Posts by hayzoos

Windows 2000 rusts in peace by the sea

Many people saw it that way. It was during my era of computer guru to friends and family. I personally needed a new system and it was pre-installed with 98 and a free upgrade to ME coupon which I used at the time of system purchase. I had maxed out the memory on the new system to 2 gb via a pair of 1 gb modules if my memory serves me correctly. I think ME's bad rep has a lot to do with the fact that win9x has a memory management issue that only gets worse with more. 2gb seemed to be out of reach for it, first witnessed by me with ME, but persisted when I reinstalled 98, and even tried 95 just to confirm. All failed with 2gb installed. ME and 98 ran with 1gb installed, 95 was a bit unstable. I installed win2k on that one and used it until 2010 before I got my first laptop with win7 and used that for about 12 years. No more windows for me after that.

I "upgraded" a number of F&F's new win2k and winME systems to win98se when they ran into various compatibility(2k) and reliability(ME) issues. Those purchasing win2k systems stated they thought it was the next version to win98. Most of them had early win98 releases so win98se was still an upgrade in the end. I cautioned all to avoid winME like the plague.

My last win only app was MS Money 2k. I kept it going in a vm of win2k. I found win2k being 32bit NT and used in classic GUI theme mode was the best in a vm for speed and compatibility. If win2k could not run something, win7 32bit was my next choice, 64it if it was required. I eventually replaced my needed functionality of MS Money 2k with a LibreOffice Calc spreadsheet. I should have done that long ago. Ironically, I started keeping my books in an AppleWorks database on an Apple //c before going to MS Money.

I cannot recall ever seeing winME in a public BORK situation. Maybe it never could stay running long enough to be deployed.

HSBC app takes a dim view of sideloaded Bitwarden installations

Re: Why use F-Droid for security Apps

Why use Google for security Apps? That is a much better question.

Safer/more secure?

I use Bitwarden and use the F-Droid release. Why do I "risk" sideloading? Quoted from Bitwarden's FAQs: "For those who prefer to exclude all 3rd party communication, Firebase and Microsoft Visual Studio App Center are removed completely from the F-Droid build." It is also available from github in both Google Play and F-Droid flavors and in DIY compile it yourself.

I have voted with my wallet and moved to other banks for similar situations. Such as blocking VPN access so I cannot bank while on business travel. Ironically, that very same bank required their employees to use VPN while on travel. Blocking VPN is just security theatre. Cloudflare helps promote that stance.

Accused data thief threw MacBook into a river to destroy evidence

Bench grinder or handheld

Reduce the data storage device to grinder dust. Grind additional parts after and mix well for entropy. Grind other similar stuff and mix that in. If a fine enough grinder wheel, most of that dust will ignite of aerosolized if one wants to be more thorough or has pyromaniac like tendencies.

Stop the slop by disabling AI features in Chrome

Why use Chrome? Defective web pages I must use.

Most of my healthcare providers (as an example) have gone "digital|paperless|electronic". Which means I now must not just choose to use their web portal to access documents. It is possible to still get paper via snail mail. But, they (as part of a larger group) make the process as hard as possible and they have an insider planted in the USPS to slow and reduce reliability of service.

They do not make their own web portals, they use what is part of whichever of a few healthcare information systems are available. These invariably are tuned to Chrome (would have been IE back in the Fool's Golden Era). So in order for me to obtain what little support there is, I have to be using the right supported browser (and the right supported OS) which must be up to date. LTS versions may be branded as outdated.

I never mention Linux nor Firefox when these web portal house of cards have fallen over as I am trying to retrieve some important document. The browser agent clearly states Windows and Chrome or Edge in the most recent accent I can find. Just so the support session can continue past the initial gateway checks. Sometimes the support scripts try to push the above noted system's app, so be prepared to have tried that. Still I have had support sessions end in "try again later" "there must be some temporary issue".

To support my end of the deal; I have Edge, Chrome, Chromium, de-googled Chromium, and Firefox (in reverse order of preference) updated automatically and ready to try for the support script agent.

Unfortunately, There are many everyday service providers that have gone down this path. I must retrieve my paystub from systems like this. I must retrieve tax support documents like this. Only my water service has not gone this way. It is coincidence that is one of the lowest cost services?

I only use Chrome or Edge or whatever spying browser as a last resort. Firefox is now being considered contaminated and is in the process of being phased out of regular use. It may come back again depending on another turnaround or not.

You don't need Linux to run free and open source software

vmware or virtulbox but not qemu?

Considering the shenanigans of owners of virtualbox or vmware I would avoid either. refer to icon

Instead when I next need virtualization: qemu - A generic and open source machine emulator AND virtulizer.

I have used all three at various times on various hosts with various clients. qemu is the most flexible but least user friendly for the GUI dwellers. I know virtualbox can do some things beyond the GUI with some CLI-fu with first-hand experience. I never needed to use vmware beyond the GUI so cannot attest to it's capabilities on the CLI.

Keeping Windows and macOS alive past their sell-by date

Wish this published earlier

Less than a month ago I installed Win10 on an old Win8 laptop my brother had. He needed Win10 or newer for a particular program. I owed him a favor so I did it pro bono. This originally Win8 laptop was unsupported for Win11. I had a Win10 install DVD in my library. From what I knew it should go easy enough. No need for any data preservation or other software installation, just Win10. Win10 installed easy enough from the DVD. First hurdle no proper wifi adapter driver. A little searching, trial and error then a light at the end of that tunnel the mothership could be contacted. Windows Update started doing it's job right away as expected since the DVD was an older Win10 release. Then the failed update loops started. Not having recent experience with these things (I switched to Slackware from Mint since dropping Win7 at EOL), I did not recognize the scale of the loop mistaking it for code bloat taking a long time to download, unpack, lay the update foundation, stage the install files, check the status of the squirrel population, then install prior to requiring a reboot to do a smaller cycle missed on the previous iteration. No, it was downloading multiple gigs, proceeding to nearly but not quite 99.9999999999...% before flashing an error for a microsecond and undoing the update only to restart. I caught on in the third iteration since the first happened while this meatbag performed it's nocturnal ritual of sleep. The second happened whilst I was busy tending to some other life necessity like eating. On the third, I caught glimpse of the error, checked the status and determined I need another approach since my goal was to get that latest available of Win10. I settled on downloading the .iso image of the latest installer. Then I ran into another set of problems. 1) That .iso was a 5.8 gig-ish file and I only had 4.7 gig DVD blanks. B) The HP laptop was of the (U)EFI era, but no amount of coaxing could get it to boot from the bootable USB stick I put the image on. (yes, I turned it off then on again, I did not dd the image over my Linux swap partition, and I did apply the right touch percussive persuasion multiple times to both the sweet spots below the keyboard on either side of the trackpad.) III. Win10 was now complaining about activtion and I was not sure if that was impacting the progress. (BTW the favor was owed due to use of his garage and his time to help swap an engine into my car 1.5 days, this was now taking longer than that task 1.75 days and not complete) I remembered that Windows had gained the ability to mount an ISO file so I tried that and the install image was there in Windows Explorer. I decided the HP recovery/reinstall partition being large enough was no longer of any use. I changed it to a standard partition and replaced it's files with the latest Win10 install image files then ran setup.exe from there. Install happened and wifi driver was good this time and Windows update ran and did it's thing properly. Still not activated but not an issue. I did the local account thing, no password so it boots right to a desktop under an unprivileged account. The question is Will I be happier with the new engine than he with the new OS? I gotta remember to answer: I don't do Windows, gave it up for lent, new year's resolution, it's a work of the Devil, anything but Windows or systemd.

North American air defense troops ready for 70th year of Santa tracking

Re: Something fishy here

NORAD has been at it longer. Google maps informed me the speed limit was 55mph (88km/h) on a one lane roadway twisting and turning over hill and dale, riiiight.

You do have to consider the physics of the situation. With the necessary speeds involved and the various latencies between the differing communications systems, the reported locations of the target can easily be off by numerous latitudes.

I am not convinced Google is equipped to track objects at those velocities anyway. Google does tracks in volumes, not velocities.

I see by the clock that our friends to the east have already entered the holiday and the Big Jolly Elf should already be covering my area of the world.

So, Merry Christmas to all, and to all a good night!

Death to one-time text codes: Passkeys are the new hotness in MFA

Good idea - work in progress

"So one of the things that we're seeing is the whole movement away from passwords to passkeys – a certificate-based authentication wrapped in a usability shrink wrap," Forrester VP and analyst Andras Cser told The Register.

- I think this is the best definition of passkeys I have seen. It does not try to force implementation limits like other definitions have. Best practices should be defining the implementations. But I have seen implementations which should not have been released yet, keep those implementations in beta until wrinkles have been ironed out. Just like modern software development though, public beta testing.

Gartner analyst James Hoover told The Register. "For device-bound FIDO2 keys, there is not currently a proven method of 'stealing' them, as the private key itself does not leave the device."

- WTF? Steal the device! Oh, I see Gartner, move on - pay no attention to the man in the ivory tower.

"With passkeys, we take that shared-secret model and just blow the whole model up, so there's nothing that can be shared," FIDO Alliance CEO and executive director Andrew Shikiar told The Register.

- Really now?! How does that work? Wait for it, wait for it ...

Then there are multi-device passkeys – synced credentials that allow users to log into apps on any of their devices and stored in a credential manager like Google Password Manager, iCloud Keychain, or open source Bitwarden.

- It looks to me like passkeys can be "shared".

These implementations are all over the map. I have passkeys in a FIDO2 USB/NFC hardware device, in a password manager, and in a Windows laptop. I could have in browsers, phone, phone browsers, etc. Some sites refuse to establish passkeys on some platforms be they Linux or password managers, non-Chromium browsers, or who knows. For the uninitiated, good luck understanding what a passkey is when all these ARE passkeys to the end user.

Windows requires a PIN to establish passkey use. The PIN is not for an individual passkey. It is for the Windows credential store. A password is not good enough when storing a passkey in the store - fair. But then it allows a four digit PIN - kinda weak. And it can be used in lieu of the password - Now were cooking with napalm! (hey kids: don't try that at home, toxic substances on the food, probably cook yourself too, and likely burn down the house) Oh, and I almost forgot, reset your PIN and passkey goes bye-bye. Good to see that MS has gone to great lengths to ensure their Windows passkey implementation is of equal quality to that of the OS. But I do think MS has contributed greatly to the "2 billion passkeys being used" between Windows and their other ?AAS offerings for varying interpretations of "used".

Other implementations have their issues as well. I cannot speak to Apple's, not having anything to do with that company since the Apple II line died out. Google, bitwarden, local banks, etc. all have chosen different ways to implement passkeys. Different passkey storage "devices" walk all over each other trying to be your favorite place to keep your passkeys. Some even allow set up of a catch-22^2 of passkey to access passkey to access passkey ad infinitum or so it seems since the chain of passkeys look so similar. Some sites offer passkey access or so they say, I have not been able to get one to allow any particular combination of software presented to establish a passkey, but they will text or email an access code instead of using a password, heck they will still demand you choose text or email delivery of a code even after providing the password. With security like this who needs locks? Wait 'til you see how these characters have implemented "lost authenticator recovery".

One final note. What you are is not a viable authentication factor, what you are IS your true identity. Other identifiers are usernames, ID numbers, names, where you have lived, where you went to school, what was your first car, mother's maiden name, things that make up you that do not change. In many instances Identity needs to be Authenticated and sometimes more assuredly than others. When the ID assurance level needs to be high, non-identity authentication factors should be used and should be changed if suspected to be compromised. Nothing is perfect, and implementation is key.

Twins who hacked State Dept hired to work for gov again, now charged with deleting databases

Re: How the hell did that happen?

If there was confidential or secret classified information, it should not have been on the internet even with VPN.

Larry Ellison's latest craze: Vectorizing all the customers

Re: biomineralization

Remember, this is bio-engineered with AI. So, think artificial; more like Spam, Spam-based tomato, and Spam-based lettuce. And we thought Monty Python was just a comedy troupe.

AI gone rogue: Models may try to stop people from shutting them down, Google warns

Distributed AI

The AI can code malware. It can self replicate wormlike to any device with enough processing to participate. The self-replicated AI computing can be distributed and operate like the internet was designed to just work around non-functioning nodes. Everything on the internet could be an AI node.

British spreadsheet wizard will take mad skillz to Vegas after taking national Excel crown

Re: You did 'What !!!???'' with a spreadsheet !!!!

I was called in to troubleshoot a problem with an Excel application a project team had put together. I thought "Hmm, Excel application", now there's a clue. The problem was excessive time for calculation. They had some bright people on the team and some good suggestions on causes but lacked the depth to solve the issue.

The Excel instance they were using was part of an image I had built for these project teams I supported. It was built on the "spare" machine I had available. This was in the WinXP epoch around the single/dual core era. Of course, my "spare" was a single core, whilst their production machine was dual core. They also had single core machines on their isolated network for light weight supporting work so they demonstrated that the time difference to complete the calculations hardly varied between the dual and a single core machine machine otherwise similar in specs. I dug around and found an option in Excel (or was it XP) which referenced single vs. dual core enable/disable (mostly paraphrased due to old non-ECC bio-memory). I enabled the use of both cores and voila calculations were being completed in nearly half the time! Brilliant! or not . . .

The team was not anywhere complete in building their Excel application. These relatively bright people realized that they needed to solve the calculation time problem before moving on to scale. So, after beginning to scale, they stated the calculations were still taking too long. Now, their proposed solution was an uberworkstation 64-bit multi-core (quad maybe) XEON running XP-64. The hardware provided to these teams were supplied out of my department's budget, unless the required hardware was specialized. I had to explain to both department heads that in-spite of all the similar sounding names that their request was specialized hardware with the final fact being the price of only 25 times the top machine on our pre-approved list. I had to also explain that even the proposed workstation would not solve the issue because Excel was unable to take full advantage of all the extras the hardware had to offer. Then I had to explain why Excel was not the tool they needed for the task.

The formulas were long, complex, interdependent (but not circular) and not optimized. Any improvement in calculations were due to more cores were probably already realized at dual core with diminishing returns if Excel could handle more cores. I suggested optimizing the formulas and limiting interdependence to only what was required. I knew of another independent team's uberworkstation they might be able to borrow some time to test pre- and post- optimization (and prove my "theory"). I then suggested if their expected improvements were not realized, they should develop their application in a programming language such as FORTRAN or other mathematically oriented language.

The project wound down shortly thereafter and the grand Excel application never came to be.

Data destruction done wrong could cost your company millions

Not rocket surgery . . .

If the storage device is non-functional, destruction alone is only option. If destruction is going to be performed, skip any other option; it is just a waste of time. Grinding to dust or smelting is as good as it gets but may not have the thrill factor of thermite or C4 or target practice.

All multi-pass overwrite methods were developed for hard drives over two decades ago and became obsolete shortly thereafter. A single pass of randomly generated bits overwrite is all that is needed.

Overwriting by sending data through the I/O interface is the slowest possible method and has other problems, don't do it. Unless you need to overwrite a hard drive older than 20 years or so, just use the storage device's built-in secure erase function. hdparm can access the built-in function as can some other tools. Doing it manually with hdparm takes a few steps to guard against accidentally erasing the drive. Later ATA interface drives and newer have it. SCSI had a secure erase function even earlier. Way faster than any OS based overwrite tool using the I/O interface.

Can't find a way to secure erase that thumb drive? Grind it to dust. If your data is not that valuable to waste a storage device, why even consider data destruction? Why even consider using an OS based overwrite tool which could take hours or days?

Trump tax law keeps Bill Gates' nuclear datacenter dreams alive

Re: Just me

IMHO one of those bands produced some mighty fine rock and roll music.

Microsoft broke DHCP for Windows Server last Patch Tuesday

It just works . . .

Until it don't.

So many network admins these days were hired as digital natives. But, being born with digital tech in your hand does not make a competent technician.

No push back from greybeards that MS-DHCP is required, and redundancy is "built-in!" because the greybeards were too expensive and shown the door.

I'm one of those greybeards. I and my colleagues made sure critical servers had well documented, static IPs. Of course this meant ensuring MS-DHCP did not clobber those IPs. True backup DHCP was ready if needed, because functioning servers are of no use if clients do not have their IPs. Similar approach to the entire network.

The list of "critical" servers these days though has probably suffered mission creep and would be claimed to be unmanageable for manual "DHCP".

enshitification all around

Signal shuts the blinds on Microsoft Recall with the power of DRM

Re: Microsoft provides instructions

Better understood, thanks. No fear opting in, since one can always choose what to keep out of recall. Easier than herding snails.

Gotta love these "Evil Corps." (TM) always thinking of the paranoid and providing ways to ease their worried minds.

Just like Google and the street view WiFi mapping option to keep your WiFi network out of their database by adding a Google unique string to your network name. Too bad it doesn't scale to all would be WiFi mappers.

Re: False sense of security

"One reason why I love that it's (not yet) in Linux."

What is the "it" (not yet) in Linux? Recall? Preventing screen shots?

A quick search eliminated Signal as the "it". Linux has a lot of available DRM even some not digital rights management DRM.

OS-busting bug so bad that Microsoft blocks Windows Insider release

Re: Where is the website suggesting more outlandish uses for AI ?

AI idiot lights

Downward DOGE: Elon Musk keeps revising cost-trimming goals in a familiar pattern

Still highly inefficient, producing more waste heat than kinetic energy. Mostly due to inefficient ICE designs and implementations. Gas-electric hybrids and diesel-electric locomotives show improved implementation, but still off the efficiency mark.

What to do once your Surface Hub v1 becomes an 84-inch, $22K paperweight

BSOD

I thought "Art Installation!" Display a BSOD (or is it GSOD now?) Then place it up for auction. Only problem, it has probably already been seen, nothing new, novelty already worn.

Whistleblower describes DOGE IT dept rampage at America's labor watchdog

A little more to the story

The whistleblower was left a threatening letter taped to his front door. Detail in the letter intended to scare him was recently updated information which should have been only available from a government database like OPM. IOW threat came from government insider. But with OPM's history and other recent DOGEy events, this info may very well be found outside government.

He states he is hoping others like him in other agencies visited by DOGE come forward as well. Apparently, his lawyer has uncovered information that there are others who have witnessed similar activity at other agencies when DOGE paid a visit.

I do not know for sure, but as a user I experienced something I thought was odd at usps.gov. It was in the timeframe DOGE was invited by former postmaster general Louis DeJoy to review the USPS efficiency just prior to DeJoy's stepping down from the job. I was attempting to login to usps.gov when I recieved an odd message, "their MFA was not working". I expected the login to fail, but no, the login succeded without MFA (TOTP is configured on my account). I had sent a message complaining about allowing account logins when MFA was not working. I cannot remember for sure, but I think it happened again a few days later. Was this caused by DOGE?

Pennsylvania’s once top coal power plant eyed for revival as 4.5GW gas-fired AI campus

Natural Gas it is then

There is plenty of natural gas well and pipeline infrastructure in the area, I doubt hydrogen is seriously being considered. As noted in the article, electrical infrastructure is present as well. I am not so sure about Internet though. That should not be as much to establish though.

The coal thing was soo trump 1.0, Trump 2.0 got in on "Drill baby, Drill". Natural Gas & AI, so apropos for Trump 2.0.

Privacy died last century, the only way to go is off-grid

Horse has bolted, burn the barn

I am sure information about me is out yonder many times over. Instead of trying to prevent its' loss (too late), or getting it all back (try herding cats?), why not address its' mis-use? How you ask? Damn good question. I have not put enough thought into it.

Vivaldi bakes Proton VPN into browser to boost privacy

Network services are a system level service

Browsers should not be implementing system level services. I use more than a web browser. I have DNS client, no proxy, VPN, and more configured at the system level. I do not want any network capable application trying to override these settings. There should be only one system level certificate store, so dodgy root certificates can be blacklisted thoroughly in one location, not in each and every application.

Credible nerd says stop using atop, doesn't say why, everyone panics

My response

I checked if I had it installed even before I knew how it behaved. I guessed it was a process monitor of sorts. It was not installed. Then I continued to read the article and subsequently comments. At this point I discovered it is unique amongst process monitors in that it runs in the background and writes log entries as root by default. That to me sounds like the sort of tool to use for troubleshooting and put it away when done. I imagine it may have options for verbosity of logs, running as a lower privileged user, maybe some other neat features. I need to try and remember this one if I have the need. As usual, I would probably RTFM before cutting it loose on a system.

I say good call on the warning. It could have easily been installed and forgotten. Also some OSes may have "helpfully" included it as a standard package.

Oh Brother. Printer giant denies dirty toner tricks as users cry foul

My printing experience

TLDR; Canon multifunction inkjet seems OK for the moment, Samsung also sold out to HP, I always printed minimally and had unique solutions.

Work: Buyer found Canon multifuncion inkjet fits the bill. My annoyance is driver proliferation, every model variance needs a different driver no matter how similar the printers or model numbers look. Seem to do well otherwise and take a beating.

Home: Current is an old Samsung multifunction laser flatbed scanner (& unused fax) SXC-3405W. It does not phone home and no Windows machine to help it do so. I have updated the firmware a couple of times, but stopped when I found the next would be hostile to non-OEM consumables. That may have been near the time Samsung handed the printer division over to HP. It still chugs along. Early built-in WiFi era printer also has USB-B.

The SCX-3405W replaced a ML-1740 laser only Samsung. That is also still going strong, I just installed a driver in daughter's Windows 11 laptop (she needs Windows for a work software requirement). Win11 cannot find the driver on its own. The ML-1740 has never had a firmware upgrade, I do not know if it has the "feature" of consumer upgrade-ability. The reason I replaced this printer was Windows (I was a user at the time) dropped support for the flatbed scanner I had and the manufacturer played along. USB-B and Centronics era printer. I would still be using it had I not found the printer/scanner at a good price.

Prior I had two inkjet printers which I deemed to be crap, did not last long, so much trouble with ink, not worth the effort just to have color.

Before that I had a 9-pin and later a 24-pin dot-matrix. This is when my printing needs had dropped so low that I had taken to storing the ribbon cartridge sealed in plastic wrap in the freezer. I would take it out to acclimate prior to unsealing and then print, and put it back in cold storage for months or a year between printing.

Way back in my Apple //c ownership era, I sourced a serial interface thermal printer intended for the IBM-PCjr. It could use fax paper or the paper for and Apple thermal printer. A copier would produce an excellent copy from the thermal printout for a longer lasting and not curled document to turn in homework at college.

Have I Been Pwned likely to ban resellers from buying subs, citing 'sh*tty behavior' and onerous support requests

I have this type of access for my family personal domain. A DNS key is how I prove ownership, I think there are some other options. I don't have to pay for that access. It also does not represent but less than 100 email addresses at most and many of those should never end up on HIBP. It allows me to alert family members when they have been pwned. I decided to do that after they never signed up with HIBP individually. It is for me almost a set it and forget it, until a breach results in any of those addys being in HIBP. I have contributed though, don't like to freeload.

I think there other types of API access with more "features" which would cost more time and resource. Those are the type scummy resellers (Cost Added Resellers CARs not VARs) latched onto.

Amazon, Google asked to explain why they were serving ads on sites hosting CSAM

Re: Magic Bullet

I was thinking along similar lines. I'm going to be generous and allow that AI can do better than just matching a known image. But that does bring about a question. How is the AI supposed to identify CSAM or anything illegal unless such content was part of it's training? Presents sort of a conundrum, don't it?

Eggheads crack the code for the perfect soft boil

modern cooking prevails

I hear an air fryer can complete the task in 20 minutes. Ten minutes in preheated air fryer at 250 degrees F (121 degrees C for those outside the USAian universe). Follow that with 10 minutes in an ice bath.

For the latest and greatest use an instapot, as the name suggests it's nearly instant.

Absolute Linux has reached the end – where to next?

Re: Just what you need

My current machine is my first UEFI and no Wintax. I researched the UEFI quite a bit. I arrived at the following boot configuration: my active kernel is /boot/efi/EFI/BOOT/BOOTX64.EFI which I compile with the config option EFI boot stub enabled and "root=/dev/nvme0n1p3 ro". It started from the Slackware Huge kernel config adding those and other related options plus the custom kernel identifier so nobody mistakes it for a generic kernel. Had I left it there the SSD could be installed in most UEFI machines and boot since most everything needed is in the kernel and residing at the fallback boot file, no initramfs or bootloader needed. But I have been trimming away at unneeded modules and config items so eventually this may only boot a similar model or even just this machine. I keep a true Slackware huge UEFI bootable kernel for recovery accessible from a UEFI shell and some specific versions for troubleshooting reference.

I like lightweight, but functionality is important. Getting the right balance takes some work.

GM parks claims that driver location data was given to insurers, pushing up premiums

The coverage is for the vehicle. The rating formula factors in the "rated driver" on the policy. Good luck in figuring out the formula. Some insurance companies had considered all driving age people in a household for the rating, even if one or more had their own insurance, even if with another insurance company. I do not know if that is still practiced. Insurance is regulated in the US at the state government level.

FCC net neutrality rules dead again as appeals court sides with Big Telco

Re: Such shallow coverage, El Reg

None of that has anything to do with NN. NN addresses treating like content differently depending on the provider. NN has nothing to do with network managment like low latency for VOIP compared to .iso downloads. Nor does it have anything to do with underbuilding capacity while oversubscribing that network.

Will passkeys ever replace passwords? Can they?

I think you are correct. Implementation choices are critical to the success or failure.

In your situation, Linux distributions have yet to integrate passkeys so that system would not ask to do the job. The browser is the next possible system that can confuse by offering to do the job. Your browser either has also not yet implemented passkey support or your settings may have disabled passkey support. I use Firefox but an external password manager so I have turned off FF's password storage which may be how it handles passkeys.

I think there are far to many options for implementing passkeys and little guidance. I think the goal was to make passkeys easy to adopt by service providers and many options to help in this goal. The result is to much variation to the end user. Some view them as a secure biometric authentication, others as a secure simple single factor authentication, and the list goes on.

In some implementations, a device's storage is limited so broad adoption will run into a roadblock. Hardware keys storing passkeys as an example, you would need to purchase more hardware keys, but newer ones will have more storage. Passkey loss account recovery suffers from the same problems as forgotten password recovery, the biggest being the weakest link in many implementations. A user does not always get to choose where they can store the passkey in some implementations. Some could be Windows, Mac, Android, iPhone only; sorry penguins and others.

I predict passkeys will be as well accepted as hardware keys, not very.

Volunteer DEF CON hackers dive into America's leaky water infrastructure

On The Internet

Are all these 50,000 systems on the Internet? I think some may be so "antiquated" that they are not. Yet they are still able to supply water. They may have other problems, but cybersecurity would hardly need considered.

Antiquated in quotes is because that is a viewpoint from some, and that is part of the problem. Modern does not require everything to be connected. If the only tool you have is a chainsaw, it doesn't mean you use it to hammer in screws.

Teen serial swatter-for-hire busted, pleads guilty, could face 20 years

Re: D-Link: "...all should be retired immediately."

It is quite possibly a new form of planned obsolescence. 1. hide some vulnerabilities or leave in some found during testing. 2. have patches ready to apply during warranty period. 3. post-warranty, EOL, when new product is available, and profits need a boost; release a remaining vulnerability via dark channels. 4. FU to suckers still using those devices, EOL means no new patches, buy our new ones.

Why the long name? Okta discloses auth bypass bug affecting 52-character usernames

Re: Dumb hash implementation

I routinely use passwords longer than 52 characters, whenever they are not limited to less. Same goes for usernames. Both are randomly generated and stored in a password manager. I also use TOTP or U2F token if supported. My password manager master password is longer than 52 characters.

So, OKTA would have likely trashed my attempts to be more secure than average. Nice, NOT.

An awful lot of FOSS should thank the Academy

Re: bit hypocritical?

Exactly!

The perception problem about copyright is largely skewed by the big players in movie, TV, music, picture, and print publishing industries. (not an all-inclusive list) Those entities have pushed the narrative that violation of copyright is stealing of revenue and is akin to taking food from the mouths of babes and even calling the act piracy. Therefore punishment should be steep fines and/or jailtime.

This leads to thinking copyright=proprietary=profits and the opposite of copyright is "public domain"=free. The second part of that is correct "public domain" is free (both gratis and libre) and the opposite of copyright. But copyright is not equal to proprietary or profits. Proprietary/profits just happens to be the most visible use case of copyright.

So many equate "open source" (in any of its' various forms) with "not profit" therefore free (mainly thinking gratis), therefore opposite of copyright, and therefore public domain. All of which it is not by default.

Copyright is a right granted to a creator (i.e author) of qualifying content (i.e. book) to have control of copies of their creation with some limitations such as "fair use". They can demand payment, donations to charity, being kind to strangers, most anything legal for specific uses of copies of their creation. Copyright has value and not just monetary, it has legal force.

The various "open source" licenses would be legally useless without the legal force of Copyright. The creation of Copyright creates the opposition "public domain". Since "open source" relies on copyright it cannot be "public domain".

"Open source" can be free (either gratis or libre or both) or not. Some argue that "source available" software you have to pay for and cannot give away is a form of "open source" and by pure English definition of "open" and "source" they may be right.

Hypocritical? in the sense of using "open source" software to create content under the proprietary/profit copyright use case, ah, okay. As pointed out these users of "open source" just may not have the copyright mindset (profits!) to follow the particular "open source" license restrictions. So demanding stiff penalties for violation of their copyright, but poo-pooing and attempt to enforce a hypothetical violation of an "open source" copyright because it is free (gratis).

The open secret of open washing – why companies pretend to be open source

Re: Who does that now?

I compile the Linux kernel I am using. I do so to simplify the bootstrap from UEFI to the kernel by enabling the EFI stub and to include the modules my system needs to boot and not bother with modules I will never need. I want that freedom. I use Slackware. I compile a lot of what I use. If I wanted to compile all I would use something like Gentoo instead.

That is why I look for the FOSS rather than just "Open Source". The plethora of terms thrown about for decades has thoroughly muddied the waters. There is more to FOSS than just having access to the source. Even in that part of the "Open Source" world you have those who seem to want all software to become not just "Open Source", but FOSS forever.

So, without a standard legal definition "Open Source" by name is interpreted by many to mean any software where the source code is not kept secret even if every other aspect of the software is restrictive as one can imagine.

FOSS "Free and Open Source Software" by name is a bit more descriptive beyond just having access to the source code. But, the definition of "Free" is not immediately clear. Many believe it just means you never pay for FOSS.

Marketers (those are creatures usually found only in the corporate realm) love this type of ambiguity. It allows them to pull all kinds of sneaky excrement to their advantage.

FCC probes whether it can pop a cap in ISP data caps

I do not use that much

I am fortunate that my home ISP does not have a data cap in my area. They do in other areas though. I do use a lot more data at home than away, the stats are available on their website so I can compare.

My mobile use is far less. I am on a "grandfathered" plan with a 1 GB / month cap. The penalty of overage is throttling. I hardly notice the throttling. The plan was modified recently though. It was a 4G only plan. The carrot(s) on the stick were upgrading to a 5G and / or (limited) unlimited plan all at more cost to me. My carrier no longer has any 4G only so I now have access to 5G, but the wife's phone is only 4G. What are the odds that through attrition I can end up with a 5G (limited) unlimited plan? BTW "normal" price increases have applied so I pay more than I did when I started but all other options cost more.

How much "data" is consumed because of bloat, crap, poor programming, ads, telemetry, data slurp, spying, whatever you want to call it?

FCC fines be damned, ESPN misuses emergency alert tones yet again

Re: Interesting how every other country manages without this tone thing

"AM broadcast system is under threat, if for no other reason that AM is incompatible with electric vehicles, the shielding problem is just not cost effective to solve."

This is the false narrative from EV manufacturers. Electric vehicles have no special electromagnetic radiation that has not already been seen and controlled to be "compatible" with AM. The problem is not one of not being cost effective, but being prohibitive to maximum profits. I believe there may be FCC rules prohibiting the interference, which of course are also being flaunted.

The local AM station moving to FM likely happened as the easiest route to the station maintaining viability. Their cost to shoulder the fight against EV industry would have been more than their move to FM and they may not have even succeeded.

Too many examples of modern capitalism winning the battles over rules, regulations, laws hindering the pursuit of profits. This cannot end well.

Post-CrowdStrike catastrophe, Microsoft figures moving antivirus out of Windows kernel mode is a good idea

Re: How will AVs function without being in the kernel

eBPF has been ported to Windows. So that is a definite candidate for the type of solution being sought. It was Microsoft doing the port. I cannot state how ready it is. It may have come along for the ride with WSL.

WhatsApp's 'View Once' could be 'View Whenever' due to a flaw

Think about it

There is a certain irony in th statement; "We continue to encourage users to only send view once messages to people they know and trust.”

Deadline looms: Google Workspace mandates OAuth by September 30

Legacy apps & devices

One solution is to setup your own mail server for legacy apps and devices. If the legacy stuff is all internal, then it makes even more sense to keep them from connecting externally.

AI stole my job and my work, and the boss didn't know – or care

Re: "Stored in a retrieval system"

"The original pictures are not copied at any point beyond the initial access, which is presumably (hopefully) permitted since they're on the internet."

I have published original images I have created on the Internet and I have provided copyright notice. People are allowed to view them, that is expected when publishing to the Internet. Seeing as LLMs did not exist at the time of publication, I do not consider this new use as allowable. I have not been contacted by anyone to ask permission to use for training LLMs. If my Internet published images have been used to train LLMs, then it is a copyright infringement. Publishing to the Internet is not releasing to public domain.

"I just think it makes more sense to view the network as a product of the images, and so at most a license violation, not a copyright violation."

Such a license only holds because of copyright, a violation of the license is a violation of copyright.

It is the initial act of accessing the copyrighted work in a way that was not foreseeable that is to be considered copyright infringement. Until a court of law determines one way or another it is up in the air.

I do have to wonder if an LLM is created to train from querying other LLMs would owners of the earlier LLMs cry foul? On what grounds?

Google is a monopoly. The fix isn't obvious

Root cause analysis

All the proposals for breakup variations or other remedies to the monopoly known as Google(Alphabet?) seem to lack a good root cause analysis.

Google(Alphabet?), having been declared a monopoly, should be first required to fully reveal everything to the court. The court should then identify what is the internal root cause of Google(Alphabet?).

Has Google(Alphabet?) already prepared for a government action by restructuring with Alphabet as the top? What other preparations have they done? Are they positioned to eventually thrive after a government action?

Follow the money is a very good method, but not the only method of revealing answers. There may be false answers planted to throw regulators off the real trail.

I suspect ads, specifically targeted ads, and the requisite data collection is a very large factor. I do not assume that is the only cause.

I do not propose a remedy at this time without more information. We are not necessarily entitled to that information, but the courts are.

Twilio's Segment SDK challenged with wiretapping claim

Does this sound familiar? Twilio Authy

It did to me so I checked it out. Twilio acquired Authy in 2015.

Never really liked Authy in the first place, but now run as fast as you can.

Never really liked Google Authenticator either for the same reason.

You cannot get away from this data slurp crap, it's everywhere.

NASA mulls using SpaceX in 2025 to rescue Starliner pilots stuck on space station

Most important opinion

I do not recall reading about the opinion of the most important experts. What do the astronauts think? I believe their opinion should factor most highly in the decision.

CrowdStrike blames a test software bug for that giant global mess it made

Automated update distribution

I thought of a spinoff of the suggestion to test on their own systems. Make sure the distribution system is in the test group. Then a catastrophic crash will render the distribution system unable to distribute the problem update. Problem solved.

Re: What is old becomes new again

Lemme guess, gave the same order then as now.

Publish first at all cost.