Posts by DrXym

Linux PC vendor System76 tries to talk Colorado down over OS age checks

I honestly do not get the reason they even want this

Age verification is stupid but especially here. Operating systems are disproportionately installed by adults. Even if a child installed one, what purpose is age verification solving? What even is an operating system? Is it firmware? Is it a docker image? Does it have to connect to the internet? Does it have to have a browser? Do firmwares for consoles count as operating systems? Do in car entertainment systems? Or phones? Or LeapFrog gizmos aimed at toddlers? Or Raspberry Pis?

It's just perplexing, stupid, unenforceable legislation that serves no purpose.

Document Foundation urges EU to ditch Excel lock-in for cybersecurity law consultation

Re: OOXML is also an open and ISO standard

At yes, the 5000 page long specification for MS Office formats compared to the 760 page long specification for OpenOffice formats. And it was belated specification tossed out there as a sop simply so Microsoft can proclaim they're a "standard" even though it is so impossibly complex that few competitors would bother attempting to implement it.

DOGE bites taxman

And AI isn't exactly renowned for its financial or accounting acumen.

Stroke of genius

Lay off all the people who ensure people pay their taxes and pay them on time. I'm sure that won't have any predictable consequences.

X users howl into the void as timelines fail to load

Nothing of value was lost

I truly wonder why anyone bothered with that cesspit any more.

Supermarket sorry after facial recognition alert flags right criminal, wrong customer

99.98 accuracy

Sounds impressive but that still means a false positive 2 times out of 1000. How many customers are there in a supermarket on any given day?

Workday reveals around 400 staff soon won't have to work another day

I think in some cases it's a sign of extremely conservative development - the company is literally paralysed, fearing any change could generate support calls. Or if they do change the UX it's a thin veneer over the terrible old system. I saw this first hand with Lotus Notes which got a facelift but only until you opened a dialog and then it was as awful as it ever was. It's like baking a cake with a dog turd in the middle.

That's all enterprise level software. A salesperson beguiles the CTO / CEO / CFO with horribly expensive software which looks good on paper but isn't fit for purpose. They'll sell it on bullshit claims like it reduces infrastructure costs, or improves metrics or whatever when it will do none of those things. Instead it will become a money pit requiring expensive contractors just to make the thing work at all and thereafter a constant drain on productivity because the UX is unforgiving arcane dogshit and the software needs constant nursing by full time employees.

UK names Barnsley as first Tech Town to see whether AI can fix... well, anything

The first results are in from the AI

It says "use the £500,000 to reduce child poverty, food insecurity, urban decay and crumbling infrastructure."

McDonald's is not lovin' your bigmac, happymeal, and mcnuggets passwords

Re: On the flipside

What data???? All there is in the McDonalds app is discount vouchers and occasionally promotions. I had to double check there and there is NO WAY to put any payment information in there. There is literally nothing of value to protect beyond the login email address and the most basic of information.

So the 2FA is just pointless, at least for retrieving the vouchers.

Re: On the flipside

I haven't entered any credit card details into my McDonalds app so my wallet is quite safe. Attempting to login to get a discount off a burger is not something that should require having to check email for a code to paste into the other window. Aside from anything else it means I'm wasting an extra minute at the kiosk for no benefit to McDonalds.

And if there was something of value in the app, e.g. Monopoly tokens, the simple answer is to surround that stuff with the 2FA.

On the flipside

The McDonalds apps insists on 2FA just so I can avail of some stupid hamburger deal. If there was any reason their app had to be protected for some niche reason (e.g maybe some people order through the app) they should protect that rather than the innocuous stuff, i.e. Sometimes security has to be proportionate to what it is protecting.

Paranoid WhatsApp users rejoice: Encrypted app gets one-click privacy toggle

Re: Rust

That's not what they said and no reason to assume it either. Media files are complex with all sorts of values and buffers whose size could be manipulated to trigger writing data beyond the end of a buffer for remote execution attacks. So rewriting the filter in a safer language is a desirable security mitigation.

Mozilla Firefox replaced its media filter all the way back in version 48 for exactly the same reason. You can see some of the code that Firefox wrote in Rust here - https://github.com/mozilla/mp4parse-rust. I assume Whatsapp implements something similar and probably for a variety of common file types.

How one developer used Claude to build a memory-safe extension of C

Whenever I used BoundsChecker, or Purify on a real-world project the machine usually ran out of memory. Because the overheads of these tools and the instrumentation they added was so bloated and slow the machine died trying to build the code. Even when they actually worked they generated so many false positives that any genuine issues were drowned out in the noise. Given how obscenely expensive the tools were I found very little value in them at all.

I think a better approach would be linters that enforce rules like MISRA (rules that make C programming safer). It's still not perfect but at least it would focus on questionable programming practices.

Emmabuntüs DE 6: A newbie-friendly Linux to help those in need

Try our newbie-friendly Linux!

"What was it called again?" "E̸m̷m̶a̴b̸u̴n̸t̷ü̴s̶"

Surrender as a service: Microsoft unlocks BitLocker for feds

Re: Just remember that laws can be changed

And I get two(+) thumbs down from people who think handing keys to an adversary for safekeeping is an awesome idea.

Just remember that laws can be changed

Imagine a cold war between the US and Europe - not much of a stretch. The US government could well enact laws allowing law enforcement far easier access to foreign accounts. If Microsoft / Apple / Meta / Google complies with legal demands then they will be handing information like candy.

So entrusting some big US corporation with recovery keys is probably a terrible idea, especially for individuals or companies whose line of work could be considered in the national interest.

As Oracle loses interest in MySQL, devs mull future options

No wonder

There is an obvious conflict of interest when Oracle controls one of the most popular open source databases that happens to compete with its own proprietary, expensive database.

So its not surprising that volunteers withered on the vine and decamped to the fork along with almost everyone who had an interest in MySQL.

PowerShell architect retires after decades at the prompt

Re: I only use it when I have to

I'm not "demanding" anything. The reason Powershell is still not a niche on Windows is because it's longwinded and provides no migration path. When I or anyone else opens a shell they want to type a few terse commands, not participate in a game of Verby-NounyNoun. Most devs know bash and/or command prompt and they just want brevity and familiarity. And for anything complex they'd write a script of some sort in NodeJS, Python, Perl or whatever which would have the added bonus of being portable.

PowerShell could easily have implemented "dir" the way people expect - write Get-DosChildItem cmdlet which supported the old arguments and alias to that. All of .cmd could have been supported and people would have no reason to use command prompt because the commands are unsurprising and PowerShell is a superset. They could have done the same for Linux/Unix file utils for that matter, as long as there was a way to switch personas / aliases.

But that didn't happen. So I and probably a lot of people only bother with PowerShell when they have to dip into the bowels of Windows to do some specific thing that is achievable no other way.

Re: I only use it when I have to

I don't use Powershell, which is what I was getting at. Occasionally there will be some weird admin command that requires I use it but not often enough to want to stay there when it's so verbose and strangely arcane - like a mainframe. The aliases suck and the cmdlets are verbose and unfamiliar.

It should have been a seamless transition had Microsoft decided to provide cmdlets that mimicked the old command prompt but they didn't.

I only use it when I have to

Powershell supports cmdlets (mini scripts) so they should have written cmdlets for legacy commands like dir, move, deltree etc. If they strove for compatibility there wouldn't be a need for a command prompt today since they could have implemented everything over Powershell.

Instead they just lazily aliased commands onto the nearest Powershell equivalent even if it behaved differently. So "dir" is not "dir", it's "Get-ChildItem" and none of the arguments work the same.

Shame really. I suppose it's more powerful but it's also very longwinded and different way of doing what command prompt is capable of most of the time.

Mozilla starts offering RPMs of Firefox Nightly

Not for Red Hat's benefit

Red Hat take the source code from upstream projects and build their own packages from them. Presumably their build pipeline would just do a pull and rebuild and ignore the rpms Firefox supplies.

This effort appears more for users who want to refresh their browser with nightly builds to be on the bleeding edge. Although that come without added risk of stability, data corruption etc.

Meta retreats from metaverse after virtual reality check

Really not surprising

The way to approach a "metaverse" is to give people something fun to do and come back, e.g. an MMO with quests and progression, places to explore, danger. Then let users go wild creating races, factions, clans, bases etc to organically grow out this place. They'll come back for the progression, to hang out, for the raids etc. Plenty of opportunity to monetise the experience without being too heavy handed. It should feel slightly chaotic and mad, but fun.

OR go the Meta route. Create a bunch of boring zones where there is NOTHING to do except play some lame and broken minigames. A metaverse so profoundly dull that all the avatars look like humans, and it was a big deal when they got legs. A metaverse where Zuckerberg envisioned people gathering in virtual conference rooms to look at presentations. God knows how many focus groups and committees Meta ran their vision through to get to where they got by dear god did it fail hard.

Moon hotel startup hopes you get lunar lunacy, drop $1M deposit for 2032 stay

Lunar grift

That's a million dollars the marks won't see again

Firefox 147 brings GPU boost, tidier tabs, and video that follows you around

Re: 1 button option to turn off AI

Just right mouse on a page and click Remove chatbot. Technically three clicks.

AI industry insiders launch site to poison the data that feeds them

About time

I was suggesting this last year. Just generate sites full of garbage - mislabeled or badly mangled images, false content about people and places, false movie trivia, false research papers, false sports & hobbies.

An AI can even generate large quantities of this garbage based on prompts. It works better the more esoteric a subject since the information is not competing with other information.

EU won't scrap tech regs just because Washington dislikes them

Want to do business in Europe?

Then abide by its rules. They are set in place to ensure privacy and security and no more discriminate against US firms than they do European ones. If a firm steps out of line and does so egregiously it'll get a heavy fine for its troubles.

But it does emphasize that Europe (and the UK) really need to reduce their dependence on US firms. e.g. there are European based cloud services who do take the law seriously and maybe its time for governments and companies to think long and hard about digital sovereignty.

Claude is his copilot: Rust veteran designs new Rue programming language with help from AI bot

Re: I sort of expected something like this.

If you're using a smart pointer then you're using the heap and have a new somewhere, or some kind of std::make_unique from a std::move going on. If you just declare your class / struct in a block of code then it'll be in the stack, but of course member variables might use the heap, e.g. if you had a string or collection in your struct.

The danger with C++ is that using smart pointers is optional and it's still possible to dereference a pointer or subvert reference counting. It's still better than GC in most cases but object ownership and destruction order can get pretty disgusting for shared (ref counted) pointers.

Re: I sort of expected something like this.

Theoretically Java could do limited lifetime analysis during compilation and zap some shortlived objects programmatically rather than in a GC. e.g. maybe there is a loop where a temporary collection gets dereferenced and it and the objects inside are obviously not referenced elsewhere so just force their destruction from the bytecode. Or maybe an object which is expended / drained / nilled or whatever you want to call it could say so to the runtime to expedite its removal.

But this is only going to work in trivial cases because Java and similar high level languages don't enforce how many references an object has at a time so either the object says "I'm done", or the language has to track and enforce it.

Garbage collection can also be a huge problem for things like games, or real time, or running on anything which only has physical RAM where you have to strictly budget heap to avoid out of memory situations. If you can reasonably foresee GC being an issue, then don't use that language to write the thing.

You don't need Linux to run free and open source software

User experience is definitely some open source products forget. Making the UI only show things for the task in hand, removing clutter, being discoverable, being forgiving / helpful, and internal consistent are really important. Sometimes they're more important than the power under the covers.

For example I'd love to use FreeCAD more but the UX is so awful that I'll stick to a free tier on OnShape or Fusion 360. Not because I want to but because those products are way easier to use despite being functionally similar.

UNIX V4 tape successfully recovered: First ever version of UNIX written in C is running again

Linux (disambiguated here to mean a common dist with a Linux kernel + user land) is a Unix lookalike. It is not compiled or derived from BSD or System V source code so technically it is not Unix. But it implements the same functions, commands and concepts as Unix so for all intents and purposes it's Unix even though it isn't.

About 20 years ago SCO claimed they owned Unix and threw sueballs at everyone to try and wipe out Linux but failed hard because the implementation was different. They also lost ownership of Unix in the process to Novell - oops.

Unix lives on in various derivatives. The most mainstream one in existence is Mac OS since it is a BSD derivative. Most *nix systems implement POSIX standards so there is a lot of similarity regardless of how they came into being.

Microsoft wants to replace its entire C and C++ codebase, perhaps by 2030

Re: "It's new and shiny - it must be better!"

It's also worth mentioning, this is one guy saying his goal is this, not Microsoft's.

But even if it were Microsoft's, the real issue isn't whether Rust is safer than C (it obviously is) but whether it's worth rewriting existing code for the sake of it. I could entirely see the point of writing new code in Rust but not necessarily some ancient Win32 DLL which hasn't been a vulnerability for as anyone can remember.

The Roomba failed because it just kind of sucked

The failed because all their patents ran out

Once the patents were gone, a bunch of competing brands sprang up and ate their lunch.

Airbus to migrate critical apps to a sovereign Euro cloud

Re: "Sovereign".....Exactly What Does That Mean?

Cloud has a place for some companies for uptime / disaster recovery and other conveniences. For most companies it probably doesn't matter much who their hosting provider is because their data isn't worth spit to anyone else.

But when a company is big and can afford to run and operate its own servers cloud becomes a really bad idea. Especially for a company like Airbus. It must be aware of a lot of threats from competitors and governments and must be subject to a lot of regulations regarding cybersecurity & resilience. The cloud becomes a point of failure and unique threat that has to be considered very carefully. At the very least, don't use an adversary's cloud hosting - and that includes the USA these days - and ensure digital sovereignty. But even better, bring stuff in house. I'm sure Airbus has honking big server rooms and hundreds of IT staff. They have the means and motivation to do stuff in-house and probably should.

Re: "Sovereign".....Exactly What Does That Mean?

It means the data is stored in a centre somewhere in Europe and not in the hands of a potential adversary. It's not just that it could be stolen, but could be basically held to ransom. e.g. maybe Trump decides to be a dick to Airbus and threatens their data in some way as leverage in a "deal".

Personally if I were any company with concerns about foreign adversaries stealing their data I would want to bring as much of it in house as possible, or at least host it as securely as possible. For a BIG company like Airbus I don't know why they'd want to use the cloud anyway if they could avoid it.

Trump gives state AI regulation the presidential middle finger

So much for state rights

MAGAs backers were all for state rights when it suited them on things like abortion, transgender etc. But when it impedes their profits by limiting AI, or pollution suddenly it's a big problem.

Pure hypocrisy

Trump's regime is all for "state's rights" when it comes to abortion etc. but then attempts to force AI on states even when the executive order is unenforceable garbage.

Waymo chalks up another four-legged casualty on San Francisco streets

Re: Legal & criminal liability

I'm interested that at least 2 people don't agree that the makers of self driving cars should be legally and criminally liable if their creations break the law or hurt people.

Legal & criminal liability

The boards of these companies should be legally and criminally liable for accidents their product causes. i.e. if they run a red light and hit a pedestrian then they're on the hook for the bills and potential charges for failing to stop.

Perhaps the law cannot be applied the same way as when a person causes an accident or breaks the law, but there has to be something. There has to be serious risk to the company in terms of fines and personal risk to the board for criminal negligence. There has to be a real possibility that the board of Waymo / Tesla (including Musk) ending up doing time if their product kills a family through negligence or oversight.

Samsung reveals its first tri-fold phone – and its desktop mode

The solution and problem are obvious

The answer is "money" and the question is "how do we take it from people?".

Samsung knows there are people who'll pay a two and a half grand for some flimsy gadget that will break and need replacing in a year. Even though they could buy a separate phone and tablet for half the price.

KDE Plasma sets date to dump X11 as Wayland push accelerates

Re: Not surprising

Erm, not X11 itself but X11 in KDE Plasma. But the same applies. I expect the number of people who really care that X11 is at the bottom of KDE and are prepared to maintain the code will be very sparse because the reasons for doing so are minimal.

Not surprising

Volunteers on these projects are a sparse resource. Focusing on a single API removes a lot of complication and code and makes it easier to maintain. I'm sure we'll see a fork that attempts to maintain X11 if its really important to somebody.

Soup king Campbell’s parts ways with IT VP after ‘3D-printed chicken’ remarks

No 3d printing necessary

Most tinned "cream of chicken" soup is chicken stock, chicken fat, corn starch, milk / cream powder, salt and a few specks of meat. So basically the byproduct of chicken carcasses which have been stripped of their high quality meat. What's left is used either directly or through products reconstituted products like stock powder / fat / meat granules thrown into the mix.

So high quality it is not. Chopping, shaping, extruding or 3d printing the meat would be a costly extravagance for these companies.

Makers slam Qualcomm for tightening the clamps on Arduino

Just write them out of the picture

Arduino was beloved for its openness. If Qualcomm doesn't want to follow suit then we'll enjoy watching them seal the coffin. It's not like there aren't other viable alternatives.

Retro Games opens pre-orders for THEA1200, a full-size working Amiga replica

Re: Don't see the point

It is but it goes still goes further than this. It boots up as an Amiga and takes Amiga peripherals, like 9-pin controllers, floppy drives, and is designed to go in A1200 case. There are FPGA style solutions too which go further again. Nobody realistically thinks OCS / AGA custom chips are going to be fabricated any time soon, but I see the THEA1200 as a pretty lazy effort.

All of which are better than what this thing will be which is basically just a custom keyboard with a tiny ARM board rattling around inside. No doubt they'll have to toss in some metal bars to make it weigh more substantial than it is.

Re: Don't see the point

I'd consider myself part of the nostalgia market. I have a gazillion Amiga games, workbench, kickstart roms etc. and they run on my PC. They run on a RPi even.

THEA1200 has a superficial resemblance to an Amiga, but it's keyboard with some ARM board inside. Like I said, if it were like a A1200 NG (or a Minimig), it might have some merit, but as it is, it doesn't, at least for me. I honestly don't get the appeal.

Don't see the point

I owned many Amigas and play around in emulators all the time but I don't see the point of this. Run UAE on a PC or even a Raspberry Pi with keyboard and you're basically getting the same experience this thing will offer. At least the keyboard works I guess, but people wanting a real-ish experience would probably expect something akin to the A1200 NG where you can even plug a FDD into it. I expect somebody will whip the dremel out and try and get the case to have something better running inside.

Ubuntu 25.10's Rusty sudo holes quickly welded shut

Yes and nobody ever claimed different

Software engineer reveals the dirty little secret about AI coding assistants: They don't save much time

They can save time

I asked an AI last night to generate a Python script that draws some boxes with PIL (Pillow) for an e-ink display I'm playing around with. It managed it and saved me faffing around writing the same code by hand. HOWEVER, I only trust AI for this sort of noddy programming - as a glorified wizard for making simple code samples or throwaway stuff. When tasks are complex, or require security / safety I wouldn't trust it as far as I could throw it.

Snap out of it: Canonical on Flatpak friction, Core Desktop, and the future of Ubuntu

My opinion of snap

I'm 100% in favour of sandbox style packaging the application level. It's very convenient to have an app just install and work regardless of the distribution.

But at a lower level this stuff can be a source of grief because its security sandboxed and if the policies get screwed up or don't behave the way the native executable does it can fail in surprising ways. I've suffered errors that only happen in snap but not the same executable run directly so I prefer the latter. I really don't like the zeal Ubuntu is trying to do this. I'm sure they'll say they're trying to modularise their distribution, make it all componentized but it comes at a cost.

I also don't buy arguments they had to use snap because flatpak supports multiple websites - that is a feature not a bug. There would be nothing to stop Ubuntu using flatpak and pointing at their own site and their own signed flatpaks if they were so worried about that.

So application level good, below application level, not so much.