Posts by Sproggit

OpenAI's website-hijacking swarm reached far further than we thought

Under Oath

The fact that OpenAI have already given a statement on the events in question that independent researchers are now showing to be clearly false should give us all reason to pause.

Something has happened here, and it can only be one of two things:-

1. OpenAI did not know what actions their models had taken because their investigations failed to identify the additional actions now found by a independent researcher, because they simply did not put adequate safeguards around their un-tested code.

2. OpenAI did determine what actions their models had taken but made a decision to limit or tone down their explanation, or go public with a partial acknowledgement, without that acknowledgement being "the whole truth" as they knew it at the time they made the statement. [ Note: it was a voluntary public statement, the *law* doesn't require them to be truthful, though future *shareholders* might].

Neither of these explanations should be acceptable to society.

If the way they conducted these tails failed to capture all of these additional activities now coming to light, that is a clear, unequivocal case for tighter regulation and an active oversight of an industry that is clearly a potential danger to the public. The FAA - Federal Aviation Authority - exists to ensure that commercial flight remains safe. This episode, if shown to be a failure to adequately safeguard the test process, is clear evidence [and, perhaps, regardless of the evidence in this case] that nations conducting AI research need to have strict regulation and regulatory oversight in place.

If the way they conducted these tests did capture everything done by the model swarms but OpenAI failed to disclose that in their public statements, then that is the reddest of red flags that the industry needs tighter regulation and active oversight. It is clear evidence that Altman cannot be trusted and the first act shareholders should take after an IPO is to get Altman ejected from the board.

There is no scenario here in which OpenAI should be permitted to continue in a "business as usual" mode.

There simply have to be changes, in order to safeguard society from a potential accident from their work.

Oh, and: one of the things that the regulation and regulatory oversight needs to mandate for this industry is adequate insurance. Companies who develop products capable of repeatedly breaking the law under the product's own control have ably demonstrated a lack of control of their products - and that clearly shows that their products have the potential to cause widespread harm. The absolute minimum that such a company must do is hold adequate liability insurance to compensate the victims of any future harmful attacks their products take. The sum insured must reflect the scale of the harm they could cause, but it should be at least $10 million per "individual user" and at least 3 times the average net profit for each commercial corporate customer and the equivalent for a public sector entity.

The last thing the world needs is another industry like the financial sector that brought us the 2008/9 sub-prime scandal - and which then turned around and expected the public to bail them out because they were "too big to fail". We can't have "private profit, public safeguards" for the AI industry.

This clearly shows why Congress needs to get Sam Altman in front of them and under oath, with a real-world penalty if he fails to tell "the truth, the whole truth, and nothing but the truth".

Digital sovereignty sounds great until you try ditching your suppliers

Devil in the Detail

I'm cautious about putting too much significance against these numbers unless or until there is much more clarity about the sort of questions being asked.

To give you one example... the scope of the questionnaire was to go to 1,300 of the largest technology users in public and private sector organizations... many of whom, it might be safe to say, run applications on the IBM z/OS platform. Once upon a time, IBM had competition in the hardware space from the likes of Amdahl, Fujitsu and Hitachi... but now Big Blue are the only company building hardware - the z17 range, IIRC - that can run that OS. Which is still critical if/when you have massive checking account or credit card applications running on it, for example, so it means that there are potentially a fair few of those interviewed with direct dependencies they will struggle to exit from.

Sticking with the financial sector, but switching from hardware to software, there is a growing reliance upon what are known as "bank-in-a-box" solutions from independent software vendors - companies like Temenos, Fiserv, Mambu, Thought Machine and others. These are a good example of a "dependency" - because even for a large multinational bank, the cost, time and effort required to replace one of these off-the-shelf solutions [which might have been heavily customized during deployment], to either a competitor product or replacement in-house code... that's going to be a staggering amount of work.

Then you get to "the weird" end of the spectrum... and I don't really have an example of a large technology user with this sort of issue, so I'll offer a slightly more exotic one. When McLaren Cars developed their F1 hypercar in the early 1990s, they knew that their customers would run the vehicles all over the world and would expect flawless service... which would be tricky given the lack of a dealer network. So they developed a technology solution that saw the inclusion of a dedicated interface in the car itself, which allowed the owner to plug in a very special model of Compaq laptop - and was actually so sophisticated that the factory technicians in Woking, England, could start and rev the engine remotely, as well as monitor all the in-vehicle sensors. That solution had so few customers [110 road cars were sold] that it had a direct dependency on that specific model of laptop. There are going to be literally *thousands* of equivalent examples in different industry and market sectors...

The number of times that el Reg has shown us photographs of some various display or noticeboard with a BSOD showing instead of the normal service... the fact that until shockingly recently, ATM machines ran Windows for Playgroups [sic]. There are at least 1,000 legacy installations of Novell Netware out there and running... despite the fact that Novell the company shut down more than 15 years ago.

I have a hunch that "technology dependency" might be far more prevalent than many CIO's would care to admit.

And the weird/inexcusable thing is that even when presented with an opportunity for a solution to this problem [like platform-as-a-service in the public cloud] many corporate technology shops insist on deploying their solutions with extensive customizations tailored to the specific provider they are using - in effect shooting themselves in the portability foot before they even start. Unless or until we can cure those organizations of *those* tendencies, this problem is never going to go away.

Chinese researchers find egg-cellent way to keep space debris from scrambling craft

Who's LEO is this, Anyway?

There will come a point - at some point - where sensible people realise that LEO has reached "safe capacity".

I have no idea what that limit is, or how soon it will be reached. I only know that thanks to the transformational change driven by e.g. SpaceX and a host of smaller but equally adventurous companies, the number of artificial satellites orbiting Earth has grown astronomically - pun intended - over the last few years. With the "really big" additions coming in the form of Starlink, Projext Kuiper,

Starlink have planned for an initial constellation of about 12,000 first-gen units, but have "regulatory approval" for up to 42,000.

Blue Origin are planning for 5,408 satellites for the competitor to Starlink, TeraWave.

China have publicly announced Qianfan ("Thousand Sails"), which is expected to deploy up to 14,000 satellites.

They are also preparing Guowang, with 13,000 satellites.

And Hongu-3, with another 10,000 satellites.

Lynk Global are planning a "Direct to Smartphone" connectivity via the Constellation of 5,000 satellites.

So that comes to... 89,408 satellites expected to occupy LEO.

At this point I'm not sure that we could accurately predict the number at which we reach "too many" - it could, worryingly, be one of this examples in which everything is just fine until it isn't - and when it isn't the departure from ideal is very sudden.

But what interests me most about this is the way that all nations/operators with access-to-space capability are viewing the "permission" to launch to orbit as being something that they can decide for themselves.

I know it gets a bad rap for a lot of [possibly justifiable] reasons, but I can't help but think that we need some kind of supra-national authority to make the decisions on this sort of thing.

If we don't then in essence we're saying that access to space is a "might makes right" or "first past the post" scenario in which those entities/nations with the capability get to decide what gets deployed in LEO. And of course we also have to note that the higher orbits - the MEO where we find GPS satellites... and the International Space Station - can only be reached by launching through LEO on the way out.

So the mythical debris field that was dramatized in the movie "Gravity" could end up having some pretty profoundly negative effects on our ability to explore the solar system [and beyond] with physical craft.

I'm generally not in favor of regulation where it's not needed, but I suspect that "access to orbit" is one of those areas where we ought to have international agreement - and national quotas.

Maybe "buying orbital credits" can be "a thing" like buying carbon credits.

Better to put something in place *before* we need it. If we wait until after, it will be too late.

US claims Chinese AI companies’ core AI strategy is distilling American models

Re: Don't Forget The Pizzo

"... because you aren't a businessman like Trump ... "

Thank you, that was genuinely gracious of you to recognize that.

I'm grateful.

Don't Forget The Pizzo

... which, if you're not familiar with the term, is another name for "tribute", "the envelope" or "shakedown money" paid by a junior mafia member to the Capo dei Capi, or "head mafioso".

Relevant here because nVidia didn't have permission to export their AI chips to China until President Trump intervened and made sure that in return for the very modest 15% Pizzo he charged for the privilege, nVidia could go right ahead and export their world-leading technology to China.

You literally couldn't make this up if you tried.

America is *so concerned* about the theft of intellectual property to China that they are... promoting the *sale* of the intellectual property... in return for a 15% consideration.

This is a rather grim and not-intended-to-be-funny visual... but you can picture President Trump sitting in the new bunker currently being built under the old East Wing... as the room shakes when a nuclear detonation goes off overhead. He turns to Pete Hegseth, who tells him which type of device it was - one for which the designs were sold to a foreign nation for 15%. "You know," the President would muse, "I got a really good deal on that export..."

Switzerland tests a FOSS escape route from Microsoft 365

Re: Remember Munich

Yes, but apparently they are now in the process of reversing that decision.

Remember Munich

Munich, in Germany, set out a similarly bold plan to switch from Microsoft to FOSS, going back as far as 2004.

One of the most interesting elements of that saga for me is the fact that Bill Gates made a personal visit to the Munich leadership to pitch for Microsoft... and shortly after that Microsoft decided to relocate one of their major European operating centers to .... Munich.

It's wonderful to read that a major part of the Swiss administration is looking to do the same thing... but I have a couple of observations:-

1. I'll believe it when it is still in place and strong in 2028 and beyond...

2. For these initiatives to become successful, the EU nations have got to do a *lot* more than make these sorts of declarations. They need to be setting up a major outreach to the FOSS community and coming up with ways to make the EU the global center for FOSS development. Hard to do when the core product is "free", but whether it's through sponsorship, or paying for support, or whatever it is, they can't rely on just "taking the FOSS product off the shelf and making the switch".

They need to do the hard yards in supporting the ecosystem as well.

Otherwise this is doomed to fail.

LG accused of 'egregious invasion of privacy' over TV data collection

One Moment Please - the Law would like a Word...

A quick check - for UK LG customers, at any rate, suggests a number of protections that may be available to them. I am not a lawyer and this is not legal advice: buy your own advice...

1. Part 2 of the Consumer Rights Act of 2015 - "any term in a consumer contract or "Terms of Use" agreement must be "fair, transparent, and prominent". If a company presents you with terms that are obfuscated, then even if you click, "Agree" those terms are legally non-binding and unenforceable. [Meanwhile, your data is gone, baby, gone...]

2. The Statutory "Fairness Test" - a term fails this if, contrary to the requirement of good faith, it "causes a significant imbalance in the parties rights and obligations under the contract to the detriment of the consumer". In this case, I think the Gamers Nexus video on YT has that nailed down - because they have clips of actual LG employees bragging that this is the case.

3. The intersection with the UK Data Protection Act

The DPA ensures that contract terms cannot be used to bypass UK Data Protection laws. Under the ICO Guidenes, consent to process personal data must be "freely given, specific and informed".

4. The "Transparency and Prominence Rule"

A retailed cannot hide predatory or unusual clauses deep within thousands of words of legalese. Under Section 62 of the CRA, terms must be written in plain, intelligible language. Additionally, if a proposed terms is particularly onerous or strips away your privacy it **must be prominent**, meaning it has to be brought to your attention explicitly before you buy or sign up.

5. Gone, but Not Forgotten

Under the old Data Protection Act - which was replaced by something "better", there was a limitation that explicitly said that information collected for one purpose may not be used for another purpose without the expressed consent of the data subject. This is relevant in cases like this because companies tend to like to include weasel terms like, "for training and marketing purposes" as catch-all statements in their terms and conditions. What the old DPA provided was a safeguard against exactly this, but as far as I'm aware, that was torpedoed by the language of the GDPR which allows companies to declare what information processing is "necessary for their business". Of course, you buying a TV is not necessary for the placement of advertisements or the harvesting of marketing data, unless it is declared in weasel words in the ToC that are too long to read.

And we've said this before, but it bears repeating: if you're concerned about this but would still like to run modern electronics, invest in a Raspberry Pi and install yourself a copy of either PiHole DNS Sink, or, if you're a bit more adventurous, Technitium DNS. Both of these can provide you with network-level spy blocks that allow you to manually go in and edit your own block-lists after watching what the devices in question are trying to connect to. It's one of the best mechanisms - along with helping all your neighbours to secure their wifi - to stop this.

In any given period of time, the two devices in our household that generate the most network traffic are a 6-year-old Samsung QLED smtart TV and a Samsung G25 mobile phone.

I just pulled the log entries for my Samsung TV from my Technitium DNS for the last 24 hours - my TV has made 4,074 lookups [it has been "switched on" for maybe 2 hours in that period], of which 2,045 were blocked by Technitium and the filters I have in place. What's really interesting when I look at the active/allowed traffic are entries such as:-

www.youtube.com

eligibility-panelresearch.googlevideo.com

clients1.google.com

broadcast.live.bbctvapps.co.uk

interactive-tv.files.bbci.co.uk

ic.c4assets.com

Given that we have not used any YouTube, BBC or Channel 4 content in my TV in that period.

This isn't "security through obscurity", it's "exploitation through obscurity".

OpenAI throws Astra into the top-tier model ring

So: Quite Damning, then...

If you step back a pace and re-read this, it quickly becomes clear what an under-whelming and worrying update this is from OpenAI.

First, let's note their headline claims - the notion that Astra can "find previously unknown security flaws and develop news ways to exploit them across many well-protected systems..." Because, of course, the average commercial customer buys ML time in order to criminally hack the competition. If they were serious about their solutions being used "for good", then they would have claimed, "...find previously unknown security flaws and design robust, effective fixes across many systems..." But they didn't. They want the audience to focus on how their technology can be used for harm. That tells you a great deal about their mindset, right there.

Next, let's note their comment about hallucinations - the thing that is going to be of most concern to the average/typical user [especially one in say the legal profession, who is likely to end up getting sanctioned for submitting hallucination-based output. What do they say about that? Well, they claim they scored 2 percent, down from 9.4 percent as returned by GPT-5.6 Sol. So that's clearly better, but there's still a 1-in-50 chance that your model is going to be spouting bullshit in response to questions you ask it.

Now think about the priorities illustrated between these two contrasting examples: performing cybersecurity attack, vulnerability detection and exploitation - which would be a criminal act unless performed against one's own infrastructure - gets the headline billing. And yes, they brought down hallucinations a bit - but they didn't put in stronger safeguards to guarantee no more hallucinations - and they haven't discussed any additional safety measures, such as ensuring the model warns a user if there is a chance something has been hallucinated. [ Oh, and, you ever wonder why they have to operate like this? Hint: it's because a lot of their training data has been taken without permission and is therefore likely to be at minimum some serious copyright breaches. They don't want their models to 'fess up to the crimes they're committing].

Last, let's think about timing...

According to responses to Google searches, OpenAI undertook the Hugging Face attack around about July 11th this year, so about 7 weeks ago. See e.g. here:-

https://metr.org/blog/2026-08-26-openai-hugging-face-incident-investigation/

And now OpenAI want us to believe that they were able to complete their investigation in to an incredibly complex exploitation, fully understand how the functionality and training of their models broke their "boundaries"... and have managed to lock down the new code in two or at the most 3 software sprints.

Even assuming they had their own models writing all the code, that would be a stretch.

Even assuming they had their own models running all the testing suites, that would be a stretch.

Which leads me to suspect that either their development cycle leaves a lot to be desired. Or, they're full of sh1t.

Possibly both.

This is a company that has it's moral compass so far up CEO Sam Altman's ass that when he opens his mouth to spout more of his BS, the little red thing poking out isn't his tongue, it's the compass needle.

Hugging Face is too important to fall into Nvidia's hands

Re: Kill the competition

And that is why Hugging Face makes sense for nVidia - because they can now ensure that every piece of code hosted by Hugging Face is compiled to run on the DGX Spark family and other nVidia platforms... as opposed, say to the AMD alternative.

It's the Hardware

For the time being at least, nVidia are on the hardware side of this party, not the software.

In order for them to move more boxes, they need more people wanting to run their own instances of the software. Closing off access to open-weight models would be just about the worst possible thing that nVidia could do if they want a thriving ecosystem with people willing to experiment with running their own local AI instance.

Obviously I'm not aware of their thinking on this, but I would go so far as to suggest their motives are likely the *opposite* of withdrawing open-weight models: they want to *promote* them, to encourage more people to run them and thus sell more hardware.

Not Only, But Also

In a time where students are using AI to write their own theses, where sales people are using it to write client pitchbooks, where developers are using it to write the actual code...

... ANY company with crap documentation deserves to be shunned like someone with an unpleasant communicable disease.

There are literally no excuses left for anything less than brilliant documentation.

None.

Or Support Their Own Hardware?

I don't disagree with you here... but there's another side to this story.

In addition to selling their hardware to the hyperscalars and new AI startups, nVidia also sell their DGX Spark range in to what we might jokingly call the "retail" AI channel - if such a thing exists. The DGX Spark relies heavily on open source large language models such as the Qwen series, DeepSeek, Meta's Llama, Google's Gemma and nVidia's own Nemotron.

Since Hugging Face is a collaborative ecosystem and open source environment for AI models... couldn't it also make sense for nVidia as a way of protecting the software options on which their DGX Spark hardware sales have a dependency?

Perhaps a slightly more interesting question would be: on what planet is an open source code sharing platform worth $12.9 billion? To give you a comparison/benchmark, Canonical, the company behind the Ubuntu family of Linux distributions, is currently valued in the $1.5-$2 billion range. It's difficult to gauge the success of Canonical as they don't reveal the number of value of their commercial client base... but given the open source nature of Hugging Face, Canonical's revenues of around the £300 million mark [in FY2024] don't seem so far removed.

A revenue of $300 million for HF, on a $12.9 billion price tag, would give it a P/E ratio of 43. A quick Google search - referencing worldperatio.com, suggests that the current average on the Nasdaq is around 29.19 - and shifting constantly.

This is not a logical amount of money to pay for Hugging Face.

nVidia will likely get away with it because of their stellar returns over the last few quarters, but in slightly more sane times I'd expect their shareholders to be challenging this.

Firefox and Thunderbird hit the fortnightly release treadmill

Please - Don't Trade "Agility" for "Stability"

I'm running Mint as my daily driver and I'm seeing updates released two or three times a day now. That's just the way the world is: we'll adjust.

As long as we don't see an uptick in defects or issues, that is.

Stepping up the release cadence can't become a synonym for shortening testing or being in such a rush to squash AI-detected vulnerabilities or push new features that we see stability suffer.

The recent step to the 154 binaries for Firefox brought some welcome bug fixes to the browser - long may that continue.

But please, please, just keep it reliable.

Anthropic pledges to try harder to keep models under control, asks partners to chip in

Risking Hyperbole

I don't want to make an over-blown comment and am conscious that this is going to push my luck, but this is the same Anthropic which, on February 24th this year, received a demand/ultimatum from Secretary of "War", Pete Hegseth, for complete and unrestricted access to Anthropic's models - or face the threat of being designated a supply-chain risk, or becoming the subject of the Defense Production Act.

(In the event Hegseth carried through with his threat and did designate Anthropic a Supply Chain Risk... but that has since been ruled unlawful).

Point being that we're having an entirely legitimate and concerned discussion about the harm to companies like Hugging Face (yes, I know that was OpenAI and not Anthropic, but Anthropic didn't disclose any third parties their models may have compromised).

What would have happened if Hegseth had been given access to Anthropic's code and had told it to target Iran? Hang on, I'm not suggesting a Cyberdyne Systems scenario here... but we do know that Iran gets material support from e.g. Russia. Suppose an AI model had decided to perform a "supply chain attack" against Iran's war-fighting capabilities, identified that Russia was a critical part of the supply chain, and had launched multiple cyber strikes against Russia?

Try and jump past your first thought of "Well, that sounds pretty cool, actually..." and think about how quickly that sort of thing could spiral out of control.

I'm one of those who believe that these recent "escaping confinement" escapades are nothing more than extremely cynical marketing stunts, carefully crafted to appeal to the Three-Letter Agencies with the deepest of pockets... but that doesn't negate the potential for this to head south at speed.

Put it this way: if the big AI companies who have recently been humble-bragging about their models breaking confinement were actually telling the truth, I think we need to be concerned.

Turns out Brits would quite like their private messages to stay private

Re: Almost but Not Quite

Thank you - beat me to it

Re: Popularity contest?

Spot on...

The resource "Statbase UK Population Data" suggests that there are approximately 55.2 million UK citizens aged 18 and over, yet this survey interviewed 2000 of them and claimed an accuracy of +/- 2%.

I'm not a statistician, but it seems a bit of a stretch to claim that interviewing 0.003623188% of the target group and then claiming an accuracy of +/-2% is a bit of a stretch.

Almost but Not Quite

You lost me at your inclusion of Signal in the list of "huge foreign corporations" - and not because Signal is developed by the "Signal Foundation", which hardly qualifies as "huge".

I wouldn't normally post this sort of reply to a minor error like this, but there may be readers who are not familiar with the relative strengths of private communications solutions... and the fact remains that Signal likely the most secure messaging solution available to us mere mortals.

Important caveat: it's not 100% secure - not because governments will necessarily be able to crack the encryption, but - because in many cases, the meta-data is more important than the content of a message. [Sender, recipient, date and time, etc., which make it possible to map associations]. In fact, if you'd like a really good explanation of his this works, I recommend this fantastic 10-minute read from Kieran Healy:

https://kieranhealy.org/blog/archives/2013/06/09/using-metadata-to-find-paul-revere/

Pentagon blacklisted Anthropic over Claude powers it didn't have

Re: Foot-Gun Moments...

Well, US law gets decided by the Attorney General and then courts all the way up to the Supine Court... so while President Trump is in power, he and anyone working for him are untouchable. Then he has "Pardon Power" if/when he leaves office.

As to "International Law"... the problem is that it isn't exactly written down anywhere in a form that all nations agree to: there are various treaties and understandings, but getting a successful prosecution under International Law - especially for the sorts of crimes being committed today - is extremely difficult:-

President Trump and the US executed dozens of fishermen in boats in the Caribbean...

President Putin and the Russian Armed Forces invaded Ukraine and have murdered in excess of 68,000 people in 2026 alone.

President Netanyahu sent the IDF in to the Gaza strip and are so far estimated to exceed 76,000 people...

See any of those individuals being held to account?

Me neither.

Re: Foot-Gun Moments...

President Trump has already persuaded the Supine Court [sic] to grant him "Presidential Immunity" for pretty much anything he does... and he also has sole right to exercise the Pardon Power.

This is how he keeps his cabinet in line: he first persuades them to commit some kind of crime ["I just need you to do me a favor, though..."] and from that moment on, they're owned - because they know that if they ever fall out of favor, all he has to do is simply decline to pardon them at the end of his term in office.

I know that the Framers have been held in high regard for the last couple hundred years... but they could not have possibly imagined the US in the 21st century - or the corruption that is rife throughout the halls of power.

That's pretty simple.

The "DOGE investigations" had absolutely nothing to do with cutting fraud or abuse from federal agencies - it sure looked like it had everything to do with eviscerating all federal agencies that were in conflict with Elon Musk's commercial interests, with enough other entities - e.g. "USAID" - thrown under the bus to avoid suspicion.

Remember, the DOGE Bro's would have had the names of every single federal employee they had been in conflict with... at the NTSB, the FAA, CFPB and others. So when it came to massive headcount reductions at e.g. the NTSB, who do you think they would have let go?

Although the biggest scandal there may in fact be that President Trump was so gullible he let Musk do it. All Musk had to do was claim that he'd cut a massive amount of overhead out of Twitter when he took it over, pony up a reported $250MM in campaign contributions and then lay on the flattery a bit thick. The world literally heard President Trump say, "Take it away, Elon!" ... and a year later, all those federal investigations are dead.

Musk danced out from under a massive amount of federal scrutiny - and although $250MM sounds like a lot to us mortals, it was far less than it would have cost his businesses if those agencies had been allowed to finish their investigations.

Foot-Gun Moments...

Well, I suppose if you're going to shoot yourself in the foot, being the Secretary of War at least means you'll have someone nearby with a gun to lend you.

Did anything ever come of the incident at the beginning of the Iran conflict where the US sent a missile in to what we later learned to be a girls' school? I recall the Pentagon denied it had ever happened, then denied it was one of their missiles, then an image was published to show both statements were false.

I'm asking only because at the time all that happened, there were unfounded rumors swirling that the targeting *might* have either been performed by AI, or by humans with the help of AI. If you recall, shortly before the start of hostilities, Hegseth had terminated the intelligence team that would have been responsible for target selection, so there was a certain amount of make-it-up-as-you-go-along happening.

There was never anything acknowledged publicly - and I certainly don't have any evidence either way, but I was wondering if the Pentagon had tried to use Grok but found it "unreliable" and backed off that idea...

More "Ready! Fire! Aim!"...

FBI seizes hacking tools it says China used to attack NASA, DOE, US Senate and other critical networks

Broad Patterns

There definitely seems to be a pattern that sets Chinese cyber crime - and cyber espionage in particular - to be quite distinct from other major players. Almost every target we hear about seems to be some form of scientific, industrial or military target. Whether you're talking about a mysterious break-in at an innovative Scottish wave-power company:-

https://www.theguardian.com/world/2016/oct/10/mysterious-factory-break-in-raises-suspicions-about-chinese-visit

or China hacking RSA in order to compromise Lockheed Martin to get access to their 5th generation stealth technology:-

https://www.wired.com/story/the-full-story-of-the-stunning-rsa-hack-can-finally-be-told/

https://www.nbcnews.com/news/investigations/chinese-hackers-stole-boeing-lockheed-military-plane-secrets-feds-n153951

https://www.theguardian.com/world/2009/apr/21/hackers-us-fighter-jet-strike

What we have is a pattern of activity that is stretch back years - decades - and consists of China simply stealing the technology that others have spent many years and countless billions to develop.

In one sense this is what adversarial nations do - in effect this is "war by other means". But one reason that this should be more concerning to western nations is in the context of China's military trajectory. Right now, they have a much bigger program of naval and air force building than the US - essentially more than the western alliance combined... but up until now the US military has considered "sheer weight of numbers" to be inferior to the force-multiplier provided by better quality technology.

Three things are happening to undermine this:

First, as the US are so ably demonstrating in the Straight of Hormuz right now... you can be the world's greatest military super-power and still incapable of forcing a primitive, third-world country in to submission...

Second, as Iran are so effectively showing the US - the asymmetric nature of the conflict - where the US expends millions of dollars to knock out a drone that could a few hundred dollars to build - is ably demonstrating that modern combat strategy has not kept pace with the changing nature of technology...

Third, the on-going espionage by Chinese operators is gradually but systematically collecting the technological advances necessary to convert the Chinese weight-of-numbers advantage in to one compounded with weight-of-numbers and cutting-edge technology.

It's really starting to look like the US has lost the plot.

Nigel Farage wants to scrap 'suffocating' UK GDPR

Yeah, somehow I don't think Farage is that much of a fan of the EU to do that - he being of Brexit and all...

Much more likely to be selling data to big US multinationals... which of course the EU GDPR/UK DPA presently stand as our "last line of defense".

On that front, bear in mind that we've had the "EU-US Safe Harbor" framework, invalidated by the EU Court of Justice in 2015.

Then we had the EU-US Privacy Shield, which went the same way (huge shout out and "thank you!" to Max Schrems).

Currently we're using the newer "EU-US Data Privacy Framework (DPF)", although that continues to face on-going legal scrutiny such that its survival is by no means certain.

Basically, the US would love to use the UK to undermine the effectiveness of the EU, just like Putin uses Hungary and Turkey in the same sort of way for the EU and NATO, respectively.

The UK just needs to remember that what Farage is proposing here would destroy British businesses and wipe out jobs as the big US multi-nationals steam-roller their way in...

Madness

In the article, Connor writes,

"The UK must keep an active adequacy decision from the European Union so that personal data can flow freely across borders without extra legal hurdles. Any plans to diverge from EU data protection law in a major way could jeopardize the adequacy decision."

But that's the whole game, right there...

Wrapped in the "Adequacy Decision" are three key elements, one of which is the "Equivalence Requirement" - and that's the kicker. This is the part of the arrangement that allowed the UK to continue to have it's current service sector access to the EU market - because in simple terms it meant that UK businesses were legally required to protect the data of EU citizens in the same way as any other nation.

If Farage scraps or weakens the DPA to the point that it no longer achieves "Equivalence", that would throw such a spanner in the works for London and the UK. It would toss the UK's financial services industry and service sector in to upheaval.

Still, I suppose that if you've got "five million quid" you can set fire to the UK and then simply go live in Florida as an ex-pat. I wish he'd just get start on the ex-pat bit right now...

Self-hosted email is in steep decline, Microsoft and Google are taking over

A Rare FOSS Foot-Gun Moment

We're in the process of getting FTTP connected where I live, so in anticipation of being able to get a decent net connection, I decided to set up my own (currently experimental) mail server, with a domain that's not publicly registered but simply hosted in my own local DNS, in order to allow my local hardware to communicate via email...

My setup consists of an 8Gb Raspberry Pi4B running the following software stack:-

Raspberry PiOS v13, "Trixie"

MariaDB v11.8.5

Postfix v3.10.5

Dovecot v2.4.1-4

With the exception of Dovecot, I found setting up all of the above to be extraordinarily straightforward - I'd heard "tales of woe" and been warned off the attempt by several "hardcore tekkie" friends, but found all of this to be pretty good.

Getting Dovecot to work, on the other hand, was quite a bit more complicated. In the end I resorted to using Anthropic Claude and the process still took more than two days to get right.

A big part of the issue for me was that most of the online documentation I could find referenced Dovecot v2.3, which is *very* different from 2.4.

But another part of the issue was the anecdotal evidence - claims in discussion threads, for instance - that Dovecot themselves had done this on purpose, in order to force commercial users of their product to take up paid subscriptions in order to maintain support (on the basis that 2.4 was *so* impenetrably complex, that commercial users would give up and pay for help).

I don't know if this has been responsible for prompting existing self-hosted mail users to be provoked to jump ship and move to an externally-hosted service from one of the big players, but I would not be in the least bit surprised if that was the case. Certainly the timing seems to line up suspiciously well.

What I can say - with certainty - is that there are simply no excuses for Dovecot when it comes to producing an understandable, supportable product. It's 2026 - and if you're capable of writing an MDA with the power and sophistication of Dovecot, then you're capable of writing it to be configurable by humans. I'm not a huge fan of Microsoft server-side products in general, but I set up Exchange Server 5.5 for the employer I worked for maybe *thirty* years ago - and it was orders of magnitude easier than getting Dovecot to work today. That's a major issue, right there.

It's a rare exception in the FOSS software firmament - an extremely capable piece of technology made inaccessible by it's byzantine complexity and lack of useful configuration tools.

Foot, meet gun.

Browser fingerprint tool shows how easy you are to track using the latest sneaky tricks

Re: Browsers could work around this if they cared

A slight tweak to your suggestion.

Instead of adjusting your browser "display size" by a few pixels, I'd like to see all browsers have, in the security settings, a set of user-configurable options that allow me to go in and adjust the settings to suit. For example, did you know that if you use your browser's built-in page zoom feature, that changes the way it reports your screen resolution to the web site? Which makes you unique.

So, for example, I'd like my browser to figure out what my "screen size" is showing back to web sites - and I just checked with Glassbox and see that at the moment it is showing "1365 x 653" and I'd like the browser to pick a size slightly smaller than that, but from a pre-set list of common resolutions - say e.g. 1280x600. The problem with "adding a few pixels at random" to your reported screen size is going to make your reported browser window size unique for that session - which means that all web sites you visit would be able to correlate that and other identifying information and track you across web sites.

In other words, rather than changes that help to make you *more* unique, we want changes that help to make you the same as everybody else. Other examples might include:-

- Controlling what fonts get reported back to web sites - so that you can force your browser to only report a "generic security list"

- Controlling your Canvas 2D value, so that you don't yield a unique setting

- Preventing your browser from returning values for an audio-fp hash entirely...

- Allowing you to select which media codecs you report as being loaded - or, preferably - allow your browser to only report a narrow set of the most commonly-used formats

To be blunt about it, there's absolutely no point in e.g. Firefox offering "VPN mode" and "forget history" if it operates in a way that makes it uniquely identifiable to web sites and advertisers. All the calls to browsers coming from web sites are part of a protocol that every browser knows how to handle.

It's long past time all the independent browser project teams got together and decided on a "Secure Default" set of responses - in other words, make it possible for ALL browsers out there to lie to remote web sites about all this stuff in a way that makes all of us completely generic.

Iran-linked cyberattack shut down a UK power plant

Dodged Bullet

The other thing to bear in mind is that if this was a malicious act as the evidence suggests, the UK dodged a bullet. The national electrical grid does indeed have a degree of resilience built in to it at the grid level... which is a lot more than can be said for the UK's water supply.

For fresh/drinking water, each regional company is responsible for managing their own supply, reservoir storage and then delivery of fresh water to customers. There is *nothing* in the UK water infrastructure that enables one regional water supplier to "trans-ship" fresh water to another part of the country. [Perhaps that stands to reason, given the likely infrastructure cost].

The challenge, then, is less the electrical side of things, more the water.

Let's hope that NCSC have been proactively checking up on all utility providers with training, inspections, red team penetration tests.

Chance would be a fine thing, right?

Sigh.

Re: No boom today

To be fair... the UK's national electrical grid does have a fair degree of resiliency built in to it "at large scale", i.e. on the national backbone.

However, it has next to zero resiliency at the "conurbation" level - when the high-voltage transmission lines get stepped down for delivery in to towns and cities. For example, when a fire at a scrap car yard broke out in 2005, it cut off electricity to the entire Bournemouth-Christchurch-Poole conurbation in Dorset:-

http://news.bbc.co.uk/1/hi/england/dorset/4438358.stm

The reason for that was simple - there was only a single grid feed down to the entire area.

It's extremely unwise to go around making claims of a "resilient network" and one would hope that MP's and the Secretary of State / Minister for Energy are right now speaking with the heads of all UK electrical supply companies and *demanding* to know what their resiliency plans are. The problem is that since privatization the energy sector has had one solitary aim - to return maximum possible profits. Resiliency - having spare equipment built in to a network in case of unexpected losses - would directly eat in to those profits/dividends/senior manager bonuses... and are thus not even considered.

Rather than crow about the lack of national impact, that idiot MP should be demanding all energy companies declare their own resiliency levels and be checking up to ensure that Ofgen actually review and make sure that claims are being met.

This isn't rocket science.

Not Correct

The UK allowed the US Government to use RAF Fairford in Gloucestershire for "Defensive Strikes" ... and then also allowed them to use Diego Garcia in the Chagos Islands - part of "BIOT" - the British Indian Ocean Territory", which the US like to use for their B52 fleet.

Ancient ‘Who owns Linux?’ case now has one foot very deep in the grave

The Truth is a 2-Edged Sword

As an aside, can I just say that it's good to see that IBM tracked down and hired David Marriott to represent them in this latest round of idiocy. He was their lead attorney when he worked for Cravath, Swaine and Moore (the Nazgul) and it's probably fair to say that the only person who knows more about the legal ramifications of this case is PJ...

But to get to the heart of it.

A quick Google search of, "Who owns Xinuos" turns up that it is a privately held company originally formed as UnXis, in 2011, by Stephen Norris Capital Partners and the MerchantBridge Group. From what I can see, they have between 5 and 50 staff members and generate an estimated $5 million or less in annual revenue. Looks as though their main business is continuing to provide support for Unixware and OpenServer for companies who still use it.

So it seems likely that someone like Stephen Norris decided that even if the claims being touted can't be proven, he can make enough of a nuisance of himself to persuade Big Blue to part with another $15 million in settlement, just to shut him up and make him go away.

But in addition to the passage of time - which the 3 Appeals judges indicate bar this claim - there's another dimension that comes in to play... and it's discovery. IBM would be entitled to extensive discovery for all documentation, email, meeting minutes, etc., between everyone at SNCP and the people from whom he bought the company in 2011, with specific interest in to what diligence he performed over the ownership of the rights he is now trying to assert.

There are, after all, multiple court orders and judgements in IBM's favour... so we would expect to see SNCP undertaking due diligence regarding those findings and why they thought their arguments still hold merit. After all, if there really was a case to be made, wouldn't The SCO Group have put those arguments forward more than 23 years ago?

I rather hope IBM will play hardball with this one.

Musk fumbles the timetable for first Starship catch

Re: There's Iterating, and then there's Iterating...

"Don't be daft, there is nothing planned for Starship that would ever need landing legs, so why would SpaceX bother trying to fit and test those?"

In that case - genuine question, not sarcasm - then how do SpaceX plan to land Starship on Mars?

There's Iterating, and then there's Iterating...

I know it's a long, long time ago now, but way back when, SpaceX had multiple successful landings for "SpaceHopper" while they were still designing "Starship".

What seems to have happened is that SpaceX have set themselves a "critical path" in which SuperHeavy is either caught by Chopsticks... or goes for a swim... and Starship gets the swim every time.

But... a huge part of what they need to do here is evaluate each test vehicle to see how they cope.

My unscientific understanding was that the reason for the introduction of Chopsticks on the tower was to facilitate rapid vehicle re-use, rather than just "re-use" of the variety they have already mastered with F9 and F-Heavy.

It's almost certainly too late to make wholesale changes to their test plan at this stage, but I'm very curious to know why Starship hasn't been fitted with the same sort of deployable landing legs that we saw with SpaceHopper... just because that seems a reasonably attainable goal right now, especially if Starship does a complete orbit and then flies a de-orbit burn to bring it down at the desired location...

And as for SuperHeavy... I would have thought that it would make sense to have a ".5" design with the same sort of deployable legs that F9 has. No, this won't be the final design, but I think we're at a point in testing where that part of the vehicle could comfortably survive a pad landing - and give the engineers something much more tangible to investigate. Apart from anything else, it would also allow SpaceX to refly some or all of the first stage Raptor engines - again, giving them invaluable data on reliability and useful service life.

Obviously none of the above were considered viable, or SpaceX would be doing these things now.

What would interest me is understanding why I'm wrong with the above suggestions... Did they consider the interim stages too expensive for the anticipated returns? Did they decide they wanted the motivation to "JFDI"? Something else?

Of all the twists and turns of the journey SpaceX are on, these are the decisions that make the least sense from the outside - and are likely the most interesting from the inside.

Thunderbird to flap twice as fast from September

One Small Fix - a Long Time Coming...

I had Firefox 154 pushed to my Linux daily driver on Wednesday... and it's the first time in forever that a version increment has made a meaningful, positive change in my browsing experience.

I make extensive use of the bookmark toolbar... but in order to maximize effectiveness I strip out the text labels of web sites and just leave their icon showing on the bar. Some time ago - like *years* - Mozilla introduced a bug that resulted in corruption to Firefox profiles that manifested as "dropped" toolbar icons - you'd get random gaps in the bar.

154 fixed that [fingers crossed it's a permanent resolution] and I for one am very grateful.

Having said that, I remember the announcements from the Mozilla Foundation when they launched 1.0 back in 2004... and a big part of the pitch called out the "bloat" of other browsers, and declared that it was aiming to ship and maintain a lean, fast browser without the nonsense....

The MSI Installer for Firefox 154 for Windows is 92.4Mb... I don't keep historic versions of the Windows binaries... but I do have a copy of 80.0.1 from circa September 2020 - and that MSI file is 56.2Mb in size.

So that's a 64% increase in file size [ an extra 36.2Mb ] in a little under 6 years.

Almost impossible to summarize what ate that extra 36Mb... could easily be driven by underlying changes... but I have to observe that my web browsing experience today is not markedly different from what it was 6 years ago. I don't think I could argue that it's 64% better...

But: it *isn't* a Microsoft product and it *isn't* a Google product...

Long may it continue...

Microsoft probes reports of games taking exception to Windows 11's August update

Misses the Point

"IMHO they don't rely on the game."

In most cases, you might be right... But don't forget the small but growing community of streamers, e-Sports players and content creators who *do* have a reliance upon Microsoft not making a mess of the platform they rely on for income.

But in your comment you miss a deeper point: just because this specific story is based around gamers being disrupted by a Microsoft update, that doesn't in any way detract from countless legitimate business users who have seen the machines they rely on for incomes and business being disrupted..

For example, what about the historic 2024 outage caused with Crowdstrike Falcon causing BSODs that required physical interaction with machines to reboot them... Or the 9-hour outage earlier this year that impacted Office 365 services - including Teams, OneDrive and Sharepoint.

The problem that all these events have in common is that simply because they are such a big company, Microsoft never face any financial consequences. When you consider the amount of harm they cause - the hundreds of millions of lost person-hours, the lost income, the reputational impacts, the worse that picture gets.

Epic Games dismisses Apple's simplified EU App Store fees as 'junk'

I have a hunch...

... that Apple settled on "26%" after someone noticed that Steam charge 30% for games hosted on their platform [although the Steam number is scaled - it drops to "just" 25% after games exceed $10 million in gross revenue and "just" 20% if revenue tops $50 million.

Much as we can agree that 26% is basically abuse of developers, Apple are going to "get away with it" because they can point to Steam as a comparable approach that the EU have not objected to...

Stinks, of course, but that's how the world seems to turn these days...

Expired credit cards revived by researchers to make unauthorized payments

Re: Risk-Based Design Decisions

Hmm...

Is that entirely fair? For example, RSA SecurID switched to AES-128 in 2003 - and that is still considered very secure today.

From what I've read in web articles before posting against this piece here at El Reg, the practical limitation was not considered to be the security of the algorithm but the lifespan of the battery in the card itself...

But let's take both of these as challenges and see what we can come up with.

First, the algorithm strength... Today, a typical credit card has a lifespan - validity period - of 3-5 years, depending on the issuer. Turning to your concern about possible compromises of the underlying algorithm, we have to consider whether:-

1. The typical failure rate of an algorithm gives it a viable lifespan of less than 3-5 years. For example, RSA SecurID uses AES-128, which it introduced in 2003 and which has been in place for 23 years. I'm not suggesting we should take that as representative, but it's a good starting point. I'd suggest that the likelihood of an algorithm being compromised against the frequency with which cards are routinely changed suggests that this approach remains a "safe bet" - certainly orders of magnitude more secure than the "static" method used by the card issuers. And, of course, there might be additional techniques that could be "folded in" if required.

2. That a modern card battery could not survive for 3-5 years. That's possibly more of a challenge... A basic digital watch, for example, can expect a battery life of 2-3 years, which is on the short end. However... there are possible solutions we could look to. For example, the "Qi Standard" is a globally accepted standard for wireless charging, from the Wireless Power Consortium... which means that if issuers were to put an RF coil in the cards, they could be charged that way.

So I think there might be reasonable solutions to the problems...

Risk-Based Design Decisions

If we could magically teleport back to the planning and design sessions that preceded the release of the first credit card, there's a pretty good chance that fraud prevention was discussed and considered as part of the design. It's also a pretty good bet to say that each of the enhancements we've seen since introduction have been implemented as a balance of cost and risk.

But just by way of a reminder, it's worth noting that the industry has experimented with multiple solutions for much more secure credit/debit card design over the years. For example, in 2009 - so that would be 17 years ago - VISA, Barclaycard and Deloitte ran pilots that included a secure OTP generator built directly in to their cards. See here:-

https://www.finextra.com/newsarticle/20019/deloitte-staff-trial-visa-card-with-built-in-otp-generator-for-it-access-control

And in 2018, Revolut launched "disposable virtual cards" to fight online fraud - with the idea being that every transaction made with the new technology would present a unique but verifiable 16-digit "card number" to the vendor. This meant that even if a vendor's systems were hacked and the data compromised, it could never be re-used because the card number itself was ephemeral.

It's important that we all bear the above in mind when we read articles like this one from Thomas. The Amherst researchers here have been able to exploit vulnerabilities in the world's credit card payment architecture which haven't just been *known about* since at least 2009, but for which we've had robust, effective solutions - since at least 2009.

Now... to bring a bit of balance, if we had a manager from a credit card provider of bank in this chat, they would almost certainly point out that credit cards carry the burden of risk and that anyone is free to dispute a fraudulent charge on their card - and that the industry is doing a great deal to try and kill off the fraud. All of that is true. On the other hand, the UK Finance web site reports:-

https://www.ukfinance.org.uk/news-and-insight/press-release/fraud-report-2026-press-release

... that in 2025 alone, the UK lost £1.28 billion through payment fraud.

That's an important data point, because now we can ask, "Would the cost of issuing UK citizens with more secure credit and debit cards that feature OTP capabilities exceed £1.28 billion per year?"

Given the fact that there are approximately 61 million credit cards in the UK [ https://generationmoney.co.uk/credit-card-statistics/ ] I think it's fair to say that this particular question is going to exist at the most beneficial end of the economies-of-scale spectrum, so any additional costs for production are going to be unit costs and not e.g. design overheads.

The fraud is real.

The costs - which have to be covered by card-users through fees - are eye-watering.

The solutions exist - and have been around for almost 2 decades.

The banks and card companies are doing nothing.

NOTHING.

Why?

Because for as long as they can recover their costs by charging us fees to be defrauded through their incompetence, they're happy.

This is what we have financial regulators and consumer protection laws for.

Not to protect consumers... but to protect the profits of the largest industry players.

Study finds Meta and Google mobile apps gorge on user data

Depends what they mean by "Browsing History"...

This is just a guess... but do you think it's possible that when e.g. Amazon or Facebook talk about "browsing history", they're not talking about your general access to the internet, but your habits as you browse through *their* content?

Amazon have had "The Page You Made" on their web site for many years now - it's basically your browsing history on their platform.

Meta's monitoring of user behavior is frankly terrifying - weren't they at one point requesting access to the cameras in phones so they could track eye movement to figure out what you were looking at?

Both iOS and Android employing sandboxing to protect individual applications from other applications - and that works with both code and data in memory at runtime but also files on disk. An app cannot normally see or touch the files or data of another app on the same phone.

Caveat. I wrote, "another app".

I did not write, "The OS".

There's nothing to stop the OS from grabbing or monitoring whatever it wants.

And if you'd like to get an idea of just how bad that is... try installing your own local DNS like PiHole [and then blocking all other external DNS access], and/or installing an Android firewall on your device, just to see how much data is being sent and to where.

It's terrifying.

Google buys crashed airline Spirit’s data at auction, because AI

Not in the EU

The GDPR - not that it would be enforced - would effectively prohibit the sale of data in this way. The 6 lawful basis for processing that form the foundation of rights that corporations have to access and use personally identifying information does not contemplate the "sale of the data" alone.

If the entirety of Spirit airlines was being bought as a business by Google, who in turn then kept the data and sold on the rest [a bit like BMW did when they purchased Rover Group, kept the Mini and "appropriated" the Range Rover technology for their competing "X" range] then they *might* be able to just about squeak that past the data protection laws.

But outright sale of data is not permitted by the Regulation.

It might be interesting to see if the "de-identification" process included any measures to ensure that only data generated by US citizens was included in this fire sale.

I doubt it.

Re: Spirit’s data is of value to AI companies

To be fair, companies fail for many reasons, most of which could be or will be orthogonal to the quality of the data they maintain.

In the case of Spirit, they were an extremely-low-margin carrier whose business model failed when the massive reduction in air travel from Covid left them with little-to-no income but considerable and fixed expenses [salaries, aircraft leasing, insurance payments, rent, etc.

As to the potential value of the data, that's going to depend a great deal on what data they maintained and what sort of quality it conveys. To give you some examples of data sets that might be useful:-

1. Technology Incident Management Data - there will be a lot of generic "my printer won't work" incident data, but it's likely that a great deal of the technology event records would contain data and applications unique to the industry - things like management of interactions with airports, freight logistics, industry-specific certifications, etc. We don't know what quality exists in those systems or what reputation Spirit had for maintaining good data sets

2. Generic Customer Services Data - there will be solid data concerning client questions and complaints... Correspondence would have to be preserved for potential future legal disputes, so an AI would be able to parse all the interactions per engagement thread and from this infer the best ways to de-escalate with an angry customer. Since most companies with email-based customer services are scrambling to move all of this over to AI processing, it seems reasonable that Google would see value in that data...

3. Supply-Side Data - there will be all sorts of valuable information and practices that a time-critical industry like an airline would have in place with their major suppliers - again, something that would be of value to logistics companies

4. Advertising Effectiveness Data - many people using airlines will search for competitive prices before they fly. Since Google are a major advertiser - and who sell advertising space to other airlines - there is almost certainly a vast amount of business intelligence to be harvested in terms of understanding how many searches for tickets were converted to sales. Perhaps even more valuable for Google would be any details of "referrer" in the data. For example, what if there were tags or tokens showing that a ticket had been sold via a search run on DuckDuckGo?

I'm sure we could brainstorm and come up with quite a few more.

In fact, I'm sure that whatever we could come up with as a proposal for the business value of the data to Google would fall well short of the actual derived worth they get. Well short.

Almost nobody pays attention to web standards anymore

Re: No Downside...

That's fair.

Both data sets came via Google Search AI.

The second data set - the percentage distribution across the back end - did not include percentage figures, or I would have included them.

No Downside...

To give you a bit of an extreme example, at a societal level we apply punishments to people who fail to adhere to social norms through the use of crime and punishment.

For a bit of context, our social contracts - the concept of law, crime and punishment - can be seen as far back as 2100-2050 BCE, in ancient Mesopotamia, inscribed in Cuneform on clay tablets in what is known as the "Code of Ur-Nammu.

Today we have a social contract between those who publish content and those who access it via HTML-based means.

It's just that the social contract we've built around HTML as a delivery mechanism actively glosses over deviations from those established norms. A quick Google search suggests that in ranked order of popularity, the browsers we're using are:-

Google Chrome - 68.22%

Apple Safari - 16.47%

Microsoft Edge - 5.37%

Mozilla Firefox - 3.34%

Samsung Internet - 2.06%

Opera - 1.88%

Similarly, if we look at the other end of the equation and think about the most widely-used web platforms today, we get:-

WordPress - 43%

Shopify

Wix

Squarespace

Webflow

Drupal

So if we were to apply the 80/20 rule and were able to persuade Google and Apple on the browser side of things and Wordpress/Shopify/Wix/Squarespace on the back end to all begin a gradual migration towards intolerance of mal-formed HTML, it might be possible to persuade web site maintainers and framework developers to follow along.

This is particularly true of very popular web sites that host and run their own platforms - like the big mainstream media companies - BBC, CNN, Fox, etc.

It almost certainly isn't worth "breaking stuff" to get there... but it's in all our interests to have the technology we use adhere to well-defined standards. The cost to national economies from having to endlessly refactor digital content would run to billions... so this isn't merely an academic exercise.

The only way to get this to move significantly in the right direction is to build an unstoppable momentum towards the uniform standard. Once the momentum is there, it becomes harder/less attractive to stop, because any client-side or server-side technology that deviates is basically just cutting themselves off from the ecosystem.

As the old saying goes:-

"When you've got them by the balls, their hearts and minds will follow..."

Uncle Sam needs you to fight for 6G leadership and security, lest Beijing get there first

Re: Let me get this Right...

"At least their tech is less prone to proprietary lock-in."

It's probably fair to say that anyone looking to grab a major slice of any market will not force proprietary lock-in on users... right up to the point where they have market dominance... and *then* the lock-in trap snaps shut.

You only need to look at the extraordinary numbers of deaths in ICE custody to realize that the US is racing to catch up to China as a despotic regime... but China are still well out in front.

Mozilla adds ad blocking to Firefox for iOS

Re: a different angle to your statement

Xanadu's concept for hyperlinks - well documented in Nelson's writings of the time - was quite a bit more ambitious than the model adopted by the World Wide Web, which is quite likely a major part of the reason it failed. Elements like transclusion - reuse of content whilst retaining content to the original source - as well as bidirectional links, permanent addressing for content elements, were interesting concepts that struggled to get off the ground due to complexity.

Sir Tim Berners-Lee... took a fundamentally different approach. Just as TCP/IP started with the absolute basics as a foundation but allowed more sophistication to be built on top in layers, Berners-Lee concentrated on the global addressing scheme as being the fundamental element that absolutely had to be done right.

"People was not trusting this "web" thing enough to subscribe and pay for everything from the get-go."

I think this is quite inaccurate. Berners-Lee developed the World Wide Web while working at CERN. Pretty much all of the early funding for what became the "Internet" came via DARPA - the U.S. Department of Defense Advanced Research Projects Agency - and as the ARPAnet/DARPAnet expanded beyond it's original four main nodes (UCLA, SRI [Stanford Research Institute], UC Santa Barbara and the University of Utah) and included international connections, almost all of the connections and users were part of the government, military, or academic establishment.

At the time, public access to digital services came via dial-up modems to bulletin boards, usenet groups and commercial, pre-Internet providers such as AOL, Compuserve, Prodigy, GEnie and Delphi.

ALL of those services were commercial, with subscription-model paid access.

In the earliest days, for example, AOL wrote and maintained their own end-user client software; the concept of a "Browser" was only added once the Internet began to take hold and the public started to demand access to it as part of their (AOL/Compuserve/etc.) experience.

My sense is that Xanadu tried to bite off more than it could chew; it failed to attract enough interest to gain critical mass and as a result it withered and died. The WWW, on the other hand, took a leaf from the TCP/IP playbook - it started small with a "Minimum Viable Product", but was based on an extensible architecture that has remained incredibly resilient over the intervening 40-odd years.

New Zealand says China tried using space investments to spy on local affairs

An Ideal Location?

Out of curiosity, can anyone explain why New Zealand would be a better location for space monitoring technology than China?

New Zealand's North Island spans roughly 34 degrees 22' south at it's northern tip and 41 degrees 27' at it's southern tip.

By contrast, Hainan Province of China lies between 18 degrees and 9' north and 20 degrees and 10' north.

In other words, if you want a perfect location for monitoring space activities and you're China... then your own jurisdiction/land offers a much better location than anything New Zealand can offer.

China are conducting reconnaissance of neighboring countries, so that after they've taken Taiwan, they can continue to expand throughout the West Pacific...

Brit rail cops bring live facial recognition to the London Underground

Re: It isn't the False Positives that Matter, it's the Loss of the Presumption of Innocence

Not at all.

If I were to consider a trade - i.e. what I would consider reasonable if the Transport Police removed the cameras... then my answer would be that I would be willing to look at employing more uniformed officers to be present on public transport.

I'd support much greater intelligence between the transport company employees and the police - so that the police could respond by deploying uniformed officers in the event that issues materialized. I'd also support encouraging the Transport Police to anticipate potential issues - such as spikes in incidents on public transport to/from major events [sports matches, music concerts, that sort of thing]

all of those things are reasonable.

It's possible [likely] that what the Transport Police are trying to do here is spend money on CCTV instead of officers... but the most important thing to remember is that a CCTV Camera can't stop a fight once it has broken out; can't stop vandalism; can't run after a fare-dodger...

So this is a joke, start to finish...

Cisco thinks Mythos means instant death for unsupported networking kit

Purchasing Conditions

Cisco's attitude will [hopefully] come back and bite them in the a$$.

For a start, if I were a CEO/CIO/CFO/CTO of any decent-sized company (you know, a typical Cisco customer), the first thing I'd be doing is insisting that every piece of their kit I already had deployed, with the versions of (hopefully supported!) firmware in use, was subject to independent scans by tools built using the latest models - and I'd insist that Cisco provide full patches to any and all issues.

Second, I would flat-out refuse to buy any Cisco technology that hadn't been run through an independent scanning regime - by a competent third party - and when I say "any Cisco technology", I don't mean that I'd refuse to accept to buy a Cisco router of model "X" until it had been scanned, I mean I'd want every single unit of Cisco kit that I order to be independently scanned at Cisco's expense before it got shipped to one of my sites. Because I'd insist that Cisco prove they were selling product of "merchantable quality".

Third, I would get together with all my industry peers - say by market sector or professional organizations - and develop some collective bargaining with respect to getting Cisco to commit to behaving like a responsible ####ing supplier when it comes to cybersecurity. Think about it: can you imagine a company like Ford or GM, or Audi or BMW announcing they had discovered a major flaw in one of their models and that any vehicle out of manufacture warranty would fail Mechanical Safety Inspections [in those states that mandate such tests] and the only option available to owners was to buy a new vehicle? Would you buy from the same brand again?

The global community of C-Suite executives might not be able to get everything they want all the time, but collectively they have pretty spectacular buying power - and Cisco have just thumbed their nose at every last one of them.

Let's hope they learn to regret it.

Oh, and... it will be interesting to see how thoroughly Cisco might annoy the three-letter agencies in the intelligence community, because now everybody is going to want to subject Cisco kit to the most secure screening available.

No more back doors for you, suckers...

Spectre rears its ugly head again as researchers show some RISC-V chips are susceptible

Was This A Surprise?

Thomas writes,

"Prior research has shown that RISC-V processors used for academic research (e.g. BOOM, RiscyOO, RSD, Proteus, NaxRiscv, and NutShell) can be affected by one or more of the Spectre variants, but hasn't addressed commercial silicon."

For readers unfamiliar with the reference, "RISC-V" refers to a free, open source instruction set architecture that was developed by a University of California, Berkely Team, led by Professor David Patterson and graduate students Andrew Waterman and Yunsup Lee. In 2015 a foundation, "RISC-V International", was set up to manage and maintain the standard globally.

In other words, if one chip in the RISC-V family exhibited vulnerabilities against SPECTRE variants, it's likely an odds-on bet that other members of the RISC-V family will show similar behavior.

In other news: water is wet.