The Register Home Page

* Posts by Lee D

4951 publicly visible posts • joined 14 Feb 2013

This is node joke. Tor battles to fend off swarm of Bitcoin-stealing evil exit relays making up about 25% of outgoing capacity at its height

Lee D Silver badge

Re: I continue to be surprised

Yes it does, with modern browser technologies.

That's why China have blocked modern browser technologies.

Even then, you would only ever have got the SNI field out of the SSL session, so you'd know what domain they were going to, but that's it. Not what file, page, download, etc. Just the domain.

I'm sure "amazoncdn.com" (or whatever it is) is really useful when you're trying to pin evidence of something nefarious on someone.

But even that avenue is closed to them nowadays.

Lee D Silver badge

Re: I continue to be surprised

Because it's free to do, one-click install in many places, and stops people's sessions being sniffed (i.e. what sites they were looking at, what pages they read) and prevents man-in-the-middle injection attacks where people can slip in Javascript or - like some ISPs have done - adverts into a page that doesn't have them, and you'll never know because there's no indication of if the page was as it was sent from the server.

Irony, thy name is SANS: 28k records nicked from infosec training org after staffer's email account phished

Lee D Silver badge

Since when have people's emails been "largely available in public databases"?

Can't decide which OS to run today? Why not Linux inside Windows inside macOS?

Lee D Silver badge

Surely the top reason of "Why not" will soon be that they won't be x86 and thus won't support virtualisation, only emulation (which is an entirely different beast).

Can I get some service here? The new 27-inch iMac forgoes replaceable storage for soldered innards

Lee D Silver badge

Re: Sad

Bought new laptop two weeks ago.

Ordered another NVMe for it the week after.

Sorry, but I'm going to max out storage because it's the one thing I use / want the most, to actually hold things I want to keep.

I could have gone from 16Gb to 64Gb of RAM for the same price - but I can do that any time and as my need requires it.

But I filled up my first 1Tb NVMe within the first week just loading my Steam collection and files from my old laptop - before I'd even STARTED downloading anything new.

Lee D Silver badge

Why do people buy this junk, and why do the Reg keep pushing articles about it?

"New Mac out. Slightly less repairable than ever".

Headline done.

China now blocking ESNI-enabled TLS 1.3 connections, say Great-Firewall-watchers

Lee D Silver badge

Re: Huh

AI = brute force and cross your fingers for luck.

All they did was fuzz the API until they hit some kind of success, that's all the AI can (ever) do.

Lee D Silver badge

Re: Own goal?

To my knowledge, Windows Update does not use a web browser to load its updates.

It's the internal Windows crypto APIs connecting to a specific service - there's no way that they're using TLS1.3, or any installed web browser - especially ChromiEdge, which isn't on most machines - for that.

It's not even BITS any more, it's some peer-to-peer-supporting thing.

UK utility Thames Water splashes cash as host of IT consultancies appointed to handle £100m worth of deals

Lee D Silver badge

Digital Thirst

I never get why anyone would think that a water supplier cares about people reducing water usage.

It's like when electricity companies try to give you a free energy-saving bulb. The cost of that bulb is spent in about a day by the average household. And why would they want you to cut consumption while they are charging you FOR that consumption.

It's entirely the wrong way to go about it. The company who wants your business isn't going to be bothered about you using more of their products and paying them more money.

If you want to reduce electricity usage, you put up the tax on the energy supply. Problem solved. (And other problems introduced).

We've reached the endgame: Bezos 'in talks' to turn shuttered department stores into Amazon warehouses

Lee D Silver badge

Re: Now would be the time

Like Amazon employees have enough money for fast food.

Huawei Matebook X Pro 2020: Nothing too crazy but at least it's more fixable and cheaper than comparable Apple wares

Lee D Silver badge

I recently bought a laptop for the same price.

It has a 17" 240Hz screen and a proper graphics card (RTX2060). It has more ports, and a Thunderbolt. The same wide touchpad. Double NVMe. Effectively the same processor, RAM, etc.

It just doesn't have touchscreen, but quite why you'd want that on a 13" laptop I can't fathom. Laptops break at hinges (always). So you're gonna stab the glossy thing you need to look at with a smudgy finger.

Oh, and it opens with ordinary small Philips screws, because I did that already to change the Wifi/Bluetooth and the NVMe's.

I'm sorry but who is paying this amount of money for a 13" business laptop? Are they suffering from Surfaceitis? Or Macbookavirus?

British Army does not Excel at spreadsheets: Soldiers' newly announced promotions are revoked after sorting snafu

Lee D Silver badge

Re: Perhaps the person

If you only have one person compiling, checking, and sending out things like that - that's the problem right there. Sack the manager who put that procedure in place.

Even the basics of things like payroll and admissions should have a double-check by someone else. If nothing else, you do NOT want your processes to be in the hands of a single person (who could slip their mate through, or get run over by a bus).

Whoever *checked* it should be sanctioned just as harshly. It's easy to make a mistake, but if you don't have someone checking, it's just human nature. If you do have someone checking, they didn't do their job at all (not just made an easy mistake, but literally didn't do the entire purpose of their job).

That this went from Excel out to emails without something dry-running, then manually checking, is the problem. It's a process problem, not an individual. And, generally speaking, in my experience, the individual in this case would have been crying out for someone to help for years, because they can't be expected to compile, check and distribute emails like this without being a prize target for the slightest cockup.

That's how we roll: OWC savagely undercuts Apple's $699 Mac Pro wheels with bargain $199 alternative

Lee D Silver badge

Re: Brace yourselves for some wheely bad puns in the comments

It's just the pressure getting to you.

Think carefully about cyber insurance, says NCSC. But don't worry about buying off ransomware crooks

Lee D Silver badge

There are whole groups of schools, state and private, at the moment that are suing a bunch of insurers because their "pandemic" insurance (literally has the word in it) doesn't cover COVID-19.

The insurance company's defence is basically "It doesn't explicitly say COVID-19". Why would it? It wasn't known about when it was drafted. But it says things like pandemics, medical incidents, etc.

Hundreds of schools thought they were covered, went to cash it in, were told no, and now have to fight it in court. And they're questioning what they actually paid for, and whether it was worth paying for it at all.

Pretty much like every insurance I've ever heard of. There's a reason why, unless it's legally necessary, I don't bother with insurance. Just put the premium in the bank. On average you'll win just by doing that, and unless you're particularly unlucky you can stand to save a fortune that you'll never use.

We Kana believe it! Raspberry Pi Foundation launches Japanese keyboard

Lee D Silver badge

Re: Why?

There's code all over the Internet for virtual keyboards, handling scancodes, keyboard layouts, modifiers, the symbols produced, etc. If nothing else, Linux itself has handling for them, not to mention Linux GUIs, not to mention virtual keyboard software that runs on those GUIs that produces the scancodes and tells you which keys are modifiers under which circumstances, etc. right in the code.

Hell, my secondary school 20 years ago offered a course in Chinese Wordprocessing with pretty much everything you'd need to know from a non-technical basis, and coupled with a basic knowledge of scancodes you could sort it out in a few hours, let alone having a native Japanese speaker that you can ask to get that kind of documentatio / translate that for you.

What this suggests is they got someone to buy a Japanese keyboard, press every key while running a scancode monitoring tool, and then did that for a few hours recording the results. Possibly the cheapest/worst way to arrive at such a thing, because it's unlikely to catch all the unusual / little used modifiers and then you're hardcoding everything.

Honestly, it's 2020. Buy a Japanese USB keyboard encoder IC (literally pence) and then hook it up to the specified keys that will be in its datasheet. Likely it'll literally just specify the row/column on the keyboard matrix that it expects each key too.

Google to pull plug on Play Music, its streaming service that couldn't beat Spotify, in favour of YouTube Music

Lee D Silver badge

Re: Play Music App

VLC works fine on Android.

Hell, I use it to watch TV (via tvHeadend and a cheap Raspberry Pi with a DVB hat on it - which I saw for sale for just £6 on top of a RPi cost recently).

Lee D Silver badge

Re: Moderately aggravating

Solve the problem in your first sentence.

Just export every piece of music, store it on a card, NAS, cloud account, whatever, and deal with the problem once and for all.

Lee D Silver badge

Re: I've just uploaded my music collection to...

Buy a big microSD.

Seriously.

128Gb Samsung is £17 on Amazon at the moment.

I mean... being a music lover and all, you DID buy a phone with a microSD slot, right?

And when your entire collection can sit on a tiny card, I see no point having a cloud service for it at all. But if you wanted one, just about any home NAS with the default software will do what you want.

UK data watchdog having a hard time making GDPR fines stick: Marriott scores another extension, BA prepares to pay 11% of £183m penalty threat

Lee D Silver badge

Re: Falling on sword time?

Don't be silly, in a few month's time they can just revoke the entirety of the GDPR. Why bother?

All those years of compliance (with a quite sensible and powerful-to-the-consumer law) will be wasted because of our "independence". They'll just cut the red tape so that their own projects (like the track and trace, etc.) don't fall foul of it either.

Apple re-arms the iMac with 10th-gen Intel Core silicon

Lee D Silver badge

Imagine paying $4,999 and ending up with an i7.

NSA warns that mobile device location services constantly compromise snoops and soldiers

Lee D Silver badge

Or just... don't allow phones in secured areas.

Leaky AWS S3 buckets are so common, they're being found by the thousands now – with lots of buried secrets

Lee D Silver badge

Re: And the corporate world ...

If you can pay an outside entity to do the job securely and rent equipment to do it all, then you could afford to pay an internal team MORE, or be of better quality.

Especially if all these people are doing is dumping your data in a unsecured bucket in the cloud.

There's a reason I resist cloud-movement of data, and why I insist on keeping the most critical stuff in-house where we can see it, and know where it goes.

It's all going to come back to bite you, and then Amazon / Azure / etc. are just going say "Your problem".

Doctor, doctor, got some sad news, there's been a bad case of hacking you: UK govt investigates email fail

Lee D Silver badge

Re: If the Tories General Election pledge was to NOT sell of the NHS

"No because manifesto pledges aren't binding"

And, yet, the number of times I've had to explain this to grown adults is scary.

Listen: Politicians lie. They lie because they can, because there's nothing stopping them doing so, because people give them power on the basis of those lies, and because there's no comeback to lying except possibly in a few years time not being put back into power.

That's it. That's the entirety of UK, US, etc. politics. "Everything is made up and the points don't matter".

That's why anyone who says "I voted X because they're gonna do Y" is an idiot, in my opinion. There's absolutely no legal ramification if they don't. None whatsoever. They can lie with impugnity, not do anything at all or - worse - do the exact opposite of what they said, and nothing happens.

They get sacked because "people don't like them" or something like that, not because of any failure of them to carry out their promises - nobody *ever* punishes them for that.

And while you have such a system, guess what kind of people gravitate to that kind of position? Liars. People with no intention of doing the job, beyond what they need to convince you to not throw them out (which is a very low bar indeed, apparently).

And then people ask me why I don't have any interest in politics. It's because it's like watching a kindergarten quibble over whether they said it was the other person's go or not, and whether they said they would let them have a go, have a go today, have a go eventually, or even have a go at all. It's honestly that bad. And even with a supposed opposition that's supposed to be holding them to account, it just turns into bickering and nonsense and more lies.

Until we hold them accountable, until manifestos are binding (with independent review of progress!), and until people start to vote them out - outside of voting cycles - for doing a BAD JOB, it's all a bit pointless really.

And it's really not difficult: "Please submit your proposals for the next four years with progress indicators, timelines, regular success targets, budgeting and contingencies. We'll check in at quarterly intervals to ensure you're on track and, if not, why not, and whether that's justified" The government is actually worse-run than a small project at a tiny company.

Linus Torvalds pines for header file fix but releases Linux 5.8 anyway

Lee D Silver badge

I buy a computer to do the hard, repetitive, boring work for me.

If it can't build a tree of the files, their dependencies, duplicates, and then work out which bits it needs from where - even via brute-force, then what's the point of the compiler/linker, really? And most of these problems are not circular dependencies - even when they are, they are solved by taking files partially rather than in a chunk. If B has a dependency on A is in file A which includes B at some point - that's easily resolved. You have everything you need.

A proper circular dependency is literally un-compilable by anyone, ever. These file-level dependencies aren't - proven by the fact that you can eliminate them by excluding one of the files which isn't strictly necessary, or juggling the include orders. Parse file B. That needs parts out of file A. Parse file A. When you get to the bit that needs a definition from file B - oh look... it's just below the bit we're working on... if we hang on a moment, or look ahead, we'll get the answer. Or even just mark that as "grey", carry on parsing the rest of the file, then parse file A in its completeness and when it comes back... oh, look, we only needed this part out of B anyway and everything else is "not grey" now. Now resolve.

Some compilers can do it. Some systems have had this for decades. Most software still gets written in C. GCC and associated tools are the most-popular/complete C compiler / linker / etc. Why is this not a solved problem?

Is it really that difficult? Scan file A top to bottom, pull out all the named symbols and dependencies they have. Do the same for B, C, D, E. Now that you just have names and dependencies, resolve all the ones you can, whittle out the rest like you would a logic puzzle in a magazine. 1st stage you'll eliminate from consideration 99% of the entire codebase. Then it's just a handful of dependencies, and they'll mostly work themselves out via iteration. Anything left - ASK THE USER. It'll be a duplicate definition (i.e. same thing specified in two different files), a true circular dependency (struct A includes struct B which include struct A, which can never, ever compile anyway), or a false circular dependency (struct B includes a pointer to struct A, which contains a struct B, but it's just a pointer so who cares?).

Literally, you could do this on perfectly compliant C code just by building a list of all the includes in all files, ignoring where they were *included from*, finding them yourself and parsing them just like files A, B and C. And then if you still spot an undefined symbol... have a quick shufty though a centralised database of all the include files in the standard include folders and see if you can make a suggestion. The database for a whole system with SDKs etc. and thousands of include files would be, what, a couple of meg or so (just the file name and the symbols it has defined in it).

Lee D Silver badge

I love programming in C (99) but I have to say that one of the things I'd throw out is everything that leads to header file dependency problems.

If I #include a file... I've included it. If it was already included, then I don't need to include it again. But, no, you have to put magic #ifdef's through 50 files to stop that happening.

If I #include a file, and it has a structure or other definition in it... then that structure of definition is defined. I shouldn't have to play games so that it is prototyped in files to let them know it's defined (even though they think it isn't yet) so that when it is actually defined, they know where it is (and god-forbid you define it twice).

Then the real magic comes when you want to include structures inside structures, when you want nothing more than a pointer to a structure inside a structure that you haven't defined yet (you don't need to know what type it is yet... it's just a pointer!), so you end up playing games with void pointers that then get cast to the proper type.

Then you have things like you miss off the include in one file - while processing 50 files simultaneously. There's no "I think you meant this, and I can't see any conflicting definitions" logic. Then you have "Do I define this structure before I include that other file, because it needs it, or do I do it after? Do I mess up my nice list of top-of-file includes just to resolve a header dependency issue?"

I actually kept a screenshot I got while coding a game with a copy of GCC - the whole code compiled except for ONE error. It said precisely this:

expected 'struct Player *' but argument is to type 'struct Player *'

Now, it doesn't matter how many times you read that, it's nonsense. It wasn't a typo, or similarly named but different structures, it wasn't a formatting error - the "struct Player *" in that error line is 100%, absolutely, totally identical (I know, I compared them in a text editor!) and there's only a single definition of that structure in all the code. It came about from some weird header dependency where it thought it had a perfectly defined struct Player, but had somehow managed to include the file twice, without it realising that it was the same file/structure inside. So instead of warning about duplicate definitions, the original "player.c/h" files believed they had the definition, but the function they were used in somehow included them via a roundabout route that thought that *it's* inclusion was the correct definition. And the compiler had obviously given the same structure, only ever defined in only one file, two different "internal" names that it thought were different.

It's 2020. I understand the *legacy* of things like C header file inclusion, the preprocessor, etc. but I do still think it's about time that we got a compiler switch which basically means "just sort it out". If you don't have a definition, hold onto that thought and come back to it later in the compile. If you have double definitions but they're from the same file or the structure is identical, maybe warn but carry on regardless. If you need the size of a structure pointer - it's a pointer. Put it in as a pointer. Worry about the structure inside it later. If I #include but the file is in a slightly different sub folder (e.g. #include "SDL/SDL.h"), work it out... warn me or let me choose as necessary. "Did you mean SDL2/SDL.h? Would you like me to modify the include line to reflect this in the future?".

There's no reason that a C compiler, even in "C99 mode", can't take the whole compile as a process, and colourise parts as it goes, leaving unknowns in a grey area until it can determine what was actually meant. Then filling in the gaps later piecemeal (not on a file-by-file basis as that would just leave you in the same position because it can't resolve the entire file, so nothing else is "ready" yet either). Then warning/asking the user exactly what they want to do.

Especially with things like preprocessor file paths (is it SDL.h or SDL/SDL.h?), it could just search, and tell you, because those things might well change from every different computer that code is compiled on. Work it out, present options, because those options are only ever going to affect me anyway, if I'm the one with the weird-arse include layout.

The problem with C is that it's a fabulous language to program in, but far too much time is spent faffing getting compilers, linkers, Makefiles (YURK! Why are we still using that junk?), etc. to work. I use it on several platforms, with several different architecture targets on each, with all kinds of libraries, and in several ways (command line, Makefile, CMake, Eclipse IDE, etc.) and it's the damn setup that takes most of the time to make sure that the libraries are linked when you use their headers, that they link in the right order to fulfill the stupid compiler's demands, that header inclusion takes place in the right way, etc.

It should just be... compile main.c - it includes a bunch of files, we know they are there in the same folder, pick them up and use them if we've obviously intended to, inform the user of what you did, link it with the libraries that included those headers (it's really not hard to have a #pragma or similar for this... if you include SDL.h, link against libSDL, if you include SDL_Mixer.h, link against libSDLmixer... it would take one line in the header!).

I get the reasoning, I know there's the chance of including the wrong version header, library or whatever, but that's not unresolvable (especially if the compiler/linker tell you what did!), and it's very easily avoided.

But recursive-header-includes are a pain in the butt. In some projects where I know the code isn't for public consumption, I just have a master header file and include it on every C file, and that master file includes everything else "in the right order". Why not? Literally a hundred files with just "include "main.h" " and then let the compiler sort it out. But that's not what the header files are designed to do... I should only be including what I need, I know. And the compiler shouldn't be as dumb as a bag of rocks when I miss something. But if it's going to be, then I'm going to make IT do all the hard, unnecessary work, because I'll be damned if the tool I'm using to make it easy to write tools I'm going to use is just going to spew errors at me and expect me to do the manual legwork. It's a machine... it should be doing that for me.

Microsoft to Cortana: You’re not going out dressed in iOS or Android, young lady!

Lee D Silver badge

Re: Yes

I use 2020 tech. And turn off the junk.

Secure, and nothing listening to my every move and me trying ten times to get it to understand "set a timer for 15 minutes" with any accuracy over a bubbling, boiling stove and extractor hood compared to just prodding it with the back end of a wooden spoon and doing it directly (what is that? Three presses? Home button. Clock. Drag timer and hit start?).

Honestly, I've never had voice recognition work for me at all. I demonstrated this in my brand-new car (voice satnav, now mostly disabled - because it literally couldn't understand "navigate to <major London town" from a car full of people all insisting that if *they* tried it would work first time, no second, no third... okay, you try, smartarse!), with a brand new phone, with any number of desktops, laptops and Chromebooks, a Chromecast, Alexa and Siri.

I have a mild Cockney accent which *nobody* has trouble understanding - on the phone, in person or however else. Except so-called AI. Which literally has never worked first time for me, and which I grew to realise unless you trained yourself to talk to *it*, then it wouldn't do anything. Honestly... I'll pull over and tap the screen, it's easier than messing about.

Now translate to those people with speech impedients, background noise, young children, strong accents, etc. etc. etc.

I give up the second a phone line is automated and wants me to say something for it to recognise nowadays. Not just unnecessary automation but I have been known - especially when demonstrating exactly this to people - to spend 10 minutes trying to get it to recognise one word correctly. Not even *trying* to confuse it, just speaking normally in a variety of tones, speeds, accents, wording, etc.

Reminds me of the guy who tried to convince the teachers at the schools I work for that they could write all their school reports with Dragon Dictate. He was literally trying to sell it to them all. I suggested they try it first. We never expanded past the trial, and all they had to write was a one-paragaph summary for each child, where the child's name wasn't even required (so no odd proper nouns, etc.). Everyone started at "Isn't this an amazing idea? It'll save us so much time? The demo he gave was fabulous! It looks amazing! Why haven't you ever said to do this before?!" and ended in silence and just sitting typing it themselves manually for the next three years.

Lee D Silver badge

Does anyone actually use these things?

Got a new Samsung phone. First thing I did was turn off Bixby and everything related to it.

Got a new Windows 10 laptop. First thing I did was turn off Cortana (and get rid of Edge, put a proper start menu, etc.).

The only thing I ever see people use Siri / Alexa for is to pee about, showing me "how cool" it is to have them sing songs or do tell stupid jokes.

Does anyone actually use them for anything that wouldn't be quicker to just tap the screen to do anyway?

Lee D Silver badge

Spin on it!

(Bonus points for getting the reference).

Someone made an AI that predicted gender from email addresses, usernames. It went about as well as expected

Lee D Silver badge

Re: The complaint seems confused

It's not just me!

Someone write a news site where I can literally filter this stuff out.

Lee D Silver badge

Re: The complaint seems confused

I'm dubious that any data available to an advertiser is of any use at all, to be honest.

When was the last time that you got an ad and thought "Well, that's really relevant to me!"? You get IT ads on IT sites and bikini ads on swimwear sites, and then those follow you through the rest of the Internet because of the magic of Google Ads.

At no point do the advertisers seem to know anything about *me* when they advertise to me. If you're an advertiser and you want to sell, say, tampons... are you really going to go to extraordinary lengths to identify every user's gender based on their username, browsing history, IP address history? I don't think you really are. You're going to advertise on sites that women use, and on searches for feminine products.

It's like the loyalty card thing with supermarkets. When they first came out, they were a vital source of information that the supermarkets couldn't collate themselves. Transactions were just transaction and they had no way to link your shopping this week to next week. Now, the supermarkets themselves admit that it's quite useless as the data is readily available and not very useful. They can link all your purchases together, but they can pretty much do that with credit card data anyway.

And what do they find? People buy more sunhats and salads in the summer. What an insight! And it doesn't help at all to predict, say, a pandemic leaving you with a severe toilet paper shortage.

And every time I get through my Tesco's clubcard statement with discount codes, it's literally for the same things as everyone else's, because they're pushing a particular product, not aiming it at me particularly. They're not trying to make me, a tee-totaller, buy whisky but to sell off the whisky they got cheap. So they don't even customise to whether I drink or not - removing or targeting products based on that - and that's an easy thing to determine from my purchase history (because I've not bought alcohol on it all the time I've had it). My ex and I both had cards and for a while, they were registered at different addresses. The offers to us both were identical. And pretty much things like their stock control and inventory programs tell them everything they need to order or push anyway.

All this data is useless, and I very much doubt anyone's really interested in buying something that guesses based on your username, when Google could let you target to people who have actually visited any of billions of gender-focused websites across the globe, or purchased gendered products.

And even then... I'm not quite sure that you could determine with any accuracy if, say, a couple shared a laptop at home.

All this data is valueless nowadays. It's not used for targeting because it doesn't work and isn't accurate enough and, in the end, makes little difference to the success of an advertising campaign.

Think of everything Google knows about you. Now go to YouTube. Do you get a men's razor ad, or a tampon ad? Neither. You get Grammarly. Because it is relevant to everyone. Go to a review of a men's razor, or even a car website. You'll get razor ads. Go to a beauty salon page or a handbag store, you'll get tampon ads.

The data just isn't valuable and isn't used for those kinds of things. Even Tesco's, Sainsbury's etc. say exactly that. There's a reason that ASDA (Walmart) don't even have such a loyalty scheme. It's seen as a waste of money, because the data is worthless.

Lee D Silver badge

Re: Work with facts

Not true. 1955. A generation before I was born, at least. 1970's, it was commonly-accepted terminology and knowledge. I wasn't even born for most of that. And gender is no more a choice than your sex, and no more clearly defined.

Plus it makes you sound like a twat.

And what you think is your biological sex has been known to be non-binary for a long time.

Biological sex is very much a combination of a chromosome, where certain things attach to that chromosome, whether body-cells have the receptors for the proteins coded by those genes, whether those body-cells actually act upon those receptors, whether particular hormone levels are enough to trigger certain actions in the body and - in the end - all kinds of other factors.

There's no such thing as XX/XY being the sole determinant of your biological sex. For a start, things can attach to XY instead of XX and vice versa, XYY and XXYY and things like that exist, and those two chromosomes are far, far, far from being the only things that modify your physical sexual characteristics, your genitalia, your fertility or any number of other visible, measurable indicators of your biological sex.

XX males and XY females are perfectly possible.

1-2 percent of the world are biologically intersex. That's the same proportion as diabetics, red-heads or epileptics.

If you know a red-head, or a diabetic, chances are you know someone that doesn't fit the standard school biological sex model. And for every 100 people who "think they're male", there's a chance that at least one of them is genetically / chromosomally / hormonally not - even if they have perfectly ordinary and functional genitalia indicating otherwise.

Now, how do you think that affects the *gender* that people have, if the biological binary determination you were taught in biology is actually so wrong?

It's never been as clear-cut as you were taught in school, same as it's never been true that an atom looks like you've been told it does.

Treating it as some kind of modern hippy fad, where people get to choose who they want to be (oh, what a crime!), is really quite a 1950's way of thinking.

Lee D Silver badge

AI given a 50-50 chance of correlating a piece of information with a gender.

Gets it wrong so much they turn it off.

Pretty much sums up the state of the field to me.

In the market for a second-hand phone? Check it's still supported by the vendor – almost a third sold are not

Lee D Silver badge

Re: LineageOS?

LineageOS's problem is not volunteers.

It's that you need intimate and hardware-level knowledge of the device, with suitable drivers, complete functionality, access to secure bootloaders and boot partitions, several devices of each type to test with (okay, they may be able to help there), and lots of potentially-damaging experimentation to get to the point that you can *see* anything on the device, let alone make all the third-party components like cameras, etc. work properly.

LineageOS doesn't really fully support many models at all, and the ones it does are essentially random based on hardware support and software driver availability. Do you have a driver for an obscure, Samsung-phone-only part that only exists in one phone and provides, say, fingerprint reading via the secure enclave? No? I'm sure we could just ask Samsung for it...

LineageOS is a LOT of hard work. No way that even a commercial entity is going to be able to fund or help that in any significant fashion, especially not for even a handful of models going forward onto years-in-the-future OS which won't really work with you (Google aren't going to help out LineageOS any time soon, because then they'd lose control of Android).

It's like Coreboot and other things along that ilk. Complicated. Technical. Working in the dark. No support. Never fully supporting everything. Hindered by basic security. Able to trash the machine permanently at the first mistake. Undocumented.

Throwing a couple of old phones, and even funding a couple of people's salary to do it 40 hours a week, isn't going to make a dent in it.

I have a LineageOS phone. I did it to my S4 Mini, which has a great IR blaster, which I use to turn my gadgets on. That's it. The camera is unreliable, the Wifi isn't great, some of the features don't work at all, and it's 3 or 4 versions of LineageOS behind now, and even then it's "unofficial" LineageOS from a forum post that I didn't care if it worked or not as the phone was headed for the bin anyway. It's never been updated since.

Pretending that LineageOS is the solution to this is crazy. It's just a bunch of amateurs hitting on Android code trying to get it to load on devices without any support whatsoever. They are just as far behind on security updates and OS updates on many models as the official Android for that device, and take out your warranty etc. in the meantime.

There's no business interest there for a reason. They'd end up with a bunch of LineageOS'd phones that were still out of date and couldn't be updated, but where several features of the phone didn't work at all, and they'd be "responsible" because the base Android could have supported them - so when are you going to fix it?!

'I'm telling you, I haven't got an iPad!' – Sent from my iPad

Lee D Silver badge

School IT revamp.

I literally upgraded (and therefore wiped) every client and server.

Obviously, before this, I took copies of absolutely everything. And did things piecemeal over the summer. And even went to the extent of copying/imaging/removing old client drives before doing so or as I went. People stored stuff in silly folders and something they didn't hit their network profiles and one of the things I was upgrading for was a better version of Windows that handled users profiles on a network in a better fashion, so we were killing that legacy but needed to be sure we'd got everything.

One teacher, upon their return, was subject to a subject audit - the big bods go through their teaching and make sure they're compliant with the curriculum and so on. Strangely, at that point, she claimed she'd lost "everything" (even by her admission, that's a handful of files, but anyway). So I "must have wiped it all when I upgraded". The saga went on for a few days, while I explained that we'd wiped nothing that we didn't have copies of, and provided what I had.

No, apparently those things were still missing. I was obviously stupid and had deleted it all. All her stuff was there. I was causing her stress. She couldn't go through with the audit without those files, etc. etc. etc.

So I reached into my filing cabinet and - stacked among several hundred others - was every hard drive from every computer and every server. Pulled, labelled, stored just for such instances. Yes, the "upgrade" didn't wipe anything at all. Not one byte. I'd put new drives in everything, and pulled the old ones, carefully labelling them with their former location, PC number, and who used that PC. And I know that, because I did the entire upgrade single-handed, so not one computer got upgraded without that happening by myself personally.

Strangely, that drive didn't have her claimed files either... shocking! It was at this point that, having a boss who understood IT, there was some hefty backtracking and she "found" what she was missing, and the saga blew over.

Until a few days later, when she claimed that I was blocking websites and they were critical to her department review. It was odd, because I didn't block anything manually unless asked, it was all auto-categorised. And teachers pretty much got an exemption (their web history is recorded and flagged, but it doesn't block pages for them like it does the kids). I asked her to send me the address. She sent me her department curriculum planning document, which is something that every department keeps and contains all their ideas for teaching, what resources, etc. Obviously, that often now includes a web link or two.

I clicked it. The site was dead. I told her "that's not us, the site is down". She made such a fuss, she went straight to the head and complained that I was blocking things she needed to "do her job", etc. etc. etc.. So I investigated. No DNS resolution for it. I poked around, looked up WHOIS records. The domain had expired TWELVE YEARS prior. No other website had ever sat on its domain. Archive.org provided a lovely timeline of updates, ending promptly at the point of domain expiry all those years prior.

I presented this to the head and there was a ruckus. Because that website was in her curriculum plans for the last 15 years, and it hadn't existed for at least 12 of them. And she insisted that she'd been using it all that time, which was technically impossible. She couldn't provide any evidence that she'd used it, we had years of web logs, the kid's accounts had no traces of anything from it or work like that.

She'd basically dropped herself in it twice, in quick succession, and shown everyone that she hadn't been doing her planning for all the time she'd worked there. There was a huge fuss. I don't know/care what happened because they accepted my evidence, and I left shortly after, but last I heard she was being made the "Head of VLE". The day I left, she asked me what a VLE was (virtual learning environment - a website where teachers post resources, homework, kids log in and grab them and submit them back, teachers comment on them, etc. etc. etc.). "That's like Google, right?!" she asked. Yeah. Just like Google. Bye.

Modem life is rubbish: RootMetrics 5G stats show EE has widest UK coverage, but Three is the speed demon

Lee D Silver badge

Re: Someone forgot the one thing that actually needed fixing

"Since upload is pretty much all that matters to a mobile user, it almost seems like a downgrade. Seriously, we all upload videos and photos to Facebook, Twatter, the cloud etc "

You have strange ideas about most people's use of the Internet or, indeed, their phone.

I work in IT (obvs), and I couldn't care much about my upload. I mean, it has to have some, but ADSL was asymmetric for a reason... people's use is asymmetric.

I have two 4G connections, one on my phone, and one running my entire house (given that the broadband is so shite I didn't even bother to take out a BT line when I moved into this place). Both unlimited data. I don't suffer at all, mobile-wise or when at home. I game, I upload photos, work remotely, hell I even stream HD TV from my home (via tvHeadend, a RPi and a DVB-T2 hat for it) to my phone and watch it routinely.

And I upload to Facebook / Twitter maybe a picture or so every now and again. What's that? A couple of meg of data? Videos take longer for them to process than to upload. And it's really not a huge part of my life at all. If I did a video once a day, I'd consider that excessive. And my connection would perfectly handle it without very much inconvenience at all (it's a mobile... I say upload... I continue going to work or whatever I was doing, and it uploads while it's in my pocket wherever I go).

Honestly, though your ratio is less than you'd expect (about 8:1 is right), it's really not going to be detrimental to the vast, vast, vast majority of people - even those working from home and videostreaming in... what's that? 1Mbps? Maybe 2.

YOU... SHA-1 NOT PASS! Microsoft magics away demonic hash algorithm from Windows updates, apps

Lee D Silver badge

If they had half a brain, they'd simply sign everything with SHA2 in a *different* field. And continue to do that for whatever algorithms they switch to in the future.

Then, even with old obsolete programs, the chances of a file not only being maliciously crafted to match the SHA1 of a file, but also its MD5 and a CRC and whatever-else are increasingly slim, and things that only check other hashes would continue to work as normal. This would then allow a smooth transition where at no point did you *need* to suddenly re-sign everything you use, but could slowly move over and additionally-sign them with SHA2 as time goes by, and legacy clients would be "vulnerable" but still work.

But, of course, they won't.

Then, even if someone found a SHA-2 collision, the chances of it also being able to collide its SHA-1, MD5, CRC, etc. *as well* with the same malicious file are infinitesimally small, especially when they are entirely different algorithms.

Reply-All storm flares as email announcing privacy policy puts 500 addresses in the 'To' field, not 'BCC'

Lee D Silver badge

Re: mail client

Yep.

But the fact is that such a group is just a disaster waiting to happen while it resolves in ANY field.

If someone puts "everyone" in the To:, expands it, and it jumps into the BCC: you're going to have user's complain. If someone put "everyone" in the To:, expands it, and it expands into the To:, then you have this problem.

If you warn that there are outside entities in that group, people will ignore/disable the warning. If you warn that the email is going to more than X people, people will complain/ignore/disable the warning.

It's fundamentally not a tech problem. The computer does what it's told, precisely. What you want is a computer that second-guesses the humans, which almost always results in it being wrong and getting turned off.

What you *need* is a computer system where the decisions available to the humans are few and far between. There is no *technical* reason why you couldn't send literally every email ever using only the BCC field, and that replies still go to all those people, but nobody knows who those people are except the original author (via a conversation tracking), and then setting BCC as a global default. But then people will complain that they can't see that "boss" was copied in and you dropped them in it by doing that. And they'll complain that you could be copying it into outside entities, and so on.

This isn't a tech issue. This is a process issue. And the process of sending out hundreds of customer emails in an office email program is the process problem. It just shouldn't be happening. But millions of businesses worldwide run that way "because we always have" and you can't fight that.

20 years from now, like I said 20 years ago, we'll still be having CC/BCC/reply-all errors. Because it's the human process of even attempting it via that method that's in error. Not the quirks of a particular program.

Lee D Silver badge

Re: mail client

Trouble is that sometimes people demand that.

I work in a place with 100+ employees. There is a mailing list for when *everyone* needs to know something (e.g. regulation change, site closing, covid, etc.).

As such, one email "name" in Outlook - that group - expands to 100+ people instantly. Include several groups and it grows and grows.

Now, those are strictly internal, but if you're in that pattern of working, then you start to creep outside people in (we have outside-domain people on our list now, for contractors and suchlike). And eventually you get used to using it for everything and use it for outside people.

So you can put all these limits on, people will just turn them off because they stop what they want to do. And you can't whitelist "@domain email only" or whatever, because that won't work either. And you can limit the number of people in an email and then when the boss has to shut the site or send everyone out their covid info to all their outside customers, it'll get turned off because it got in the way when time was of the essence.

This isn't a technological problem. There's plenty of tech to take account of it, and controls in almost any tech capable of doing this. The problem is human, as always.

I know in my workplace, the "everyone" email address is over-used for all sorts of junk, and I've warned about the "feature-creep" of such facilities many times. As people get used to receiving them, and sending them, you'll get misuse of them, then someone will Reply-All by mistake, and you'll have a huge spam problem, then everyone will ignore/filter those emails because they're now junk, then they'll miss an important message, then everyone will get told to read ALL emails, then you'll wonder why nobody has any time, and so on...

My biggest question, for the last 20 or so years, is really: Why are you contacting customers direct by email. Why is the person behind the Send button even aware of their addresses? Under DPA and now GDPR, we've clarified that you need to have access to the information necessary to do your job and nothing more. Does the person who sends out these email *need* to know the email address of every customer? No. They need to have a database with them in, obviously, but they don't need to actually see them unless they are verifying the customer's details.

So why is it not the norm that such things are handled via a CRM, where you send an email to all customers who purchased product X in the last 5 years - you have no need to know who those people actually are, or what email address they've chosen to give you. It's somewhere in the database but you, the person sending the email, don't need to know it. So your Send button should be in the CRM, you need to know how many it's going out to. You or someone else *could* interrogate that list, if necessary, but you shouldn't ever be putting those addresses into a list and then into an email client and then into a To: field or a CC: field. It just shouldn't be done.

It's then trivial to prevent these occurrences, and as a nice side-effect you have a perfect barrier against a rogue agent stealing your customer database, against compromise of a desktop meaning that all your customers are at risk, etc.

I've always said the same about call-centres. Why do they have my full history, addresses, phone numbers, etc. just the second I phoned up? It's not necessary. And they could just have a ton of fields and then literal "request" buttons on a field if they need to see it. Then all the problems with misuse of such databases evaporates.

I'm a proponent of the idea that such workers should really never have anything more than a set text menu of options available to them, not an Excel of email addresses or whatever. Press 1 to amend customer details, Press 2 to view customer orders, etc.

There's no way that someone should be able to get a list of your customers email addresses and just throw it into Word mail-merge or screw up like this.

Amazon and Google: Trust us, our smart-speaker apps are carefully policed. Boffins: Yes, well, about that...

Lee D Silver badge

Top tip:

If your device has a microphone, it's entirely a trust issue about what's happening to that data from that microphone.

If it does not have a microphone, then it can't record sound.

If you don't put this stuff in your living room, then it can't do things.

Microsoft wants to show enterprises that Edge means business, rather than the thing you use to download Chrome

Lee D Silver badge

I dunno, but can you stop bundling it into Windows Update and then force-installing (despite previous uninstallation) and then making itself the default browser?

Otherwise I'm just going to have to track down that nice woman at the EU again, because I've had a Windows 10 laptop for precisely days and it's already pissing me off.

No choice - turned on machine, it was installed. I uninstalled. I rebooted. Windows Update put it back on, pinned to taskbar and had it try to steal my default. Uninstalled. Few days later, another batch of updates. Rebooted. Same thing.

I wouldn't mind but I have literally no intention to ever use it, ever. Stop it.

I've spend the last few days doing nothing but researching how to turn off self-pinning apps (an XML file in your user profile can force them back on every reboot, apparently), apps that load but don't appear in startup, and apps that want to be in the taskbar for no discernible reason. And uninstalling crap I will never need, and if anyone knows how to move/rename the Windows Administrative Tools folder, I'd be most grateful, it's messing up my career-long folder organisation of my start menu (Yep, Open Shell, because that other thing is just a heap of junk to try to use).

Microsoft tells AMD-powered Insiders they're unblocked in new Windows 10 Dev Channel build: 'Oh no we're not!'

Lee D Silver badge

Re: the much-vaunted Eye Contact feature

And would be solved in a second by the "Raise My Hand" feature which puts a flag on the speaker's screen so they know who's waiting to talk.

Most videoconferences don't actually need to show video for most participants at all. Two-way, you want both people to see each other. When there are more people and one's talking, maybe the previous speaker needs to be shown to the current but it already switches to the active speaker. Everyone else, that's just pissing bandwidth away.

Shocked I am. Shocked to find that underground bank-card-trading forums are full of liars, cheats, small-time grifters

Lee D Silver badge

Re: Colour of surprise

Quite.

"Oh, that criminal who was going to sell me a thing to help me commit crimes actually committed fraud and took my money and didn't even give me the thing in return!"

Oh, no. You should go to the police. Oops. You can't. Because what you wanted was illegal in the first place and you were just dropping yourself in it.

I do wonder, though, how they paid them - presumably such payment is Bitcoin or something. I doubt a card-skimming forum would accept credit card or Paypal!

It's like a drug dealer selling them talc. What are they going to do? Dob him in? And face a charge themselves?

Nvidia may be mulling lopping Arm off Softbank: GPU goliath said to have shown interest in acquiring CPU design house

Lee D Silver badge

Merging of CPU/GPU looks to be the only real reason.

AMD is basically ATI/AMD.

nVidia is out there, usually paired with Intel.

Apple is incorporating everything onto an ARM chip and abandoning Intel.

Seems like nVidia/ARM could well be a very powerful combination, bringing proper GPUs to computers and well-established ARM to the fore.

I doubt they can afford it or it would work, but nVidia/ARM (strong GPU, strong CPU) against Intel (rubbish GPU, strong CPU) and AMD (strong GPU, strong CPU) seems to be about the only thing to stop them eventually becoming irrelevant - especially in the mobile/tablet area which they only dabble in (nVidia Shield being their most successful?).

And I say that as someone who just bought a nVidia/Intel gaming laptop that I'm in love with.

Apple to hand out limited-edition iPhones among 1337 h4x0rs because it wants more bug-hunters

Lee D Silver badge

Re: Cognitive Bias?

The last round of hacking on Apple's phones managed to find a remote flaw in browser parsing of a simple website, caused by all kinds of things that just shouldn't be possible - not just technically, but procedurally - that allowed a Mac, iPhone and iPad compromise of the browser to illicitly enable the camera.

https://www.ryanpickren.com/webcam-hacking

This included allowing websites to download arbitrary files, then treat those files as trusted local file: or about:, blob: or even data: protocols (!!), letting you load javascript from them, thus bypassing security permissions, along the way discovering that domains with .- or -. in their name don't appear in the permisisons dialogs, you can do popups and even force a browser password autocomplete, and abuse window history to play clever tricks.

The problem is not the bug you suffer from. The problem is the CLASS of bugs you suffer from. Because they indicate the design of the system, rather than a tiny incidental oversight. It's not an oversight to do the above... it's a completely thoughtless design process. Which is the opposite of security.

As with everything Apple that I've ever touched - design for them means "designer", not good design, not easy-to-use, intuitive, sensible, planned-out, functional, etc.

Capita's bespoke British Army recruiting IT cost military 25k applicants after switch-on

Lee D Silver badge

Re: Why haven't we banned Capita

CANCELLATION CLAUSES and PRESCRIBED METRIC TARGETS (e.g. number of job applications handled by the system, percentage of applications experience technical problems, etc.).

Why does nobody put them in?

You didn't deliver, contract is null and void, you get nothing. Want to get paid? Make it do what you promised.

Computer misuse crimes down 9% on last year in England and Wales, says Office of National Statistics

Lee D Silver badge

Go tell that to your local drug rehabilitation centre.

If you can read this, your Windows 10 2004 PC really is connected to the internet no matter what the OS claims

Lee D Silver badge

https://en.wikibooks.org/wiki/Windows_Troubleshooter_Guide/Network_Location_Awareness

"Note that sometimes, you might get a yellow warning sign/exclamation mark indicating that you have no internet, yet can connect fine. In this case, judging by the above cases, it should mean that #2 failed but #1 works."

That suggests that this would be caused by DNS issues on that given domain.

(Although someone could check Windows 10 2004 if they like and see if that registry entry points somewhere other than the two known values).

It does seem incredibly stupid to have the entire world check a text file on one website to see if they are online or not. That's one of the reasons I changed mine to my own server.

Lee D Silver badge

I think this sounds like MS has changed the NCIS methods they use.

It always used to be that they would try to connect to a given website (www.msftncsi.com, owned by MS) and download a text file whenever it detected a new connection (wifi or Ethernet). If that didn't work, the connection was "limited" instead of "Internet". I know, because in the registry you can change the given website and then use it as a primitive (and completely invisible) monitoring of your devices. If a thief is silly enough to turn it on, it'll connect back to your website and your Apache logs will tell you the IP where it's at, and additionally if that server goes down you'll notice because your Windows PC will say that it's not on the Internet when it clearly is!

In Windows 8/10, they changed the website and the text file and the contents of the text file. That's why you see a ton of connections to msftconnect.com or something... that's every machine on your network trying to see if they are on the Internet or not. It also triggers proxies to prompt you to login, so it does serve some purpose.

I bet either that domain is having problems, they've changed the verification again and it doesn't work the same, or they simply broke the NCIS protocols in the background.

Philippines to install 23,000 free public Wi-Fi hotspots

Lee D Silver badge

$6700 per wifi point.

Makes me wonder what they're deploying and what they're connected to.

Twitter hackers busted 2FA to access accounts and then reset user passwords

Lee D Silver badge

GDPR lawsuit in 3.. 2... 1...