Posts by Lee D

Lightning struck: Apple switches to USB-C for iPhone 15 lineup

Re: Thank God for fast forward..

My previous two Android phones (4 years apart each) both supported USB 3.0 and so many devices by default that it was basically a PC. Apple still don't support USB3.0 on their low end models here.

Samsung themselves even make a thing of this with DeX, which when it detects any screen automatically makes it into a "desktop" Android OS. It's been in the OS for years, DeX is just one implementation to make it a bit prettier.

And I've been able to connect USB / Bluetooth mice (and you get a cute little cursor immediately) and keyboards alongside the touch/OSK since the days of my Samsung Ace series cheapy-smartphone.

Currently my phone has free software for full SDR functionality (including dump1080, SDR app, airband receivers, FM radio and DVB-T receiving apps), one for all webcams (and even some antique and difficult-to-drive ancient models via a very cheap paid app, including a snake-cam and microscope I bought 20+ years ago), and I carry a tiny USB-3 hub with Ethernet, HDMI, VGA, SD-card, etc. that "just works" on Android and has on every phone I've tried... except all but the most recent Apples.

"already has support for network and cameras" is a laughably "recent" addition for Apple compared to just about any other smartphone, even the iPhone 11.

Yet again, Apple just cripples a phone on release and then finally lets you "use" those standards at your own expense much later if you buy adaptors or upgrade.

Re: "can reach out for help when there's no cell signal coverage over satellite connections"

I've been able to send signals to a satellite for 20+ years from a device no bigger than a matchbox.

The Register used it themselves for weather-balloon and other projects.

In those 20 years, mobile phones have come into their own so I'm not at all surprised that it's possible, especially given as this isn't the first generation of phones to feature it.

It's just a very short emergency "high-power" data message on reserved frequencies, not a phone call.

Iridium is so old that the kit you're talking about is basically obsolete nowadays.

Linux 6.6's in-kernel SMB networking server graduates

Nothing says "kernel-level compromise" quite like putting an antique, backwards-compatible user-facing network service into the kernel for performance reasons.

Especially when for decades it's been a user-level application with numerous protocol security problems but otherwise without major issue in terms of operation or performance.

Did we not learn from IIS?

Windows August update plays Blue Screen bingo – and MSI boards got the winning ticket

Re: Gee

You're cheaper than a suite of beta testers.

And you pay them for the privilege.

Microsoft calls time on ancient TLS in Windows, breaking own stuff in the process

"Most of us" would then utterly fail any kind of cybersecurity review, which is required for workplaces as basic as primary schools nowadays.

Re: This will be fun

There are still mainstream UK banks insisting that you have to do all your millions of pounds of bank transfers via Internet Explorer, so I'm not surprised.

To the point that they just point you at a PDF on their main website which basically says "Get your IT to re-enable it" including "after 30 days the security settings will revert, so you'll have to put them back every 30 days".

So you have to have a smartcard, double-authentication via two separate entities, getting a card is almost as difficult as opening a bank account in the first place because of all the authorisation you have to get, but then you have to plug it into a Gemalto reader for which they will only give you IE plugins to access it (despite Gemalto having Chrome, etc. plugins for everything) and won't support any alternative.

Ran IISCrypto last year and enabled it's best practice mode on all the servers on my new workplace.

Who the hell relies on early TLS still? And Microsoft doing it now "because usage has fallen to an acceptable level", in essence? How ridiculous for an outdated and insecure security-based protocol with a clear path to replacement/upgrade for years now.

CrowView: A clamp-on, portable second laptop display

Almost every laptop I've ever condemned to the "cannot economically repair" bin has been breakage on the screen hinges.

This just adds for more weight, in a lop-sided manner, to what's supposed to be a portable device.

Nope. If you want this, buy a separate monitor - small portable ones are cheap - and never attach it fully to your laptop screen, because you simply don't need to.

What happens when What3Words gets lost in translation?

Do you know why ISBNs were designed specifically differently to other barcodes?

It's because you can transpose any two digits and the ISBN will still work. To counter the most simple human error seen when entering book numbers manually.

The same way that you know the code of any ISBN barcode is faulty if it doesn't total up to a multiple of 11 (where any X is taken as 10).

You can design systems to cope with errors. You're literally using probably a hundred different checksum and ECC and error detection systems just putting your post on this page, at every level from your keyboard up to the website's database's multiple storage drives.

If you want a resilient system, you can easily build one where it doesn't matter if people get 5 out of 10 numbers wrong, you would still know where they are. Literally you can choose the number of errors you want to correct and that'll determine the size of the final code and almost all such codes are not prohibitive. We literally use the exact same system to take to Voyager spacecraft where some countless thousands upon thousands of errors can occur in every megabyte of data transmitted and it'll still get through in an understandable way where you know it's correct.

W3W has *SO MANY* flaws that it really shouldn't be taken seriously.

Lat/Long or OS are long-standing, standardised, royalty-free and "just work", and you can do it in a foreign language (I know the German, French and Spanish for the numbers 0-9 without even trying, all I'd need is the compass directions and possible "minus").

But if we want a resilient system, random numbers or letters would actually work far better - even just a small bunch of alphabetical characters could do a better job than W3W, could be transmitted with the NATA phonetic alphabet or Morse Code, and just one or two extra characters would greatly enhance its resiliency in the cases of tranmission or transcription errors.

It's literally an afternoon jaunt for any mathematical student averse in Coding Theory, with a dash of geographical coordinate systems, to code up a solution to all the problems there.

But when Lat/Lon (international, standardised) and OS (UK only, standardised) are staring us in the face, there's really little need to do so. Transmit both. Transmit one and your approximate location. Or just read it twice.

But the problems with W3W go far beyond confusingly similar symbols (not something that Lat/Long or OS suffer from), and it really should be put to bed as anything but a gimmick to get your pizza.

Tor turns to proof-of-work puzzles to defend onion network from DDoS attacks

We were talking about allocation of money, for which exit nodes would be a good candidate to spend money on.

Tor exit nodes are expensive and difficult to run, and Tor operate several of their own.

Not everything can just happen "for free" especially when every ISP and host is rejecting Tor exit nodes, especially when they're being DDoS'd all the time.

Using the money to set up or fund exit nodes would make Tor vaguely useable rather than the slow mess that it currently is.

'Millions' of spammy emails with no opt-out? That'll cost you $650K, Experian

Good, can they look at Santander now?

All kinds of crap posing as "service messages".

Internet Archive sued by record labels as battle with book publishers intensifies

"The real idea of this is preservation, research, and discovery,"

None of which allow them to REDISTRIBUTE their captured material.

Hell, they host entire MAME ROM sets which have seen all kinds of places taken down, entire BBC series, etc.

It's fine to "archive", it's not fine under current law anywhere to then put all those archives online for absolutely everyone in the world to download without limit or permission.

There's a big difference between being something like the BFI or the British Library, and just being a torrent dumping ground of anything people like.

Ford SYNC 3 infotainment vulnerable to drive-by Wi-Fi hijacking

Re: firewalled

I can't speak for Sync 3, but Sync 2 (which was ironically Windows-based) actually is isolated.

There is no information from the driving computer (e.g. speedo, mileometer, etc.) that propagates into the Sync 2 system anywhere at all. Even the controls on the steering wheel are separated - cruise control etc. on the left,and entertainment volume, phone etc. on the right. You have the clock on one but not another, the GPS on one but the instrument speedo on the other, and so on.

The Sync 2 handles bluetooth, wifi (for sharing local connections only), satnav (entirely offline) and - oddly - aircon and as far as I know contains no connection to the car's buses. If you want to replace the Sync 2 with Android units, you basically have to plug in an OBD adaptor to get anything like that. You don't have to plug in to control aircon, for instance, but you do if you want OBD information.

Given that you can upgrade the Sync 2 to the Sync 3 in many models, I would suspect that this is actually the case going forward too, unless such an upgrade involves a far more drastic rewire than people are letting on.

And I have personal experience of the Sync 2 because I had the unit fail on me while driving. At first the music was skipping and being odd, then I lost control of the entertainment. Then the unit powered down and I lost aircon. But at no point was the dashboard computer (the one behind the steering wheel that handles and displays MPG, driving settings, etc.) affected, and nor were any driving functions.

Turned out that the SD card just needed replacement, but the whole entertainment system just bugged out and fell over, while I was driving along happily.

Apart from that one incident (resolved with a non-corrupt SD card), it was pretty solid.

But Ford Sync has been through a number of iterations now - QNX, Windows, etc. I'm just going to leave mine on Sync 2 until the car dies, I think. I don't even really use the satnav any more as it costs £150+ (or some piracy) to update the maps and they only surface once every year or so. They can't quite seem to get it right and I don't think throwing it all out and starting again each time is helping.

That said, it does everything I want it to do which is connect to my phone, play music, turn on the air-con and get out of my way.

Scientists strangely unable to follow recipe for holy grail room-temp superconductor

Seems to be largely hyperbole at this point, and for a material that was actually created 24 years ago.

All the created samples appear to be miniscule as well, which seems odd for something that uses basic materials.

As with all science - until you can reproduce it independently, it's at best a fluke or misreading, at worst a fraud.

Selling it as a room-temperature superconductor, especially, appears to be largely nonsense. And diamagnetic properties are hardly rare.

Like with every battery-technology claim, every "AI" claim, every super-material breakthrough - until it's literally a commodity item (even if that commodity is a £1m per sample thing sold only to labs), it's basically just hyperbole.

'Weird numerological coincidence' found during work on Linux kernel 6.5

Re: The what?

Same department as awaits responses from Apple, so it's unlikely anyone ever hears them at all.

NASA mistakenly severs communication to Voyager 2

Re: Talk it up

They'll still call it fibre.

Tesla's Autopilot boasts, safety probed by California AG

Re: Autonomy

No, the moral of the story is always let some other poor sap buy the car first, test it for you and discover and deal with all the problems, then research your purchases accordingly before parting with 30k+ of your money.

At no point was it ever full autonomy. Ever. Not even for a microsecond, and then later revoked. You bought a sales "promise", from a car dealer, with absolutely no way for them to deliver on it. And, hilariously, you bought a promise that this car would do something that no other car has ever done in all of recorded history.

I have no sympathy, but I am very grateful that someone is now taking this up from a consumer-law point of view because it's years past that point and Tesla are still getting away with fraud.

TETRA radio comms used by emergency heroes easily cracked, say experts

Re: Spectacularly irresponsible.

Maybe they should stop just throwing money, lay down a specification, and engage a company in a contractual agreement to deliver it.

Other countries around the world don't seem to have this problem. Ask them. Engage their people.

It's because the politicians can get their 10% repeatedly if they sign up a company every year, then get about 10% when they renew with the old system (at zero cost to the manufacturer, but at significant markup because "well, we were going to retire that, but we'll keep it running another year, but it'll cost ya!"), then get to call out to tender again, sign another dodgy contract that doesn't penalise non-delivery, change the spec just at the right time so the new guys pull out because of costs, etc. etc. and repeat ad infinitum.

It's a government IT project, and it's failing because it's a government IT project. There's really nothing difficult here, even if you produced a hybrid system that did BOTH Tetra and whatever you wanted to move to.

One investment in new kit... no investment in infrastructure required to use it... then as you build up 5G (or whatever), you don't need to replace the kit... you just keep using it. And if something goes wrong, you still have the other to fall back to! And twice the capacity.

Specify that properly, put out a government contract, and write proper delivery clauses. Watch the Tetra people run around like loonies in case a rival delivers a product that can do that and make them obsolete within a couple of years.

Re: Spectacularly irresponsible.

The services were all at risk anyway. This is just the first lot to actually legally and publically look into it, after the EU asked them to (obviously suspecting that there may be flaws).

You think the criminal gangs that are hacking huge cloud datacentres don't have a few guys who could have done the same at any point in the last 20 years (bear in mind, these researchers had no info or assistance so had to reverse-engineer everything just the same!) and the whole thing been compromised for decades?

It's not a Heisenberg radio. It's not "secure until you actually look at it". And it's definitely not "secure until someone with good intentions looked at it". It's insecure, by design, and has been for many, many years.

Without exposure, that would NEVER change.

TETRA and similar systems has been posited for replacement for decades, as far as I remember, and huge amounts of money spaffed on obtaining replacements but then falling back and just renewing the system for yet-another-year. The only way to actually get them secure and move into the 21st century is to show that the old system is not just "archaic but viable" but that it's entirely obsolete, insecure and unfit for purpose. And, probably, always has been.

Framework starts taking orders for 16-inch repairable, upgradeable laptop

I looked at one as soon as they come out, as a replacement of a gaming laptop that was no longer supported by the manufacturer and had a bad firmware update (the timing seemed perfect, I was willing to drop money).

As soon as you load the GPU onto it, the price goes beyond what I would reasonably pay for such a thing (and I own a gaming laptop!) before you even get into the same amount/speed of storage, RAM, etc.

Also, the modules are a bit... well... limited. 6 modules on this model (I think it used to be four) and two of those are a single USB-A slot, and a single USB-C slot. One for Ethernet. One for HDMI. One for microSD. Sure you can change them, but the modules should really be things like 2 or 3 USB slots, not just one. Hell, one module is nothing but a 3.5mm audio jack. By the time you get it back to a "normal" laptop, there are no slots left. You can argue that you wouldn't use the microSD all the time, maybe, but if you thought it important enough to order the module then surely you use it quite a bit and not just as an afterthought. Why not microSD, plus SD, plus maybe another USB-C on one module? I think few people are going to be carrying it around with a bunch of spare modules at £20 a pop (so it's £120 just to populate the basic ports!).

It's a great idea but it needs more, and it needs to justify its price. I have a friend it would be ideal for, but it still needs more to entice them beyond dropping the same amount of money on a more mainstream laptop that'll actually have more connectivity. And if you're carrying around modules (okay, they're USB-C connected but they're still non-standard), you might as well just carry around cheaper more generic adaptors.

Linux lover consumed a quarter of the network

My old university used to gauge people's internet usage by the amount of local storage they were using.

They didn't have the kit to monitor the BLINDINGLY fast connection of the day (I think 100Mbps), and so they weren't able to monitor usage directly, so they correlated it to those students downloading tons of stuff and keeping it on their account.

Every few weeks, they'd send out an email of shame to everyone naming the people using the most local storage, and next week those people would have cleaned up and taken the slap on the wrist.

Except... if you looked, the emails were always generated from data produced at a certain predictable date and time. Obviously some scheduled task or cron job somewhere.

I managed to go three years, in which I knew I was literally trouncing everyone on the name-and-shame list, by the simple precept of removing all the downloads the day before the script was scheduled to run. That sometimes meant an evening with a bunch of floppy disks (and later ZIP disks), and an intense familiarity with the PKZIP command line options for spanning disks, but I would pack all my stuff up, go home and "download" it to my machine, clear out my university storage, and then repeat over the next week.

They never seemed to cotton on, and I was literally orders of magnitude more downloading and storage than those on the list, and I never made it onto the list personally. Not even once.

But when your only home connection was 56K dial-up, then "sneakernet" to a 100Mbps location and the cost of a box of disks was actually far superior, even if it required far more patience (especially if I got home and the spanned set had a failed disk!).

Also, because of the loss of the storage on a regular basis, I would later make a bunch of CD-R copies (at 1x speed!) so I didn't have to download things again. I still have them. They all still work. I would burn them in pairs so I had two copies of everything.

Including one that, the day I burned it, failed verification when it was read back. It's copy burned absolutely fine, no problems. When I looked, a single byte was incorrect in a single file. I attached a post-it to the CDR with the hex address and what the byte should read.

To this day, if you load up that CD-R, hex-edit that one file, change that one byte, the archive passes all tests and opens and give you the files inside perfectly intact.

Tesla's Dojo supercomputer is a billion-dollar bet to make AI better at driving than humans

Re: But will it be clever enough

Name a RHD country that would allow this product on the road. Pedestrian safety laws rule out UK, Australia, NZ, etc..

Throwing a billion monkeys at a billion typewriters does not make an intelligent end-product.

And in this case, the monkeys aren't even sentient themselves, they're just mechanical automaton monkeys.

This is the same problem that we've had since the 60's. Neural networks, AI, etc. etc. etc. - and the answer is always "if only we had more computers, more computer time, and just left it running for longer processing more input, I'm sure that somehow it will magically become intelligent".

No. It won't. If it did, Google would have had the best AI in the world about 10-15 years ago. Or even Amazon.

Brute-force and ignorance is not the seed of intelligence.

Slackware wasn't the first Linux distro, but it's the oldest still alive and kicking

Best part:

No systemd.

Lawyer sees almost 1,000 complainants sign up to Capita breach class action

One day this is going to happen to Azure, AWS or Google Cloud.

I believe it's already happened to places like UKCloud and Rackspace.

I don't know why anyone would ever think that it wouldn't. But if we don't punish this one, then when it all goes wrong everyone will go "Oh, who knew?! Maybe we should do something about it for next time?". Capita need to be made an example off to try to head off an actual, proper, serious cloud breach.

Tesla to license Full Self-Driving stack to other automakers, says Musk

Re: improvements happen on a logarithmic curve

It's worse than that. He's talking nonsense. What he describes is not a logarithmic curve. Those plateau to a flat line.

He might *MEAN* exponential, I guess (those grow faster and faster and faster and spike upwards). Or he might mean that progress will constantly become even slower over time (logarithmic).

But worse than even that... This is "AI".

In which the gains after initial training plateau to nothing.

One million data points and it (erroneously) still think it's appropriate to turn left here? It's gonna take one-million-and-one contrary but similar data points before the algorithm starts modifying its behaviour of its own accord. Repeat ad infinitum. Or add in a ton of human heuristics at which point, you're basically just programming it yourself.

AI plateaus, which means the curve is logarithmic. Which means improvements are impossible beyond a given point, because all progress stagnates and flatlines no matter how much time, energy or money you throw at it.

Re: Attempting to Outsource Potential Legal Liabilites

This is the problem - until a car company steps up and says "Our car is the driver, hence our driver is the one insured, hence the human *passenger* doesn't need insurance and all claims and responsibility go through us", then you don't have a self-driving car.

And when that happens... can you IMAGINE how much that's going to cost the manufacturer in an area that they simply don't have to deal with.

And, no, they can't just necessarily pass the buck, because it'll mean every Tesla recall also becomes a Ford recall.

Either Tesla would be bankrupt - from the number of recalls, plus the manufacturers who licenced it suing them into oblivion, or from the sheer amount of claims against them - or they'd have to not accept any responsibility (in which case, we're back to square one... "you can licence the software from us, but it's on you if it kills someone").

Until there is a blanket insurance on a vehicle and it's ACTUALLY the responsibility of the manufacturer as to whether or not it runs over small children, self-driving is just nonsense.

And that's a business proposition that I can't imagine ANY manufacturer wants.

First of Tesla's 'bulletproof' Cybertrucks clunks off production line

No RHD variant as there are almost no countries with RHD that will allow it on their roads due to pedestrian safety requirements.

A car that's literally illegal by design in half the world (pedestrian safety requirements).

Yeah, this guy's a genius.

Microsoft 'fesses to code blunder in Azure Container Apps

Re: they interpreted this as a configuration change ... and restarted as well

More importantly: Why is there not a little thing somewhere saying "Hey, this service that never normally restarts is suddenly doing it every 5-10 seconds"?

Simple statistics to detect frequency changes and unusual behaviour like that.

Or whoever is in charge of this global, business-critical, spans-all-customers, service should have at least some kind of alert and then go "WOAH! Everyone stop and tell me what's changed in the last 10 minutes!".

Rocket Lab wants to dry off and reuse Electron booster recovered from the ocean

Re: Probably just as well

Or they could just, you know, make something that's explicitly designed to land and launch again.

(And, no, I'm not referring to SpaceX because landing "upright" is a dumb idea that cost them lots of money during testing and offers zero advantage and burns even more fuel in Earth's atmosphere. Make the damn thing able to GLIDE BACK DOWN in a controlled manner rather than just sever it and make it plummet into the ocean at random places. Yes, it'll cost more. But then it'll be properly reusable without stupendous risk in the landing zones, and it won't have to be checked over constantly because it's made of metal and has been swimming in a saltwater ocean... All this fancy rocket, computer and drone tech and we can't make a fuel-empty rocket turn into a small glider for the journey back down).

Boris Johnson pleads ignorance, which just might work

Contempt of court aside...

Why not just subpoena Whatsapp? They are the ones holding the data, and they allow you to move it to a new phone at any point (your security code may change, but the data doesn't).

Funnily enough, AI models must follow privacy law – including right to be forgotten

Re: 7 Data Protection Principles

"Purpose limitation" is the killer.

Was I reasonably notified, explicitly, that they were going to use my data to train an AI system that anyone in the world can query?

Because if not, it really doesn't matter about "right to be forgotten"... they shouldn't be having the data in that system in the first place.

Let's have a chat about Java licensing, says unsolicited Oracle email

I don't think it's stupid - I think that's a sensible business decision, because Java is about to start going the way of the dodo because of actions like this, and who wants to deal with any fallout from - say - an Oracle/OpenJDK lawsuit, hassle from Oracle over your exact usage, etc. etc.

If the time was already ripe to consider moving, and you start getting this hassle, and you feel there's no future in Java - that's the time to just burn the bridges and start afresh on something without any such licensing whatsoever.

And if you have no Java on servers... even more of a case to just move in the modern age. Why would you want to be dealing with Java clients nowadays?

I'm watching vendors who are dependent on supplying Java software (including some embedded in hardware) scramble to move us to their new versions that aren't. Java is being tainted by Oracle, and people are beginning to want nothing to do with it. Even if that's executives misunderstanding and just decreeing "No, no more Java, or anything associated with it, I don't want to see another threatening Oracle bill!", that's no bad thing from the business's point of view. Oracle's, yes, but not the business.

Which is the only sensible response to discovering that a product you hold is now licenced by Oracle.

Lamborghini's last remaining pure gas guzzlers are all spoken for

Anyone who claims to be "all about the performance" and yet still drives an ICE car is just a liar.

Nobody who has these flash cars has it for the performance, they have it to show off - and for that they need loud noisy engines to attract attention.

All the "motorheads" I know who say they love the speed and the acceleration and the wind in their hair, etc. won't touch electric cars or bikes. Despite the fact that they are the fastest moving things around. What they mean is "they want to make a nuisance and let everyone know they drive a flash, expensive car".

And if you're driving a high-performance sportscar, "range" isn't a concern at all. You burn through that tank faster than anyone else anyway.

It's why Formula 1 is more popular than Formula E. It's why loud noisy Harleys are filling the biker-joint near me, and not their all-electric models that are far faster and more powerful. It's why boy-racers tear the tags off their tiny little engine cars and put on large noisy exhausts, lighting and stereo systems.

It's why companies why Lamborghini are potentially in trouble - their base is not built on people who feel they need to do 200mph and 0-60. It's built on people who want to be loud, brash, obvious and make a nuisance of themselves. Which electric cars don't achieve.

Don't get me wrong - I'm quite looking forward to it. Despite the danger of almost-silent, far-too-fast-accelerating cars on public roads (if there isn't already, there'll be a massive market for cutting off the acceleration and top-speed limits of these electric cars, because one will be mandated, I guarantee it), I'd rather be without the idiots grinding off into the distance as loud as possible at 3am.

Brit broadband subscribers caught between crappy connections and price hikes

Re: 4G or ADSL backup

Last I checked, A&A's usage limits were pathetic.

Looks like they finally upped it to 1TB/month now, though.

Vodafone likes to randomly kill my DSL session (but not the whole connection) at random - but fairly regular - times of the day.

Knocks out my access for several minutes as it resyncs.

Often coincides with me sitting down with my tea, or just needing to check something important online.

The DSL session is dropped (but not because of lack of signal, it's a software session drop), the router re-dials (TRAINING, etc.) and then goes back to SHOWTIME - at exactly the same speed, etc.

It's too regular to be incidental. It's too irregular to be a scheduled restart of the session (e.g. it's never something like 24 hours since the session started).

Same router as I've used for years, plugged into the master socket, no extensions (or even phones!), etc.

The worrying thing is that they have just announced they are moving me to "Digital Voice" (which is a brand name for SIP) and cutting off all voice on the line, so I will have to dial up a SIP session to take calls on my home phone number (no biggie for me, I don't even know what it is and don't care as nothing is plugged in). That's going to screw loads of people who have phone extensions that are wired (they even have the cheek send you only one SIP adaptor, and to recommend DECT for all your extensions).

And if their DSL connection cuts out that regularly, it's going to drop the call too, isn't it?

When I moved house, I did wonder whether to get Starlink but I just can't bring myself to give Musk money - and they are changing the terms and conditions all the time. I can fall back to 4G, but that's the same kind of problem. I ran a house off nothing but 4G for 5 years, no problem at all, even with all my CCTV and gadgets, but I'd rather not have to.

But if they keep putting the prices up, and can't keep basic connectivity up (and I've never had a DSL ISP just randomly drop my session like that), I will just find an alternative.

I don't like being trapped into a poor-performing monopoly. I'd actually rather pay far more money to someone completely unrelated who can deliver a decent service.

It's 2023 and memory overwrite bugs are not just a thing, they're still number one

Re: This crap should be fixed in hardware

Yep.

But that's because x86 / x64 software and Windows OS are written under assumptions that mean they would have to be completely rewritten and all backward compatibility would stop.

The problem was in carrying forward the initial design of the 8086 - and later chips actually marketed the fact that they treated things with a flat memory model, etc. etc.

Since then, we had DEP and ASLR and all kinds of "bodge jobs" to try to implement what you're talking about, but fatally, they all kill backward compatibility and require OS rewrites.

DEP, literally, was one that was supposed to "solve" this for Windows. You have DEP enabled on your machine now. It doesn't solve the problem.

Fixing it in hardware won't do anything - there are almost certainly hardware architectures designed like that out there. The problem is that none of the popular OS or software will work on them because they rely on code/data tricks to operate.

Instead we have a 30-year-plus slow revisionism and culling of parts of backward compatibility and trying to fudge it into the OS piecemeal.

We're still bound by decisions made in the 70's, to a large extent. When everyone was trying to squeeze every cycle they could out of their chips and something like separate instruction and data spaces would have been deemed entirely unnecessary and affecting performance.

And, unfortunately, machines have pretty much stagnated in terms of sheer processing performance (more cores, yes, but faster cores? No). So even things like "emulation" of such for backwards compatibility isn't viable because it would just make computers still appear slower than they are without such technology (when running legacy software, at least).

It needs a redesign from the ground up, or an designed-for-it-from-day-one architecture to take hold of the market (I'm not sure what ones would be "closer", but things like ARM, RISC-V, etc.). That's not going to happen any time soon.

And though we have fixed some problems and deprecated some functions of those early chips in more modern designs (64-bit was a transition not just in word-size, but in deprecating a lot of legacy nonsense), nothing will actually fix the problem after the event.

We'll just keep plugging holes with our fingers until the dam is nothing but fingers, I imagine.

Rust isn't the panacea

Anything that involves drivers, kernel-level code, bus-interfacing etc. requires you to be able to manipulate things provided to you as "unstructured" RAM freely.

To do that in Rust, you need to surround the code with "unsafe" modifiers, which instantly destroy the guarantees of Rust of all that code AND any code that might be near it.

So although we can fix bugs in, e.g. document handling, and web-page processing, buffer overflows etc. are ALWAYS going to be inherent in lower-level code which is where they are also most dangerous.

Anything that's given to you as a memory-mapped set of data, which you then have to interpret and write to, is a serious risk... and Rust doesn't help one bit in dealing with that.

That's basically everything to do with PCIe, USB, TCP/IP acceleration, device drivers, filesystems, DMA, just about everything at the kernel level.

And although you can in theory convert everything to Rust, that code will end up with unsafe keywords EVERYWHERE in order to do so, and doing that destroys guarantees of pretty much all the Rust code. So you're back to square one, after spending an age converting decades of legacy and tested code to new fancy Rust and probably introducing myriad other subtle bugs along the way.

Even in the Linux kernel, which has started accepting some Rust, Rust usage is limited to certain particular areas. Because you can't write a "safe" Rust driver for almost all the hardware that exists in a machine.

Warning: JavaScript registry npm vulnerable to 'manifest confusion' abuse

Re: Heat your home with the Web

Gosh, if only we could limit the resources that an individual tab / page / domain / window takes up in the browser to ensure it only ever gets a fair share of what the user wants it to have.

It's almost like that would solve all such problems and show which sites truly are taking the mick.

I can remember when I could also stop ALL moving images and plugins on a page so nothing showed me distracting moving images unless I clicked on them specifically. Those days are gone too.

Browsers need to start limiting resources, because there's basically nothing stopping someone running Quake or a Bitcoin Miner in your browser when you visit their website, and they can easily do so silently and without output.

WASM etc. is incredible technology, but it needs resource limits. I can literally compile one of my old SDL / OpenGL games with Emscripten and run it in a browser unmodified. If I can do that, then someone can do far worse with just a simple Javascript include on an seemingly innocuous webpage if they want.

Five billion phones are dead in drawers – carriers want to mine them

Almost every recycling scheme ever falls foul of this.

I'm literally PAYING a council to pay a company to take away my paper (very easily recycled) to then sell on.

If it was at all worthwhile, they'd be paying me for the source material - like how we used to "return a deposit" on a glass bottle.

Just about the only thing that I can actually get money for are certain metals in significant amounts. Not the rare-earths, no. The steel, iron, aluminium, etc. Even then, without bulk, it's not even worth someone paying a penny for them if they have to come collect, it's not worth the fuel to do so.

And any recycling scheme involves some amount of at least one of: transport, handling, human interaction, washing, chemical cleans, heating the material (often to melting point), reforming, quality-loss, transport (again!).

Those things all cost money and most of the time the "value" of the "free" recycled material at the end doesn't even cover the cost of the process, let alone profit, let alone paying for the raw material.

Phones are even worse - trying to discombobble them to the point you can isolate all the dangerous parts and chemicals, and recover metals etc. to a purity you can re-use and re-sell them? It's not worth the fuel it would cost to transport the phone to the depot.

These kinds of schemes are almost entirely subsidised - they aren't commercially viable. And, in a way, that's fine. We have to pay more to deal with our waste correctly, I understand that.

But claiming that you're going to actually expend less energy, pollution, etc. overall by recycling the device rather than making another is basically equated with "you should be able to profit from recycling the device, then". And that's basically never true.

Microsoft's GitHub under fire for DDoSing crucial open source project website

Change the returned data to perform a dangerous action on anyone running that workflow.

Problem solved.

This was always the problem with "let's just include this code from the web in our webpage/scripts" as if that was a valid, never-down and free resources for all. Remember the fuss when certain crucial Javascript includes went offline and thousands of websites "broke" (more accurately: fell over because the crutch they'd been using free of charge disappeared).

It certainly shouldn't be pulling hundreds of copies of the code just for a test suite.

I have responses back to those IP ranges being a 0Kb zip file, at minimum, but more likely a zipbomb, malicious code, stroppy messages that means their test suites all fail, etc.

They'd soon "fix" it then.

Vodafone offers '5G Ultra' to users of very specific phones in very specific locations

Plenty of people use their phones as a mobile hotspot.

I was doing it... what? 15 years ago? In remote Scottish backwaters where I was the only one with signal and I had a table of friends/family that piggybacked off my connection.

I don't ever use trains, but I can quite imagine there are a LOT of people who dig out a laptop on a train and basically connect as if they are in the office, not to mention those people who work from home or while out in pubs or the field nowadays.

Never, in the course of human endeavour, has someone NOT found a use for even more data and processing even faster.

Microsoft investigating bug in Windows 11 File Explorer that makes the CPU hangry

And yet still they can't fix that Active Directory Users & Computers search functions will ALWAYS pre-select Users, Groups, etc. but not computers. Even when you're dealing with computer objects.

And when you switch to include Computer objects, it clears your current search and makes it happen again.

Don't even get me started on what fields are copy-able and what aren't in pretty much any standard windows dialog or system management application.

And why is Sysinternals STILL not part of core Windows?

Honestly, rather than fussing over explorer (which impacts all users negatively), why not fix some of the longest standing bugbears that your guys MUST be having to deal with the same as everyone else.

Open source licenses need to leave the 1980s and evolve to deal with AI

Is your code substantially similar to the copyrighted works?

And nothing makes you "no longer making any non-GPL work".

What you can't do is infringe your agreed-to GPL or non-GPL licences by making code "substantially similar" to code you don't hold the copyright for without the permission of the copyright holder(s).

You can be as smarmy as you like, but hyperbolising this into GPL vs the world is a trick employed by such copyright experts as SCO (who lost) and Oracle (who also lost but because interoperability is required and made the question of potential copyright infringement moot and so that part was never actually tried in court).

And yes - there's a reason NDAs exist. There's a reason non-compete clauses exist. And there's a reason why Wine and Samba don't want you working on their code if you've been exposed to Windows internal source code.

Copyright covers distribution of derivative works.

Anything that produces related output after having been trained on copyright material is making a derivative work.

Letting someone else consume that media without appropriate licensing (including any attribution, etc. that's necessary under the author's chosen copyright licence) is copyright infringement.

No they don't.

Copyright law is quite clear.

Just because "AI" people think that they can ignore it and just suck in everything and use it as they like for commercial purposes does not mean the licences are wrong.

It means the AI people need to verify their training data's origin and copyright status.

Lawyers who cited fake cases hallucinated by ChatGPT must pay

I don't like it because "Hallucination" suggests that such a diversion is a deviation from the norm.

But actually this is just AI at work. It has no method of inference, it doesn't "understand" any of the data it's manipulating, it's just a brute-force statistical machines that's been Pavlov'd into reacting as a "good boy" for its trainer. It doesn't know why. It doesn't understand that it wasn't when it was soiling the carpet that it was being rewarded for.

Even a comparison to a dog intelligence is insulting to the dog. The dog does have the ability to try to infer, even if not particularly well.

We need to mock AI at every turn, to understand that this isn't "Sonny" from iRobot that we're getting. We're just getting yet-another dumb assistant that looks useful but ultimately requires a human to double-check everything it claims. Again.