The Register Home Page

* Posts by Sproggit

464 publicly visible posts • joined 8 Jul 2012

Page:

Intel bit off more than it could chew with 18A process node

Sproggit Silver badge

This is Misdirection, Pure and Simple

If you step back and look carefully at what this article reports, Intel are basically saying: "We screwed up with our 1.8nm process. We didn't have reliability and we didn't have yield."

So why the #### did they release product based on what they now admit is a sub-standard product driven by a questionable road-map?

The article quotes Intel executives as trying to describe the "problems" as being of a technical nature and to have us believe that with all they learned from 18A, they will have better results with 14A.

But the issue wasn't the *technology*, it was the *management*. It was the management who signed off on the decision to go in to production. It was the management who agreed to release an entire family of chips (the 265/275/285) that actually *under-perform* the silicon they were supposed to be replacing.

Apparently one of the saying's of President Xi of China is, "Don't interrupt your enemy when he is making a mistake..." AMD clearly understood that lesson and just went on with their own work. What we're seeing from Intel today is the culmination in a long, long chain of poor management decisions that likely have their roots in the time when Intel ruled the chip world - I'm thinking back around the time that we had HEDT processors with 44 or more PCIe lanes and everything was Intel. Just - what - 4-5 short years ago.

As retiredFool so thoughtfully wrote, above, it's much more likely that Pat was the one who made the decisions to right the ship, after inheriting a bunch of bad decisions from his predecessors.

And the hard part of this is that when there's no decent competition, *everyone* suffers. You only need to look at nVidia's attitude towards the GPU market - the sector that gave them the capital and the architecture that made them what they are today - to realize how quickly these corporations will throw people, customers and ideas on the junk pile of history.

I'd like to see Intel turn it around, if for no other reason than to give AMD some competition. But a big part of me thinks they don't deserve it.

They're still not learning the correct lessons from past mistakes.

Grep this: Microsoft grafts (most) Linux commands onto Windows

Sproggit Silver badge

Re: Imitation is the Sincerest form of Flattery

"Today you can build, and deploy .NET apps on Linux."

Indeed - I run a Primary/Secondary pair of Technitium DNS at home [on multi-homed Pi4Bs] for my home network. That project is developed on Windows and ported to Linux using the .Net runtime.

Good project with a very responsive team of developers... but I do notice some inconsistencies in the edge cases - and they turn out to all be down to .Net failing to properly implement / call down to the Linux networking stack. For example, Technitium has an admin parameter that allows users to specify which adapter or which address should be used for communication with fellow Zone Servers. But on my Pi setup it doesn't matter what configuration you use, the code will ignore it and use the primary network adapter for the host.

Very much an edge case, but the sort of thing that would make me wary of deploying .Net on Linux to anywhere sensitive - like a DMZ. Probably fine for your internal network segments though.

Sproggit Silver badge

Imitation is the Sincerest form of Flattery

Getting on for 7 years ago, Steven Vaughan-Nichols wrote an article in Computerworld, titled, "Call me crazy, but Windows 11 could run on Linux". See here:-

https://www.computerworld.com/article/1658541/call-me-crazy-but-windows-11-could-run-on-linux.html

As he rightly put it at the time, "Desktop Windows has had so many problems, desperate measures may be needed." While I think that might be a bit hyperbolic, it's becoming increasingly clear that Linux is as important to Microsoft's future success as their own code, mainly because they are never going to win over enterprise clients. The massively scaled platforms used by e.g. Amazon and Google all run on Linux variants... and run well.

Linux is capable of running on lower-power hardware, because it's possible to run it in headless mode, without all the expense of the GUI. Which means it's faster and more cost-effective.

I think that this latest move by Microsoft is entirely unsurprising. Maybe not the full, "If you can't beat 'em, join 'em" acceptance, but certainly the acknowledgement that if Microsoft want to remain viable in the enterprise space - and avoid going the way of Apple - then they need to become a lot more "Linux-friendly."

My suspicion is that SVN was probably right, just maybe a decade or so ahead of his time.

Remote work – not AI – is killing job prospects for the youth

Sproggit Silver badge

Re: not sure if this is the only reason

Happy to be corrected, but strongly suspect that this is possible in e.g. the United States due to the fact that an individual is asked to pay federal, state and local taxes. So if your idea is to take two jobs, you might get it to work if they are technically "based" in two separate states...

But in countries with a single personal tax collection structure - like most of Europe, for example - you would immediately get caught. That happens because each of your employers would submit your earnings to the government, which would then calculate your "Tax Code". It doesn't take a rocket scientist to notice that if you're on a job paying say 45,000 Euros, but your tax code suggests your income is 90,000 Euros, that something has to be a bit "off".

And you have to consider the risks, too. Most large companies will have a clause in their employment contracts covering "exclusivity" - in effect insisting that whilst employed by them you agree to work exclusively for them. This protects the company against conflict-of-interest scenarios, but it means that if you did take a second job, you are by default breaching your contract of employment. Now that's not a criminal matter per se, but as long as the responses are strictly factual, employers are permitted to include details surrounding a termination if they receive a request for a reference.

So depending on "where in the world" someone decides to commit their breach of contract, the downside could include effectively self-blacklisting if they were to be caught.

Sproggit Silver badge

Re: Time to Sack Managers

That's fair...

My current employer has a policy that where teams total less than 12 [not counting the manager/team lead] then everything gets rolled up to the next level and everyone is asked to provide feedback on all the managers in that group, whether a direct report or not. It is very rare for people in that scenario to not know the managers across the group.

But honestly, looking back, the times in my career where this sort of thing has not worked out well for me has been when I've been putting too much attention to the problem in front of me and not enough on my "big picture" for my career writ large. I think a little more coaching at those times would have helped, at least until I got to the point where I "knew what good looked like" and was able to move on - rotate to a different team - when things looked like they were going south.

I don't think there's any perfect solution... just that the best thing you can do if you have experience is to "pay it forward" - be a coach or a mentor, share tips on career development, that sort of thing...

Sproggit Silver badge

Time to Sack Managers

I've spent most of my career to date working in global organizations - truly global, with offices in dozens of countries around the world.

Except the first couple of years, I've never been in the same building as my manager and [actually checked employment file] 90% of the time I've been on a different continent than my manager. There is NO PRACTICAL DIFFERENCE between managing someone who works from home and managing someone who works in a different company. Idiot senior managers like to think that if you get someone to sit in an office they will be "more productive", but if they are the only member of a team in that building, nobody local to them is going to be able to tell if they are productive or not.

Managing someone at home is simple:-

1. Set clearly defined goals for Year, Month, Week and Day.

2. Have a daily stand-up by phone or video conference; 15 minutes max. Use it to call for help, report progress, deliver updates - nothing else.

3. Have a weekly 1:1 with every remote employee: 30-60 minutes, depending on complexity of their work. Use it to prioritize, schedule, manage the work queue, give feedback.

4. Have at least a monthly status check for the big-picture stuff - time to pause, look up, see what is happening around the org, adjust where necessary.

A good manager with remote staff coaches *constantly*... Every single time you connect with a subordinate, you should be checking in and coaching where necessary. How is X coming along? Anything unexpected happen? Any questions? Anything you need from me? Did Fred reach out to you for an assist on X?" A good manager encourages their team to network and to motivate each other.

If you are a senior manager, looking at your organization and thinking that remote working isn't working for you, then you have one or possibly two major problems - maybe both. Either your middle management are not doing *their* jobs properly, or they don't know *how*. Neither of those issues are the fault of distance between employee and manager, but the fault of senior management who abdicate responsibility and then blame others.

Here's a top tip for senior managers reading this who have organizations that let people work remotely. Pull all your intermediate managers in to some town halls and tell them that this year you are going to be grading them based on the feedback of their subordinates, who will be specifically asked pointed questions about how well they assign work, track work, check in with subordinates, coach and mentor, track and report progress and ensure that everyone feels included and valued. Make it crystal clear that middle managers who don't *deliver* won't be working for you by the end of the year... then stick with it.

You'll find that your most junior staff, given the right conditions, will thrive. You'll also discover that more of your middle management, people you assumed to be competent, have zero aptitude for actually managing staff. *They* are the ones you need to focus on - or replace. And if after 12 months you are not seeing a significant improvement in organization-wide performance, then I have a newsflash.

*You* are the problem.

A manager who tells you that they have to have their staff in line-of-sight in order to get maximum performance from staff is in truth declaring their own incompetence.

Claude celebrates Anthropic's stock market float with blockbuster ... outage

Sproggit Silver badge

Re: REPORTEDLY, Anthropic earns more in revenue

"There's a couple of rather large flies in that ointment though: Energy costs and depreciation costs that scale with er, scale."

Fair challenge...

But, on the other hand: energy costs only go up because your customers are using your services. If you can't price your services in a way that covers your energy costs and still leaves you with an operating profit, there's no hope for your business. I think there are aspects of this that we could express differently that make this more relevant - like, for example, the challenge of setting a retail price for a product when you don't know what you're going to be paying for your energy costs... but if Anthropic think that is a serious risk, then they could invest in their own generation capability, and/or they could agree rolling, fixed-price contracts with suppliers.

The depreciation costs are, I think covered... As I noted in my previous comment, that depreciation is already unwritten by existing agreements they have which guarantee a "future minimum value" for the hardware they're leasing. So not only do they have no up-front costs for access to the hardware, they also know what their recovery will be when it's time to upgrade.

To be clear - I have no insights to the company's thinking - I just started looking after I saw the tracker web site and wondered if I could verify their data. What I found was a set of data points that simply did not align with the claimed numbers and which looked to be pretty well substantiated. Your reasonable challenges take us a bit further on, but I don't think they challenge the basic premise of my earlier point, which was the fact that the break-even tracker was based on incomplete data.

We may not be word-for-word aligned, but I think we're in basic agreement.

Sproggit Silver badge

Re: REPORTEDLY, Anthropic earns more in revenue

Happy to be corrected, but I am not convinced the data on the web site you link to is entirely accurate.

For example, it shows Anthropic as spending $33 Billion and receiving $6.5 Billion in income. Yet if you look deeper in to the numbers, you realise that what has actually happened for Anthropic is that Apollo Global Management and Blackstone arranged a $36 Billion [note, 36, not 33] private-credit facility to *lease* Google's Tensor-Processing Units (TPU's). This is treated as an off-the-balance-sheet deal because of it's lease nature - and it is back-stopped by Broadcom guaranteeing the residual value of the hardware that Anthropic are leasing.

Meanwhile, they have set up a revolving credit facility that totals about $2.5 Billion with Morgan Stanley and Goldman Sachs effectively serving as co-lead Book-Runners on the deal.

Finally, Anthropic also raised a very significant amount of initial capital through a massive convertible bond investment, through partners like Amazon. If you're unfamiliar with the term, "convertible bond", it's basically like a hybrid between a traditional corporate bond (where a company agrees to borrow money, repayable after a fixed term, for a specific rate of interest), and a share. In other words, the creditors to Anthropic - who provided the seed capital to get the company up and running - have the option to either take their investment back as a repaid loan, or they can optionally convert that loan to shares. From what I've read, a significant portion of these bonds have already been converted in to shares, which has the effect of massively reducing Anthropic's debt - in effect the lender converts what they are owed in to a share in the company.

But let's take a moment for another reality check/comparison.

Amazon started operations in 1997 and turned it's first profit in 2002 - so that's five years of operating a loss before a first glimmer of profitability. Obviously it took the company longer to pay down the debts it attracted during that startup period. At peak, Amazon owed something like $2.5 Billion, including a then-historic earlier bond offering of approx $1.25 Billion. There are a couple of key points we need to consider here: first, Amazon's business model (basically logistics) is very different from Anthropic's (AI). In fact, Anthropic may be better-placed because it is technically easier for them to scale rapidly. Amazon took *years* to build fulfillment centers, hire drivers, staff, etc. On the other hand, once Amazon branched out from being primarily a book store to other products, there was pretty much nobody in the marketplace to touch them. Many countries have or had some version of a "mail order" provider, but most of these have long since been crushed by the Amazon juggernaut. By comparison, Anthropic and the other AI companies have more competition in the market - which may be good or bad. It will certainly help ensure that the fittest survive, not always the case when there is no serious competition.

Finally, if you look at the ranked list on that web site, until you get to OpenAI (which is *massively* funded by Microsoft) all the top players are very well established and hugely profitable companies: - Amazon, Alphabet [Google], Microsoft, Meta and Oracle each have two things in common - they are already either multi-trillion or multi-multi-multi-billion dollar businesses in their own rights. So: they have deep pockets. Also - equally importantly - every one of them is massively vulnerable to a scenario in which AI proves to be a success and they choose to ignore it. In other words, a big part of the driver for them to invest in AI is simply because a failure to do so could be a fatal mistake.

Notice, for example, that Apple is nowhere on the list. Why not? Because their business model is less impacted by AI than, say, Microsoft.

None of my response should be interpreted to mean that I think you're "flat-out wrong". Far from it. Even the most profitable companies can screw up. Just ask Eastman-Kodak how they got on with the digital camera revolution.

I just wanted to point out the two key things missing from your observations: the depths of the pockets of the companies making the biggest bets in AI... and the scale of the risks they would be taking if they hadn't invested.

Final observation concerning profitability... My direct experience of using AI in the workplace comes from the financial sector... and I can only say that I'm watching it revolutionize a massive global company from the inside out. I'm seeing our time-to-market come down; I'm seeing high-impact production incidents come down; I'm seeing the number of code releases increase and I'm seeing the number of regressive failures decrease. (As a technologist, I don't really have insight to the business side of the house).

As cynical tekkies, we've all heard some dopey senior manager declare, "We're going to do more with less!" and "We're going to work faster, not harder!".

In decades of professional experience, I've never seen those claims come true.

Until now.

Footnote: there's always a cost, right? There sure is. Hiring patterns are shifting - away from deep technical skills like DBAs and developers, like QA Engineers. Now I'm seeing preference for people with really strong BA skills coming back in to fashion. So the jobs market will undergo an upheaval. And of course there's the cost in hardware and energy consumption.

Your mileage may vary.

Peter Mandelson invited UK PM to meet Palantir's Thiel

Sproggit Silver badge

Anyone else Remember "Cash for Questions"?

In 1994 there was a major political controversy in the UK that became known as the "Cash for Questions Affair", when a Conservative MPs Neil Hamilton and Tim Smith accepted literal brown envelopes stuffed with cash (typically £2,000 at a time), to ask questions during PMQs.

The money came from Mohamed Al-Fayed, the now-disgraced late Egyptian Billionaire and then owner of the world-famous Harrods store in London.

John Major set up the Nolan Committee, or more formally the "Committee on Standards in Public Life", which established the 7 "Nolan Principles", which were:-

1. Selflessness

2. Integrity

3. Objectivity

4. Accountability

5. Openness

6. Honesty

7. Leadership

Oh how quickly the UK parliamentarians have rushed to forget all those lessons - and now we find out that Mandelson was basically using his official permission to promote the interests of a client of his global "consulting" company.

Why isn't this outright illegal? This is corruption, pure and simple.

The problem that UK citizens, tax-payers and voters have is simple: no elected official is going to vote for a law that could result in their doing serious time.

Quis custodiet ipsos custodes?

I know I end far too many of my comments here with this, but it bears repeating:

Crooks, the lot of 'em.

Sproggit Silver badge

Re: Corrupt

I regret that I am only able to offer you a single up-vote for that...

Microsoft reaches for olive branch after public dustup with 0-day researcher

Sproggit Silver badge

Time for a Code of Practice

Even if Microsoft's initial claims about this specific research are 100% valid, their conduct in this case has been deplorable.

What's worse, they made the wrong move here. Their comments are a blatant attempt to apply teflon to their own shoulders as they seek to de-escalate. What they should have done was own the mistake, outright. People with the skills to find the sorts of vulnerabilities we're talking about are not stupid. They know a face-saving move when they see it.

Chances are their move will pay off, but this is one of those times when the cover-up should have been considered worse than the crime. Shame.

But what this entire escapade says to me is that this specific part of the industry needs both a Code of Practice and a better way of operating. The Code of Practice should provide non-negotiable requirements for participating companies. The Code should, for example, make all payments transparent: once the vulnerability has been independently confirmed, it should be assessed using an industry-wide rating scheme, like NIST's CVSS 4.0:-

https://nvd.nist.gov/vuln-metrics/cvss/v4-calculator

Each company adhering to the Code of Practice must be required - as a condition of participation - to publish the actual dollar amount they will pay for a defect based on the CVSS 4.0 vulnerability calculator. Each company must publish details of payments made for which vulnerability within e.g. 60 days of the patches being shipped.

But as this entire debacle shows, the reason we need a Code of Practice is because a researcher in a similar situation to this one really needs to have recourse - they have to be able to go to an industry body, or even a "confidential 3rd party" in order to raise a grievance.

The situation that has come in to effect today is that all the power resides with the multi-trillion dollar companies still shipping vulnerable code - and that's clearly wrong.

I make these observations not to suggest that these companies need to be punished, but to suggest that they need to be held to account, need to be able to demonstrate that they are operating with transparency and integrity.

There's something else that an arrangement like the one I suggest would help bring in to effect - and that is, if/when a company started to behave as unreasonably as Microsoft appears to have done here, then the entire community would be able to "down tools" and walk away. The consequences would be such that the errant company would fail to receive early warning of issues and as a result their reputation for reliable and bug-free software would be further tarnished.

Even a couple of years ago, a company like Microsoft would have laughed if we suggested this. But today, with the massive increase in shareholder litigation against directors and companies for negligence, Microsoft can't afford to lose major corporate clients through fear that the client might get exploited because of bugs in Microsoft code. Not when the President and this Administration are doing all they can to anger Europe and persuade Europe and "former allies" to start divesting from US software, cloud and services and build their own technology ecosystem.

A concerted effort from the industry - to raise our collective game, to be transparent, objective, to have independent escalation paths involving trusted third parties - would help strengthen everything.

This sort of thing won't happen through wishful thinking, sadly. But maybe if you're employed in the cybersecurity realm of technology, or you have influence with technology management, or you have good relationships with Microsoft or other software vendors, maybe you could have a few earnest conversations and see if they are open to reason.

It certainly won't hurt.

Sproggit Silver badge

Re: blah blah

We can only hope so.

Ohio hits pause on datacenter tax breaks draining its coffers

Sproggit Silver badge

That Max Shreck Moment

In a weird way, the entire story of "AI Data Centers" rather reminds me of the plot to the 1992 movie, "Batman Returns".

You're much more likely to remember it as the one where Michelle Pfeiffer played Selina Kyle / Catwoman, but bear with me here.

In the plot of the movie, Max Shreck, played by the world's greatest movie villian - Christopher Walken - came up with a fantastic plan to "solve" Gotham City's electricity supply problems. Instead of building an electricity "generating" station, his design secretly absorbed and stored electricity - like a massive battery bank - when the costs were low, such as in the middle of the night. Then, when demand was peaking, it simply sold on the stored electricity for profit. Not only did that not "solve" the problem, it meant that the citizens of Gotham were going to be paying more for their electricity all around.

This is pretty much what is happening with the rush to build these mega-data-centers... The take up land, they need water for cooling - and they are going to extract megawatts of power from local grids. Yet the people who benefit from all that resource are not going to be local citizens, but elite Californian shareholders and billionaires, who are funding the construction. These vast processing centers aren't going to employ large numbers of staff, so unless you want a job swapping dead processor blades, or sitting outside in a uniform as a rent-a-cop, there's not much hope for employment opportunities either.

There doesn't yet seem to be anyone in the LameStreamMedia who has put together the obvious two-plus-two-equals-brown-out that the reason these centers are being built up and down the country has nothing to do with "opportunity for all" and everything to do with the already creaking, already out-dated and already unreliable US electrical distribution grid. They're spreading them out not because of the desire to create opportunity, but the desire to not be competing with other centers for electrical supply. Screw the local residents, of course.

I wonder how many of these things will get built and start operating before citizens realize just how seriously bad the consequences will be for them. Especially as temperatures continue to rise and air conditioning in summer moves from being a luxury to an essential. As the cost-per-unit of electricity eats and even bigger hole in the household budgets of people who are already taking a hammering.

Here's a [loosely] related question for you: why do you suppose it is that President Trump has been 10x more determined to "get rid of" as many low-income workers as possible. Why is the US moving hell-for-leather to ship people out of the country, even American citizens? Do you think it's because they're "illegals"? Arguing it's because he's "more" racist than he was in his first term doesn't seem that realistic.

Do you suppose it might be because someone has told him that if/when the true impact of AI hits employment, it will wipe out millions of white-collar jobs and put hundreds of thousands or millions in to unemployment? Do you suppose that there's an actual strategy there? That maybe he's anticipating the need to find work for millions of semi-technical office workers and has decided to "free up some capacity" on the lowest rung of the employment ladder?

London cops post £300M tech shopping list after Palantir contract blocked

Sproggit Silver badge

Re: six times as much

All your points are fair...

... but I'm still much more concerned with understanding what the Met thought they would be able to do with Palantir technology in the first place.

Palantir is designed to be a "capture everything, analyse after-the-fact" in the way it operates. It is designed to sit and snoop on corporate employees to ensure that they are working hard enough.

What, exactly, has that got to do with catching crims? Either the Met want to use it on their own employees [in which case, that contract is an eye-wateringly huge amount of money to spend] or they plan to start spying on people as a matter of routine. Neither answer is acceptable, but the second answer is several orders of magnitude worse.

If the Met plan to use Palantir tech to gather data on citizens - without a justifiable basis that a crime has been committed - then the UK has become an actual Police State.

We should all be concerned.

Sproggit Silver badge

Palantir

One thing to bear in mind about Palantir is that they are, in essence a "corporate spyware company".

With funding people like Peter Thiel, Palantir sell technology to large companies that allow those companies to spy on their employees. They monitor physical access to electronically protected locations, dates and times of access to networks, hosts visited, keyboard and typing patterns, remote IP addresses used by VPN services.

Does your employer require you to have some "corporate" software installed on your iPhone/Android phone? Large company? Congrats, you might have been pwned.

I worked in a Team that was one of Palantir's first big corporate clients... in banking. Even the very first versions were shockingly capable - as my former Boss used to say when we did road-show briefings for senior management: "I know who is planning on leaving the company before they tell a soul; I know who is fiddling their travel expenses. I know who is stealing the work of others to claim credit and who is having an affair with whom." And that was back when they started.

The thing you have to remember about Palantir is the philosophical difference between their technology and policing. With lawful policing, you are innocent until proven guilty - and a police officer has to have reasonable suspicion that a crime has been committed before they can conduct any serious investigations. With Palantir technology - at least deployed within corporations, you are guilty until found innocent; you have no personal freedoms. He doesn't name Palantir specifically, but if you've ever read "The Trading Game" by Gary Stevenson, you'll know how he was told to stay squeaky clean by a more experienced trader, how the bank he worked for, when a profitable trader declared they would leave, would immediately trawl through all their old emails to look for blackmail material [my choice of words, not Gary's].

That's what Palantir tech does well. You have to wonder what possible need the Met might have. Actually, there are only two viable explanations. First, they suspect their own employees of bad misconduct and want to monitor them. Fine, but even for a force as large as the Met, the numbers on this deal are way to high. Or... you want to use it to surveil members of the public. But in order to do that, you're going to need access to raw electronic/communications data - think emails, SMS messages, that sort of thing. Now ask yourself where they are going to get that from?

Well, what's to stop them striking deals with mobile phone telcos for intercepts? What's to stop them from trying to put a real-time tap in to Linx? Yes, these are extreme hypothesis, for sure. No, there isn't a scrap of evidence to suggest this is or will happen. But ask yourself one simple question: what in the heck were the Met expecting to pay £50 million to Palantir *for*? What could possibly justify that sort of invoice.

And once we can eliminate the impossible, then whatever's left, no matter how improbably... etc.

Next stop: "Minority Report". ...

Sproggit Silver badge

Not Just Corrupt, Foot-Gun Corrupt

There's clearly some gamesmanship going on here between the Met and MOPAC. So MOPAC pull the rug out from under a £50M Palantir contract, and the response - in a ridiculously short time frame, no less - is to retort with, "Well, if you won't let us spend £50 Million with Palantir, we want *six times as much* to buy from all these other companies.

But wait up a minute.

Just FOUR Effing days ago, Rachel Reeves told other Ministers to "Buy British" in four key areas - one of which was "AI". A huge part of what Palantir's technology delivers is the intelligent association of disparate activities to identify abnormal and potentially suspicious behaviour. I've worked with the technology when my employer took out a license years ago. Even in the earliest days it was remarkably effective - it could spot employees who were about to resign before they handed in their notice; it spotted people up to something suspicious with remarkable accuracy based on oddities such as the times they logged in to and out of computers - and which computers in which buildings, on the times of day and days of week they crossed personnel turnstiles in different buildings.

So now we the tax-payer are going to be asked to fork out - let's be generous - somewhere between £50 and £300 million.

Why isn't the government sponsoring domestic software development? Why isn't seed capital being invested in partnering with good universities to promote the skills development and help the nation "trade up" to an AI-driven world? Why aren't different parts of the government *actually talking to each other about strategic investments*?

Oh, wait.

Because this administration is in an out-and-out competition to see if they can beat the existing Boris Johnson/Liz Truss tie of "Most Incompetent British Government Ever" award.

Sigh.

FCC warns US broadcasters their licenses are a privilege, not a right

Sproggit Silver badge

Re: Yes it's a privilège

You ask a fair and important question. Important enough that I think it's worth a genuine effort to give you a detailed answer...

1. Why do you think that it is a right? Please explain.

The US Constitution explicitly grants, through the First Amendment, the right to free speech.

2. Is it also a right to drive down the wrong side of the highway?"

I realise that you've picked a provactive counterpoint - and that's OK - but here I think context matters... and the context needs to consider relative harms.

If you drive a vehicle down the wrong side of the highway, you endanger yourself, your passengers and other road users.

By contrast, if you say something that a viewer or listener does not like, or disagrees with, they have the freedom to change stations or switch off entirely.

Therefore, in a practical and probably legal sense there is a distinction we can make between the actions of a third party where you have the total freedom to negate those actions if you so wish, and the actions of a third party that you may have limited or no abilities to influence. If you don't like my radio broadcast, you can change channels. If I drive my 18-wheeler in to your Ford compact in a head-on collision, I'm going to be annoyed at the scratch on the front fender and you're going to be, well, a lot worse off. What I'm trying to say is that the law tries to ensure that the safeguards it provides are proportionate to the risks and to the rights of the constitution.

Also, it's important to note the much more adversarial relationship between citizens and the federal government compared with their city, municipal, local, council or even state governments. Many Americans have much higher levels of trust in their local municipal government than they do in the federal government. That's one of the reasons why it would be so hard to remove the 2nd Amendment from the Constitution.

3. Its a privilege because there are limited resources and in order to keep things running correctly for all it is important that there is coherent practices. So the privilege is given to those that behave and removed from those that don't.

There are quite a few elements to unpack here and I'm not completely confident I will identify them all, or do them justice, but let's give it a go.

First, the limited resources. This was certainly the case back in the early days of broadcast media, when spectrum was limited and any bad management could ruin the medium for all concerned. For example, between the early 1920s and the late 1930s, all broadcast radio operated on the Medium Wave Band. Spectrum was limited and so to avoid crosstalk between stations, a federal agency was set up to ensure that the patchwork-quilt of different broadcasters were laid out nationally in a way that didn't cause interference. Eminently sensible.

Many technological enhancements have happened since that time... The UHF band was opened for television; the transition from Analogue TV broadcasts to digital (DTT, using the DVB-T/DVB-T2 and ATSC Standards) *massively* opened up the available spectrum, allowing for orders of magnitude more broadcast channels within the same frequency spectrum. Happening roughly in parallel, the US in particular saw a huge increase in satellite television coverage, with Direct-Broadcast Satellite (DBS) now making it possible to receive anywhere from 50-300+ individual channels. And of course, there's the cable approach - both the traditional/legacy "CableTV" as well as the more modern and often fibre-based "broadband" cable service.

So that basic premise, the foundation argument that "bandwidth is highly limited and thus we need onerous regulation to ensure this scarce commodity is not wasted" is simply no longer a viable or logical argument. That pretty much pulls the rug out from most of the justification for having an FCC in the first place. [ The glaring exclusion from that, of course, concerns propriety - ensuring that what is broadcast is factually accurate [advertising] and not offensive [violence, nudity, sex, use of drugs, etc]]. But just to underscore this a second time - ALL of those activities of the FCC absolutely MUST be weighed against the 1st Amendment right of Free Speech. It cannot be repeated often enough that the Constitution explicitly mentions Free Speech. The "FCC" doesn't get a single mention. ;o)

Anarchy never provides anything other than destruction, whereby all parties lose.

Now you touch on something that's particularly interesting and [I suspect, but I'm not sure] might actually be unique to the United States. have you heard of "Public-Access Television" or "Public-Access Broadcasting"? It was actually introduced in the United States between 1969 and 1971 - BY THE SAME FCC THAT IS NOW THREATENING BROADCASTERS THE ADMINISTRATION DOESN'T LIKE - and it created the means by which ANY member of the public could create their own television content and have it broadcast. To be fair, this brought about some of the whackiest, craziest broadcast content you could possibly imagine... but it completely and thoroughly disproves your point about "anarchy never provides anything other than destruction". Quite the contrary. Head out in to the mid-west, between the coasts... and you'll find plenty of folk who'll tell you that a "Brewskie Night" involved buying a few crates of beer, inviting your mates round, and sitting down to watch a couple of hours of batsh1t crazy Public Access Broadcasting. You definitely need the beer, though.

I think there are a couple more points that are worth making in conjunction with your comments.

Some of the greatest harms to be inflicted on media in the United States [particularly television] have come since 2016 and have been propagated by a small number of extremely vocal media outlets: Fox News, NewsMax, OAN, but where there is substantial [and not disputed] evidence that the broadcasters have been repeating lies and outright fabrications in a pretty brazen attempt to generate outrage among their audience.

But just to try and stick a pin in that, here's an example of what I mean. In 2018, Fox News host Tucker Carlson described a $150,000 payment made by Donald Trump to Karen McDougal - with whom he had had an extra-marital affair - as "extortion. In reality, that payment was part of a catch-and-kill scheme, operated by Donald Trump and David Pecker of American Media, to squash "bad press" during Trump's 2016 Presidential Campaign. McDougal sued Fox, in essence arguing that describing her as an extortionist was slanderous and wrong. The Fox defense was that Carlson's statements were "merely non-literal commentary, rhetorical hyperbole, and "opinion commentary", intended to frame a political debate, rather than actionable statements of objective fact."

The case was dismissed, in essence handing Fox "News" the win.

And therein lies the problem... When Fox on the right wing and MS NOW on the left wing broadcast deeply biased, selectively reported and leading segments as "news", it undermines the trust that can be placed in broadcast news. *That* is something the FCC should be concerned about and should be dealing with.

The fact that Fox, OAN, NewsMax and MSNOW and all the others continue to exist and continue to operate is as informative as a book could be. The differences between the regulation of news in the US and the UK could not be more different.

The challenge with the US regulatory framework - and this has recently been completely overturned by a recent ruling from the Supreme Court of the United States, which overturned the 1984 landmark case, "Chevron U.S.A., Inc, v. Natural Resources Defense Council, Inc. That case had made settled law the idea that when it came to interpretation of federal law, government agencies were presumed to be the authority in their respective area of expertise. In June 2024, the Roberts Court issued a landmark ruling in Loper Bright Enterprise v. Raimondo that threw that out - and granted the Courts, ultimately the Supreme Court, the role of the ultimate arbiter and interpreter of legal meaning.

So now, despite everything that Brendan Carr says about the FCC considering revocation of licenses... the Roberts court would like a word. They basically cut the ground out from under Carr [on paper only - the chances of them disagreeing is extremely remote], since SCotUS basically granted themselves "Imperium" (supreme executive, military and judicial power, from ancient Rome) to do pretty much whatever they want.

Ultimately, I think the elements you raise in your argument do not stand the sniff test against shifts in technology or society, but I concede the effect remains unchanged thanks to the highly partisan nature of governance that the US operates.

Given an choice between the US model and say the UK model, I think it's pretty safe to say that all the evidence points to the idea that the UK model - largely non-partisan - has proven to be the more successful. Of course, that will never be reached in the United States - because while there is a numeric minority [currently in the right-of-centre politics] of voters, they will always argue in favour of a model that allows the minority to win and retain power.

This is why the US currently exists as a criteriarchy [a government or political system led by the judiciary], not a democracy [government led by the people], given the simple facts that:-

1. Appointments to the highest court of the land are intrinsically political

2. The current SCotUS has issued countless brazenly partisan rulings

I don't think that - or the model of broadcasting - is likely to change soon.

Disgruntled 0-day hunter 'humiliated' by Microsoft pledges 'bone shattering drop' as Redmond calls cops

Sproggit Silver badge

It's the Hubris

I think the real issue here is the arrogance with which Microsoft bring in the reference to their "Digital Crimes Unit" and how they intend to continue bringing cases against parties *they* - note, please: Microsoft's decision, not the law's finding - that "enable criminal activity".

Well, it's newsflash time.

Microsoft are a *THREE TRILLION DOLLAR* company, a company with roots in software theft - sorry dumpster diving - and which today still earns literally billions of dollars in revenue from sales of software.

So let's talk about "Digital Crimes".

Is it a Crime for a company with that scale and those resources to continue to ship code with known bugs?

Is it a Crime for a company with that scale and those resources to arbitrarily stop supporting older software versions - no matter the reason - and then fail to provide the means for anyone who has a critical dependency on old code from being able to get support from a 3rd party?

Is it a Crime for a company that operates and ships software with known bugs, where those bugs are subsequently used to perpetrate crimes against unwitting victims - think zero-day vulnerabilities - to simply point to the tiny print in their EULA and declaim any responsibility for shipping of code that doesn't meet basic "merchantable quality"?

Well let's slow down a second. Maybe this is unreasonable. What if Microsoft were to build cars or trucks or aircraft? What if those vehicles were to have been shipped with known defects? ("Meh, what are the odds someone will activate the cigar lighter and then put the vehicle in reverse with headlights on and the left turn signal engaged? Nah - it doesn't matter if the vehicle will blow up - ship it already...")

The fact is that if Microsoft - or any other large software company - were in the business of producing *hardware*, then for some of the "not of merchantable quality" mistakes they've made over the years, they would have been sued to the stone age by now.

So for them to come out with that total BS about their "Digital Crimes Unit".

There's a worrying trend here: the bigger the corporation, the greater the chance that the management believe they operate above the law.

They still expect you to pay "full market rate" for shoddy software, then run and hide when someone points out their code has more holes than Swiss cheese.

Cowards and crooks, the lot of 'em.

Sproggit Silver badge

Re: CRUD?

Try prune juice.

Tony Blair and the Reform party both want AI in government, though they can't agree on what for

Sproggit Silver badge

Re: He sees good use for AI...

The rest of us spell it Bleurgh.

This is the man who:-

1. Lied, repeatedly and brazenly to the nation about Iraq WMDs - which means that the deaths of 136 brave British service personnel who did from enemy action, as well as another 43 who died from other causes during deployment - rest solely with his shameful fabrications...

2. Was privately advising Rebekkah Brooks of News International on how to hold an "internal" inquiry in to the News International phone hacking scandal, when what he should have been doing was making sure that his Home Secretary and the Metropolitan Police conducted a thorough investigation in to what was clearly illegal...

3. Among other actions, used "Tony Blair Associates" - or whatever his private consultancy business was called at the time - to rehabilitate the reputation of Kazakhstan's authoritarian regime following a 2011 state crackdown on protestors, despite the fact that Nazarbayev's government was widely repudiated for their history of targeting regime critics and exiled citizens living in Europe.

4. Bought a British Virgin Islands company in 2017, in order to acquire a London-based property for Cherie's business, which just happened to have the convenient side effect of their not having to pay stamp duty on the property, since it was the sale of a "property" but of a "business" for which stamp duty wasn't charged.

Just a despicable excuse for a human being who should keep his opinions to himself.

Anthropic to release Mythos-class models to the public

Sproggit Silver badge

Real world Example

For anyone out there who isn't using AI for tasks such as coding support and might be a bit baffled by some of our complaints, I thought a real-world example [as best as I can manage] might help give an insight as to the obscurity and inexplicable "costs" when running sessions with a model.

What you see below is an exchange at the end of an 90-minute session with Claude Opus, Anthropic's most powerful [and thus most token-expensive model].

We've just spent > 80 minutes chasing a couple of defects to ground. One was in a multi-form, "Create New Record" type setup, written in a single re-entrant PHP script. The other was to diagnose a fault in a complex, context-sensitive and authorisation-driven menu framework (which I wrote and Claude broke). It was a very productive session and as you can see, all that problem diagnosis - and then a counted 7 cycles of me doing unit testing, failure-capture testing and regression testing on the "create" code, with Claude diagnosing reported oddities by scraping log files in real time.

That was 74% of a session's token allowance.

Then, as the log below shows, Claude:-

1. Ran 7 commands [that's me giving Claude access to my BASH script library to reduce cost of doing stuff]

2. Performed 3 git commits - that's literally entering 3 statements on my behalf and letting git do the heavy lifting...

3. Documenting where we had reached and next steps by editing 4 files:-

3.1. A summary of what we did this session

3.2. Updates to our snagging list

3.3. Updates to "CLAUDE.md", which is basically our "Big Rules for this Project", which I required Claude to read at every session start

3.4. Putting down a skeleton of our "Next session brief" for me to edit/refine off-line.

You're going to have to take my word for it that the above is trivial when compared with the 50+ minutes of deep triage and unit testing we just did.

The entirety of what follows took maybe 2 minutes to complete.

But... before I closed down the session, I went and checked my token usage - and I was apparently and miraculously at 100% - not a percent under, nor over. [You get an amber pop-up warning window when you actually hit 100%]. So that's 26% of a session's token allowance to create scratch notes of what we did and what comes next - basically a dump of what it's holding in session storage.

I don't know for sure - I'm not sure how I could test this in real time - but it looks to me that the moment we hit my objectives for that session and the documentation was complete, token usage miraculously jumped to *exactly* 100%. Not 99%. Not 101%. *Exactly* 100%. What are the odds of that, eh? Twice now, in a week as a paying Claude user.

I shall be checking every session from now on.

Don't get me wrong, the Anthropic models are stunningly effective. But there are some deeply fishy behaviours when it comes to token consumption. Top tip for anyone starting out using Claude for this sort of thing: Take the time to read up on how to get the best out of your Model-of-Choice. Look for articles like this:-

https://faizkhan3597.medium.com/98-of-your-claude-tokens-are-already-wasted-heres-how-to-take-them-back-6a758565d28c

with plenty of concrete proposals, then experiment with them. There are quite a few YT videos out there with similar content. If you're paying for access, it's in your best interest to be aware of how to get the best of of the resource.

Me: Re-test complete. urDefault is good; urCreatorRef is good.

Me: Session Usage at 74%

Claude: FP6 is signed off. Marking #9 and proceeding straight to the commit per the three-commit recommendation from the previous session's brief. Will go quickly to leave room for the end-of-session brief.

Claude: Ran 6 commands, used 2 tools

Claude: Ran 6 commands, used 2 tools

Claude: Commit 1 — 25-May unblockers:

Claude: Ran a command

Claude: Ran a command

Claude: Commit 2 — FP6 deliverable:

Claude: Ran a command

Claude: Ran a command

Claude: Task list is in good shape. Continuing with commit 3 of 3.

Claude: Ran 2 commands

Claude: Ran 2 commands

Claude: Three commits landed cleanly. Two backup files left untracked (your offline backups — safe to ignore or move to Archive).

Claude: Used a tool

Claude: Used a tool

Claude: Now updating CLAUDE.md §4 with FP6 ✅ and new commit hashes, then writing the end-of-session brief.

Claude: Edited 3 files

Claude: Edited 3 files

Claude: Now writing the end-of-session brief while we still have budget.

Claude: Used 2 tools, created a file

Claude: Used 2 tools, created a file

Claude: All seven tasks complete. Session summary:

Claude: FP6 ✅ closed and committed. Three commits:

59f1f7d — 25-May menu/auth/dispatcher unblockers

8224e59 — FP6 Add User multi-step form (with B3/B4/B5 fixes and the urDefault fix)

d002816 — Migration 019

Claude: Menu regression diagnosed (read-only, per your brief): both regressions have high-confidence root causes and small fix sketches in Daily Brief/2026-05-26 - Menu Regression Investigation.md. tracked as B-003 and B-004 in CLAUDE-snagging.md.

Claude: Snagging framework created: CLAUDE-snagging.md with seven open defects (B-001…B-007) and one closed (B-000). Housekeeping cleaned up; CLAUDE.md companion list updated.

Claude: Recommendation for next session: B-003 + B-004 fix as a quick standalone pair (one line + a six-line block removal). It removes the visual broken-window, restores the menu chain, and lets us test future modules via the navigation path rather than direct URLs — which would also reduce the practical impact of B-006 while FP7 dispatcher auth is being planned.

Claude: End-of-session brief at Daily Brief/2026-05-26 - Session 1 - FP6 Close-out + Snagging Framework.md. CLAUDE.md §4 updated with the new commit hashes and FP6 ✅.

Sproggit Silver badge

The is the AI Model

Been working with different models for a couple of years now. Mostly Chat-GPT through employer subscription, more recently Claude.

One thing I've noticed has been a steady - but non-uniform - erosion in the amount of work I get done per session. This is partly explained by existing reporting that shows that e.g. Anthropic reduced the token budget for the Pro model, but offset it by giving Max5 users more than the supposed 2x allowance [for 5x the price] of Pro.

What I've experienced is that as both professional and personal projects have leaned in to AI more - to get the job done, to address particularly thorny issues - the "spend rate" on tokens and allowances has drastically increased.

Real-world example for you. A few weeks back I registered for a free Claude account and used it to diagnose a config error with a Postfix+Dovecot mail server. Dozens of file content reviews and edits. The total session - on a Sunday - lasted OVER FIVE HOURS. On the "Free" account. So I subscribed to Pro.

Today my morning session had lasted about an hour when I got the "90% of session limit warning". Claude and I had just been regression-testing some code mods and found issues. So my next instruction was: "Stop all fix activity. Document findings in text file for next session."

Off it went.

Next thing I saw on my screen was the "You're at your session limit. Buy more tokens or upgrade to Max".

10% of a session to put some notes in a file? Are you serious?

The problem here is that the formula that Anthropic, OpenAI and others are using to "measure" user consumption is obscure and capricious.

And of course, the models are intelligent enough to scan code libraries and work out how much of the change is model-driven and how much by devs - and once they see that they have become a critical dependency, "That's a nice little project you have there. Do you have a deadline to meet? It would be a shame if something were to happen to it..."

I smell something rotten.

I know this is laughable, but we are going to need to push for regulation, oversight and transparency. These guys are as bad as UK telecoms providers and their laughable, "Up to 63Mb/s" claims.

The issue here isn't that they are definitely committing fraud. The issue is that if they WERE committing fraud, it would be next to impossible for anyone to find out.

I'm not typically a fan of increasing regulation, but given the impact of AI in our lives, I think it's a justified move.

London's police asked Big Tech for comms data over 700,000 times last year

Sproggit Silver badge

Re: Data networks are the infrastructure of the surveillance state.

Captain Pedant here...

If the "future" is already here, doesn't that make it... the "present" ?

;o)

Sproggit Silver badge

And the Measurable Results are...?

As someone who considers themselves a law-abiding citizen, this type of metric, if accurate, represents a critical erosion in the most basic principle of a free society: the presumption of innocence. There is simply *no way* that the Met could handle that many potential crimes and actually function.

It would be interesting [but annoyingly unlikely] if we could see a breakdown of these requests by crime type: how many were for burglaries, rapes and sexual assaults, general assaults, shoplifting, speeding, other motoring offences, etc. It would be interesting if we could see what percentage of these requests were associated with cases that actually resulted in charges being brought, and/or the number associated with convictions.

It would be even better if His Majesty's Inspector of Constabulary performed a detailed analysis of the Met's use of data requests in order to confirm that all were legitimate, proportionate and supported by a solid legal foundation.

Colour me cynical, but if those numbers are accurate, I suspect... not.

But I think there's another dimension to this. From active reporting by the BBC over the last few days, we have seen that a tiny handful of investigative reporters have managed to bust open a nationwide people smuggling ring - and have learned how the small boat operations are funded, how much money they raise ... and who the masterminds are. At this stage in things we are frankly at the point where the Metropolitan Police Commissioner needs to be sacked and we need to replace them with the lead BBC journalist who cracked the smuggling story.

Because the measurable evidence suggests the BBC journalists are capable of doing a better job.

As a whole, I feel very grateful for the fact that we live in one of the safest nations on earth, with comparatively low crime rates and a comparatively stable, civil society. I have several friends who are serving police officers and I respect and admire all of them. But that doesn't mean that there is something fundamentally wrong here. Hundreds of thousands of British citizens fall victim to crime every year. Scam calls, malware, people smuggling, illegal fly-tipping, contraband cigarettes/booze/vapes have become problems of epidemic proportions.

I appreciate that the Met doesn't have a national remit, but what on earth are they spending their time doing?

And perhaps more than that: who is responsible for their oversight? And what are THEY doing? For as bad as the Metropolitan Police may be - and the evidence leans in that direction - those responsible for the oversight are an order of magnitude worse. Hmm... Apparently Google says that the "Mayor's Office for Policing and Crime" (MOPAC) is responsible for oversight and responsible for holding the Met Commissioner to account.

And a completely useless job that body is doing, for sure.

Linus Torvalds to ‘start being more hardnosed’ about ‘pointless pull requests’ – some of which come from AIs

Sproggit Silver badge

One of Those "Yes, But..." moments

As a matter of principle I find myself [entirely unsurprisingly] agreeing with Linus on this.

But there's another side to this: "Help me to Help you".

I get that Linus doesn't want to see his RC cycle descend in to chaos because more and more kernel contributors are now using AI to scan their code.

But what I would have much rather liked to see would have been Linus say something along the lines of: "Hey, all kernel contributors. It's great that you're able to get some value out of having AI coding tools scan your code for vulnerabilities... but at the same time it's important that your work doesn't disrupt the orderly transition of kernel revisions through our delivery pipeline. We have 7 release candidates for each new kernel version and so I've had some discussions with some of the most active and critical kernel contributors - and this is what we're going to do. Below you'll find a table showing each of the 7 RC candidates, and against each candidate in the list you'll find guidelines of what we expect to see being submitted or pulled.

Please, please, please respect these guidelines and don't mess with the bigger cycle of getting important stuff released in a timely manner.

Please make sure that if you do need to make a pull request, it's justified by the objective defect severity you've identified, as documented {over here, in this neutral, industry standard [like CVSS2]}. Please don't buck that process. Please remember that every request you submit has a cost for potentially dozens of other people - like those with downstream dependencies. This is a team sport, and we only win if we remember that we're all on the same side..."

I think Linus is entirely within his rights to call out bad practice where he sees it - and he has a unique perspective to tell when things are going south. But I think he might need to be a bit clearer and go in to print with respect to what he thinks is acceptable versus what he thinks is not. Sadly 99.9% of us out here lack his abilities - and the same or more of us are not telepathic either, so we'll need some slightly clearer directions - House Rules - to get this consistently right.

Years after UK Post Office scandal broke, Accenture and OneView Commerce bag contract to replace Horizon

Sproggit Silver badge

Re: Why....

The cynic in me is happy to answer your entirely valid question.

In the case of the Grenfell fire, the correction/prevential actions required fell in to two distinct groups:-

1. A tightening of building regulations - relatively quick, easy and inexpensive for the legislative body to complete...

2. Improvements to regulation enforcement by Planning and Building Control functions in Local Authorities - i.e. **NOT** the responsibility of Central Government.

In other words, as soon as MP's had approved any necessary changes to laws, they were in a position to "wash their hands" of the whole problem and hand it [throw it over the wall like a grenade minus the pin] to the Local Authorities with Planning and Building Control functions, and let them worry about it.

In the case of the UK Post Office scandal, the most sensible safeguards that you and I - as pragmatic observers - might want to see would place the burden of responsibility directly on elected officials and very senior Whitehall Mandarins. In other words, any buck would stop with them.

The thought of actually being held accountable for another example of something like the Post Office scandal is so antithetical to what makes an MP want to be an MP (power without accountability; cushy directorships without relevant competence or work) that there is no way they would write laws or rules that put their own necks on the block.

Unfortunately for us poor tax-paying saps, that means that sensible measures - things like ensuring that when the Government contracts a third party to do something, the government gets a perpetual, non-exclusive license to all the intellectual property involve - are baked in as defaults at the outset. I have a strong suspicion that part of the reason that the government gets this sort of thing wrong over and over and over again is a combination of two things: first, elected officials tend to insist on being involved in the minutae and as a result changes in administration effectively reset the institutional knowledge; and second, where that doesn't happen, the likely bidders employ "regulatory capture" techniques to "buy off" the critical experts from government, either to force that institutional reset, or as a back-hander for the official's support in giving them the successful bid in the first place.

In other words, the system is rigged against the British people getting value for money and reasonable contractual safeguards... The people charged with ensuring that British tax-payers get the good deal have personal objectives that directly conflict with the priorities of the tax-payers [because e.g. an MP might decide that their getting a cushy Non-~Executive Directorship is far more important than a contractor actually being held to account to deliver value for the British tax-payer... And finally, even if by some miracle the NAO - the National Audit Office - had been allowed to go take a look at some of these stupid projects (HS", cough, QE Class Carriers, cough, CrossRail, cough, etc.), their budgets are tightly controlled and it isn't hard for the audited entities to burn through the NAO's resources by stonewalling them.

And in case you're wondering: no, none of this is by accident, it is ALL by design. Successive governments have gradually tweaked the accountability model in UK politics to ensure that they are never held to account.

Sir Humphry wouldn't just be proud, he'd be jealous.

Sproggit Silver badge

What I'd Like To Know...

... is why does the government continue to insist on these "take huge risk", "big bang" projects, which, when they inevitable go wrong, not only prove to be a complete waste of money [Horizon], or prove to benefit the contractor more than the nation [the contract for the 2 Queen Elizabeth class aircraft carriers - which are proving to be full of issues - where the contract required the government to pay the contractor *more* if the government decided to pause work on the 2nd carrier and mothball it. Or the HS2 debacle, which appears to have achieved very little beyond paying insane amounts of money to friends of Cameron and Osbourne.

The problem appears to be a lack of oversight. The government police their own performance on projects like this - and we the taxpayers are left with the bill and nothing of value in return.

The contract for Horizon not only resulted in Fujitsu getting paid hundreds of millions for a complete turkey, it has required the UK taxpayer to *keep on paying them* to maintain their dogsh1t code - and even worse, at the end of this debacle the UK tax-payer would never have owned the rights to the code anyway.

What the hell were the government thinking when they set up a contract for those terms?

And out of interest, do we have complete confidence/clarity/guarantees that none of the "client" participants or influencers in this debacle have received anything - direct or indirect - from the contracts? No consultancy fees? No non-executive directorships? No work placements for the nephew? Nothing like that? Just exactly how clean are the government's hands? How closely was this watched? What does the NAO report say?

Call me cynical [because I am, obviously], but the sad fact is that every time there's a major government contract, there's waste, fraud and abuse. Every time. So how come no political party ever manages to make a dent in that?

Inquiring minds would like to know...

AI will soon be capable of telling convincing lies

Sproggit Silver badge

Re: Models always have a bit of trouble following instructions precisely.

Actually, I think EricM may be describing something entirely different from the essence of your reply. To be clear, your reply is valid. Tongue-in-cheek, but valid.

If I read Eric's description closely, the bit that stands out for me is the bit where he says, "and they digress".

A couple of months back I was using ChatGPT 5.2 to perform some alignment tasks. I had a set of high level technology threat definitions (e.g. "Malware", "Authentication Attacks", etc.) and a bunch of lower-level threat classifications from the MITRE CAPEC framework. For each of my high level threat definitions I had a brief paragraph descriptions written for me by an expert in this field [I work more on the controls side].

The idea was to take all the MITRE ATT&CK techniques and align them with a hierarchical classification scheme, to see if we could then identify generic controls suitable for mitigating collections of threats as opposed to point-solution controls.

What I found is that you can tell the Model what you want to do, then provide it with your dozen-or-so high level definitions. You then start feeding it your low-level technique descriptions and ask it which of the high level definitions it would best align with. My personal experience was that after a relatively brief period - say in the range of 15-25 cycles, the model would start to deviate and throw implausible recommendations back.

My Team and I took this up with one of our in-house "ML-CoE" folk and that's when we learned that actually, even though commercial models aren't typically set to "learn" from end-user interactions [as a safeguard against poisoning] they are perfectly capable of going off the reservation all by themselves. We learned that there are emerging terms used to describe these failure modes - things like "context rot", "cumulative error propagation" and "attention dilution" - with the first of the three being suggested as the explanation for the results we saw. The issue seems to step from the gradual increase of data in the model's context window and the way that as the window fills, this pushes the original guidance/instructions off the back of it's "short term memory", at which point results go south quickly.

So Eric's description really resonates with my experience, which as I say is narrowly defined as being with Chat-GPT 5.2 or thereabouts. It's possible that more recent models have overcome this tendency and of course the actual behavior is going to depend very much on what you're asking your model to do... and how you are asking it to do that task.

More recently I've been working with Anthropic's Opus 4.7 - which they claim is "most capable for ambitious work" and I haven't seen any evidence of that sort of issue. It still isn't infallible, not by a long shot. But it's much more consistent with the quality it brings to a repeating task over time.

In fact, the only real flaw - if you can call it such - I've seen with Opus is that a month ago I was struggling to get a local Dovecot configuration to work the way I wanted ... and worked through debugging with Opus, only to see it ask me to change a file from setting 1 to 2. Then 2 to 3. And finally back from 3 to 1 in conjunction with other changes. I don't have access to Anthropic to ask them what the model is doing, but community users tell me that my request is taking it to places where it's supporting data - clearly harvested from the web - is not statistically significant and therefore it is struggling to build trust and instead moving to a more experimental state. What it doesn't do when that happens is tell you - it continues to engage as if it knows exactly what it's doing, when it soon becomes clear it does not.

It won't do much to dispel your doubts to say that when that happens, the best you can do is just trust to the process and be prepared for a few misses before you hit success.

I stress I'm clearly asking it to do things where the documentation simply doesn't exist yet, which makes it hard to research valid answers.

Perfect? No.

Useful overall and on balance? Yes, definitely.

Sproggit Silver badge

Rise and Shine...

Only a year late to the party, give or take:-

https://www.axios.com/2025/05/23/anthropic-ai-deception-risk

Windows boot partition runs out of space for Microsoft's May security update

Sproggit Silver badge

Re: 100Mb

Hmm...

On this same dual-boot machine I have a copy of "EaseUS" partition manager, which I installed in order to be able to safely adjust partition sizes in order to be able to make space to install Mint - on account of the system builder formatting the entirety of both installed M.2 drives (against what we agreed on order) and my deciding that I didn't want to have to go to the hassle of re-installing some software.

The same EaseUS software can re-size an EFI partition, but doing so does require that you first free up space immediately adjacent to that EFI partition. If I had to bet, I'd say it is because the EFI partition is of course the very first one to be written to the drive, which means that it starts right at the front of the disk and is therefore easier for BIOS authors to code in to their firmware. Looking in detail at my first drive I've got:

EFI - 100Mb

Microsoft Reserved Partition - 16Mb [ wtf, Microsoft...]

My C: Drive, which on this machine I set to 1Tb on a 4Tb M.2 SSD....

After that I've got an 817Mb partition marked as "hidden, diag", which I presume Windows uses for it's data slurping, then we're off in to the first of the ext4 partitions [the root partition] for my Mint build.

The trick is that if I wanted to extend my EFI partition I'd first need to move the 16Mb "Microsoft Reserved" space, with it's unknown filesystem type... then probably shrink my C: drive too...

Sheesh those guys are useless...

Sproggit Silver badge

100Mb

According to gparted - my machine dual-boots between W11 and Mint Linux - my EFI system partition - as installed by default by the Windows 11 installer - is 100Mb.

Currently showing 41.37Mb used.

Mozilla warns UK: Breaking VPNs will not magically fix Britain's age-check mess

Sproggit Silver badge

Legal Responsibility

Whether the participants in UK families like it or not, for pretty much everything else in the life of an adolescent, legal authority - and responsibility - lies with the parents, at least until such time as the child reaches legal age.

What seems odd about this is that politicians all over the world seem determined to stick their nose in - and lets hope it remains only their nose - in a part of life traditionally handled within the family. When the children of Linus and Tove Torvalds reached an age where they wanted internet access, he sat down and wrote code that limited the hours they could use and the sites they could visit. Of course, we don't expect all parents to have those coding skills, but his approach demonstrates that simpler solutions exist.

Got kids and want to control their internet access? Ask your ISP for their "Parent and Child" router - and mandate that all ISP's must offer such a device - which has the ability to restrict outbound access, block VPNs as necessary, and so on. Or better yet, put your router somewhere that your kids can't reach it... and switch the thing off unless you actively want to let them have access.

The problem with all these scheme by GovUK when it comes to this sort of censorship is that they always have an ulterior motive - spying on UK citizens. If not actively doing so, then having the ability to do so any time they wish, without reasonable checks and balances.

Stinks.

Sproggit Silver badge

Re: Impossible?

The really scary thing is that a "dumbed down" population is frighteningly, shockingly close.

Just take a look at what Education Secretary Linda McMahon is doing in the United States. The short version, if you're not aware, is that she's basically killing of any and all forms of financial support that allow talented students, regardless of their economic background, to attend higher education. The net effect of her policies will be to create a permanent underclass - because blue-collar workers will never be paid enough to fund their children to train to become skilled workers like doctors or dentists - only the children of the wealthiest will get those opportunities.

And the next step in that program of genius will be for the super-wealthy of the future to visit dentists not based on ability but on the depth of their parents' pockets.

I'm sure that will work out just fine for everyone.

Coming to a nation near you soon...

SpaceX sets date for Starship test that asks: Did we break anything in the upgrade?

Sproggit Silver badge

It's not the Artemis III Flight...

... that is going to matter to Elon.

Remember, SpaceX is currently still a private company, and one looking to go through an IPO. As of last month, there was plenty of talk that SpaceX had filed confidential paperwork with US regulators - the SEC and so on - for a possible listing as early as this summer.

I think this reporting highlights a much more significant dilemma for SpaceX than Artemis 3...

Clearly the new vehicle is taking many more launch attempts than Musk anticipated [Surprise! Surprise!] and each launch is burning through vast amounts of cash.

But on the other side of the fact that you have launch costs eating in to SpaceX profitability [I think "destroying SpaceX profitability] might be closer to the truth, you have the dilemma regarding continued launch failures and their impact on the perceived value of SpaceX as a publicly listed company. As tekkies, we all understand that with nothing more than F9 and Falcon Heavy, Musk and SpaceX can easily corner the market on launches - certainly unless or until Blue Origin demonstrate an equal capability.

But each failure of Starship/Heavy is going to be very apparent to prospective investors as/when SpaceX trigger their IPO.

This is why I agree with others who have posted replies here saying that it is crazy to keep on with the self-imposed pressure. Better to adjust the cloth of the Starship/Heavy testing based on revenues from commercial launches and put as much effort as possible in to learning every possible lesson from each launch.

RUDs are great for us to watch... but not so much if you're a potential investor who doesn't really understand that "space is hard".

Doozy of a Patch Tuesday includes 30 critical Microsoft CVEs

Sproggit Silver badge

More Mythos Fallout

I'm hearing from contacts and friends in more and more corners of the industry... the huge spike we're seeing in patches from everywhere is being driven by more companies being given access to the latest AI Models. The article from a while back about 271 new issues being found in Firefox is just the tip of the iceberg.

Yes, this is hassle and yes, for all those companies out there who have failed to "kill the tail" and are running a large amount of [beyond] end-of-life technology, this is going to hurt. But the alternatives would be far, far worse.

NHS England confirms: Palantir staff can access patient data

Sproggit Silver badge

Re: Data breach

Just to be a bit tongue-in-cheek pedantic... are you suggesting that in this matter Mr. Ahmed is an employee of the target, or an agent of the attacker?

Obviously I have no way of knowing, but I would observe that *if* you were the attacker and *if* you had an agent working inside the target organisation as a malicious insider and *if* they were in a position to make claims or statement to confuse and misdirect your target in order to undermine the target's ability to defend itself, then as an attacker you would want such an agent to come out with a lot of the bulls..... excuse me, explanations, that Mr. Ahmed appears to be producing.

Ahem.

Water company's leaky security earns near-£1M fine

Sproggit Silver badge

Re: Counter-Productive

You make a really important point here - and coming up with a way to block this sort of defense strategy is going to be hard.

It's like the way corporations want to operate now - privatised profits, but nationalisation of losses.

Maybe one way that a government could set this up to make it harder for companies to shield their officers would be through tax codes and taxable benefits. If you have a company car or corporate phone, you have to pay tax penalties for the benefits you receive. So maybe tax legislation could be set up in such a way that the tax liability for narrow types of corporate-provided protections against offer bad practice could address this.

Or maybe the government could impose a levy on that specific type of insurance premium and set the tax rate at something to discourage those narrow types of defence - i.e. to set it up so that the part of an insurance policy that covers criminal malpractice [the type of malpractice that if proven would result in these fines] and set the tax rate to 10,000%.

This would make that narrow policy prohibitively expensive, to the point where any board of directors wanting to take out such a policy would have to answer to their shareholders and explain precisely what sort of illegal activity they are contemplating that warrants the company investing in that type of policy.

These are spur-of-the-moment responses to your valid challenge... having read many of the comments that get posted here my sense is that "el Reg" readership is full of a large number of people who are far more astute and better educated that I am and who would almost certainly come up with robust and effective ways to make this workable.

Maybe it's as simple as prohibiting certain types of insurance policy on the grounds that they encourage dangerous practices.

And I'm sorry to sort-of dodge your challenge... but perhaps there's a bigger picture here. Rather than take my previous post at face value, maybe the right approach is to turn this around and ask the question: "What do we have to do to make the thought of that type of behaviour so unpalatable that nobody would ever consider it?"

Terrible example: if the government mandated that anyone filmed driving whilst holding a phone - so that there was photographic evidence of the offense being committed - could be stopped and shot dead by a police officer, I kinda think that would discourage people from using a phone while driving. It's an extreme example to illustrate the point, which is simply that if we want to stop this sort of unacceptable practice, we have to make the consequence of doing it a price too high for even a greedy, idiotic C-Suite executive. Not saying that my suggestion is the right way, but I do believe that success requires us to think of a consequence that is just too unpleasant to those who may be tempted to "try it".

Sproggit Silver badge

Re: The fine is less than £2 per victim

Fair comment... but the point here isn't the scale of the fine relative to the harm, it's that a water company is a de-facto monopoly that is going to off-load the fine on to the very customers it has harmed. The C-Suite are still going to get their bonuses, the shareholders are still going to get their dividends.

And for as long as that outcome happens as a result of breaches like this, we'll continue to see the problem with other companies.

Sproggit Silver badge

Counter-Productive

I very much applaud the ICO taking South Staffordshire Water to task for the "significant failures in the company's approach to data security"...

... but simply slapping them with a fine of any amount is absolutely *pointless*. The company are going to treat that as "the cost of doing business"... The senior management will still get to take home stupid bonuses, the employees will still get shafted and the customers will now be paying an *extra* million quid to cover this additional expense.

If the ICO actually want to some good for once, how about:-

1. Personal financial penalties to each member of the C-Suite

2. Prohibit the C-Suite from getting any performance bonus for at least 3 years

3. Prohibit the payment of dividends to shareholders for at least 3 years - with the money instead being directed to improving cybersecurity and/or cutting water leaks as well as data leaks

4. Introduction of actual jail time for repeat offenders and/or any practice which qualifies as negligence.

5. Lifetime bans [prohibiting them serving in a board-level capacity] for any NED - Non-Executive Director / or Executive Director with oversight responsibility for Cybersecurity

The point here is that the ICO need to change the calculus for the people who are allowing or enabling these shoddy practices to continue. That's the C-Suite and the Board. Unless or until the C-Suite and the senior management in companies get the painful message that the buck stops with them [and the buck is the size of an articulated lorry doing at least 60mph], this sort of thing will just continue to the heat death of the universe. It isn't that the ICO are failing to address bad practice, it's that the ICO are, in effect, actually *encouraging* it. Why? Because there is no ####ing down-side for the people making the decision to be this stupid.

The only way to get them to change the behaviour is to make it [really] hurt when they do stupid things.

Both Fedora and Ubuntu will get AI support – soon

Sproggit Silver badge

Become The Product

Back in October 2012, Mark Shuttleworth/Canonical introduced Ubuntu 12.10, "Quantal Quetzal" - and one of the most distinguishing and least popular features was the "Shopping Lens", part of the "Unity Desktop Interface" - an agent that would literally "phone home" to Canonical to let the mothership know what search terms the user was entering. It took 4 years - until 16.04, Xenial Xerus to be precise - but after serious backlash from the community and the EFF and others, Shuttleworth abandoned the idea.

All they are doing now is introducing the same scam but via AI.

In other words, Shuttleworth is looking to use the work product of everyone running ubuntu to harvest data and potentially generate training data for AI models that Canonical might control.

Privacy Be Damned, of course.

We might have hoped that they would have learned their lesson 14 years ago.

Apparently not.

When is Shuttleworth going to realise that "No" means "No"?

Perhaps we might need to set up our own "Movement" - Not just "Me Too" but "My Computer Too".

And no, I do not mean to "make light" of the harms inflicted on women that prompted the "Me Too" movement, but rather to point out that the driving thought process - the "I/we can do what I want and get away with it" seems to be present in both cases.

No. Absolutely no ####ing way. With bells on.

AI quota inflation is no token effort. It's baked in

Sproggit Silver badge

Designed-In Robbery

From 1986-1998 I worked for on of the UK's many "Borough Councils" ... and when I joined the organisation in question proudly boasted not one but *two* "Honeywell-Bull mainframes". I think "mainframe" might have been a tad optimistic - this was a "Level 64" and an early "DPS 7" for anyone else of a certain vintage... and for those of the "Big Blue" persuasion, they were basically System 36 / AS/400 / iSeries machines in terms of their position in the range.

Those machines had an internal billing system baked in to the OS that was made up of 3 discrete elements - CPU time [and back then it was roughly £10 for a CPU-minute], storage space [and that was charged by the megabyte, and finally output - and that was charged on the number of printed lines ... all of which we could harvest from *basic* system accounting and all of which we could then cost based on our paper usage and hardware maintenance costs. [ We had to split out storage separate from CPU on account of certain departments insisting on using complete copies of their production data sets for testing...]

Anyway, I simply had my Shift Teams run one batch job per month... and it would collect that data from the machine's internal accounting files - all broken down by Cost Centre. I wrote some pretty basic COBOL to summarise the amounts, perform some calculations, then spit the results out in a file format that went directly in to the financial information system.

Simples.

If I could do that [checks notes... forty years ago...] I'm pretty sure that these AI companies can put some very simple metric capture subroutines in their code in a way that records actual CPU time and not "vibe coded tokens"...

The fact that they are *not* doing this tells me that the AI companies have intentionally created an abstraction between actual resource consumption and the cost being charged back to users.

Which tells me that they have done this in order to have the freedom to tweak their "charging model" in a way that allows them to continually adjust and adapt their billing in a way that will maximise their profits and not be reflective of either the resources users consume or the value of the service to those users.

In other words: they are price fixing.

Of course, in any other decade we might expect some form of regulatory interest... but given the recent changes to [decimation of] the federal government in the United States recently, I don't hold out much hope of there being anything that remotely resembles transparent, objective pricing for AI.

Which is a shame, really. I've used it quite extensively for the last 18 months or so and for some tasks it is frankly amazing [and getting better all the time]. But, powerful as it is, there is danger for any organization that invests in the technology only to be held hostage to the small handful of established players.

Which is pretty galling when you think that the effectiveness and efficiency of their product comes as a direct result of the millions of hours of testing and training that we have been providing to those companies - and then *paying them* for the privilege of teaching their models to get smarter.

Hmm...

Minister gives Palantir's NHS platform a clean bill of health

Sproggit Silver badge

Re: Response from an MP

Protecting highly confidential data so that it cannot be read "at the back end" by sysadmins requires both design and implementation controls.

It's often known or referred to as "Application Layer Encryption" ... and here's a rough idea of how it works - very rough, I'm writing this ad-hoc, not copying or pasting from anywhere...

You start with design: your application typically stores data in a structured data storage system like a relational database. That database will need to be searched, using queries and typically using index or key fields on the data. The first thing you need to do is to make sure that you don't use your confidential data fields as keys or the indices to tables, because that breaks your ability to manage the data outside the actual application. The next thing you need to do is write the application so that as data is written in to the database, sensitive fields are encrypted - using a symmetric key - *by application logic*. This means that anything that "comes out of" the application is encrypted where it needs to be. This is distinct from having your RDBMS encrypt the data on disk [Database Layer Encryption, or DLE] and the reason that we need the Application Layer Encryption [ALE] is because we don't want the database administrators to have the ability to scan the sensitive data.

This isn't always as easy as it sounds - there are a couple of considerations here. The first is the overheads that doing all this brings. Modern CPUs contain firmware/hardware to accelerate symmetric encryption [or you can use hardware-based accelerators]. Even so, there is a workload increase and that has to be factored in to your hardware selections. The second and more important question concerns the apex of the chain-of-trust. You need to have a "master key" that can be used when the application starts up, so that it can "unlock" the data that it has previously encrypted and stored. That "master key" must always be available - lose it and you've lost your data. ALL your data. More importantly, it must always be under your control. You can't secure your data if you have to hand the unlock key to the company managing or hosting the data for you.

The conventional approach to solving this problem would typically be by using an HSM - Hardware Security Module. This is just a small box that is physically connected to the host processor [or hosts, if you have a load-balanced infrastructure]. In the implementations I've worked on, we did this by having the HSM in the same cabinet as the server and by having the two devices direct-connected via an Ethernet cable, on an isolated network connection. Not impervious, but if you tightly control who can access your host and how, you can somewhat manage the risk. To be honest this is quite rare - most implementations I've seen have the connections running over IP and use network security at the per-host level to protect key extraction.

The net effect is that you the client control the HSM. You buy and commission the hardware. You install it. You make sure that you and only you have access to it. You make sure that it is placed in a building and equipment rack that is entirely under your control and you don't give admin access to the third party.

If the government did this [ho ho ho] then even if Palantir were to take/transmit the actual data to the US, or to try and share it with others, the first thing they'd need to do would be to crack that encryption. Which, if you're careful, you can make secure enough to force them to have to work for it. [No encryption is completely secure. NO ENCRYPTION].

For the super-paranoid there is a level beyond this - known as homomorphic encryption. It's an advanced technique that allows things like arithmetic operations or data analysis to be performed directly on the encrypted data, without having to decrypt it first. Interestingly, one of the fields for which homomorphic encryption was specifically developed was for the processing of medical data.... As you start to look at homomorphic encryption, however, the overheads start to get a lot more significant and you're going to have to look at specialist hardware to accelerate your crypto activities. There are devices available - things like FPGAs - field programmable gate arrays, as well as ASICs - application-specific integrated circuits.

Colour me cynical... but I very much doubt the UK government would be using homomorphic cryptography for anything outside the most sensitive of government secrets... and almost certainly not for the medical records of us plebs.

Sproggit Silver badge

Re: Response from an MP

"The Government has issued assurances that Palantir does not own or sell any NHS data."

OK, but - serious question here - what if Palantir were to go in to a commercial agreement with another company - oooh, say a US healthcare provider - where that second agreement said, "We'll offer you insights in to this 'anonymised' data if you agree to give us a contract to perform the same work for you?"

Exactly how much oversight and diligence is the UK government enforcing on Palantir?

For example, does the government insist that all data is Application Level Encrypted, so that technicians working with the infrastructure can't see or access it? What about 3rd parties to whom Palantir might sub-contract operations?

Why are the generic terms of data protection for British Government contracts openly published on a central web site so that anyone who wants to see can go and ensure that the government is protecting their rights and their personal data with adequate safeguards?

The answer is - because they're not. This isn't incompetence. Expect to see the ministers responsible for these decisions to get offered juicy directorships at some future point.

Sproggit Silver badge

Remember The Summary Care Record Initiative?

In 2002 the Blair Government tried to implement the SCR - Summary Care Record Initiative - which would have resulted in all medical records for all UK citizens being uploaded to a central register that they wanted to call "The Spine".

Under tremendous pressure from multiple external organisations regarding privacy concerns, the government was forced to a compromise that resulted in UK citizens being given the right to "opt out" of joining - but this was set up in such a way that one had to act in order to be "opted out" as the default was to be "opted in". Even though that default [of "opt-in"] was chosen, so many people objected and explicitly opted out that the government cancelled the entire scheme. That should tell you how unpopular it was.

Now we find the Starmer government trying the same trick by a different mechanism. Instead of telling us directly that they will form a central "SCR" database [so that they government can sell the medical details of patients to the companies who are lining up to be awarded contracts once the same government has finished killing off the NHS], the Starmer crowd came up with a new wheeze - set up this "NHS Platform" and then make sure that it was awarded to Palantir - a major US company with a *horrendous* record of privacy abuses - and make sure that the contract allows Palantir to "off-shore" that medical data to the US for "processing and storage".

What could possibly go wrong.

It's really interesting to read the response that Lindsay Clark gets from Labour Junior Health Minister, Zubir Ahmed, which is so deliberately misleading that it beggars belief. That "independent procurement exercise" which they claim to be a "rigorous, competitive process in line with Government procurement legislation" is just a smokescreen. An unrelated example: ever wonder why all London taxis are the same make? It's because the "regulation" and "requirements" - down to stupidly narrow dimensional and performance criteria - are written in such a way that if any manufacturer other than the existing one were to produce a vehicle, it would have to be such a close knock-off of the existing model, that company could win a case for design and trademark infringement.

So it's utter tosh to say that the selection of Palantir was an "open and rigorous process" if the requirements were carefully tailored to suit one and only one bidder. And if the bidding was as open as they claim - how come the results of the "independent review" won't be published until the *END* of the 3-year process - by which time it will be *far* too late to back out... How convenient, eh?

The problem with British democracy is [apart from the fact that it's not a democracy] the deliberate obscurity behind major decisions. And it's so much easier to bribe a couple of dozen members of a committee - or at least compromise them - in order to win a contract that isn't only worth over £1 billion, it locks the British people in to a single vendor, who is then going to be free to charge whatever they want for "variations" once the ink on the first part has dried.

I love the comment, "He also referred to NHS England numbers that say 123 NHS hospital trusts are live on the FDP while 80 are reporting benefits..." Let me translate that for you: "We asked 123 hospital trust to complete a form that included a requirement to list both things that got better ("benefits") and things that got worse ("detractions"). Of the 123 who responded, only 80 managed to think of a minimum of *one thing* to put in the "benefits" column. The remaining 43 hospital trusts - roughly a third of those asked - reported that there were no benefits whatsoever."

There. Fixed that for you.

Finance company stores DB credentials in helpfully labeled spreadsheet

Sproggit Silver badge

I'm likely to get flamed for this... but based on personal experience, this is a common problem caused by poor management and more specifically by giving people conflicting objectives.

If you run a "DevOps" shop, you are asking some of your technology people to both support production environments and have developer-level access to the code they have in production. Everywhere I've seen this done, I have seen higher levels of unauthorised changes, higher levels of post-change incidents, higher levels of downtime. In fairness, that would be less than 5 organizations, so I acknowledge my experience is limited.

But in shops where developers have no access to UAT or Production and where robust controls were in place to safeguard those environments, stability and reliability were much higher. And yes, we're talking big financial institutions, where the stability and integrity of production code wasn't just important, it carried legal implications for executives [think Sarbanes-Oxley Act, False Claims Act, etc.]. I recall watching one DevOps Analyst-Programmer in particular - a pretty smart guy - get a clean compile out of some code he'd just written, give it a *single test run* on the *production* data, sample the output and then move the code to Production libraries... All because our manager had set up an incentive structure that drove that behavior. Or as we would say, "Work faster, not smarter". Doing that in a shop where roles and responsibilities are amorphous is just asking for trouble.

If you want people to behave in a particular way [sensibly] then you have to incentivize them to do so. Setting year-end goals to "Get X in Production" or "Implement Feature Y" is not an incentive for your developers, it's handing them a loaded gun and asking them to aim at *your* foot, close their eyes and pull the trigger.

DevOps is like giving them a gun with a full clip and asking them to keep shooting at both your feet until the clip is empty.

And DevSecOps is like dropping a tactical nuke in your boxer shorts and hoping it won't go off...

GoDaddy customer claims registrar transferred 27-year-old domain without any security checks

Sproggit Silver badge

Downhill from Here

Sadly, I think this is going to get worse, not better. And not specifically because of GoDaddy, though I'd agree I've had nothing but bad experiences dealing with them.

In my case the issue was driven by a sudden burst of spam that started to come to one of my email addresses and which saw a constant iteration through ".shop" domain names.

Clearly GoDaddy have a business model which caters to the "low cost" end of the market, but as a consequence this also means that their services are often abused by spammers and other con-artists.

You would think that with the amount of surveillance and monitoring of our internet usage that governments now insist on doing that they would be able to shut down crooks and scammy outfits like this near-instantly... but apparently they don't care.

GoDaddy have become part of the parasitic underbelly of the internet - whether they like it or not. I'm willing to give them the benefit of the doubt and accept that they went in this direction with the best of intentions... but there is just so much evidence of how this end of the market is rife with crime... it would be nice if they were willing to clear up some of this stuff...

No sign of that happening yet, however...

Brussels orders Google to share Android's AI sandbox with the other kids

Sproggit Silver badge

Re: Portabililty Between Models

I don't disagree with your observation that "there's no defined set of functionality from model to model".

Perhaps AI is generic enough that at some point process can be switched between models from competing vendors and still return acceptable results.

We're not there yet. I'm seeing differences between two iterations of the same model that have force a complete rethink in terms of basic process design.

I made my original comment because of the way I've seen models "drift" in terms of their performance, even over a couple of dozen iterations of the same basic process.... To be sure, there are going to be a good number of business cases where an iterative, learning approach that renders different results from the same data inputs [over time] is not an issue... but I suspect that for every business process where such variability is OK, there are going to be 2 processes where the business owner is going to want a better degree of consistency.

I think portability is tied to that consistency challenge - because of course you're going to want to be consistent in your prompts and to get consistent results. There's no point in developing a model to produce insurance premiums given a set of vehicle, drive and location data that starts to deviate too much, because it wouldn't be reliable enough to be profitable for the business trying to run it...

And I'm not sure I'd fly in an aircraft where the autopilot was engaged for the landings and simply decided to iterate or experiment with how to get the aircraft on the ground...

Then there's that piece over on Axios today where OpenAI and Anthropic are both saying that their latest models are rewriting themselves... and I'm not so sure this is heading in the right direction...

Sproggit Silver badge

Portabililty Between Models

This article opens the door to a dimension of AI adoption that I haven't really seen discussed yet: portability.

Back in the day, organisations like ANSI (the American National Standards Institute) developed portability standards for technology that covered programming languages, including COBOL, FORTRAN and even SQL. [ And yes, I appreciate that these are older languages, but COBOL and SQL, in particular, remain two of the most widely adopted languages in computing today.

The thing is, we have no way of knowing which of the current AI companies [if, indeed, any of them] will establish the most capable or effective solution. We don't know if the companies will continue in business, or be bought out, or sued out of existence if something goes wrong.

What we do know is that companies that use technology in general - everything from banks to healthcare to engineering - is rushing to experiment with and adopt AI-powered solutions, even if this largely seems driven by FOMO (the Fear Of Missing Out).

But the problems will start to manifest in maybe a year or two, when the AI race starts to solidify around leading players and we start to see major rounds of consolidation, with smaller and less effective players being consumed or simply fading to insignificance. But what of companies that invest in those doomed providers?

The thing about a programming language like COBOL is that it is relatively simply to port it between systems [as long as it sticks to an external standard, like ANSI]. We have no such collaboration happening in the AI space right now. What happens if you're a downstream consumer of i.e. Anthropic as a major part of your business process and then Anthropic is bought or our withers and dies.

If you've experimented with AI at all in a business setting you quickly learn that it is a brutal, Garbage-In/Garbage-Out paradigm and that crafting really good prompts is essential to getting good, efficient results. Once you have effectively hard-coded that in to other software by means of an API, things get more complex still.

I dare say it will come... but it would be interesting to ask companies who are rushing to adopt AI and just ask them what their contingency plans are if the AI provider they are partnering with is toast within the next 12-18 months.

I have a hunch that not many of them will have an answer for that.

The spaghettified DBMS chart that shows Oracle's crown is slowly slipping

Sproggit Silver badge

Don't Forget the Q

Having read the article and the comments, my sense is that both are discussing the ebb-and-flow of database views over the last 20+ years or so. Go back to the late Nineties/early Noughties and it was Oracle-on-Solaris as far as the eye could see. That was the combination to beat because Solaris ran Oracle better than anything else - and Oracle had the speed, scale and flexibility to run anywhere. What's happened since has been a steady drip, drip, drip of evolution.

But all of this ignores the fact that we're starting to see some really promising developments at the intersect between Quantum Computing and database design. Quantum computing is bringing features and capabilities - like superposition, entanglement and quantum interference - that can directly impact routine, common database operations.

Grover's algorithm offers a quadratic speed increase for searching un-sorted databases - which can reduce search times from minutes to milliseconds for massive datasets - which are becoming more prevalent thanks to AI and Cloud...

The development of Quantum Partitioned Database solutions [QPD] are opening the doors to more efficient data insertion, deletion and selection - and the more complex the data model, the greater the advantage it provides...

With transaction management - methods such as Quantum Walks can massively improve transaction scheduling conflict resolution and throughput.

Basically, quantum computing brings parallelism, reduces the need for steps like pre-sorting, and improves vector search or the definition/annotation of complex data patterns with much greater speed and reliability than any conventional technology.

Right now the big limitations are NISQ related - the qubit count of available quantum computers, decoherence and of course more mundane things like the cost...

But pretty much every technology mankind has perfected started out with the same challenges... and we overcame them all.

I don't think "Oracle's Crown" is the right question to be asking or the right observation to make. I think that if you want a clearer insight in to the state of [top end] database deployments in the mid-future onwards, you need to look to what these companies are doing to marry their database tech with quantum implementations; who they have working those problems; what their use cases or drivers are.

As the technology is brought more in to the mainstream, it will be those with the insight that move forward the quickest.

Iran claims US used backdoors to knock out networking equipment during war

Sproggit Silver badge

Re: False flag operations

i agree with the principle/outline that you describe here, but implementing the attack in software is too vulnerable to detection.

The issue lies in the non-volatile nature of the storage... That must be readable... and even though modern routers all include the ability to update their firmware, the image that runs is stored in a form that has to be *read* in to be able to execute. If you can *read* it while the router is running, then you can dismantle the router, pull the non-volatile storage, and it's pretty simply to wire it up to a PC and simply dump the code.

We have to make a distinction here between a vendor-supplied exploit and a hacker-installed one. Phineas Phisher - the anonymous hacker that broke in to the "Hacking Team" - the Italian security company - achieved his attack by compromising and rewriting the firmware in an IoT device they had connected to their "office" network, which allowed him to detect and penetrate their "secure" network.

But anyone examining that IoT device would immediately detect the changes in the device firmware introduced by Phisher and realise the device was compromised.

By contrast, if you're a device manufacturer and you want to compromise some hardware you're making... what you do is include a chip in your device that looks like a well-known integrated circuit - and which provides all the functionality of that commercial IC... but, when given a specific set of inputs ... unlocks additional, un-documented capabilities.

For example, you could have a network adapter IC that is responsible for collecting the received electrical signals from the pins of an Ethernet cable and converting them and assembling them in to a data packet. A bunch of companies have chips that do that. But you could develop a chip that did *more* than that by giving it the ability to recognise a very specific bit-pattern in a received network data packet, you could unlock additional functionality.

Very high speed network peripherals employ "DMA" - Direct Memory Access - so if you wanted to, you could have a network interface card that is designed to push malicious code directly in to memory when remotely instructed to do so... Much harder to detect than software as it would require you to dismantle or reverse-engineer the hardware.

Page: