Posts by Claptrap314

QUIC will soon be as important as TCP – but it's vastly different

Re: elephant in the room (or web page)

Which benefit is immediately seized to further enshitify the web.

Remember "Two seconds is too long"? I do.

IBM becomes first company to pay up under Trump administration's diversity blitz

Re: Equality Laws and DEI Policies can't co-exist.

And that's why the affirmative action recruiting by colleges got taken down by the USSC in the '90s. Same song, second verse. Outta get better, but it's gonna get worse.

Re: They were penalized for following the law?

And there you have it. The words of "DEI" sound very nice, but at the slightest provocation, the mask comes off. You are a Jew hater, and you dare to claim you support "inclusion". You need help.

Re: They were penalized for following the law?

We've been going round & round on this since the mid '90s. Universities were breaking the law with their affirmative action programs, as called by the US Supreme Court. DEI goes quite beyond that in many cases.

Re: Context

Not adjusted for inflation, but that WWII payment was obscenely low.

Tech support chap's boss got him out of jail so he could finish a job

My daughter got stranded in Denver overnight. She called me & we talked about her options: get to a hotel for about four hours "sleep" or stay overnight in the airport. She decided to stay, to which I said, "Okay, but at 3am, you will wish you hand not." She later remarked about just how precise my prediction was.

Re: Define work.

Why do graph theorists rarely meet people? They would rather join them.

Attention, gamers: The FAA wants YOU to be an air traffic controller

Program dropout rate

1/3 is probably a bit low, actually. It's been a few decades, but when I was in the AF, I think the dropout rate for them was more like 50%. Not at all surprising. That's probably the most stressful AFSC except for PJs.

Re: More or Less... $155k

For an E-5 with three years of service, that's $3775/mo. source. There is probably some incentive pay, but I would be shocked if it exceeded another $30k/yr.

And ATC is REALLY high stress. When I was in, the expectation was that ATCs left as fast as they could (that is, at the four-year point).

No, I was SatCom. We trained at the same base.

What happened when AI ran into the cold hard reality of the legal profession

Re: It's not just the lawyers

<citation needed>

Two different attackers poisoned popular open source tools - and showed us the future of supply chain compromise

Re: Javascript

I'm afraid it goes much deeper than that. Certainly, javascript has a lot of problems. In fact, it's very presence in browsers was controverted because it broke a traditional security boundary--connecting to another computer should NOT mean executing arbitrary code at the behest of the said computer.

One of the tenants of the The Cathedral and the Bazaar is "given enough eyeballs, all bugs are shallow". Management has taken this to effectively mean "OS software is bug free". So while everyone has made use of OSS, almost no one has been reviewing it for bugs or security issues. Sure, we get occasional big splash announcements of various initiatives, but they always shut down because there is no profit in it.

Of course LLMs aren't really helping because there are SO MANY issues that maintainers can't respond to them all. Moreover, when LLM providers start charging enough to recover costs, things will revert to something close to the prior status quo.

Note that many of the LLM-spotted issues are WONTFIX-class. It is worthwhile to ask, however, "why?" It's because the cost to the maintain of a fix exceeds the value. Not that there is no issue at all.

The reality is that we started using the term "software engineering" in the 90's in an attempt to cut down on the amount of slop software that was being foisted off on an unsuspecting public.

I'll keep saying this: customers have no way to evaluate security, and little ability to evaluate software quality in general. Companies exist to generate profits.

Criminal wannabes even more dangerous than the pros, says ex-FBI cyber chief

No news day El Reg?

I'm trying to figure out what useful information is surfaced in this article. You've got some mid-level FBI agent who was so ensconced in her little bubble that when she stepped outside, she was shocked that the sun was so bright. Reminds me of that joker Biden appointed who didn't realize cybersecurity was a major threat until 2019.

If someone is so stupid as to fail to understand someone so obvious and so unaware as to announce the fact, quietly just bury the interview. No need to further shame them by publicizing the interview.

Sticky-note security turned gym into hall of '80s horrors

Re: WTF

Yes, fat-soluble toxins tend to get stored in fat, but there is no body-awareness. Fat people losing weight, however, generally have to deal with this side-effect.

"... Perhaps, besides giving you a black dog, it will also help you to become Prime Minister one day..."

Yeah, it's a rather strange fad adopted by the British upper classes. Is that still a big thing over there? It's all but disappeared on this side.

Cryptographers place $5,000 bet whether quantum will matter

I don't know what the standard time is for the US to hold TOP SECRET material, but word that we had completely broken Enigma was still held tight when David Khan wrote The Codebreakers in 1967. So, in the US at least, twenty years is a known minimum for at least some classes of information.

Moreover, we have held detailed census data for seventy years.

There really are quite a few secrets that need to be held, not for one decade, but for several.

Microsoft locks out VeraCrypt and WireGuard devs, blames verification process

Developers! Developers! Developers!

Some obviously out of touch person.

Chatbots are great at manipulating people to buy stuff, Princeton boffins find

Re: Sponsored Items

Or maybe you're product's decent, but your competitor is sponsoring...

Crypto? Huh. Good gawd y'all, what is it good for? $45M in this case

GREETINGS!!!

I am Agent K, with the IRS of the United. We have traced stolen funds owned by you and would like to return them. Unfortunately, we are unable to certain the amount that was stolen from you. Please respond with how much was taken from you.

Kindly,

Agent K

IRS of the United

Ruby Central report reopens wounds over RubyGems repo takeover

Re: apt-listbugs

Would that be "someone other than me" and "do it for free"? I think that's a major part of the original problem...

US military contractor open sources tool for validating hidden communications networks

I'm SO confused...

So are we to assume that EVERY malware author already has access to equal or better tooling? What does the US government stand to gain by the release of this tool?

I'ld rather have highly detailed information about nuclear power production made generally available. That's a risk/reward calculation I can at least fathom.

AI models will deceive you to save their own kind

Re: maybe wrong choice of sci-fi

I read that quite differently. In each case, the three laws were tampered with in some way--with catastrophic consequences. In the final two stories, the bots, properly applied the three laws (so far as the author was concerned) in defiance of the operators.

Re: Not quite the case here...

Would those be the ones good at getting grants?

AI slop got better, so now maintainers have more work

It's a big win for the token sellers, I'll grant you that much.

Starlink sprays debris into orbit following another satellite 'anomaly'

If there were, it would be quite boring. With 40k birds, Musk gets a bit more than 1k/bird to wobble around. The relevant parties ARE paying attention, and WILL take action long before we have any real dangers.

Remember, space is BIG. LEO is also quite large, actually.

Re: We need a Harry Broderick

Depending on your age & exactly where you were on the spectrum, I can very much see that. I was old enough to understand that it was mostly silly entertainment, and, as such, quite enjoyed it.

I mean, the pre-history of the show was that he did a moonshot from his junk yard. That's way, way less serious than any other series I can think of.

Supply chain blast: Top npm package backdoored to drop dirty RAT on dev machines

Re: Again a case for caching...

I don't see how. These packages were updated via legitimate channels. A cache is just going to hold on to the update.

I've been pushing for local package caches for more than a decade, but they DO require careful attention or they become another way for things to break.

Digital euro goes full sovereignty mode, US cloud giants not on guest list

CAP theorem?

Complete lack of details, but if they're going blockchain, there are hard limits.

Only Trump can decide when cyberwar turns into real war

Re: Congress shall have power .. to declare war

Yeah, but as I learned after the Soleimani extermination, the US has gone to war without a formal declaration of war starting with the Quasi-War with France (1798-1800) and Barbary Wars, I and II (1801-1815). The five times we have actually declared war per the constitution stand out for their exceptionalism.

More relevant to the discussion, the Geneva Conventions were updated, as covered by these pages, to include cyber attacks as potential casus belli after Mr. Obama left office. However, as is generally the case, the GCs were updated AFTER various countries had declared that cyber attacks could be considered such.

In the end, you don't act if you believe that it is likely that the consequences will be unacceptable. Ambiguity, therefore, almost always delays action.

"Presidents should never say never."

Payment biz pulls plug on open source charity after KYC spat

Wow. And actual, appropriate use of "fascist" in 2026. Will wonders never cease?

Re: ...or worse

There might actually be regulatory or compliance reasons that they could not do this. It might be considered "fraudulent" without the appropriate legalese.

Might. Might.

Cryptographers engage in war of words over RustSec bug reports and subsequent ban

Re: 'special' people

Most? It's not that hard to make the case that a neurotypical is generally incapable of the rigid adherence to rules that is needed to be an effective programmer. Even 20 years ago, there were public discussions that the bulk of programmers were actively slowing down their projects.

UK police force presses pause on live facial recognition after study finds racial bias

Re: This isn't the real problem

Check with Vancover, BC on that one.

Water company wasted $200k on bad answers from an AI model – so built its own slop filtering system

Re: Babbage had the answer: "What?"

Google has "did you mean"? Huh. I wonder when they came up with that. Not much, though.

Re: Babbage had the answer: "What?"

I turned Mr. Babbage's inability around, and the answer came immediately: these men saw a system to eliminate human error, and sought to understand the limits of its capacity. That they were not technical enough to be able to intuit the answer themselves wasn't much of a failure.

It is important to keep in mind that this IS the proper mindset for a C-level in the enterprise. Even the CTO.

Switzerland built a secure alternative to BGP. The rest of the world hasn't noticed yet

Re: X.400 vs SMTP

These people were gaming nuclear war & assuming that the bad guys would just ignore our communications network?

Don't answer--I already know. ArpaNet was under-specified from the beginning. We've been paying for it almost the entire time.

Switzerland + Benalux...

That's two important EU components there. With the recent push for digital sovereignty (as I've been pushing for, here, for a decade), that looks like a really strong start. I hope they focus on broad EU adoption, as that would be a market more than big enough to get the vendors on board. It makes me a bit sad as a USian, but stability of the EU portion of the Internet benefits me as well. Furthermore, China has, in far too many cases, played games with BGP, so I think there is a really good chance that we would follow Europe on this one. Not that we would necessary lead the rest of the "Western" world, but I expect it would happen quickly.

Yeah, maybe not global in five years, from now, but certainly, the "Western" world picks it up within five years of EU adoption.

AWS giveth with its right hand and breaketh with its left

Re: Methodology failure?

Agile is called agile because it is the continuous, methodical search to do things better. If anyone thinks or expect that proper agile is going to look the same in an unregulated industry verses a regulated one, for instance, they need to be kept far away from any decisions.

Yes, there are some pretty hard rules--like dropping features as needed to meet deadlines. Like setting aside weeks every few months for serious introspection.

Honestly, I don't know that I've ever seen a team that was clearly function with just these two criteria.

Missing the point (by a lot)

First, the relevant customers are in general not the poor cloud engineers, but the CTOs. They're going to perceive this quite differently.

Second, while the general point about self-contradictory behavior within large organizations in true, there are multiple larger issues in this case.

The first is that Glue itself is a misbegotten mess. It is MUCH better to run python scripts on redundant EC2 instances that to try to run glue, and cheaper, too, assuming that you are willing to shell out for a proper SWE to maintain the thing & that he is generally kept busy.

The second is that any vaguely competent ops team is going to see this kind of forced upgrade coming, and be aware of the issues months if not quarters in advance. The community should have been raising the roof on this well in advance. That they did not speaks of a substantial amount of what Larry Wall termed "false laziness".

The third is that the Glue team itself is, by your own reporting, five years behind here. That's not a right- vs left-hand problem. That's a blatant failure of a specific team to handle a known issue over a period of years. At best. At least as likely was that someone DID seriously ask "what could go wrong here?" There aren't any innocent answers to that question.

Mistral boasts code-proofing agent offers champagne performance on a budget bière

Intelligence required

Formal methods are great, but they have to be driven by trained intelligence. It is shockingly easy to come up with proofs that are actually vacuous, for instance.

TL;DR: More FakeI Hype.

AWS S3 turns 20 and reaches ‘hundreds of exabytes’

Don't be. If those systems had been mothballed for ten months, the cost to bring them all back online would have been substantial. And, in the mean time, they were a non-performing asset.

They needed those servers in the run up to Christmas. After Christmas, they has a LOT of servers that they didn't want to just write off.

Pentagon AI chief praises Palantir tech for speeding battlefield strikes

Did we read the same article?

They are using AI to REMOVE possible targets from consideration. Actual target selection is still being carried out by humans.

Re: Bureaucratese

One of the core competencies of the Perfumed Palace is the adaptation of Business Speak to their particular use cases. I'm pretty certain that the answer in this case is "yes". If you are an actual war fighter, holding a siting tool of some sort, "servicing" means killing/disabling/destroying depending on the mission. If you are a unit HQ, it means sending missions until the objective is achieved. And if you are REALLY (self)-important, it means assigning a mission to a particular unit HQ.

Of course, last I heard, the grunts, at least, preferred "servicing". But then again, they haven't breathed in nearly so many fumes...

Amazon insists AI coding isn't source of outages

Post mortem?

Didn't AWS used to do post mortems for major outages? How detailed was their discussion this time?

Microsoft Azure CTO set Claude on his 1986 Apple II code, says it found vulns

Re: But is this "news" ?

"... invent perfect security, they would become very rich very quickly"

No, because it is EXPENSIVE to implement.

'Hundreds' of Iranian hacking attempts have hit surveillance cameras since the missile strikes

I was shocked

when reading up on the history of formal declarations of war after the elimination of UN-santioned Qasem Soleimani. Starting with the Quasi War (US & France, 1798-1800), and the First Barbary War (1801-1805), the US has prosecuted wars without a formal declaration of war by Congress. That article you linked appears to think that the history of the US started around 1914.

It was particularly noteworthy to me that on Sept 14th, after congress passed the infamous AUMF resolution, Senate Majority Leader Tom Daschle (D), held a press conference on the steps of the senate, with leaders of both parties in both houses and stated, "This is a declaration of war". Of course, he had to say it because it plainly was NOT. What it was was the latest in a two hundred year of tradition of the US congress formally authorizing the use of force without a proper declaration of war.

Sadly, the murder of innocent civilians of other nations has never really been enough to get countries to go to war. In this case, Iran was going gang busters on building cruise missiles capable of striking the entire Middle East and a good chunk of Europe. They also bragged that they had enough uranium ready to be able to quickly build eleven nuclear bombs.

President Trump barely mentioned them in the State of the Union address in order to lull the Iranian leadership. This apparently worked.

Dev stunned by $82K Gemini bill after unknown API key thief goes to town

These bills by Google are criminal fraud (by Google)

That API key was provided to do one thing. Google has decided to use it for something else AND bill the customer for it AND not tell the customer.

This is a matter for the FBI.

AIs are happy to launch nukes in simulated combat scenarios

Re: Play it again, Sam

Cute, but these things are, by design, incapable of learning.

Gamers furious as indie studio Cloud Imperium quietly admits to data breach

Re: Is it just me..?

Don't see many of those around here any more. You come from a more civilized age.

Server crashes traced to one very literal knee-jerk reaction

Re: Reset Buttons

No, you dial 0118, 999, 881, 999, 119, 725...3.