. One can easily get a basic charger installed for under £1000 (and I think the charger units themselves are way overpriced for what they are) - certainly in my case even consistent access to a regular 13amp socket to use a so-called granny charger would have taken the edge off in most of my own cases. I'm sure the government could easily offer grants and incentives to business across the country to try and achieve basic charging facilities installed in the majority of public and private car parks.

One of the many problems with the public charging infrastructure is the extortionate prices they charge. e.g. At home I'm fortunate enough to have a driveway and a 'smart' home charger so I can charge for about 7p/kWh vs anything from around 43p on Tesla's network up to about 89p with the worst offenders (here's looking at you, InstaVolt and PotPoint!). Don't even get me started about 'fragmentation', shitty apps, incompatibility etc.

Rapid chargers are serious machines - liquid cooled cables delivering hundreds of volts DC at insane currents - they cost a bomb and then you have to deal with the latest craze of ne'er-do-well metal thieves chopping off the cables. I have to assume that a large part of the exorbitant price of charging is due to the exorbitant cost of installing and maintaining the chargers - i.e. rapid charging might always be a rip-off and not necessarily because of profiteering but because of the massive overhead costs of running them.

I think the long-term solution is two-fold:

Firstly:

EVs need to have sufficient range for their purpose. Tiny EVs marketed for inner city use can get away with a tiny battery whilst family/business EVs should (entirely in my opinion) have enough range to be able to handle 99% of regular journeys without needing a rapid charger.

My own yard stick is: My EV needs to be able to cover a minimum distance of 200 motorway miles driving at <u>the legal speed limit</u> in winter conditions. (N.B. it is quite common for EV drivers to brag about how they achieved a better range by driving at 50mph on the motorway. For me this is a deal-breaker.)

I had a Citroen e-C4 for three years with a 45kW battery and an advertised range of over 200miles. In reality when driving on the motorway I could not risk driving more than 120miles before needing to charge and this turned a ~400 mile journey to Cornwall with my kids (and a 400 mile return) into a "never again!" moment. The lack of charging infrastructure in Cornwall at the time compounded the misery. This was certainly a time when a even a humble granny charger would have made an improvement to the experience.

Now I've got a Polestar 2 which is an order of magnitude better than the Citroen on all counts, but the really crucial difference is that it is a long-range model with an 82kW battery - close to double that of the Citroen. This is a game changer for me - I can easily do a 200 mile round-trip from fully charged driving normally, using heated seats and A/C etc, and still get home with another 80+ miles of range remaining. In 4 months of ownership (well, 'lease-er-ship') I haven't needed to use a public charger once and don't envisage needing one any time soon.

Secondly: "Graze Charging" - Almost every time I have needed to use a rapid charger, my car has been parked for multiple hours with no access to power and could have easily been topped up enough to avoid the need to make a detour and delay my driving time at a rapid charge point.

As per my initial point about the cost of chargers, I'm convinced that if some ~7kW chargers were available at the majority of car parks (and ideally half the price per kWh or better compared to rapid chargers) then the demand for rapid chargers would fall drastically and we'd all be a bit less obsessed with trying to push a huge amount of power into a battery in the shortest possible time.

Back on the topic of BYD - My gut feeling is that this new breakthrough, if it's viable, it likely to be even more costly than the current rapid charging options. I did look at BYD's cars when choosing my latest EV but the reviews were not particularly good and given they were similarly priced to the bigger names in the market there was nothing to inspire me to look at one this time round.

Photoshop FOSS alternative GIMP wakes up from 7-year coma with version 3.0

Re: GTK3!? Oh no!

Wow, this is great news, thank you.

Let the GIMP project be a shining example to all other GTK application developers of providing user choice! :-)

GTK3!? Oh no!

The screenshot in the article appears to be on a Mac but if looks dangerously like there is no menu bar...

Somebody please tell me they haven't caved in and moved random buttons into the title bar along with a hamburger menu on the Linux version?

OK, Google: Are you killing Assistant and replacing it with Gemini?

Let's see....

I've always refused to have any of these devices in my house on two counts: Firstly major privacy concerns, secondly; they are really annoying. It's really hard to disable on a phone as well - no single on/off setting... There is one exception where I occasionally use Google Assistant and that is: in my car...

My previous car had Android Auto which was exceedingly disappointing: The primary function I used it for was to play my kids' random song requests whilst driving.

But it would often go like this:

ME: 'Play Baby Shark'

ASSISTANT: 'You need to set up Youtube Music'

ME: 'Ask Spotify to play baby shark'

ASSISTANT: 'Ok, asking Spotify to play Raining Blood by Slayer'

I can't remember which songs we actually involved but this exact scenario arose more than once. At least the kids found it hilarious!

Sometimes the default song would be the wrong one, so you can say 'Ask Spotify to search for the birdie song' but then you need to use the touch screen to chose which version you actually want.

My latest car is built on Android Automotive (AAOS) which is similar but different to Android Auto (Seriously, who passed these product names through Marketing!?!?) and the assistant on that is a step worse.

ME: 'Ask Spotify to play Baby Shark'

ASSISTANT: 'Sorry, I didn't understand that'

ME: 'Play baby shark'

ASSISTANT: 'You need to set up YouTube Music...'

ME: 'Open Spotify'

ASSISTANT: 'Opening Spotify'

But now the only way I can find to voice search in Spotify is to interact with the touch screen to press the search icon and then press the 'Speech to text' button. Given this is all on a touch screen it requires me to divert my attention from the road to achieve this :-(

At one point one of my children really got into a French band called 'Kids United' and would ask me to play things like 'On Ecrit Sur Les Murs' - It's safe to say that Google Assistant cannot handle non-English words when set to English. I'd hazard a guess this means that you're a bit stuffed if you drive your car onto the continent unless you want to go the whole hog and talk to your device in the local language as well.

So if Gemini can handle these tasks then it will be a step forward.

However, the whole voice interface needs to get a whole load better to be genuinely useful - For starters I do not need it to repeat back to me everything I've asked it to do. It would also help if it were less disruptive - i.e. when a song is playing I can't queue up another one without it pausing the one being played. Ideally I'd be able to just say "Play agadoo next" and it would add it to the queue silently and without interrupting Baby Shark.

Likewise I can now fairly reliably press the mic button on my steering wheel and say "navigate to Westward Ho!" but when there are multiple route options and I want to select the one which is only 5 mins slower but 20 miles shorter, if there's a way to do this verbally I haven't figured it out yet so it's back to interacting with the touch screen again (Side rant: I hate touchscreens and they are nothing short of dangerous in cars. Bring back physical buttons!).

So let's see what Gemini brings. If I can control all the bells and whistles of my car by talking to it in plain English then in spite of my general AI/LLM scepticism I might be persuaded to use it,

Fresh Wine-flavored version of Mono released

Re: Web apps

"especially now Internet Explorer is retired"

And now you just get all the fun of dealing with all the Safari users instead!

Okay: Safari is not as bad as IE but it has caused me very significant pain on a few occasions due to its nonstandard behaviour - stuff that works fine in Firefox and Chromium based browsers but not in Safari.

I wouldn't mind so much but Safari is only available on macOS/IOS devices and therefore requires developers to purchase expensive Apple kit to be able to test it!

Satya Nadella says AI is yet to find a killer app that matches the combined impact of email and Excel

Re: Two bad examples

This is exactly the point I was going to make!

Excel's position as a "killer app" is more like being the lowest common denominator. It's flexible enough to let non technical people do practically anything they wish and I'd argue that this often harms "productivity"

For example I'll be asked to take an arbitrary list of tasks or goals written in Excel by a project manager, and manually add related ticket numbers (e.g. JIRA) and their status. It's then expected that these statuses be manually synchronised periodically with the real tickets. It's pointless and stupid but the powers that be don't see anything wrong with it.

Got a list of project issues? Excel

Want to manage a list of hardware assets? Excel

Want to draw a crude block diagram? Excel

List of team members/contacts? Excel

Heck a friend of mine who's a true power user and did national statistics for a living, ended up making a garden plan in Excel because it was just the tool he knows best!

In my own work environment Excel + OneDrive can't even handle the most basic synchronisation as still doesn't seem to support any kind of collaborative editing...

Create a new excel file and save it. Immediately there's a warning that the Server version of the file has changed and would I like to keep my version or the server version!?!?! It's a new file for Christ's sake!

And then people decide to send spreadsheets to multiple people by email for editing so then you end up with multiple edited forks of the original file. In some cases the owner of the file will then spend hours copying and pasting bits from the various edits into the master version...

It's a hideous mess and I can only hope the the "killer" AI / AGI / LLM application is something significant better and more meaningful than email spam and crappy "creative" uses of Excel.

GNOME 48 beta is another nail in X11's coffin

Re: I can feel the downvotes coming! Be gentle.

"It's nice to have choice on Linux"

I completely agree and I'd very much like the choice for modern GNOME to stop shitting all over my MATE desktop.

I personally find GNOME to be unusable - it's a frustrating and horrible experience for me but I'm perfectly happy to accept that it works brilliantly for others.

However they've taken a very deliberate decision to remove all backward compatibility with traditional UI concepts in favour of their own mobile/touch-centric interface which means that a significant number of other desktops now have a bunch of applications which do not obey the theme of the desktop and have hamburger menus and all that other nastiness.

Unfortunately this pretty much shatters the illusion of choice and even XFCE has caved in and gone down the Wayland and Hamburger Menu path.

Re: So long since

It's still very much the latter:-(