Posts by Sproggit

EU won't force publishers to grant dead video games an afterlife

Physical Comparisons

Another way to think about this is to consider how the same legal framework being considered here supports other types of goods and services.

For example, many of the most beloved and classic "analogue" cars continue to be supported by third parties and enthusiasts many years after production is stopped by manufacturers. Anything from E-Type Jaguars to Morris Minors live on today thanks to that commitment from owners and enthusiasts. So when we see companies stating that a software product they created "is no longer viable" then, as many other technologies have learned, transitioning to a community support doesn't just allow that technology to live on, it can give rise to thriving ecosystems and communities.

In other words, what the Commission seems to be doing here is in fact making a "special case" exception for software. The refusal to act [by the Commission] is in fact creating a new legal framework.

Personally, I would like to see studios that release MMO games set up a "Community Inheritance Pledge", *before* a game is released. In other words, if you're intrigued when Bungie announces "Destiny 3" [or whatever it ends up being called], you can evaluate whether or not to commit funds and time to playing the game based on whether or not the studio makes an up-front pledge to release the back-end server code as an open-source project in the event that they decide to withdraw their own support.

If studios did that, then you would be free to make your own, informed, decision as to whether or not to support the studio by making a purchase. Especially relevant when we read of some players who have spent literally *thousands* of dollars on a game - think the pay-to-play variety, like Star Citizen or Eve Online, where players are given a choice between "endless grind" and handing over more cash...

Curiously, however, I also think that writing a compelling, stand-alone game not only requires more effort [because there is no scope for the community experience to augment anything the game lacks] but I think it can produce better games.

Caveat emptor, I guess...

Britain's privacy watchdog quits after 'poor judgment' admission

Plus ça Change

Unfortunately, the situation we have in the UK is such that personal digital privacy has become a joke.

Elected representatives in Westminster - those we charge with writing our laws - have written a Data Protection Act with "holes big enough to drive a coach and horses through"...

For example, for calendar year 2025, the ICO issued a grand total of 7 major fines, for a combined value of approximately £19.6 million.

But what seems interesting is that they only seem to be interested in prosecuting major data breaches and cyber incidents where data from individual users/customers is involved.

There don't seem to be ANY fines or penalties for e.g. egregious transmission of spam, or misuse of data [collected for one purpose, used without consent for another]...

There are zero penalties for telecommunications companies for continuing to allow overseas call centre scammers to mask their number and appear to be "legitimate" UK numbers on the phone network...

There are zero penalties for egregious data errors that result in major hardship for users or customers. For example - where was the ICO when it came to the Post Office scandal? *Surely* there were MAJOR issues with the audit trails and actual evidence that the Post Office were relying on...?

Sadly, until we have a government that gets off their collective backsides and actually does the job they're elected and paid to do - including keeping UK citizens safe from predatory companies and international criminals - it doesn't matter who runs this shambolic excuse for a government agency, nothing is going to change.

Smelly config files will make your agents waste tokens, researchers warn

...if the AI bubble bursts...

I was thinking about this as we line up for the IPO rounds for Anthropic and OpenAI... and trying to do so in the context of the Gartner Hype Cycle.

https://en.wikipedia.org/wiki/Gartner_hype_cycle

I don't think anyone is going to argue with us that we're currently somewhere high on the slopes of the Peak of Inflated Expectations... but using this frame of reference makes for an interesting thought exercise. First, before we get to the "Trough of Disillusionment", it might be useful to understand what was happening in the 1990s as the dot-com boom really took off.

With a bit of help from a Google search, some of the key players in that cycle included some survivors: Amazon [initially books], eBay [marketplace], Yahoo! [portal and search] and Cisco systems [networking hardware]... PayPal managed to follow along close behind eBay...

The infamous failures include Pets.com [which burned through a massive IPO cash pile before liquidating], Webvan [an online grocery delivery business that collapsed due to infrastructure costs] and theGlobe.com [social networking].

Not shown in the list of failures, however, were dozens - if not hundreds or thousands of "me too" companies that rushed to register an internet domain before they had a clear understanding of why they needed an internet presence. At that time, remember, the concept of buying a book "online" was completely novel; while eBay was possibly an extension of a neighborhood garage sale, it was still relatively unusual to buy items "sight unseen" from unknown private sellers.

A couple of things strike me about that dot-com bubble that aren't happening this time around [which means we need to look for different triggers/warnings]. This time around, it's absolutely the case that cynical companies are injecting "AI" in to marketing materials - and sometimes even forcing models in to places they're neither needed nor wanted - but there's very definitely a sense that the market itself boils down to a relatively small number of fast-moving entities (the Anthropic, OpenAI, X/AI... and nVidia and maybe Cisco on the hardware side). My sense is that the reason that simply putting "AI" in your product name does not automatically contribute to the hype cycle is that this time around the marketplace is cynical enough to think, "Hmm... So [company name of your choice] thinks that adding AI to [business process of your choice] adds value, do they? Well, I already have a dumb version of [business process tool], but I can wrap AI around it myself...

This time, the tools themselves are smart enough to tailor themselves to business environments. You don't need to hire an army of developers to build all-new solutions when you can ask a generic model to help you design the solution you need.

This leads to another difference... In the dot-com years, the idea of mature and scalable managed hosting services - the foundation for an on-line presence - did not exist. In other words, the last 26 years or so have given us a much more diverse and sophisticated environment, which means that a company wanting to "dabble" with AI, to see if it actually makes much sense, is going to be able to experiment without huge capital investment and thus with reduced risk.

Does that mean they will be more successful? Of course not. People still attempt laughably unrealistic projects all the time.

There's another significant change that we've seen since the dot-com era - the adoption of Agile Development methodologies, which really become fully established between about 2012 and 2015. Prior to that - and in the dot-com era, technology projects were very much of the "waterfall" variety... and as a result it meant that people starting up a dot-com business, running to a waterfall model, very often didn't know their plans would fail until it was too late to course-correct. By contrast, the adoption of agile methodologies, incremental delivery, iteration and "fail fast but learn fast" has changed the way that we think about the cycle of committing, contributing and either abandoning or delivering technology projects.

My sense is that we're still going to see [many] casualties, but that fundamental changes to the industry across the last 25 years or so will act to significantly change the nature of those failures. There will be chancers, of course. There will also be big, mainstream companies that jump "all in" with AI only to crash and burn.

But investors are a litigous bunch these days, and won't hesitate to go after a C-Suite if they think they're being jerked around.

Where I think we're likely to see the biggest transformations as AI technology develops will be in the makeup of the technology part of a large business - I see a lot of the software development roles being replaced by Business Analysts, for instance... I also think that AI is going to have other administrative and political/legal consequences. For example, the job of moderating on-line content is known to be highly stressful for people... so I think that's something an LLM could be trained to do.

During the steam revolution, Dr. Dionysius Lardner (1793-1859) claimed that if steam trains exceeded 30 miles per hour, passengers would suffocate for lack of oxygen.

I have the sense that we're all currently making similar predictions about the future of AI.

Some Possible Solutions

I'm using Claude with a PHP project and though my experience is limited, I have come across a couple of useful tips.

First one is, keep your "CLAUDE.MD" file to less than 200 lines, max. If you think you need more than that, chances are you're trying to bite off more than you need to chew.

Second one - which I've not yet fully tested, is to adopt the use of an LLM Text Compressor to help. There are quite a few being shared at the moment, including, "LLM Text Compressor", available as a GitHub project, written in Python and designed to compress large text files for LLM context windows, optimizing the ration of essential information to tokens used:

https://github.com/taylorbayouth/llm-text-compressor

There are also a growing number of articles containing tips and tricks, such as this one:

https://machinelearningmastery.com/prompt-compression-for-llm-generation-optimization-and-cost-reduction/

Usual caveats apply - and your mileage may vary (YMMV).

Waymo hits the brakes after robotaxis keep missing the signs for freeway construction zones

Re: Driving Tests

I absolutely agree with you that training the model to pass a test would defeat the purpose.

However, I think there are some mitigating approaches that a regulator or federal government could take. Let's assume for the purpose of this thread that the government has access to an off-road testing facility with a selection of different environments, including urban, countryside, high-speed main road and so on.

Yes, we'd need to see evidence of the autonomous vehicle successfully driving about on regular roads. But we could vary the specifics of each test - different volumes of traffic, different lighting, different times of day and night, different weather conditions and so on.

We could come up with some tests like having a cardboard cutout of a young child hidden behind a parked vehicle, drawn across the road by a guide rope as the AV approaches, to see if it can apply an emergency stop... We can simulate the failure of traffic lights at a 4-way intersection... We can try and confuse the AV by having a driver turn on their windshield wipers instead of triggering a turn signal, that sort of thing. Basic stuff - like ensuring that an AV can stop when the vehicle in front does so - would need to be included, but I think it's relatively well covered by now.

I'm interested in whether or not an AV can handle "road closed" and "diversion" signs; whether they can handle temporary speed limits; how they would cope with one of those old-school rotating "stop/go" signs operated by a worker. I'm interested in how they cope at the scene of an accident when a police officer directs them to contravene road markings in order to route them safely away from danger. I'm interested in whether an AV truck can tell the difference between a legitimate Police Officer and a crook impersonating one.

I'm interested in whether an AV truck pulled over by a Police Officer, can interpret and respond to instructions: "I'm going to need to you back up for about 100 feet, and use that side road to turn around...Can you do that for me if I watch the oncoming traffic for you?"

I'm interested in how an AV handles black ice.

Like you say... the edge cases are going to be legion - and a lot of people might be killed before we realize that our testing regimen simply isn't good enough.

And on that last point... If there is a road incident and one motorist kills another road user whilst doing something illegal, the motorist can be sued by the deceased driver's family. Who would be sued in the event of an autonomous vehicle? The owner/operator? Or the manufacturer?

It's really not clear to me that any of these questions have been robustly answered. Where's the DMV? Where's the Transportation Secretary? Where are nationally mandated standards?

Driving Tests

It always strikes me as odd that if a person wants to drive a car on the road, they have to pass - at the very least - some form of practical test. Yet all the companies developing robotic vehicles aren't required to demonstrate that they products meet the same standards.

Maybe it's because they would simply ace the usual: 3-point turn, hill start and emergency stop...

But I can't help thinking that we really ought to insist upon something that provides other road users with a good degree of assurance that robotic vehicles are safe.

And I'm not just talking about the ability to perform an emergency stop when required... Imagine for a moment that you've got a fully autonomous 18-wheeler on an interstate... Now imagine that something in the back catches fire... or debris on the road causes a blowout. A human trucker would notice and pull over. But what if the human trucker is asleep in the back of their cab - or not even present at all?

What happens if you get some hooligans in an open-backed truck drive alongside the semi and spray paint over the cameras and sensors? Would it know what had happened? Would it respond safely?

I'm not suggesting an all-out ban on autonomous vehicles. I'm suggesting that we ought to have a comprehensive set of proficiency tests and that every software release for autonomous vehicles ought to be able to pass the tests before the vehicles were allowed on the road. After all, human drivers have to pass a proficiency test before being allowed on the road - why not the same for autonomous vehicles?

Tensordyne makes a big bet on log math to beat Nvidia

Related?

Tensordyne you say?

Are they in any way related to Cyberdyne Systems?

Kidding... probably...

Windows devs rerolled old code to save precious bytes

Re: Compact code

My first full-time employment included a "side-line" in writing software for the BBC Microcomputer... another 65C02 based machine. The Beeb used memory-addressed peripherals [no pesky device drivers for you, me boy] and page-swapping to enable it to support more addressable storage than the default 64kb. The lower half of the address space was RAM, the upper half was ROM. Acorn's Operating System sat in the "top half" of the ROM address space and the lower half - i.e. memory from 32768-49151 was reserved for "paged ROMs" ...

The OS itself had a design convention that identified "system commands" through the use of an asterisk to prefix the command and anything submitted to the command line prefixed with an asterisk would first be offered to the OS; then, if it was not recognized, the OS would "page" through any installed ROMs, swapping them in to the available address space and offering them the unknown command. If it tried all available ROM's and didn't get a bite, it would issue an "unknown command" response.

So far, so good.

I was asked by my boss to take some code [written in BBC BASIC] that provided ISAM functionality to the Beeb's flat data files [basically, giving them an Indexed-Sequential Access Methodology index-retrieval system] and convert the code in to 6502 assembler so that we could shunt all the index-handling logic in to ROM to save RAM for actual "business logic". A couple of different "6502 Assembly Language Programming" books later and I had working code - able to support 3-tier indices with up to 20 keys per block [blocks aligned in size with disk sectors for IO efficiency]. Translation: it could handle 4000 records assuming 50% index density - theoretically up to 8000 records, but that would be a bit optimistic.

The catch? My code compiled down to about 10kb.

At which point my boss announced that he'd already been out and purchased a stack of 8kb EEPROMs and I'd just have to rewrite my assembler to make it more compact.

Took me about a month - and let me tell you, that remains one of the toughest programming challenges I've ever faced. The first half - getting the code from about 10kb down to about 9kb was *relatively* straightforward... I cheated a little bit as I had a couple of unfolded loops that I'd written to perform "block copy" operations when performing a "block split" of one of my index blocks... It slowed down the update operation - but I figured that since the machine was physically writing to disk and since the disk operation would be a limiting factor, I could likely get away with it, so I just folded the code back up as a loop and saved a bunch of memory.

But getting those last few bytes, down from about 8300 or 8400 bytes to something that would fit in an 8kb EEPROM... Man, that was *hard*... and to get there I ended up using solutions I find "ugly" to this day... For example, the 6502 uses different types of code branching: JMP ["Jump to memory location and start executing"] and JSR - Jump to SubRoutine - ["push your memory location on to the heap, jump to a memory location and start executing... then, when you encounter a "Return" opcode, pull the address of the heap and go back there before executing..."]. You end up writing subroutines with multiple entry points, then a common exit/return, because doing that will save you a *single byte* of RAM, since you now only need one "return" opcode.

Or you make a "declaration" that your code won't run on a BBC Micro equipped with an IEEE488 interface [used with oscilloscopes, voltmeters, logic analyzers and the like], because that would free up a tiny amount of RAM in Page Zero. And Page Zero RAM was invaluable because the hex structure for:-

LDA &40 [Load the Accumulator with the contents of memory address hex 40, which is *in* Page Zero]

took two bytes of RAM to express, while the hex structure for

LDA &1900 [Load the Accumulator with the contents of memory address hex 1900, which is not in Page Zero]

took *three bytes* of RAM to express...

I found that by rewriting my assembler to use Page Zero addresses saved me *just* enough to get my code to compile down to 8kb.

At the time I hated it... I had no experience of assembler and I really struggled. There was no "internet" to turn to and no "user group" to ask... After the first couple of weeks I convinced myself my boss would fire me in disgust, but he seemed genuinely surprised that I'd managed it.

We can look back on a 6502 today - 2MHz clock, three 8-bit registers (Accumulator, X and Y registers) and then 8 one-bit status flags (e.g. the Carry Flag) - and think of it as crude and primitive...

But learning what was needed to wring the last drop of performance out of that antique piece of silicon gave me skills that have paid me back over decades.

Intel starts cooking up enhanced 18A-P silicon for would-be foundry customers

If Only...

I know this isn't likely to happen...

But if only Europe, along with allied neighbours including the UK, Switzerland and Norway, could start to collaborate towards building their own dedicated CPU and RAM factories.

This isn't something the EU could achieve from a standing start, of course, but the major components - the sterile environments, the lithography equipment and so on - could be iterated.

It's pretty clear that the world is moving towards an intense economic and/or military stand-off between China and the United States, with smaller nations being used as pawns between the superpowers. This means that all European nations - EU members or not - are basically going to be held to ransom by one side or the other.

For decades now we've been told that the purpose of the EU is all about giving the continent a voice at the global table - here is a chance for Brussels to put up or shut up. How about the European nations put their heads together and come up with a list of all the critical products and services for which there is a current reliance on US, China or Taiwan... and then put in place a multi-year program to provide the land, the funding, the resources needed to help the continent to become a bit more independent. Europe has some of the best universities in the world; nations in Europe produce some of the key technology used in the advanced manufacturing processes used for e.g. chip and RAM production... yet the continent remains entirely at the mercy of overseas providers.

If the UK and EU are serious about remaining a global player, how about providing sponsorship and resources to kick start the programs that we'll need to become much more technologically independent than we are today?

NHS Palantir claims face scrutiny after data suggests uneven results

Re: Saw this crap coming, opted out of this bollocks a long time ago!

Thank you!

Correlation is not Causation

The quotes from Palantir and the Government are entirely misleading.

Palantir are claiming that adoption of a software package to manage patient data is somehow resulting in improvements in the number of patients being seen. Just pause and think about that for a moment. Ask yourself how the consolidation of patient records in a central register could result in the sort of transformative throughput gains that Palantir are claiming here.

- What is the baseline for their claim of an improvement? An additional X number of patients treated... compared to what, exactly?

- What other possible factors - like, I don't know, hiring more medical staff - might explain the change in performance?

- How, exactly, has Palantir's *software* brought about such a transformative change in *patient care*? How can software provide more nurses? Doctors? Hospital beds?

This is complete and utter tosh.

What's frustrating is that nobody seems to be asking for basic facts - instead the MSM are just accepting wild and completely unsubstantiated claims.

And if Reform/Farage get in at the next GE... you can bet your life [possibly literally] that Farage will sell off the NHS to the big US healthcare companies. The government won't cut back tax raising despite no longer having to cover the costs of running the NHS and meanwhile we'll all pick up an additional burden of paying private companies for medical cover.

Re: Saw this crap coming, opted out of this bollocks a long time ago!

Unfortunately you are mistaking the previous attempt at selling our patient data with this latest con job.

With this current approach, as covered in detail with other articles published here at 'el Reg, you need to be aware that:-

1. You have no right to opt out - your data is "gone, baby gone" whether you like it or not...

2. Only Trusts have the ability to opt out, not individual patients...

3. Initial claims by HM Government Ministers that Palantir staff will not have access to patient data have already been shown to be wrong...

4. There does not appear to be any details regarding the "ownership of the intellectual property" [i.e. the data] harvested by the application once running...

5. There does not appear to be any details regarding whether or not Palantir have the rights to offer the data to third parties, or to host it in the United States [which amounts to the same thing].

6. In short, we're all screwed.

Anthropic reserves right to check ID for Claude subs

Interesting development in the Anthropic story...

https://www.axios.com/2026/06/16/anthropic-fable-trump-white-house-cybersecurity

As I suspected in my earlier comment, this is looking like the federal government have been strong-arming Anthropic over release of their model...

I'm tempted to suggest that it's wrong to assume they have a choice.

Anthropic want customers because they want a commercially successful profit. This move won't help that - it might not hinder it too much, but it *certainly* won't help.

When something doesn't make sense on the face of the evidence we have, we should be willing to accept that there are other data points we're not aware of. Most likely that Anthropic are being strong-armed behind the scenes.

In the UK that would be either your Passport or a Photo Driving License - those are the only two that would pass muster.

To be fair, the reason that Anthropic is asking for this is almost certainly some form of behind-the-scenes blackmail. It's very clear that Anthropic upset President Trump when they sent Pete Hegseth packing, by refusing to give him unfettered access to their models. President Trump never forgets being slighted. So it would not be much of a stretch for us to theorize that the Federal Government has said to Anthropic, "You know, just like we used to restrict access to strong encryption to certain nations - because we considered it of munitions grade - we're thinking of doing the same and restricting access to your AI Models." And then, when Anthropic asked, "Which countries would you be likely to prohibit export to?" the government would have said, "All of them. Nice little AI business you got here. It would be a shame if something were to happen to it..."

Do not be surprised if the federal government are strong-arming Anthropic, with their pitch being that if Anthropic wants to continue to have non-US clients, they have to do whatever the Federal government wishes... And do not be surprised if "whatever the Federal government wishes" includes giving the feds unlimited access to the Claude source code and the ability to run and modify their own local copies. This is *not* a stretch - Microsoft gave the feds access to Windows source in return for being able to sell Windows to the government...

What might be more interesting would be to ask how either of these identity checks would be validated. For example, I'm a director of a couple of companies and recently had to prove my identity to Companies House. That verification process included the use of my passport and my smartphone. I had to download a piece of Government issued software [now safely deleted] on to my phone and then, when prompted, position my passport against my phone so that the in-built RFID reader within the phone could read the chip embedded in the back of my passport.

Since Anthropic is a US company, that collected data would be immediately harvestable by the Federal government - not necessarily for you specifically, but on a broader "give details of all British users who accessed Claude between dates X and Y" and because the identifier that Anthropic would hand back would be your passport, it would mean that the federal government would be able to associate your Claude account with you-the-person if you have ever visited the US for any reason.

The moment that data bridge gets constructed, the US government - and, potentially, say, any of their 5-eyes partners ... like the UK government, for example... would have the potential to review all your interactions with Anthropic technology.

The rocky road to better Linux software installation: Containers, containers, containers

Re: How do you think about GoboLinux's approach?

That's pretty much what Acorn Computers came up with in the 1980s on the Archimedes... and which has been duplicated to some degree by ROX and AppDir, as the article notes.

The Acorn solution, which for anyone unfamiliar with it simply designated any folder in the disk system with a name that began with an exclamation mark to be an application. There are a very small set of rules that have to be met for the contents - the presence of an icon file, naming convention of the principle binary, that sort of thing.

Among the advantages - your "Menu Tree" was basically the folder structure of your local drive - so you could re-arrange your menu as you wished... the code was self-contained in a single folder - you could move and port it as you wished. The downsides are equally obvious - apart from Acorn-provided system libraries, it was a) a bit more tricky; and b) not generally a good idea to try and share library files between installed applications. So you ended up with the same sort of bloat that you get with e.g. AppImage and it's like.

Just stepping back a bit from the evangelical debate around which specific solution is best, I think there are arguments to be made for having two discrete types of packaging system supported by a given OS/distro, namely:

1. For low-level drivers, middleware and "plumbing", stick with the native packaging system supported by your distro of choice. You need to leverage the better dependency management and to avoid the wasted space of hosting dozens of copies of common library files...

2. For *applications only*... and, specifically for *applications with a higher refresh cadence*, use a self-contained package management system like AppImage or Snap. That's because the lifespan of say your local instance of LibreOffice is likely measurable in a couple of months at the outside and so it makes sense to simply bring in a new version, link to the binaries in your menu manager, then deprecate and remove the older file when you're happy with the new release.

This isn't an either/or - we can have both.

More importantly, perhaps, it would actually make the life for distro maintainers that little bit easier... With popular packages that have a high release rate - like LibreOffice - the ability to simply pick up the AppImage file and run it will obviously take a *huge* amount of packaging overhead away from the distro - which has to be a good thing. The hard part is obviously going to be figuring out the edge cases - whether something needs to be packaged as an AppImage/Snap or as a general distro package. That is going to have a lot to do with the release cadence and how close the software sits to the user.

Maybe a couple of enhancements might help - and I wish I had the technical chops to try and deliver, but...

First up - what if someone wrote a manifest-to-package utility? In other words, you're a software developer with a new app or a new version of a new app that you'd like to publish. You go to a "packager" and use a prompted set of screens to identify all the files your package needs, all the library and version dependencies it has, that sort of thing. Maybe some kind of nested dependency import tree could be possible there...

Then you go to a "packaging" screen and you get to choose which formats you want to generate... You can chose from .rpm, .deb, snap, AppImage, etc. The tool takes your code and your manifest file data and spits out different packages for the different package managers.

If you want to submit your package to a distro, a combination of the source files, the generated package file and your manifest file would be all they would need. If you want to offer your code as a Snap or AppImage, you can do that.

The one gap in the ecosystem at the moment would be the seamless [or less finicky] integration of a new AppImage with say a given Linux desktop. But that's a challenge for the desktop - GNOME, KDE, etc. It should be possible to write some code that allows a new snap/AppImage file to be added to a menu with relative ease - again using a manifest file - and for you as the installer to say "Replace Application 'X'" or "Install along side Application'X' ". That gives you the option to test out your new AppImage before committing to remove or over-write the old one. My personal experience is that this is generally a Good Idea (TM) with some of the apps that have a higher change velocity, just because there seem to be more regressions with more volatile code.

Ultimately, this is all software. If the problems we're discussing become thorny enough, we'll get collaboration on a common solution.

Right now my sense is that it's good to have some alternatives, to see how they evolve. This is one case where the Linux platform itself can sort of self-regulate to a meritocracy - the best solutions are likely to be the ones that survive.

NASA said nyet to Roscosmos plan to cut into leaky ISS segment

Re: Diagram

I think this might be a slightly better version of a diagram:-

https://www.spacefacts.de/graph/iss/english/zvezda.htm

If only because it shows the module in context with the rest of the station. In particular, it shows that Zvezda is one of the outermost modules. I appreciate that the ISS is supposedly going to be decommissioned in 2030 - just 4 years from now - but I have a hunch it will be around for quite a bit longer than that.

In which case, maybe there is an argument to be made to replace it...

Given the way that e.g. SpaceX has reduced the cost of getting payloads to orbit so drastically compared with NASA's original launch costs for ISS modules, maybe there's an opportunity to put something up there that can be retained or built on as part of the replacement...

Flatpak-NG sounds like bad news for systemd refuseniks

Re: Yes, please!

Respectfully, I think your answer proves the point, just not the one you were hoping to make.

systemd was offered as a replacement for the ancient and creaking init system... but the amount of scope creep that the project has gorged itself on is frankly ridiculous. It fundamentally violates the Unix philosophy of having software "do one thing and do it well" - of being simple pieces of code connected by clean interfaces, to borrow from TAoUP.

In short, the issues with systemd include:-

1. The Scope Creep

Originally offered as a simple replacement for System V's "init" process, systemd now encompasses device management, user logins, network configuration, system logging and even local DNS services...

2. Binary Logs (my personal bugbear)

Many people think of this as "just" a requirement to use e.g. journalctl when they might want to use grep or sed... but I have supported "hosted" instances of Linux running on top of other OS platforms. Much of the time that might work well... but what if you're running a virtualized RHEL on top of IBM zOS on an IBM Z-Series mainframe? It would be *so much* easier to review plaintext log files using native zOS tools (because your Linux environment is dead). The fact that there isn't even an option to do this [while other functionality keeps getting added to systemd] gets pretty frustrating.

3. Hard Dependencies

Systemd and its components are deeply intertwined [no clean interfaces], to the extent that many core desktop tools and network managers now require it to function. This not only creates something of a monoculture, it risks fragility and instability issues.

4. Complexity

I'm not sure the decision to replace readable shell scripts with declarative unit files is a net benefit. Yes, it can make parallel booting quite a lot faster, you have to trade that against the percentage of time your Linux host spends in boot state rather than actual operational running... The problem with declarative unit files is that they abstract away mechanical control, making it harder to troubleshoot when things break.

5. Opacity / Monolithic Design

Systemd has basically moved multiple and entirely distinct functional elements inside PID 1, which in turn creates a potential single point of failure. Now, if a core service hits an issue, it can bring down your whole system. For example, if you're running a distro that uses the built in systemd-resolved, then you are running your local DNS resolver *in your init process*. Why would you want to do that?

There's a good reason that the "rules" in "The Art of Unix Programming" has "The Rule of Modularity" ("Write simple parts connected by clean interfaces") as it's very first Rule. It's because those are words to live - or die - by.

To quote a bit more: "The only way to write complex software that won't fall on its face is to hold its global complexity down - to built it out of simple parts connected by well-defined interfaces, so that most problems are local and you can have some hope of upgrading a party without breaking the whole."

The developers of systemd could have stopped after they had provided a neat and modern replacement for systemd. The continued because they could.

They never stopped to consider whether they *should*.

Amazon owns up to using 2.5bn gallons of H₂O in its bit barns last year

Re: Oh just stop with the bullshit unscientific scare-numbers.

Columbia University is a "Climate Scare Site"?

NOAA is a "Climate Scare Site?"

But if that still isn't sufficient for you, how about the National Center for Environmental Information and/or the US Drought Monitor?

https://www.ncei.noaa.gov/access/monitoring/historical-palmers/

https://www.ncei.noaa.gov/news/drought-defined-deep-dive-us-drought-monitor

Those are empirical sources holding over 100 years of actual, documented rainfall data, collected by nationwide analysis. Both sources confirm that precipitation deficits cause localized droughts while revealing that it is rising temperatures that are driving the majority of drought severity in the western US. This data comes from *actual, historic gauge records*. To be clear, what the data shows is that the conditions are not caused by a lack of rainfall. Rather, they are caused by rising temperatures, which increase the ability of the atmosphere to absorb water, leading to higher rates of evaporation.

In fact, the National Institute of Health suggests that it's those elevated temperatures that now account for more than 60% of drought severity:

https://pmc.ncbi.nlm.nih.gov/articles/PMC3003012/

So your comment, "Yes, I can, they don't! There is no overall increase in drought conditions" simply cannot withstand the actual data collected and recorded by the Federal government.

The data is right there.

But I tell you what... if you don't believe me, why don't you go live in Tulare or Kern county, CA?

https://en.wikipedia.org/wiki/Droughts_in_California

Now, I've tried to address your concerns with links to reported facts. The data I offer has been prepared and is undersigned by the National Institute of Health, by NOAA. Given the incredible pressure that those agencies have been subjected to by the current administration, I'm pretty sure that if they had published provably false data, their detractors would have found and pointed to it as a the basis for shuttering those agencies.

If you are able to show me that the reports I link to are false, I'll gladly listen to your explanations.

So far, however, all you've offered me is invective.

One of my Team has a T-shirt he wears to the office, which reads: "Talk is cheap. Show me the code"

I've tried to provide you with references to government sponsored analysis that supports my position that areas of the US are seeing increasing drought conditions. If you have better evidence that shows differently. *Evidence*, then I'd love to see it.

But just one caveat: when you write something like this: "If you take the measurements over a large enough time scale you will see this level's out over time" you may be trending towards a bit of a specious argument - you could take that to an extreme and go back 10,000 years, to when half of the United States was covered by an ice sheet. So we should set the temporal frame to say 1900 to the present day.

Re: Oh just stop with the bullshit unscientific scare-numbers.

Just stepping back from the numbers you offer in your post, I have a more basic question.

If the trend in water consumption is so insignificant, can you explain why more and more parts of the country experience drought conditions? Records show that there has been a significant increase in the frequency, severity and geographic spread of drought mandates, state of emergency declarations and/or mandatory water use restrictions across US states. Some academics describe conditions in the American west as being of "megadrought" proportions. Many regions are experiencing longer and more intense dry periods than say 20-25 years ago.

Another part of the question of water availability concerns clean supply. When rain falls on open land and drains in to rivers, then unless there is known contamination in the ground [from e.g. a waste dump] that water may be considered suitable for processing and then piping to homes as fresh water. That is not the case when the water is collected as run-off from roads or buildings or urban areas, because of all the contamination. So part of the problem is that every acre of road surface, every acre of building surface, removes that amount of land as being available for water collection. Worse, because water drains "downhill", development on higher land can result in contamination seeping down in to existing river valleys and polluting supply.

But back to my original question: if the additional water consumption is negligible, how come we're seeing such a rapid and significant increase in water shortage and drought conditions nationwide? Does it really make sense to disregard that context while arguing for a single building that consumes as much water as 15,000 homes?

Sources:-

https://www.theguardian.com/us-news/2024/nov/05/states-drought-climate-crisis

https://en.wikipedia.org/wiki/Droughts_in_the_United_States

https://blog.ucs.org/rachel-cleetus/widespread-record-us-drought-threatens-rural-livelihoods-and-food-affordability/

https://www.carbonbrief.org/us-sees-alarming-increase-in-combined-heatwaves-and-droughts/

https://www.preventionweb.net/news/us-sees-alarming-increase-combined-heatwaves-and-droughts

https://news.climate.columbia.edu/2024/01/24/hot-drought-unprecedented-across-western-north-america-since-the-16th-century-study-suggests/

https://www.weforum.org/stories/2022/03/western-us-megadrought-climate-change/

https://www.ncei.noaa.gov/news/drought-defined-deep-dive-us-drought-monitor

https://www.usatoday.com/story/news/weather/2026/04/20/drought-restrictions-summer-2026/89658670007/

https://www.visualcapitalist.com/animated-map-u-s-droughts-over-the-last-20-years/

Palantir wins £9M contract to run UK firearms licensing: CIA-backed biz to hold gun, bomb, and poison records

Re: Hypocrisy on Steriods

You're right... and for resiliency and performance reasons we'd want some form of scalable, modular solution.

According to Google, the Home Office runs it's digital infrastructure through a "Digital, Data and Technology (DDaT)" department, which is in the process of transitioning away from a legacy Hendon Data Centre toward a "highly secure cloud environments and dedicated public-sector data centres".

There's also the "Crown Hosting Data Centre" project, a joint venture between the Cabinet Office and Ark Data Centres. Crown Hosting provides a "pre-approved government framework"...

So I think that in terms of hosting a national register with secure access from county level police forces, the UK has plenty of options...

Umm...

I take the objective logic of your point... but I find it very, very, *very* hard to believe that a bid of [checks notes] *nine million quid* represents the best value/lowest bid to write a relatively simple database.

If Only...

If only "law enforcement intelligence" was actually intelligent, or actually worked.

In November 2015, Islamic terrorists staged attacks in Paris that killed *130* victims and injured *416*. It turns out that the French authorities had been tracking the terrorists - including by their cell phones - before the attacks. It turns out that the attackers had links with one of the two suicide bombers who in March 2016 caused carnage at Brussels airport.

One of the most sobering things I took away from the 2015 Paris attacks is that the French authorities had the terrorists under such good surveillance that they knew exactly how and where those who "got away" had fled the scene - within hours. They were able to report how they left the country and where they ended up.

I make these observations just to remind us that no matter how good it is, a register of users of firearms is what a technologist would call a "Reactive" control. It doesn't prevent the misuse of firearms, so it's not preventative... it doesn't detect the misuse of firearms, so it's not detective. It just helps the police to improve their clean-up rate, *after* the crime has already been committed. And sadly, in the case of a firearms offense, that could mean after someone has been murdered or injured.

I think it's important to consider this objectively, because [granted, less so in this immediate case], a lot of the policy around activities or things that are dangerous to the public come down to a trade-off, a decision between the encroachment/elimination of personal and civil liberties on the one hand, in return for an improvement in safety on the other.

It is critically important that citizens don't allow themselves to be bamboozled by governments that claim that having a firearms register will somehow drive down gun-related crime. There is a narrow chance that it *might* (never say never), but what is much more likely is that *after* the crime, the police will be able to identify the perpetrator.

Any time a government proposes removing or reducing any freedoms or rights that you have today, they will almost certainly tell you that it is "necessary" in order to protect something else - for the "greater good". It's generally a very, very good idea to take a close look at that argument and test it vigorously. This might be a shock, but sometimes governments lie just to get headlines. Especially in the wake of a tragedy, where they feel some compulsion to be seen to be "doing something".

If the government was really serious about firearms safety, they would follow the example set by Japan - where it is virtually impossible to own or possess a gun - and which has among the lowest rates of gun violence anywhere in the world.

When a government *doesn't* do that (but does something else), you know you're watching "security theatre".

Re: Hypocrisy on Steriods

I think you may have completely misunderstood the context in which I made the statement you quote, so for other readers and the record, let me clarify.

The point I was trying to make was *not* that holding a firearm - or having the right to use one - was in any way comparable with other sports or social activities. What I was pointing out was that the data architecture and basic application functionality of a register of firearms users was fundamentally similar to the data architecture and basic functionality that you might expect to see from a more-or-less generic sports or social club membership register.

Memberships have to be submitted...

There may be some form of vetting required - for example a scuba club may accept basic details but then have to vet claimed qualifications [gas mix diving, depth rating, etc].

Once vetting completes, a membership record would move in to the main register.

Periodically there would be requirements to verify contact details remained correct.

There would be a requirement to keep annotated notes with each member.

There would be a requirement to issue subscription reminders and track payments, to ensure that membership fees [or licensing fees in the case of firearms] remained up-to-date.

Now there are a bunch of other things that generic club membership software may provide that a firearms register would not - for example managing competitions and sporting events.

But disabling or removing functionality from a starting-point package is a lot easier than adding in new functionality to the same.

So... I was not for one moment suggesting that, somehow, a software package for recording details of firearms users was in any way comparable with people in e.g. a tennis club.

I was suggesting that *the basic data architecture and application functionality* was sufficiently close to likely make it easier to start with a "club membership" base and then tweak as required.

But more than that, the point I was trying to make was that there is no way on Earth that delivering this should require the government to spend *nine million quid*.

-=-=-=-

It's unfortunate that you misread or misunderstood my point, but I hope that clears it up for you.

Hypocrisy on Steriods

According to Google [E&OE], there are currently over 250 specific undergraduate courses in the UK dedicated to software development and software engineering, across more than 85 universities in the UK. If you include broad Computer Science degrees, that number jumps to over 2000 courses taught at nearly 200 institutions.

And yet apparently our government - which worked extensively with UK universities to develop the nation's response to the COVID-19 pandemic - apparently doesn't see the value of developing government-university partnerships to promote the development of UK IT Skills by sponsoring technical universities to set up commercial arms able to write software for government use?

Even the UK's "Local Government" software - your Basic Council Tax, Non-Domestic Rates and Benefits systems come from 3 major suppliers, including NEC of Japan...

How come Rachel Reeves keeps saying that she wants to promote British Industry and get more British citizens to invest in Britain, when **the government she works for can't be bothered to do that itself**???

Just stop and think for a moment about what you'd need for a firearms register. Names, addresses, details of firearms held, details of qualifications. Maybe a few more odds and ends. Exactly how is this significantly different from any other sports and social club? (Apart from the national scope and potentially the number of members). Apparently there are something in the region of 550,000 license-holders across the UK - though of course numbers is just a one-dimensional scale and has no bearing on the complexity of the software.

And the Strava Run Club boasts over 1,000,000 members; the private PureGym chain has 1,500,000 active members. I'm betting that PureGym didn't pay *nine million quid* for their membership database.

So why the #### are we expected to believe that this is necessary? Or value for money? Or that a British company couldn't do a better job for less?

Exactly what is the root of all the corruption in the UK's national government? It can't be incompetence - what we're seeing is just to widespread for that. This is a concerted effort to waste tax-payer money, allow US corporations to come in to the UK and gain another exploitative foothold.

At this rate we would be better off to apply to become the 51st state and be done with it. At least if we did that the likes of Amazon, Facebook, Google, Starbucks, Walmart and all the rest wouldn't be allowed to pull their usual nasty "IP licensing deal" to magic all their profits out of our economy.

Sigh.

Scientists pour cold water on claims phones are rewiring kids' brains

So Just to Clarify...

The current government are about to enact a [completely unenforceable] law that prohibits social media access for children under the age of 16, on the grounds that it is harmful...

But at the same time are interviewing experts who say that there is no evidence that smartphones are have a material impact on children in their formative years.

I appreciate that these two sets don't overlap completely, but the venn diagram likely has significantly more in common than not. But what is more concerning here is that the social media ban for 16 year olds would - in the face of this evidence - to have been triggered without a sound foundation in science.

Isn't this why we have government agencies? Do you mean to tell me that we don't have a ministry or minister or cabinet member with the wherewithal to determine from scientists that one of the most widespread and powerful influences on the young in our society hasn't been researched? That we simply don't understand what effects it could have?

Pardon me, but what the #### are the government doing then? Don't sit around a committee room repeating the same question and expecting a different answer [a classic instance of Einstein's definition of insanity] - commission a study, set up a research grant, get a good British University or two involved, and **find out**. And if social media and constant interaction to connected devices is changing children in their formative years, ####ing well do something about it.

Out of curiosity, when it became apparent that the experts called to testify couldn't give a definitive answer, did *anyone* ask them, "What would it take, in terms of studies or research, to get to useful, actionable data?"

I have a horrible feeling that I already know the answer to my own question.

Sigh.

Britain plots digital bedtime after kicking under-16s off social media

Re: Reeally....

This isn't age gating.

This is a mechanism to force an association between your cyber persona and your real-life identity.

The Police State cometh.

Palantir's NHS data deal called in for a second opinion

Not Enough

So - translating - enough of a stink has been caused around this blatantly irresponsible deal that suddenly ministers are getting uncomfortable that they may have to answer for their decisions - like to just up and give this contract to Palantir.

Well, it's a start, but it's not enough.

We need some sort of public review that determines the process followed for the decision, the structure of the requirement, the selection of the bidding parties, the evaluation process, the evaluation criteria, the recommendations and the decision-making to select Palantir. Because *all* of that stinks.

There's more.

We also need the government to explain why they are so determined to give money to US companies when WE are being told to "Invest in Britain" and "Buy British". We need the government to explain to us why it won't follow the recommendations of it's own cabinet-level ministers - and the PM - and instead seems to be happy with a series of dubious no-bid contracts that result in **MEDICAL RECORDS** being reviewed by employees of a foreign company.

We also need a forensic analysis of the contract terms initially agreed with Palantir, with specific focus on what Palantir believe the contract entitles them to do with the data. We need to know if any of the data has been accessed or analysed for any reason except in directly fulfilment of the contract. And yes, I know that the deal is future-looking and that Palantir may not have access to actual patient data yet, but even so, it pays to be sure.

Highly unlikely, but I'd also like to get every single minister and senior mandarin on the record about any conversations or agreements they may have had - with Palantir or any other provider - about future employment opportunities, "fact finding trips", offers of hospitality, gratuities or anything else any of them may have received during the gestation of this frankencontract.

It's not enough for the government to quietly withdraw this abomination and try and pretend it didn't happen - that is tantamount to letting them "get away with it" - and they will be back to try again sooner or later. We need to put stronger, more robust safeguards in place.

There is simply no reason for us to trust that the government is being honest here... so we need to look past the claims for actual evidence and truth.

Their track record with the handling of patient data speaks loudly enough.

"No" means "No!"

NHS patients can't opt out of Palantir's data platform – but their hospital can

Re: What About the Six LBPs?

Palantir isn't the government - not officially, at any rate.

And the government is still able to break the law.

Or to think about it another way, if getting confidential data into the hands of anyone you want was as simple as just rinsing it through a government agency, I suspect we'd see a lot more of that being done already...

Re: When some becomes all

I have limited experience of working with contracts like these - not in healthcare, but definitely with regulated data.

In my experience the way the contract would be structured would be to have an initial statement that begins something along the lines of a cut-and-dried prohibition of any access to UK medical records by any non-UK staff or outside the UK.

Then there would be a small set of a short number of carefully defined exceptions.

Then, right at the bottom, there would be the catch-all exception - the one that says something along the lines of, "Any additional primary or secondary contract staff whom the Account Manager deems to require access in order for the contractor to fulfill the terms of the contract."

Which, translated means that Palantir have the right to grant access to anyone they want.

And just to underscore the total and mendacious sellout by our scummy government on this matter, think about e.g. Swiss data secrecy laws. It is illegal for data pertaining to any Swiss citizen to leave Swiss soil - i.e. it MUST be kept within Switzerland, accessed ONLY by Swiss nationals, UNLESS the data is encrypted in a form that meets regulatory approval and where the keys to decrypt that data are kept and maintained within Switzerland at all times. In other words, you can't export data on Swiss citizens out of the country.

The Swiss government achieved this remarkable result by putting words down on a piece of paper, voting on it and calling it a law.

A feat which, apparently, is beyond the abilities of the blithering idiots currently trying to run Westminster.

Re: What About the Six LBPs?

Fair.

I wasn't clear in my previous post, but I was specifically referring to the EU's "Adequacy Decision", which allows for the free exchange of data between the UK and EEA - for the sharing of personal information - without the need for complex contractual safeguards.

There will be some interesting edge cases to this, however. Suppose you are an EU citizen visiting or living in the UK and something happens that results in you requiring medical attention. The attending physician in the UK, with the consent of the EU citizen, can request medical records for that individual in order to help treat them. That arrangement obviously gets a little more complex if the EU citizen is otherwise unable to give their approval, in which case the system falls back on the same sort of "Implied Consent" that e.g. a First Aider is taught when rendering care to a non-responsive patient.

Where I think all this gets interesting is the question of what happens to the data belonging to the EU citizen once it is received in the UK. If it arrives in a data format that can be directly imported to the Spine, then unless the UK physician receiving the data has explicit instructions to the contrary, it seems reasonable that the record might be added to the Spine so that details can be updated [for return to the individual's home nation]. Now you have non-UK-citizen data in the Spine, which is by the government's admission going to be freely available to large US healthcare providers. Sorry, excuse me, to Palantir employees. Cough.

Perhaps the edge cases will be sufficiently few-and-far-between that the EU turns a blind eye, even if informed of the practice. Either way, I can't see the US falling over themselves to delete or hand back any data received "in error".

What About the Six LBPs?

The EU GDPR - which the UK is legally required to comply with as part of our existing relationship with the EU - includes the "Six Lawful Bases for Processing" ... and which gives individuals inalienable rights over the custody and use of our data, up to and including the right of erasure.

I appreciate that it is going to be more difficult for the NHS to provide us with primary care if they don't have any data concerning our medical histories, but I have no problem with maintaining my own medical history file and I'd be happy to take that with me if I need to see a doctor - and keep a copy on my person attached to a Medic Alert bracelet if I were ever incapacitated in e.g. an accident.

Does any reader have any knowledge of the intersect between the deal that the government signed with Palantir and the GDPR?

Has any government minister gone on record as confirming that the deal complies?

Everyone hates frontier AI labs, says Palantir boss

Re: You Can Smell The Fear...

"The Generative "AI" models and LLMs are far too unreliable for anything important."

May I ask - have you much experience using models for a wide range of tasks? My company was an early adopter of the "Big Two" models - OpenAI and Anthropic - and I have personally used them for:-

- Analyzing and summarizing lengthy, complex technical documents

- Creating an extensible, adaptable cyber and technology threat model

- Validating and recommending enhancements to design specifications of Preventative, Detective and Responsive controls

- Planning detailed, multi-destination, multi-country travel

- Software development and scripting (PHP, Python, BASH)

- Helping me configure a local mail server (Postfix, Dovecot, MariaDB)

- Helping me configure RSyslog to accept and filter a data feed from my firewall/router, so I can monitor WAN performance

and

- For fun, asking Claude to review some science fiction I've written, to help me keep the basic foundations of the story within current actively developed theories (on dark energy and dark matter).

Beyond my own use of AI, there's plenty of evidence that it is have considerable impact in many different fields of endeavor. For example:-

- AI has made massive breakthroughs in cancer care... transforming oncology, speeding up drug development and even designing proteins that can be used to re-program the body's cells to fight cancer...

- AI has transformed the software development lifecycle... massively accelerating prototyping, smoke testing, vulnerability detection

- AI has revolutionised the aerospace industry, reducing development cycles by up to 30%, but more importantly helping with things like aerodynamics and advanced material engineering

- It has completely transfored astrophysics - for example by processing petabytes of data from observatories, helping to prove or disprove theories from vast amounts of captured cosmological data.

I started my technology career as a professional developer but spent most of it working with cyber threat intelligence and the design of cyber and technology controls... so it's possible the fact that I have quite a broad technical grounding helps me get really effective results from it.

My last employer was a large US bank - who committed 10% of the entire technology budget to AI adoption, and who has seen it transform the way that technology is designed, configured and maintained.

But it's possible that my personal experience is unusual.

My own view is that it is far, far from omnipotent. There are things where it won't be successful, no doubt about it.

But I'm intrigued as to why you say that it won't deliver.

Now... if you'd said that the cost-benefit analysis doesn't add up. If you'd said that the amount of energy required to get useful results is unsustainable. If you'd said that it will struggle to gain traction while the hardware remains scarce - the RAM, storage and ultra-fast networking technology - and/or until it becomes economically viable. If you'd built a case around operational viability, I would be much more inclined to accept your argument and be happy to discuss options to address those vulnerabilities.

But your view that it is unreliable just doesn't fit with my experience.

Are you willing to share your experiences that lead you to believe that it is "too reliable for anything important"?

You Can Smell The Fear...

The TLDR: Palantir are saying that "everyone hates frontier AI labs" - because they have just realised that any of the existing AI models easily have the "intelligence" to render their products obsolete. Why pay Palantir a small fortune for their technology when you can just feed the same raw data sources to an AI model and have it deliver the same or better results for you? As part of a range of other duties, instead of being a purpose-built, very expensive product?

Right now, anyone paying Palantir for licenses who is *not* evaluating replacing Palantir tech with e.g. Claude or OpenAI is not just missing a trick, they are missing one of those handful of "golden" use cases where existing AI models can absolutely trounce existing solutions.

Palantir must be defecating building materials, to borrow the phrase.

To anyone not familiar with Palantir outside of their recent attempts to win business from the UK government, a little bit of context will probably explain exactly where this utter BS is coming from...

For the last 23 years, Palantir has been the market leader in "corporate counter-espionage" - and I'm being extremely generous with that description. Palantir have developed a suite of technologies that enable large companies to monitor their employees with *shocking* accuracy. Let me give you an outline of the sort of things Palantir can do - then tell you how they do it...

- Palantir tech can identify people about to leave a company, before they hand in their notice, with shocking [better than 95% accuracy]...

- It can identify people having affairs - not unusual in this day and age - but remember that many companies expressly prohibit relationships between managers and subordinates because of the risk of that relationship distorting performance appraisals...

- Palantir can identify data thieves, corporate epionage...

- Palantir can spot people working 2 jobs - particularly among remote workers...

The way Palantir works is to collect data from lots of key sources and then intelligently aggregate it. For example, some of the data elements that it can capture and monitor for variations includes:-

- The times of day and days of week that you "badge in" and "badge out" of secure areas and buildings, including odd variations...

- The times of day and days of week that you log in remotely - and from where...

- Your use of every ID-operated fax machine and photocopier [and if your company uses a modern MFD with an integral hard drive - the pages you copy can be retrieved and analysed].

- The in-house applications that you use - and the times you access them...

- The amount of data flowing between your workstation and corporate tech - dates, times and volumes...

- Your use of the internet, including sites visited, times spent active...

- Your use of email...

- Your physical location, if you are stupid enough to keep a company cell phone with you...

- Your physical location, if you have a personal phone with a company "MDM" package installed on it (For your "convenience")...

Palantir has spent the last 23 year developing and fine tuning their technology to harvest all that data from all those sources and then, like Cambridge Analytica and Facebook data (but with a much smaller number of target users and much, much richer data), to build a detailed profile of you the corporate employee.

Start turning up for work earlier? Palantir will know.

Start accessing applications at odd times? Palantir will be watching.

Downloading data from a Sales contact database? Palantir knows all.

Stupid enough to think you can defeat the DLP system by printing the downloads to paper and walking it out the door? Good luck with that...

The "Secret Sauce" for Palantir's brand, then, is the intelligence. It's the ability to sift through all these different data sources and "make sense" of lots of data points that really aren't easily connected in the real world. It's more of a six-sigma approach to corporate counter-intelligence than necessarily getting concrete evidence [though, because they have all the data, getting the evidence may not be too hard].

So how does all this fit with Palantir saying that everyone hates frontier AI labs?

Because what Palantir does is analyze vast amounts of data and look for patterns. It applies their proprietary algorithms to search for deviations in behaviors. The sort of thing that an AI is exceptionally good at doing. Palantir have been a commercial success because they cracked the blueprint for developing this horizontal cross-section view of an organization's data flows and users that enabled them to spot someone behaving in an uncharacteristic way. AI is going to be able to do that *so much* more effectively - and likely for a much lower cost.

So this latest spiel from their head honcho sounds to me a lot like the CEO of Eastman Kodak when they suddenly realized what the digital camera revolution would mean...

If you think about it - their response makes a lot of sense. If your business was about to be wiped out by AI, then maybe your best line of defense is to suggest that your product is what companies need to provide them with the interface to different AI providers... So he's basically trying to morph his company in to being an irreplaceable bolt-on to the technology that is about to flatten his entire business model.

A nice trick if he could pull it off.

If I were a betting person - I'm not - I think my view would be: "Toast!"

Good riddance.

EU's digital sovereignty boo-boo may be the best thing to ever happen to the project

Re: Twaddle......Some Analysis.....

"(2) One firewall (with rules set my me)"

OK, but...

1. If you want to be *confident* of your internet security, one solitary firewall is never enough, because if it's porous, you'll never know. So from an architecture perspective, a "minimum viable product" is: two different hardware manufacturers and 2 different software stacks. Configure one as your externally-facing firewall, connected to your router/fibre modem... and configure the second as your inner perimeter. If you have *anything* hosted "between" them, then obviously you have only deployed a stripped-down instance of say nGinx, running in reverse-proxy mode? Right?

2. Whose hardware are you using to host your firewall? CWWK? Or one of their derivative / badged clones? If so... are you 100% confident that your Chinese-made appliance is fully secure? If there were an unauthorized access granted via your internet-facing device, how confident are you that you would detect it? Obviously you're not using anything that's US-made, right?

3. How confident are you that you know who made the NIC or NICs [if it's a multi-port card] you are using for your external connection? How confident are you that the NIC *really is* from the manufacturer you see stamped on the physical socket on the back of your machine... as opposed to a functional clone with the brand name put there as misdirection?

4. Whose software are you using to run on your firewall? pfSense? opnSense? ipFire? Something else? Did you compile from source? How confident are you that the code contains no errors... Linking back to my first point... if you want to be *confident* of your firewall setup, you would have 2 different hardware manufacturers and 2 different software products running your firewalls. And when I say, "2 different software products", I don't mean e.g. pfSense and OPNsense, given that OPNsense is a fork of pfSense - which means that if pfSense contains a vulnerability, there is a serious, non-zero chance it also exists in OPNsense...

5. How do you route and trigger your network alerting? You don't mention a honeypot, so it's possible that you're not hosting publicly-facing content, but what about all the other network activity? Do you route all your logs to a central host using e.g. rsyslog? Have something actually monitoring the logs for anonymous events? Sending out alerts to your mobile?

OK... the chances are that you don't have all the above, perhaps because you don't need it. But if your answer is that the "firewall" you have is a packet filter built in to your home router, then, very respectfully, you have the illusion of security and nothing more...

(3) One network connection to the outside world

1. A single network connection is absolutely fine as long as you don't have anything with reliance on a working connection. If the most critical thing about your connection is that your family will kick off if NetFlix is lost, then a single network connection is probably OK. But if you're trying to do anything serious and you don't have any form of backup?

2. You mention the "outside world" like it's everything on the other side of your firewall. Which might be fine. But... do you have any wireless networking? Bluetooth? Do you have devices that have wide area network connections over say 5G and are also configured to your wireless network? Say the sort of smartphone that can be compromised with a single SMS message?

3. If you do run an internal-only wireless network, have you activated MAC Address filtering on it, and configured your mobile devices to use static MAC addresses on that "known, trusted" network?

4. Do you monitor your outbound network traffic for any evidence of compromised hosts?

5. What's your resiliency if your single firewall develops a fault?

It may well be that few [if any] of the questions I ask here are applicable to your network environment - in which case, good for you.

I ask them not to suggest that you have or are doing anything that may be insecure, but to point out that you can only decide "how much security is 'just enough' " when you have a clear picture in your mind of the assets you are protecting - along with their value ... and the threats you want to mitigate - along with their probability and impact.

I am always ready [and would in fact be *delighted*] to come across someone who has a security setup commensurate with their asset values, threat profile and risk appetite... but after many years of professional experience, I have yet to see that setup.

And I'm not talking about "Fort Knox" levels of security, I'm talking about someone who has done a thorough threat analysis, designed and implemented commensurate controls, then actively monitors their control performance and environment to ensure that they are not vulnerable to drift. I'm talking about someone who knows what their risk appetite is, knows how much risk they are taking - and can demonstrate that the former exceeds the latter ... or that they are actively correcting the imbalance.

I make these points only because in my experience having the illusion of security is worse than having no security. At least if you have "no security" you should be aware of the fact. If all you have is an illusion, you're just asking for trouble.

Every employee’s password was stored in a single Excel file

Re: Insta-Logins

I saw Honeywell-Bull implement a version of this back in the 1990s. Pretty sure this was something they did in conjunction with Schlumberger (now SLB).

There are a couple of manufacturers who offer keyboards that include integral card-reader tech - usually a slot on the top of the keyboard.

You issue your employees with photo-ID cards, but, crucially, you also give them one of those retractable card-holder devices and make it company policy for the card to be worn in plain site - clipped to a belt, or via a big old-fashioned safety pin.

Many companies today already have card-based access to their buildings, so extending the security envelope for the cards to provide workstation access is a useful layer of security.

And the best bit? You can configure the driver of the keyboard/reader such that the screen saver automatically launches the instant the card is removed from the keyboard reader. That's significantly better than the convention 10-minute timer most companies still rely on.

Re: > The Head of IT's only real option would have been to resign first,

BOFH, is that you?

Met Police, Apple join forces to choke London's stolen phone trade

The Missing Bit...

I feel obliged to make a couple of "obvious" observations...

First... that while society has changed enormously in the last 25-30 years, it hasn't been for the better. Most of the "phone snatched" stories I've come across [pretty much all of them] are of an unsuspecting victim walking down a high street with a phone to their ear, nattering away whilst distracted. The sort of high-street thefts that we read about today - particularly the e-bike and e-scooter varieties, would not have happened 15-20 years ago *because there would have been an actual, live, honest-to-goodness bobby on the high street during shopping hours* who would have stopped them before they got 2 feet.

It's all well and good for the government to try and co-opt tech companies to tracing a phone *after it has been stolen*... but how about restoring the discouragement to steal it in the first place? Pretty sure that the answer to this is that doing so would take thousands more police officers and add thousands a year to our council tax bills. One wonders where all the money went.

Second... sticking with the theme of "an ounce of prevention is worth a pound of cure"... what about encouraging manufacturers to provide phones that have a decent bit of alloy in one corner of the case through which we can put a securing mechanism. I appreciate this isn't always possible... but I have a pretty robust wallet and I secure that to my person with a good-quality stainless steel, welded-link chain that I loop around my belt and then fasten to my wallet through a provided "eye". Yes... someone could take a knife to my belt... but it isn't necessarily the permanent attachment of the valuable to your person that you need, just enough so that if a thief does snatch it and tries to run, they won't succeed.

Third... I appreciate this isn't going to work for everyone... but if you are concerned, the other thing you might consider doing would be to invest in a pair of decent quality cordless ear-buds, preferably with noise cancelling. You can keep the phone in an inside jacket pocket and you can control calls with Bixby/Siri - if that's your thing; or with a smartwatch. Nobody even needs to know you're carrying a phone in the first place. Not an ideal option - because really we want to catch and punish the offenders... but offered in the absence of anything else likely to be effective...

Ring gets buzzed by class action for collecting visitors' faces without consent

Don't Forget the Legal Argument

Ring doorbells actually carry a much more significant and fundamental risk for an owner than is described here, *if* the doorbell has line-of-sight to any neighbouring property.

At it's most simple level, a Ring doorbell is a CCTV camera. Well, guess what? There are laws in place concerning the use of CCTV. Here's a link to an overview:-

https://www.gov.uk/government/publications/guidance-on-the-use-of-domestic-cctv/domestic-cctv-using-cctv-systems-on-your-property

If you want to run a CCTV in your home, then:-

1. You have an obligation to ensure that the date and time on the system remain accurate

2. You must not store any information or images longer than is necessary - which means that you must delete the information once it is no longer required

3. You must only use captured information for the purpose for which it was required - identification of someone **at your door and requesting access**

4. You must keep recordings **secure** and **keep access to a minimum**

5. You are required to ensure that you remain in compliance with the GDPR and the DPA

6. You must regularly delete recordings

7. You need to ensure that your system is still "necessary" - it has to serve a legitimate purpose

8. You need to ensure that privacy intrusions are minimised or eliminated

9. You need to ensure that you comply with local laws and bye-laws, including e.g. the prominent placement of a sign that states "CCTV in Operation"

10. You are not permitted to position your camera to record activities on private land you do not own (privacy intrusion).

All of those obligations are on you, the user. But take a look at some of them...

If Ring exports facial data for cloud processing, how can the owner of a Ring system possibly know if the information is deleted?

How can a Ring owner know who has access to the data they are uploading in to the cloud?

How many Ring owners actually bother to investigate and ensure that they understand and comply with their legal obligations?

It's worth noting that Ring was developed for the US market, with Amazon taking no responsibility for ensuring customers know that they have legal obligations to comply with.

Much as I accept the security benefits, especially for the elderly and vulnerable, Amazon have deliberately ignored the law in order to make more money.

And all liability stays with anyone who buys and installs their product.

I just want to underscore a key part of my reply here - compliance with the DPA. The primary function of the Ring doorbell is to allow someone to ring your bell and for you to look at a camera screen and *see who is standing directly in front of your door*. EVERYTHING else is secondary and not the key function of the doorbell. This is important because when the Ring system captures images from a neighbouring property, or it identifies someone based on biometric analysis, then it is potentially acting outside of the GDPR. That's because you don't need your Ring system to tell you that it's "Fred Smith" at your door. It's enough to tell the owner that there is a visitor and for the visitor to decide. The owner still needs to take an action in response if they wish to go to the door and grant the visitor access.

So Ring are pushing the limits of the GDPR - which they UK are required to adhere to as part of our trading agreements with the EU - and may already be outside what the GDPR would allow based on a narrow reading and an understanding of the doorbell's primary function.

Personally I'd like to see this tested in court. I think they don't have a leg to stand on.

Brit maritime agency heralds fresh global rules for crewless cargo ships

Re: FSD ?

Bezos has reportedly put "Koru" up for sale...

So the story goes, he was denied a mooring at Monaco for the Grand Prix and has been unable to get the monster yacht in to various popular destinations. Turns out that when you commission a yacht as big as some container ships, with a draft of just over 5 metres [16 feet], there are positively *loads* of very popular places that you simply can't reach. He was unable to take her in to Venice Lagoon... He took it to Capri, but they can't handle anything over 60 metres. He went to Saint Tropez - they can't handle anything over 70 metres. He got lucky at St. Barts in the Caribbean, but still couldn't dock at the quay, which only handles 60 metre yachts.

I'm shocked, I tell you, shocked.

Who would have thought that such a great big f###ing yacht can't get in to many harbors and marinas.

What an idiot.

Re: FSD ?

Yes, but I wasn't referring to the fact that it was crewed, but as an illustration of the sort of damage that a ship can do when it hits something.

Re: FSD ?

This is a much more likely target for hackers.

The average oil tanker can take 2-5 miles to stop - and it is quite common practice for them to disengage drive when still 15 miles outside port and just coast in, their momentum is that huge.

Remember back in 2024 when the bridge in Baltimore, Maryland was hit? And that was by a container ship on her way out of port and not up to cruising speed.

https://en.wikipedia.org/wiki/Francis_Scott_Key_Bridge_(Baltimore)

That was by accident... just imagine what a carefully aimed, deliberate strike could do. Worse, imagine the effect of two vessels impacting either side of a span.

Now consider the fact that these ships are going to be using GPS to determine their location... but that the means of defeating GPS has been known for years and is in regular use by Russian forces.

https://www.nytimes.com/2026/06/05/world/europe/russia-satellites-gps-interference-europe.html

The worrying/inevitable thing is that work on this will proceed regardless of the risks... then a "terrorist" attack will occur... and then the parties involved will claim, "Gosh! We had *no idea* that crew-less ocean-going vessels was such a dangerous prospect. If only we had known!"

Better to regulate it now before it gets out of hand. (Or gets implemented, for that matter).

UK fraudsters using AI to doctor 'evidence' in motor insurance claims

Re: "fabricated images exaggerating damage"

I'm not sure if this is still the case, but for anyone reading this and who experiences vehicle damage in the future...

1. You should have the right to have your vehicle repaired at an authorised repair centre of your choosing.

2. As long as the repair centre is accredited and recognised by your insurer, that is very rarely a problem.

3. Always, always, always, always pick a well-regarded repair centre as close to where you live as possible.

You want to go with a local repair centre for exactly the experience that munnoch describes above - what happens in the case of shoddy workmanship. If the vehicle is sent to a centre 40 miles from where you live, you'll find that the insurance company can start to kick off if you insist that the repair is re-done. The thing is, if your vehicle has metallic paint, getting a really good match with existing panels can be hard... If you park your vehicle "outside", your paint will fade, so getting a really good match with existing panels will be hard.

It seems terrible to have to write this, but you should go in to the insurance claim experience expecting to have to turn down the first repair and insist that some of the work is re-done. Make ABSOLUTELY sure that you get a very clear understanding of the work they are committing to deliver. For example, does the offer include the vehicle being "cleaned thoroughly, inside and out"? If so, insist it gets done.

Finally, especially if you're the not-at-fault party, be particularly careful about anyone offering to "manage the claim for you". The idea here is that by default your insurers will "offer" to manage the claim [or not tell you that you get a say in the matter]. However, there are circumstances, especially when you are the not-at-fault party, when having your repair centre manage the claim can be a good thing - because they are volunteering to put their neck in a noose for you. They are volunteering to "owning" all aspects of the repair to your satisfaction. It may seem at first blush that there is little difference between a remote insurer or your local repair centre doing this... but if you have a good quality local repair centre and you get them to manage the claim, then if ANYTHING goes wrong, you know exactly where to go to get redress. Even better, your local repair centre likely employs far fewer than any UK motor insurance company, so you have a 99.999% chance of being able to speak with the same person each time you visit or get in touch.

I was unfortunate enough to have a series of claims [all non fault] with a new car I bought in 2011... and I took the vehicle to the same local repair specialist each time. There was then an interlude of a few years of trouble-free motoring and then a random accident when a lady drove on to a roundabout without stopping or looking and came straight in to the passenger side door... When I took my car back to the same repair centre maybe 4 or 5 years after a previous visit, an estimator came out to look at the damage, took one look at me, pointed, and said (in a delightfully loud voice - and with a grin), "I know you! You're bl00dy fussy!"

We had a laugh and they did the work... and they did a flawless job of it, too.

Remember, we each pay a very great deal of money for our vehicle insurance, so when something unfortunate happens and it needs a repair, it's worth your time and effort to get a *good* repair. If for no other reason, you don't want an obvious and poor-quality bodge job, as it will reduce the resale value of your car when you come to sell it.

I've never hard to argue, only ever just be polite but firm and willing to stand my ground, be sure of my facts - and quote insurance company marketing material back at them if I have to. To be fair, it takes a while sometimes, but you can usually get very good quality service just by being clear, firm and fair.

Home Office ditches legacy asylum database, keeps the spreadsheets

Re: Who cares? The government certainly doesn't!

There's a deeper problem here.

Between 1939 and 1945, the UK was at war with Nazi Germany... and as an island nation had to defend the border from spies and agents provocateur. But during that time, the UK did not have:

- Helicopters

- Drones

- Fast Offshore Patrol Vessels

- Infra-Red and Night Vision technology

- RADAR [at least, not for maritime use]

- Intelligence cooperation with mainland European nations (because they were either occupied or we were at war with them).

Yet, during those 6 years, approximately 140 German agents made it to UK shores. Approx 25 arrived via parachute or boat between September and November 1940. Nearly all were swiftly captured.

Source: https://www.mi5.gov.uk/history/world-war-ii

Yet today, in a wealthy G7 nation that has access to ALL of the above resources, we are expected to believe that stopping illegal migrants is somehow impossible, some hurculean task. These are boats moving at 15-20 mph crossing an open sea lane.

And we haven't installed remote cameras at the common crossing points?

And we haven't stationed a rapid response force in nearby harbours?

We don't have helicopters stationed nearby, to interdict the returning boats and detain their crews?

And we don't have the ability to determine who the ringleaders are, despite the fact that a couple of frikkin' BBC journalists - *BBC* - can do so?

I think we need to wake up and smell the lies.

No government is this incompetent.

Not even this bunch.

When you eliminate the impossible, whatever remains, no matter how improbably, is the truth.

And we can only conclude that the truth is that someone in the corridors of power is quite happy to permit this influx of illegal migrants, that the "something must be done!" rhetoric is just red meat for the braying masses... and that somewhere there are elected MPs who own all or part of those hostels and hotels where migrants are being housed - at extortionate rates - and the tax-payer's expense.

You're definitely right about one thing, though - which is that the people in the boat are pawns, patsies. They are being treated like sub-humans by the folk who own the hostels and hotels and who are coining it in by keeping them in the UK.

England's exam watchdog frets over smart specs turning GCSEs into Google searches

Different sets of Problems

My sense is that there are multiple challenges here.

First, we have the risk that students will smuggle in a device that allows them to communicate with an external agent - be that another person/co-conspirator, or a technical resource such as an LLM - to help with their answers. The solution to this is to use "Faraday Fabric" - available for purchase in rolls that contain a high-shielding material, such as TitanRF. This can be put up across walls and ceilings - probably via pre-positioned fastening points - and this can effectively shield an entire room against an RF signal.

See e.g. NIST SP800-53r5, Control AC-18 (Wireless Acces).

Next, we have the risk of students taking compact, powerful and self-contained technology in to an exam room on their person. The solution to this is to use a sensor such as an airport scanning wand combined with a metal detector. An RF-type wand alone will not suffice as students may try to simply power down their device to cross the threshold, so you'd need something able to detect a small amount of metal and trigger a visual/audible alarm.

Third, whilst not a substitute for having actual invigilators walking around the exam room, you could position a set of CCTV cameras around the space such that each student was captured on a video recording. This could then be saved. If the marking of their paper revealed any sort of anomaly, the video could be played back to determine whether or not they had been behaving suspiciously during the paper. (Yes, a worn earpiece might be harder to detect, but the combination of an earpiece and glasses should trigger all sorts of alarm bells).

Finally, we have an interesting choice. On the one hand, we have the recognition that exams are at best a point-in-time record of a person's ability to recall material and work under time pressure in abnormal conditions (because outside of mock exams, students spend virtually no time trying to perform in exam-like conditions). On the other, welcome to (Orwell's) 1984 on Steroids, where your every thought, word and deed will be scrutinised and judged.

Is it really worth it?

The obsession with forcing kids to grapple with exams when many of them are still being forced/bullied by parents to take subjects they don't like, "because you'll earn more as a doctor than a dustman!", or the fact that given the intense pressures on kids in the modern age, many have no clue what they want to do in life until their mid-to-late twenties. Instead of this pointless farce, how about more focus on lifelong learning, better opportunities to take a break from full-time employment to retrain, subsidies for employers to allow staff to improve their skills.

In the UK we like to think we're an advanced western society... but a few years ago I went to Brazil with my (Brazilian) girlfriend and saw first-hand how they had embraced life-long learning, national adult education programs, extensive vocational training systems and had a booming digital education market. Many towns had a "biblioteque" - a kind of cross between a library and an internet cafe, but dedicated to learning - where you could go of an evening to study. In short, Brazil's approach to education seems much more natural.

Here? We force kids through 2-3 grading cycles - GCSE, A-Level, possibly AS or Highers or University for some, then stamp that future on them.

Judging the worth of a child based on an exam they sit in their teens - and then having their performance in those couple of hours dictate the arc of their life - that's just flat-out wrong.

Capita £370M bid 40% under UK.gov estimate for Oracle HR and finance system project, court case reveals

Re: Definition of Insanity?

I haven't read the contracts, so this is just wild speculation...

But if my experience of this sort of contract is anything to go by, Craptia [sic] are viewing this initial deal as a short-term "loss leader". There are enough clauses in the contract to allow them to claw back the gap and then some, once this initial phase moves in to a longer term relationship.

I'd guess that there are no clauses in the deal that limit the amount by which Crapita can increase costs in future years.

I'd guess there are no clauses that prevent Crapita from hiring the critical experts out of the public sector and in to their company - where they will continue to provide the same basic service for the government, but wearing a different hat and with a very different set of priorities and a very different master to serve.

I'd guess that nowhere in any of the paperwork will you find any reference to the inducements - such as e.g. Non-Executive Directorships - offered to relevant Committee members or Decision-Makers to usher this deal through.

There's something decidedly fishy going on with deals coming out of Westminster at the moment. The same old "Usual Suspects" - Crapita, Palantir - keep turning up, keep seeming to win dubious bids - and even more odd, their bids seem either way over-the-top or below-cost-price.

And final thought... If our own government expected a contract worth hundreds of millions to be likely to cost 42% *more* than the winning bid, I'd expect the NAO to IMMEDIATELY start a detailed investigation of the leadership of that function, the processes they followed, the extent and quality of their work.

What's that you say? The NAO is too busy investigating the prices charged to MP's in the Westminster Village Cafeteria? Oh, sorry, I didn't realise they were all fully occupied with a matter of such grave national importance.

Snort.

Raspberry Pi's profits are up. So is its DRAM bill

Honestly Not Surprised...

I bought a 16Gb Pi 5 on Apr 1, 2025 - and paid £114.90

I bought a 16Gb Pi 5 on Nov 4, 2025 - and paid £115.20

Today - almost exactly 6 months later - the price is £292.80.

That's an increase of 154% in 6 months, compared with an increase of 0.26% across the 7 months prior to that.

I know that a lot of the price increase has come from the massive demand for RAM from the big AI providers... but it's worth noting that even the Pi5 uses only LPDDR4X-4267 SDRAM, so it's not the latest high-speed DDR5 parts that the AI marketplace is gobbling up. Obviously, it's hard to know whether exiting DDR4 production lines can be switched to fabricate DDR5 RAM (seems unlikely), so I guess this means that people are just grabbing what they can find on sale.

We're a long, long way from the £25-£30 that these boards started at, sadly.

Don’t repeat 5G mistakes with 6G, plead mobile operators

Re: Less of exaggerated claims for performance please

Can I riff from your comment with a suggestion?

Instead of all this claimed speed BS that we get from the Telco's... how about the UK government mandates that to get a radio license to operate handsets in the UK, offered models *must* have the ability to record and show the data rates they are receiving from masts over time. So that as signals and rates drop, this is recorded.

Further, all mobile operators in the UK must also switch to a billing system that charges users based on the actual available service they are being offered. So if EE offer me 100Mb/s for data and I only get 50Mb/s, then I should only pay 50% of my agreed contract pricing.

Make the speed recording tamper-proof with digital signatures and give everyone the ability to compare received performance from quoted "up to" speeds.

The mobile phone and broadband internet industries are the only two where an operator is allowed to charge full price for sub-standard service. Try delivering 990ccs instead of a litre of fuel from a petrol pump and "Weights and Measures" will order the pump closed - or shut down your business. Sell 14oz of carrots or 990g of potatoes and bill for the lb or the kilo and W&M can slap you with a fine.

So how come the communications industry has some kind of magic ####ing pass that allows them to charge me for "up to 67Mb/s broadband" and then deliver 55 - and yet get the full price? How come BT was allowed to trim available max speeds for copper circuit users from 80Mb pre-COVID to 67Mb post-COVID, for the same price? What the #### is Ofcom for, anyway?

Sigh.

Re: Coverage

Sorry to have to observe this - and it isn't funny - but you're probably getting better coverage in Gamma particles from Hinkley Point than you are from the mobile phone network.

Another bug hunter leaks Microsoft exploits in defiance of company’s handling of vulnerability disclosures

Re: ActiveGIT?

And a big part of the challenge for "the rest of society" is that over the years software companies have managed to establish the EULA as their get-out-of-jail-free card.

First they wanted you to buy software, priced as if it was of merchantable quality, but then used the EULA to disclaim any responsibility for delivering sub-standard trash. And if it turned out that you bought some code with a material flaw that cost you your life savings; well, sucks to be you.

Then they wanted you to only have a *limited right to use* software, that you don't actually buy, even though you pay a retail price for it, with the EULA narrowing your rights, purely in order to further isolate them from the "merchantable quality" debate - on the grounds that since you only have "limited rights to use" and not a "right to own", you're on even weaker foundation should you have cause to complain.

And through all this they have reserved the unilateral right to ship code with defects they know about but which they are under no obligation to disclose to you - you know, so that you can make an informed decision as to whether or not to trust your (life savings / business / actual life) to it. And because it isn't enough to just have the ability to ship defective code, they also reserve the right to not provide patches, or stop patching, whenever they feel like it.

To be clear - this isn't just the Microsoft way [though their "bug bounty" program is clearly the worst], this is the attitude of all large software vendors with retail customers.

In a fair society, consumer protection laws would be enacted to make it easier for individuals to get redress, but thanks to DOGE, none of those safeguards exist any more.

Welcome to the future...