Posts by DrXym

That upgrade from Java 8 to 11 you've been putting off? UK fintech types at Revolut 'quite happy' after a year in production

I'm not surprised people are taking so long to move

Java 11 doesn't support 32-bit Windows, doesn't have a JRE (you build your own JRE by playing a game of guess-the-modules with jpack), and a bunch of stuff was deprecated or removed entirely.

On top of that Oracle changed their licence / support terms and companies are scared and confused about that too. All these conspire for companies to stay put with Java 8 which is generally good enough. Or if they do move they move away from Oracle they move to the OpenJDK or Corretto to avoid potentially paying Oracle.

Re: Modern Problems require Modern Solutions.

Correto is the OpenJDK which some mystery improvements added by Amazon. Especially in the Correto 8 product which has received some backport / security patches.

I think personally I would use the OpenJDK unless I had a reason not to.

Apple bans COVID-19 games and restricts virus-related apps to authoritative souces

Re: Plague Inc. game banned in China

A game can still have rules that make sense without requiring ultra realism. The game simulates air and sea travel, but the land borders are not simulated very well.

Re: Plague Inc. game banned in China

The biggest failing with the game is it doesn't model borders very well. I played one game recently where I infected France completely while Germany next door was totally uninfected. It would be virtually impossible in real life.

Re: Plague Inc. game banned in China

Like most games it has received updates and seasonal content since release. But it hasn't received an official COVID-19 scenario. I'm not sure it makes any sense to ban it even if it did.

Re: Plague Inc. game banned in China

Kind of ridiculous too seeing as:

a) its a game, and an educational one at that

b) it doesn't have a COVID-19 scenario, although you do get to name your pathogen

c) what the hell?

BT's Wi-Fi Disc ads banned because there's no evidence the things work

Use a second wifi hotspot

Buy a powerline kit - an ethernet adapter and a wireless hotspot. Attach one to the router and plug the other one in where the wifi is poor and set up a second hotspot. You have the minor inconvenience of two wifi hotspots to set up but it actually works unlike most "range extenders" or some questionable mesh system.

Latest bendy phone effort from coke empire spinoff Escobar Inc is a tinfoil-plated Samsung Galaxy Fold 'scam'

I'm very disappointed

If you can't trust the only slightly less shady brother of a murdering drug lord, then who can you?

We checked in with the new Windows 10X build, and let's just say getting this ready for late 2020 will be a challenge

Sounds terrible

The ONLY reason to use Windows on a tablet or touch device is because it runs Windows software. If it can't do that, or comes with an entire mountain of caveats & gotchas then what the hell is the point?

We've seen this time and again with Microsoft - they crap out something which can't run certain kinds of software, and/or is locked to their store, and/or suffers from terrible performance thanks to emulation and the result is always awful.

Let's Encrypt? Let's revoke 3 million HTTPS certificates on Wednesday, more like: Check code loop blunder strikes

Re: What's this, a bug caused by a language quirk?

Of course you can create application errors in other languages. The point is that C and C++ have their own errors on top. This honestly isn't up for debate.

Re: What's this, a bug caused by a language quirk?

Well that's a stupid straw man argument. I never claimed a language like Rust fixed bugs like application logic errors. But it does fix entire classes of problem that C or C++ allow through - buffer overflows, NPEs etc. It should be very obvious why that is a good thing in a language.

Re: What's this, a bug caused by a language quirk?

No, both of these were caused by problems in the language.

- Heartbleed might have been "trivial" but it was caused by unsafe code that would have thrown a runtime exception in other languages and been instantly caught.

- "goto fail" would have thrown a compile time error in other languages where blocks MUST be delimited or goto isn't even a thing.

The point is the language caused these bugs to enter production with massive consequences.

And yes C++ can mitigate some of these things, but the real world says hello. These things still happen and do happen.

Re: What's this, a bug caused by a language quirk?

I'd describe Go as a swiss army knife. The standard library is huge and ideally suited for writing scalable web servers, utilities etc. that compile into standalone executables and run a multiple times faster than if they were written in languages such as Ruby, Python and NodeJS.

I hate the way the language handles errors though which is inexcusably crap.

Re: What's this, a bug caused by a language quirk?

Here is Rust's paradigm - safe by default and portable. Look at the CVE database - it's filled with exploits / vulns caused by null pointers, buffer overflows, data races etc. from code written in C or C++. Realise that NONE of those can happen in Rust because the compiler will kick your ass if you try. The consequence is that compiled code is safer code, slashing the number of bugs which means less development time, better quality and happier customers. Oh and often that code can be more performant because devs can utilitise threading, asynchronous operations etc. because the compiler catches all those aforementioned issues.

Here is Go's paradigm - scaling, portability, stability and convenience. It is very terse, has a very large standard library (crypto, networking, images, math, hashing, encoding etc. all out of the box), is well suited for scaling network applications, and it compiles code into executables. It also does not suffer from the same kinds of vulns as C or C++ thanks to runtime checks.

So yeah you can use some older language if you prefer but you have to realise why these languages exist and it helps to use them to speak from a position of experience. What I don't quite follow is the irrational attitude that always permeates discussion about new languages, as if some old timer sees this new fangled language as a threat or something. Nobody is forcing you to use them, but personally I like to keep my skillset fresh and relevant and using a new language or technology is a way to do that.

Re: What's this, a bug caused by a language quirk?

Every language has pitfalls. Some languages, in particular C and C++ have more pitfalls than others. If there is any doubt about this, search for the causes of the Heartbleed or "goto fail" bugs in OpenSSL.

And regardless of the language, all software can still have application logic errors.

Oracle staffers in Europe weather cloudy job cuts: As many as 1,300 workers face chop after sales slide

I'm shocked

So Oracle's existing customers weren't rushing to buy cloud services from a company that has routinely shafted them for years? This is a shocking revelation.

Time to svn commit like it's the year 2000: Apache celebrates 20 years of Subversion

Re: Interesting

Try doing a merge across 50,000 files in CVS as I frequently had to do in the past. The basic procedure was:

1. Tag every single file in the head prior to your merge. Takes maybe 30-40 minutes because every action is individual to the file.

2. Do the merge from your branch onto the mainline which involves diffing every single tagged file against the file's branch. You're honestly best off to use a visual tool like Eclipse Team Sync so you do not go insane. Takes another 30-40 minutes even without many conflicts to resolve.

3. Commit all the changes.

4. Tag every single file in the head post the merge. Takes another 30-40 minutes just so you have the ability to do a diff of before and after for whatever reason, such as reverting the change.

Total time for one merge could be 2 or 3 hours depending on complications such as somebody else checking in at the same time. Normally I'd email people before and after and hope they stayed away.

And of course creating the branch in the first place was expensive so people had a tendency to avoid doing it at all.

CVS may have been better than some other source control systems doing the rounds in its day (and it was free) but it still sucked. Subversion is hands down better than CVS but it's still way slower and network / server intensive at branching and merging than a DVCS like Git or Mercurial.

Re: svn vs git

It's not reasonable for multiple reasons.

1. Managers are not developers so complicating their lives for no reason is a recipe for disaster. Dont' make me laugh with the idea of making them comprehend branching, merging, rebasing, staging, push, pull etc.

2. Binary merging SUCKs and always will. How do you merge a spreadsheet?

3. Git bloats with every binary committed to it and every clone gets that bloat. At least a centralised checkout hides it from users. Git LFS is not an option, see 1)

4. Managers often want to checkout just one folder, not the entire repo.

Git is by far and away better for developers. For managers, you're needlessly complicating things by using it.

Re: Fond memories

Linus justified the point if you care to look for his comments. But it's completely borne out by what has happened since.

The main advantage of a DVCS is it allows people to create branches that nobody else sees. It allows them to work offline, and do complicated diffs or merges without choking the server. It allows the central server (if there is one) to be free of useless tags and branches. Devs don't even need to communicate with the server to do any of this so it is MUCH faster. It also allows esoteric and non centralised models (e.g. we have one repo where we pull a branch from one remote source, merge it to another branch and push to another remote branch). The point is that a DVCS is flexible, robust, works in isolation and is FAST.

From personal experience I know this. We used to have some 30 CVS repositories containing about 50,000 files of code. About 6 years ago I got so fed up of tagging / merging / synchronizing taking an hour or more every damned day, that I volunteered to upgrade it all to either Subversion or Git and evaluated both. Subversion works like CVS so migration would have been easy. But the long term advantages of Git (outlined above) outweighed all that so I wrote up a bunch of workflows, dealt with the culture shock and moved everyone to that. It was the best decision I've ever made.

Re: Anyone remember PVCS?

Source Safe was just the worst. Definitely remember situations where somebody decided to have a leave of absence with the file you really needed to change being locked out.

Re: Interesting

Be thankful you never had to use CVS, SourceSafe or Clearcase because you would be scarred for life.

Re: svn vs git

The staging / push concept in Git does look a little strange but it serves many purposes:

1. It's one final ass-saving chance from pushing something which is broken, or to modify your commit before you send it, e.g. if you missed a file or have another change to make.

2. You can make your own local branches without polluting some central repository.

3. You can squash all the commits from one local branches to another or do any other surgery you like to your repo then apply the work when you're ready.

4. You don't need network access except for push and fetch. i.e. you could be committing, diffing, merging or whatever to your own local repo.

5. Your repos don't need to follow some conventional centralised model, e.g. we had a repo with two remote sources - one an open source repository and another which was our own, and we could pull from one and merge to the other.

So it certainly looks a little clunky but it has a lot of advantages.

The main place git doesn't work is document management. Managers prefer to lock files and commit rather than dealing with branches and merging which make no sense in binary files any way. Git also kind of sucks for binary in general although things like large file support somewhat mitigate this issue.

Re: Fond memories

Yes, but the counter argument that Linus Torvalds advanced, if you're trying to fix CVS then you're doing it wrong.

One thing I've noticed is I have a Git repository which is 8 years old and has had 10,000s of commits by various people and it still takes up less space on disk than a SVN snapshot with the pristine folder. The entire history from the first commit. And it works without network access except for push/pull compared to SVN where more or less every operation except for a straight diff against the pristine copy needs network access.

The one place I'd favour Subversion over Git or another DVCS is for binary document storage. It's way easier for managers to work with SVN than it is for Git and frankly there is little need for branching and merging strategies on documents.

Southern Water not such a phisherman's phriend, hauls itself offline to tackle email lure

Re: Phishing

Virus / malware scanners, due diligence and risk assessment. Security is not just one thing but many layers of it and a company mentality that fosters it.

Re: Phishing

Aside from scanning attachments, the most effective single countermeasure would be to turn on DMARC message authentication and work with major suppliers so they do too. It allows email servers to reject emails that claim to be from a domain when in fact they were sent from another. And also to verify a signature in the message header against a public key.

It requires a bit of fiddling with DNS to make it happen but it would block most impersonation attempts.

Never thought we'd write this headline: Under Siege Steven Seagal is not Above The Law, must fork out $314,000 after boosting crypto-coin biz

Re: The true star in Segal's films is the editor.

The early movies where he was the actor, were quite good in a stupid 90s action flick way. After Under Siege (which is a very good movie) the fame went to his head and he just crapped one dumb vanity movie after another. Sometimes 3, 4 or 5 of them in a single year. Most of them are such low quality non-theatrical filler that they haven't garnered a single review on Rotten Tomatoes.

What they gave him are some digitally signed tokens which had no intrinsic value. The ICO requires other people buy in so he could exit. Presumably that was his intention and for all we know what actually happened.

Re: The true star in Segal's films is the editor.

And doubtless there is very a strong correlation between the awfulness of his movies and his personal involvement in their production. His early movies where he had very little creative control were actually quite good.

Re: Celebrity Endorsements

It might not have made a difference but it certainly nailed Seagal to the wall in this instance. And if there are laws that require it then any celeb prepared to whore their good name for a shady bitcoin service should probably do their legal due diligence first.

Suckers born every minute

Virtually all "initial coin offerings" are just a scam - "buy our scrip for $$$ and you'll make a fortune trading it!!". Except of course you don't and all your money disappears in a puff of smoke.

The scammers often liken it to an initial public offering, except of course when you buy a share in a company it has an intrinsic value and various legal guarantees that a digital token does not.

'Developers have lost hope Microsoft will do the right thing'... Redmond urged to make WinUI cross-platform

QT uses QML as a declarative layout with Javascript bindings. It's as easy to drag an app to its knees if you shove too much JS into the application or get the interfaces wrong instead of delegating to C++ objects.

I think that's the primary issue that modern layout engines suffer from - too much traffic between bound events and code can incur a call penalty or forces relayouts or redraws.

But I know from decades programming Win32 that there is no performance magic wand there either. Yes you're closer to the action. But then again the API is geared around a 40 year old design for immediate mode rendering with WM_PAINT messages flying around. A modern layout engine can take advantage of hardware acceleration so all window elements are surfaces and composition is lightning fast.

Revolut-won: British banking app gets half a billion bucks in backing, seeks to subvert today's market incumbents

Re: The startup got a European banking licence in late 2018

Bobby Drop Tables

Huawei claims its Google Play replacement is in 'top 3' app stores after Trump turns off tap to the Chocolate Factory

Definitely for smart phones, not candy bar phones. This is self evident from all the smart phone platforms that crashed and burned due to lack of apps.

It needs a gapps package, root and a bootloader with which can stick it on there. But it's doable. That's how you install Google stuff after you've flashed a phone with LineageOS.

Yes but if that were so, Google could offer Google Apps for download to the device since it would be the user of the country who chooses to install it. Instead they appear to be explicitly warning users not to do it or attempt to sideload GApps in the way you might for LineageOS.

Yeah right

Anyone opening Huawei's app store is likely to be confronted with an empty larder. Soon after they'll be angrily returning their phone to shop and complaining that it doesn't have Google Play on it.

I'm actually somewhat surprised the likes of Carphone Warehouse are trying to foist these devices onto unwitting consumers given the high number of returns they likely experience.

Talk about making a rod for your own back: Pot dealer's seized €54m Bitcoins up in smoke after keys thrown out with fishing gear

Re: So if the new owners cannot access them....

If they have the wallet.dat files then they can pound away on them day and night until they crack the password. Maybe he's been super-smart and used 20 character random strings or maybe he hasn't.

Perhaps the Irish Criminal Assets Bureau offer a bounty - crack the code and get a % - probably more profitable than mining bitcoins.

Re: Daft or smart?

Sounds a bit fishy to me

Flat Earther and wannabe astronaut killed in homemade rocket

Too bad he couldn't attach a camera to a balloon.

Messages of condolence...

... flooded in from all 4 corners of the Earth.

Apple drops a bomb on long-life HTTPS certificates: Safari to snub new security certs valid for more than 13 months

Ludicrous

Why does it matter if a cert expires 100 years into the future? Does it compromise the validity or security of the cert with a spiffy hash, key length and signature chain today??? Of course not.

Since certs have a start and end date it would make more sense to look at how *old* the cert is (ie. now - start date) in combination with the key length, hash and other particulars to determine whether to accept it. For example a 5 year old cert using SHA-2 256 might be considered fine but not if its using SHA-1 since the viability of collisions.

But that more depends on the key length and hash being obsolete and honestly, even if the key were brand new but deficient it should be rejected any way. In other words I don't see cert age even being a cause for concern.

Don't Flip out or anything, but the 'flexible glass display' on Samsung's latest pholdable doesn't behave like glass

Re: Lawsuit time

There is an expectation that a glass screen is harder and less deformable than plastic. Otherwise what's the point? If you can destroy this screen with a thumbnail or a bit of grit then why even bother?

Real glass does actually flex by the way (think fibre optic cable). It's just a matter of making it thin and resilient enough that it can repeatedly bend the radius required by these sort of devices. And if they can't do that they shouldn't be making devices or should be prepared for the inevitable lawsuits.

Corning have been developing a flexible gorilla glass. I doubt it will be tough as existing inflexible screens and might have bending radius limits but one hopes it is tougher and less deformable than plastic. Whatever Samsung is using on their screen and claiming to be glass clearly isn't.

Lawsuit time

Having an allegedly glass screen that can be permanently marked with a fingernail is a lawsuit waiting to happen.

Bloke forks out £12m, hands over keys to tropical island to shoo away claims that his web marketing biz was a scam

Re: One born every minute

I haven't been to Oxford Street for years to say. But I was googling after writing this and there was a Reddit conversation from last month that says they're still operating.

https://www.reddit.com/r/london/comments/entsxt/mock_auction_scam_in_oxford_street/

I used to go in and watch them to amuse myself. They did genuinely give a few bits away to hype up the crowd. I remember getting a sandwich toaster with toasted cheese stuck to it so God knows where it came from. The only thing I kept was a Russian manufactured transistor radio which looks pretty retro so maybe I'll sell it some day.

Re: One born every minute

I've seen this first hand. The "mock auction" was a popular scam on Oxford Street about 20 years ago. People would lose their collective minds bidding on increasingly expensive counterfeit junk because they were so whipped up into a frenzy thinking they were getting bargains.

Re: The pillage of the scammed

You'd think. But people can do things against their better judgment because the scam promises them they desire that is hard or impossible to attain by other means - weight loss, wealth, a longer penis etc.

It's Hipp to be square: What happened when SQLite creator met GitHub

Rebase can be very useful

If I'm working on a feature branch with some other people and I've locally committed stuff and other people have committed AND pushed stuff, it makes for a far neater history if my changes are rebased (i.e. played on top of) the incoming changes. Otherwise it is a dog's dinner of merge points throughout the code.

Additionally there are times where somebody screws up big time and commits something you'd rather didn't exist at all in the history. In which case you may wish to interactively rebase through the history, skipping the things you want omitted.

Rebasing shouldn't be used without knowing what it's purpose is but it definitely has one. In addition, the "rewriting history" argument could apply equally to squash merges. In our organisation we use squash merges for bug fixes and personal work to condense a bunch of BS commits on some branch down to a single commit on the mainline. That reduces a heap of meaningless comment noise and makes it easier to revert the change if needs be. We only preserve history and use merge points when bringing in a large feature, or when we want to merge from the mainline back into the feature.

In a high-security preview, we got our claws on Samsung's Galaxy S20 and S20+... which are annoyingly good

Probably not

Samsung follow Apple in thinking of ways to screw some money out of customers. A headphone jack only costs pennies and for many people is an essential or at least useful addition. But that's no good if your goal is to sell overpriced bluetooth earbuds to people with more money than sense.

Crypto-upstart subpoenas Glassdoor to unmask ex-staff believed to be behind negative reviews. EFF joins the fray

Well if you lay off staff...

... you've got to expect negative reviews. People get a tad annoyed when they are out of a job.

That said, Glassdoor is a terrible site akin to Yelp & others with sloppy vetting of reviews, and a clear financial incentive to shake down companies to have their negative reviews removed or shunted for more positive ones. It'll be interesting to see what discovery says about that.