Posts by T. F. M. Reader

Teach an AI to write buggy code, and it starts fantasizing about enslaving humans

The real significance of this story...

... is that AI has truly arrived if its flaws are published in Nature!

Well, if humanity is indeed in danger then even Nature may devote a few pages to the topic, I guess.

GNOME dev gives fans of Linux's middle-click paste the middle finger

Dear KDE developerts, please leave the middle button where it is!

There probably were multiple reasons why GNOME was never attractive to me. As others here I use Linux with KDE (since KDE appeared, more or less at the same time as GNOME). It has been my main environment (and the only one I use for personal stuff) for more than 30 years.

The big reason is how superior the GUI is to anything else I ever encountered - Windows, MacOS, etc. A big part of it is the efficiency of copy/paste with middle mouse button compared to Ctrl-C/Ctrl-V (middle-button paste is particularly brillians with autoraise+focus on mouse movement - something that is at best awkward on Windows and can't possibly work on MacOS while the context-sensitive menubar exists somewhere else on the screen). I can't imagine choosing a laptop without 3 mouse buttons if it is under my control. What's the next thing you want to disable - virtual desktops? Or the extremely useful feature of maximizing windows (at least in KDE): left-click on the button maximizes to desktop size, middle-click maximizes vertically (I use it all the time), right-click - horizontally. Will that go away, too? Stop ruining my life!

And in Firefox (and other browsers) the middle button serves another killer purpose: middle-click on a link opens it in a new tab. No need to right-click to drop down a menu, just imagine! Run a search, get a list of results, go through the list, middle-click on those that look promising, then look through the tabs... Oh, I forgot: no one searches anymore, everybody just asks ChatGPT and gets a single authoritative result. Silly me!

Please let the world and its sister disregard that bloody idiot who has no use for either middle button or grammar, and ignore the stupid desktop environment he works on while we are at it. Oh, I remember now: when GNOME first appeared everybody was laughing at its very fitting logo - a FOOTPRINT!

</rant--------------->

Users prompt Elon Musk's Grok AI chatbot to remove clothes in photos then 'apologize' for it

Re: Consequences ... apparently ONLY happen to OTHER people !!!

'cause it is an Empire

Any mention of "Empire" in the context should be followed by the "no clothes" bit. It just fits.

Europe gets serious about cutting digital umbilical cord with Uncle Sam's big tech

Requirements?

A Facebook needs "hyperscale" to handle asynchronous text/image/sound/video updates from billions of users, storing the updates, disseminating them, and crucially analyzing them to sell ad spots to customers. The big advantage of "cloud" (in general, without "hyperscale") is dynamic scaling allowing Amazons of the world to handle seasonal activity surges and the like without major contortions. And these things are known to be expensive, so if you need them prepare to pay through the nose.

For an Austrian government ministry that needs to handle 1200 of its own employees and, say, rarely updated information on 9M Austrians that does not need to be disseminated on a vast scale of analyzed in real time with sub-second latency to run advert placement auctions or anything of the kind (batch or periodic analysis is not similar), and with no foreseen surges of activity, why would US-owned hyperscale cloud providers even be in the running, even without sovereignty considerations? I don't see how their real UVPs would be relevant, the needed services (redundancy, backups, DR in general, moderate scaling facilitated by VMs+containers, technical services personnel etc.) can be provided by local hosters. It is not at all clear that hyperscalers have noticeable advantages in reliability, either (ahem, AWS).

Which parts of Europe's digital infrastructure actually require hyperscale clouds? Serious question. I am not saying they are never needed, just that the requirement does not look universal or even common.

US teens not only love AI, but also let it rot their brains

"love AI, but also let it rot their brains"

I smell a feedback loop.

Zig quits GitHub, says Microsoft's AI obsession has ruined the service

Run for the hills

@Michael Hoffmann: Github Actions look like it was written by interns over a weekend.

I gave the thread (and the fix) a quick look.

* Busy-wait "sleep" is an oxymoron, of course.

Yeah, looks like an intern's code, indeed. The whole idea that sleep(1) may not be present is ludicrous: what else would break in such a case? It is even more ludicrous to rely on SECONDS in the absence of sleep(1). If anything, a non-intern would create a binary using sleep(3) for the purpose. Surely libc exists, eh?

* date "+[%F %T-%4N] Process $runnerpid still running" >> "$logfile" 2>&1

Not only using date(1)'s format for logging is an idea that could only occur to an intern, the intern never considered what would happen if "date" were, say, an alias set somewhere else.

* if [ ! -x "$(command -v sleep)" ]; then

This is from an old (and defunct?) code for safe_sleep() function in the same thread. So they did check if sleep existed, just incorrectly. They don't check what it is or what it does, nor do they check what command actually is. This is an exercise any intern should do right after learning that bash has a 'command' builtin:

{~}$ sudo touch /usr/local/bin/sleep

{~}$ sudo chmod +x /usr/local/bin/sleep

{~}$ command -v sleep

/usr/local/bin/sleep

{~}$ command -vp sleep

/usr/bin/sleep

{~}$ alias command='command -p'

{~}$ command -v sleep

/usr/bin/sleep

{~}$ builtin command -v sleep

/usr/local/bin/sleep

After this even an intern would call 'builtin command -vp sleep' correctly.

My overall conclusion is that not only Github code is written by interns, it is also reviewed by interns. "Run for the hills" icon seems appropriate.

Web dev's crawler took down major online bookstore by buying too many books

Early 1990s?

Somehow Windows NT 4 and Windows 2000 Server don't seem quite so old to me. Nor does Jim's "weapon of choice", Microsoft Site Server (the helpfully linked Wikipedia page confirms).

Doesn't mean the story didn't happen, of course.

BOFH: Forward-facing AI brand experience meets forward-facing combustion risk management

Could we please have a new series

about Stephen's adventures as a boy scout? Maybe on Wednesdays?

One-fifth of the jobs at your company could disappear as AI automation takes off

In other news...

El Reg's weekly WHO, ME? feature will be written by AI from now on.

Airbus: We were hours from pausing production in Spain

Re: Flawed business continuity plan…

@Korev: They borrowed mine and never gave it back, the rude ****ers!

One of the many great dialogues from the movie "A Bronx Tale":

Calogero: He owes me 20 dollars. It's been two weeks now, and every time he sees me he keeps dodging me. He's becoming a real pain in the ass. Should I crack him one, or what?

Sonny: Sometimes hurting somebody ain't the answer. First of all, is he a good friend of yours?

Calogero: No, I don't even like him.

Sonny: You don't even like him. There's your answer right there. Look at it this way: It costs you 20 dollars to get rid of him... He's out of your life for 20 dollars. You got off cheap. Forget him.

Anthropic reduces model misbehavior by endorsing cheating

Human traits then, eh?

Many, many moons ago a big household name computer company decided that programmers should get monetary rewards for fixing bugs... I worked there, quite a while after that brilliant idea had been cancelled. It was still a part of the lore.

Software engineer reveals the dirty little secret about AI coding assistants: They don't save much time

Re: Premature optimization

Not only that - it optimizes the part of an engineer's work that is least likely to be the bottleneck.

Coders paired with bot buddies work fast, but take too many shortcuts

"AI is useful for simple, repetitive tasks"

The whole point of programming computers is to avoid doing simple, repetitive tasks. Resorting to prompting AI (not a simple task, in my experience) to do stuff repeatedly doesn't seem a right approach - you still do stuff repeatedly, so where's the gain?

Well, maybe the approach has a place in environments where no one can actually program computers to do repetitive tasks.

From Intel to the infinite, Pat Gelsinger wants Christian AI to change the world

Roadmap to Damascus

So, from now on, if you ask an LLM about St. Paul will it spit out the biography of Gelsinger from {Wi,Gro}kipedia?

Claude code will send your data to crims ... if they ask it nicely

"models can't separate content from directives"

AI uses von Neuman's architecture? Programs are data? Who knew?

Having said that, if I understand the report correctly the attacker needs to place a poisoned file on the user's computer and then wait for the user to ask Claude to summarize it. The first part is already a security issue without AI. So is it really an AI issue?

In a way, it is. It is certainly a plausible scenario: send "meeting notes" as an email attachment (more sophisticated option: add a poisoned file to a SW package that does something useful, wait for the user to clone the git(hub) repo and ask Claude Code to summarize it). Lazy AI enthusiasts won't ever open the attachment, but will ask their favourite bot to summarize the "notes".

Fundamentally, no different from clicking on unknown attachment, but with AI, so it's OK, innit? What I am missing is how Anthropic expect a user that does the above to "monitor Claude while using the feature and stop it if you see it using or accessing data unexpectedly."

It does not really look Claude-specific to me.

Smile! Uncle Sam wants to scan your face on the way in – and out

"cloud-based facial biometric comparison product"

So what happens when the cloud is down? On the way in - long lines, missed connections? On the way out - long lines, miss return flights, overstay your visa?

OpenAI releases bot-tom feeding browser with ChatGPT built in

Browse bravely

Now they need to partner with Palo Alto's "industry's only SASE-native secure browser" and fight it out.

Major AWS outage across US-East region breaks half the internet

Follow the money

The root cause is that people do not pay Amazon enough for redundancy and failover, so when a single region's DNS goes FUBAR...

I am leaving, ok?

Literal crossed wires sent cops after innocent neighbors in child abuse case

Risk assessment

It seems to me that both the police and the Tribunal need to brush up on risk assessment principles.

The most important principle is that risk is the probability of something happening times the damage that may occur if/when it happens. I can understand that the answer to "What is the probability that the IP-to-address resolution provided by BT is in error?" can indeed be "Very low". However, the answer to "What are the risks if the IP-to-address resolution is in fact in error?" must be "ENORMOUS". This pair of questions should have been asked and answered by the police at least after the initial search of the residents' devices turned up no evidence of wrongdoing, and extra caution should have been exercised.

The above should have been considered by the Tribunal, and they should have taken into account that the police failed to perform adequate risk assessment or management, causing horrible damage in the process.

On the face of it, even though the technical error was made by BT, BT probably did not have enough information about the investigation for proper risk assessment, i.e., they could not estimate the damage resulting from the error occurring.

No one involved should have assumed that the probability of error was zero.

Pro-Russia hacktivist group dies of cringe after falling into researchers' trap

All war is based on deception

There is an argument for publicizing deception operations, at least successes. The reasons are similar to why police undercover operations are widely publicized after a bunch of co-ordinated arrests. The remaining bad guys find themselves in a "virtual minefield", they don't know whom to trust, they start purging personnel for no reason, they get nervous in general and make mistakes, they don't know where it is safe to step, they start tip-toeing around extremely carefully, turn down the tempo of their operations, etc.

When your goal is protection rather than prosecution in the court of law even advance publication may be useful. Deception technology is effective. When it is deployed in practice red teams are typically hired to test. Sometimes the red team is not told that deception stuff is there, sometimes it is. In the former case the result is often just like described in the article: the red team "captures the flag" and writes up a glorious report that is read with chuckles all around. In the latter case the red team is afraid of its own shadow and quite often doesn't even go for the real "flag" thinking it is a trap. It's fun to watch either way, and cyber-criminals will be equally affected.

It's trivially easy to poison LLMs into spitting out gibberish, says Anthropic

Re: This seems both obvious and not exactly harmful...

It is a constant number only because the "poisoned" documents contain a bit of text (call it "word", "token", whatever) that is extremely unlikely to appear anywhere else in the training set. This poisons the model's output only when this "poison trigger" bit appears in the prompt. The constant number of documents (and document size) is apparently enough to pull them to the top of "top-k" or whatever statistical trick the model uses to pick output from statistically likely candidates - everything else will be considered less relevant/likely since the trigger word does not appear there. The poisoned documents' size is possibly relevant to make the result less sensitive to attention/temperature parameters and such.

To me, the research appears rather bogus: the setup is manipulated to produce the specific result (I am not saying it is intentionally manipulated - "never attribute to malice...", etc.). Others in this thread pointed out essentially the same thing. Your comment highlights the flaw.

What this highlights most of all is that an LLM absolutely cannot distinguish between intelligible text and gibberish. The researchers' use of gibberish is another wrinkle that pushes the results toward constant amount of poison and constant size being enough. LLM sees a unique trigger in a prompt and responds with something similar to what appears only in conjunction with the trigger in the training set. I suspect this bias was also unintentional and gibberish was primarily used to help with recognizing poisoned outputs. But it also highlights that an LLM does not have enough intelligence to say, "Oh, this is gibberish, let's lower its weight in my statistics". Or something. For am LLM tokens are tokens, there is no notion of "meaning".

Anthropic's Claude Code runs code to test if it is safe – which might be a big mistake

Re: Well... yes

Thanks for the link. This looks like a good candidate for AI Darwin Awards, and so does Anthropic's gullible "security reviewer", too.

What is it with AI bros? Many moons have passed, but I am still recovering from the shock of seeing the Linux download instructions for ollama[*].

[*] The link is safe, but if you follow the instructions blindly you are on your own. I didn't, and I am still in the gene pool. No awards for that, I know.

In a sandbox?

When Claude creates test cases and runs code during a (security) review, does it do so in a reasonably secure and isolated sandbox?

One would hope so, but hope is not a (security) strategy.

Biased bots: AI hiring managers shortlist candidates with AI resumes

Next step(s) in the hiring process

1. Ask several major LLMs to generate CVs fitting a published job description (let's assume the job is AI-related), send them all in. One that was generated by the same LLM that classifies the CVs will have a higher chance of being shortlisted for the first interview (the main purpose of a CV, of course).

2. The prospective employer may have a "guardrail" in place to cross-check incoming CVs (e.g., by the names and the supplied contact details) to detect applicants who employ the above trick, to weed them out...

3. ... Or maybe to give such applicants bonus points on their way to the shortlist? After all, this demonstrates AI skills, and the job is, by assumption, AI-related. And AI skills are deemed useful, possibly essential, to all jobs in our brave new world.

Putin on the code: DoD reportedly relies on utility written by Russia-based Yandex dev

Curiosity killed the cat's paranoia

Out of curiosity, I cloned the git repo and counted the lines in all files, comments, warts, and all. A bit less than 23K total, a bit less then 7.5K in the src directory. It doesn't look beyond the capabilities of the DoD, or any of its 30 individual projects mentioned in the article, to validate that, if the package is genuinely useful. Once. When updates are pulled in one would need to look at the diffs. Mirror the repo (all the needed open source repos?) in a controlled location and forbid pulling directly from anywhere else. DoD people can follow orders, right?

Then, again assuming the package is genuinely useful and noticeably better than the alternatives, maybe discreetly suggest to the author to take a personal trip to, say, Turkey or Finland to be interviewed and vetted for a job? On, no, forget I said that...

Developer jailed for taking down employer's network with kill switch malware

"Pour encourager les autres"

Mmm... Maybe I misread, but I think you take this famous phrase a bit too literally. It is certainly not related to finding someone innocent.

Facial recognition works better in the lab than on the street, researchers show

No high accuracy determined in the lab

survives the first encounter with the base rate fallacy.

- Helmuth von Moltke the Elder [paraphrased].

Meta offered one AI researcher at least $10,000,000 to join up

What are the chances...

... that it is AI-generated deep fake of Zuck? Out of curiosity: is there a link or an attachment (NDA? Contract?) in the mail?

Tech CEO: Four-day work week didn't hurt or help productivity

Define "productivity"

From TFA, quoting the CEO of Civo: "we saw no decline in productivity (I wouldn't say we had any gain)".

What's "productivity"? Is it hourly or is it weekly? The Fine Article gives conflicting ideas at best.

Quoting the boss of MSFT Japan (as of 2019), "I want employees to think about and experience how they can achieve the same results with 20 percent less working time", makes the impression that he wants his employees invent ways to become 20 per cent more efficient on an hourly basis to preserve the weekly productivity. As the article notes MSFT didn't expand the pilot and are not saying why - maybe the tradeoff didn't work out?

At the same time, "Everyone at Civo does their full week's hours during the four days." Hmm... This looks like no change in hourly or, indeed, weekly productivity. It's just that you cram your work week into, say, four 10-hour days rather than five 8-hour ones, and presumably you compensate for the degraded rest and family/social life for 4 days/week over the 3-day weekend. I don't know what was expected, but I can't say I am all that surprised. How happy this makes one's spouse/partner/children/elderly parents and how legal it is in one's jurisdiction may vary.

Dell discloses monster 20-petaFLOPS desktop built on Nvidia's GB300 Superchip

Re: FP4??!!

for a given definition of "works"...

And for a given definition of a FLOPS... The first PetaFLOPS supercomputer, codename Roadrunner, came into existence not all that many years ago (long enough ago though: I did get a T-shirt, but it no longer exists). That was in proper 64-bit FLOPS though.

I wonder whether even in the LLM context FP4 loses precision, or overflows, or both...

Please fasten your seatbelts. A third of US air traffic control systems are 'unsustainable'

"Eminense grease"???

Was that a Freudian slip, an intentional pun, an oblique reference to lubricant dripping from a chainsaw, or a direct reference to whatever passes between the various palms in the Administration and at Musk's companies?

Smile! UK cops spend tens of millions on live facial recognition tech

Re: Except it isn't

I suspect the main (or, maybe, another big) problem is that face recognition that is trained on, say, predominantly white English/European faces will be worse at distinguishing between subjects of other ethnicities whose face geometry is significantly different, leading to more false positives, etc.

IIRC, all the previous pilots/trials of face recognition hit the brick wall of "base rate" whereby even a small fraction of false positives among the basically nice law-abiding population will dominate the true positive rate over a small number of criminals / thugs. This was reported even in the Register on a few occasions. This is likely to be the main problem before every other big problem of relevance.

Public developer spats put bcachefs at risk in Linux

Re: Are we reaching a monolithic limit?

I'd also throw in an honourable mention of Andrew FS, Lustre, etc. I think (too lazy to check) that these - and some others - predate the (very relevant and correct) examples mentioned by @containerizer. In general, distributed filesystems have a long history in the UNIX world.

AI poetry 'out-humans' humans as readers prefer bots to bards

So how does Vogon poetry rate in this contest?

It has to be asked, eh?

Staff can't code? No prob. Singapore superapp's LLM whips up apps for them

Doesn't compute?

Users "with no coding skills" "can specify APIs if the model needs additional data from external sources".

See Title.

The Astronaut wore Prada – and a blast from Michael Bloomberg

And I thought, naively, that the red stripe was Prada Linea Rossa reaching for the moon.

LinkedIn: If our AI gets something wrong, that's your problem

Predictable

I guess Hinton was right about the dangers.

OpenAI to reveal secret training data in copyright case – for lawyers' eyes only

Wait a second...

How did they manage to download the whole Internet on a hard drive to show the lawyers "on a computer without Internet access"?

Lebanon: At least nine dead, thousands hurt after Hezbollah pagers explode

Technology question

What's the mechanism that led to nearly simultaneous explosions of thousands of devices?

Physical introduction of explosive charges and triggers into the supply chain on such a scale seems unlikely. Reports in mainstream media focus on the possibility to trigger thermal runaway reaction in Li-ion batteries by malware. I am not sure I am buying this: thermal runaway occurs when the battery is physically damaged, e.g., punctured - this would require non-trivial physical interference which is, again, unlikely, nor is it a guarantee - or overcharging, which is unlikely to be triggered by malware only, IMHO, since the device must be charging in the first place, and most obviously weren't.

So, any ideas? Can some kind of malware that, say, causes a CPU to overheat cause the battery to blow up with high probability?

Regardless, and as an aside: anyone considering buying a Chinese (or any other) EV with Li-ion batteries should let a second thought at least begin to contemplate crossing his mind (with apologies to Douglas Adams for reusing the turn of phrase that is obviously his).

So you paid a ransom demand … and now the decryptor doesn't work

Re: Backups!

Backups, of course... Fully agree. But a lot of (the same) execs who paid the ransom say they'd pay again if hit again, because they didn't expect how time-consuming restoration from backups would take. That's the executive approach to recovering from a breach: "Are we there yet?"

What they still don't get is that getting the data back is only a small part of recovery. Here are some other things their IT/security team must do: 1. clean up, 2. identify how the bad guys got in, 3. plug all the holes, 4. make sure no malware remains (including in backups), 5. do full backup (of the clean state) anew, 6. test restoration...

None of the above depends on whether you paid the ransom or restored from backups - it must be done anyway. Aside: decryptors may not work, restoration may fail, too.

Do all you can to prevent breaches (and regularly test restoring from backups!) - it'll be cheaper in the end.

Google insists the ad tech business ain't broke, urges Washington not to fix it

Wanamaker 2.0

Version 2.0 of John Wanamaker's famous quote: “Half the money I spend on advertising is wasted; the trouble is I don’t know which half” should read "More than a third of my advertising money is wasted; there is no trouble at all to know which third it is - the one that Google pockets."

WhatsApp's 'View Once' could be 'View Whenever' due to a flaw

Total Recall

Out of curiosity, if I open WhatsApp in a browser on a Windows computer and get a "View Once" message, will Microsoft Recall be able to save it?

San Francisco set to ban rent-hiking algorithms used by landlords

Re: Read Very Carefully!

What if the software/service providers are out of jurisdiction?

Too late now for canary test updates, says pension fund suing CrowdStrike

Re: WTF did I just read?

Can't they afford a test lab?

I am guessing they probably had an additional flaw in their process/CI/CD/whatever, such as not verifying that what they are pushing to the world is the same thing their QA approved. At least check the hash or something?

This is not instead of small yellow birds but in addition to them.

Post-CrowdStrike, Microsoft to discourage use of kernel drivers by security tools

@EvilAuditor: why would anyone deploy an update of any kind directly to business-critical production systems?

Customers deployed Falcon agents that includes an in-kernel components/module/driver. The agents communicate with a management server that pushes malware signature updates ("templates" in Crowdstrike parlance) and the customer does not have any control over the process. Crowdstrike don't call it a software update, even though it is (clue: there is no difference between programs and data). Once in a while such an update crashes every machine it is pushed to, as it turns out.

Your question, were it not rhetorical, should be directed at Crowdstrike in this case.

Administrators have update lessons to learn from the CrowdStrike outage

Stored programs

One of the causes of this clusterfuck is that people either forgot or never learnt what "von Neumann computer architecture" is and means. Besides clues in the more descriptive "stored program architecture" moniker, what it really means is that there is no difference between programs and data. All the CPU does is access memory, where both operands and instructions live (well, it also checks for interrupts). This means, among many other things, that if you keep a program at version N-2 but update the data the program uses then it is no longer the same program and your software is no longer stable!

In particular, to all the voices (not necessarily here) that scream that NSFT should not have signed the stupid driver: the "signed" bit does not mean much more than "we really got it from CRWD". There is no way MSFT can comprehensively validate every possible configuration of anything, let alone data updates.

Both vendors and customers need to be aware that if "only a data file is updated" then it is, in effect, an update. And if the "program" in question runs in the OS kernel then all sorts of things may go awry, and everybody involved - R&D, QA, customer IT/ops - must be extra careful.

In the past there were 2 routes to learning that program and data are the same. It was made an almost obvious basic principle in the LIST world and there were OS courses that started from a description of von Neumann architecture and the basic CPU operation (as above), neatly introducing process context and memory management, and then, typically close to the end of the course, revisited the topic in a lecture about security. I used to do that, too.

Nowadays there is always Wikipedia. LLMs may or may not come up with something more useful.

CrowdStrike file update bricks Windows machines around the world

xkcd actually predicted it

https://xkcd.com/2928/

CrowdStrike shares sink as global IT outage savages systems worldwide

Blamestorm

Part of the blame is certainly on Crowdstrike: if their content update breaks Windows with such high probability (if the probability were low only some parts of the world would crash) how come their QA didn't catch this?

The other part may or may not be on Crowdstrike: do they offer a protocol and recommend a change procedure that includes staging and testing? If not it's on them. If yes, then it looks to me that hardly anyone in the whole world (OK, in the part thereof that uses both MSFT and CRWD, on the basis of the observed data) implements a reasonable change protocol.

Mind you, EDR/XDR products typically require admin level access to the target machine, without it it's kinda difficult to fight invaders off (the R=response part, at least). And security updates tend to be quite time-sensitive, but that should be handled by the change protocol, at least at the crash/no crash and boot/no boot level.

Agile Manifesto co-author blasts failure rates report, talks up 'reimagining' project

The crucial question

Can you (= the team) do the job?

If you can, you will be able to do it to clear, strict requirements. Along the way, you will be able to argue about those requirements and suggest improvements, additions, deletions, modification, etc. You will know that those "strict" reuirements will change along the way and you will come up with a flexible design that will help accommodate the changes without rewriting everything from scratch.

By the same token, you will be able to do it without a complete set of clear, strict requirements. You will argue about what is needed (you will also find the right people to consult with, in addition to or, in some cases, instead of the Product Manager who came up with the original requirements, clear or not), and fill in the blanks along the way. Not everything will be certain - or correct - from the start, but your design will accommodate the new information.

If you know what you are doing you will also be able to estimate complexity and you will know where you do not even know the complexity (those will be the parts that you cannot easily decompose into tasks that you have already done in the past). That will be an essential input for your effort estimations that the managers will want to know, By the way, if all complexity is known and the job has been divided into familiar tasks (and known dependencies between them) a waterfall/Gantt will do as methodology. This is also the reason why old, well established industries like, say, construction can often/usually do very well. It is unknown complexity that engineers overprovision for and that is the source of those conflicts with Sales and Management. Knowing how to do the job includes being able to explain and stand your ground (and, on occasion, disclaim).

But what if you cannot do the job? For one thing, you very likely won't know the complexity. You'll make mistakes, You will redo stuff every now and then, and you won't have a flexible design to make changes easy. No amount of "methodology", "process", "daily status meetings", "looking over the shoulder" will help. As a special case, none of those things is a substitute - or compensation - for hiring cheaper but less capable workforce. And I do think that proponents of methodologies and processes have this assumption - that methodology can help regardless of composition of the team - implicitly in their theories and manifestos.

Oh, but what if you are young? How will you learn to do the job? From working alongside your more experienced colleagues who will generously suffer the overhead. Learning how to look at clear requirements and lack thereof, and how to design for various eventualities (and assess their likelihoods). In short, how to do the job. Looking back at my own career here...

Learning "methodology" won't help you much. Well, it might help you get that next job, but if it does chances are you won't learn much more in your new position. Therein lies your path to Management.

Europol says mobile roaming tech is making its job too hard

Out of curiosity...

Do Europol also complain about E2E-encrypted WhatsApp, Telegram, Signal, etc.? None of the developers is even European. Why focus on SMS?