Posts by whitepines

Farewell to function keys and swappable SSDs in the new two-port MacBook Pro

Re: Why not remap something else?

It also really helps when the dialog is presenting you with two options and it is unclear which one is the "Cancel, get me out of here" one. For instance, I've seen dialogs in the past that are basically like this:

Do you want do stop this operation and lose all data? "Cancel" "Close".

where "Cancel" is wired into losing data. So the choice is sit and try to decipher the poor English or mash Esc and hope the programmer understood "Esc" == "cancel the stuff leading up to the dialog being invoked". Most do, even if they don't understanding English grammar and syntax...

Re: Why not remap something else?

Even something as simple and mundane as "Ctrl+S" in a new document followed by "oops, I need to change something first". Hit Esc or mouse over to Cancel? No-brainer for me!

Re: Why not remap something else?

I still go days without touching the escape key.

So you prefer the RSI induced by mouse over to Cancel for Every. Single. Pop-Up. Dialog. you don't want to accept? Genuinely baffled here as a Linux user -- it's reflexive to see confirmation popup for unwanted action and mash Esc.

Just because you're paranoid doesn't mean Google isn't listening to everything you say

Re: "And then start living your life in a cave."

And if they answer, "Not very well given the shorter life expectancies"?

We need to start defining life in terms of "independent years" or some such other word. If you're senile with dementia doped up in a care facility or imprisoned for something you said to offend a Glorious Leader, those years shouldn't count as "longer life". Suddenly things get interesting in terms of effective life spans increasing for centuries (handling disease, etc. better), peaking, then declining, if one uses this metric...

Re: "And then start living your life in a cave."

It also doesn't hurt to say something like "you know, I'd love to discuss [controversial topic here that the kids brought up] but I don't feel safe while your [Amazon|Google] speaker is recording me for posterity. If you want anything other than popular media-style sound bytes and generic platitudes from me (i,e. if you want actual conversation between adults), turn it off!"

Re: "And then start living your life in a cave."

The question is how will we survive as a species *after* the adoption of such centrally controlled tech. An informal survey of sci-fi literature on the topic suggests caves might be the best option, preferably on some other planet...

And as the value of private information goes down, just think about the value to the US commercial prison system of a few tidbits, maybe even out of context, from daily speech, sent to the right folks to make various arrests and convictions for laws people didn't even know existed. Would Google get a financial kickback for each new prisoner?

Sadly this may be more reality than joke in the future. See the automatic jaywalking convictions and fines in China for the new future...

Internet imbeciles, aka British ISP lobbyists, backtrack on dubbing Mozilla a villain for DNS-over-HTTPS support

Re: Mozilla

That strongly depends on what kind of device is attached, e.g. would a Google device even allow a non-Google DoH resolver to be configured?

For a long time a DNS based blocker was at least a deterrent for the majority of access -- anything with hardcoded access as you say would trip other protections. Now that DoH is making that impossible, the overall risk posture has changed from "misconfigured device likely to be blocked at firewall" to "misconfigured device leaking sensitive information over HTTPS". Without DPI and MITM on all HTTPS traffic it's not even possible to determine who is accidentally violating policy without random search of the attached devices, which goes into GDPR territory for BYOD and basically means no BYOD on the corporate net period.

Allowing employee Internet access, especially with relatively relaxed policies on what software could be used, was always a balance between risk and productivity. Now that the risk for both sudden legal action (employee browsing blacklisted material without detection at our firewall) and internal data leakage to known hostile entities is that much higher, it outweighs the impact to productivity. Simple as that.

Re: Mozilla

Thank you! Finally some sanity around DoH.

At our organization the risks from leaking all kinds of internal information to a dodgy third party (sorry, no SLA with CloudFlare, they're a risk to be mitigated not a benefactor here) far, far outweigh the "benefits" of DoH. Thanks to DoH and the fact that it can't be blocked at the edge, we've been forced to lock employee workstations down even further for legal reasons and to deny any type of BYOD on the corporate network.

In fact I'd probably say that DoH has made privacy /worse/ for our employees, not better, since instead of blocking the unwanted external traffic now we have to control each and every device on the network at a far more invasive level than before, and instead of some degree of anonymization from the traffic going out over the central DNS servers now each and every employee gets to be tracked via their mobile phone since public Internet outside of a severely restricted browser isn't available to them any more.

Brilliant work, Mozilla, Cloudflare, and Google! Well, I guess they now have even more data on individual users and browsing habits, plus can stop those evil DNS-based adblockers, so end goal accomplished?

Microsoft has Windows 1.0 retrogasm: Remember when Windows ran in kilobytes, not gigabytes?

Re: Overlaps

Diskless workstations (thin clients) were a thing back then

In UNIX/Linux-land they never stopped being a thing. My employer has racks full of high end diskless servers, all running off central SAN systems. I sincerely pity anyone having to manage things at scale with storage in each individual server, all degrading with time and use. Might partially explain why Windows hosting providers tend to have horrible uptime and when malware hits why recovery seems to take an age and a half if it's possible at all...

White House mulls just banning strong end-to-end crypto. Plus: More bad stuff in infosec land

Re: What? No reference to "think of the kids"?

Maybe use this weapon against them:

"Think of the kids! A pervert with the master key can passively pick and choose his victims without leaving a trace, and can frame anyone for having abused the kiddies, therefore evading capture and continuing to commit despicable acts with impunity!"

I know in the real world, at least for now, there'd be enough physical evidence to still catch the creep. But after law enforcement turns into "spy on everyone and remove dissidents, physical evidence is so last century"?

Scary.

Reason #5098374 backdoored encryption is a really bad idea...

Double edged sword

You want this stopped right now?

Hollywood relies on strong encryption for anti-piracy. Point out Disney+ etc. will need the backdoor added to 4k streaming services, and according to their own logic how this will cost them trillions to piracy. After all, nothing like saying there is a single master key to everything secret and protected in an entire country to motivate various means of getting that key (including, I suspect, rubber hose methods or worse).

Just like getting this kind of crap passed, an attacker only has to succeed once. How does the US feel about North Korea or Iran getting detailed plans for the F22 or similar, or nuclear weapons? Because after a master key leak that would be the best case outcome -- worst case is collapse of the US as all tech and content creation businesses move out or go under.

This weekend you better read those ebooks you bought from Microsoft – because they'll be dead come early July

Re: What happens to the authors?

Good question. Consider that if you had sold a DRM-free copy of that book (after e.g. making the user agree not to copy it and watermarking it) you would have that money in your pocket regardless of what Microsoft does here.

DRM-free media works in the interests of authors too. DRM-free media mainly works against the interests of the large publishing houses that hoard content.

A fiver at the cinema, sure. Where they're paying for the high res 8k or whatever projector, the lights, the AC or heat, etc. If I have to pay for all of those things (purchasing whatever latest spying TV because of some revup in HDCP from the latest crack, for one) in my own flat, that fiver gets reduced by the value of those things plus the smaller screen, hassle of being threatened with prison and fines just for watching, etc.

So that 48 hour view should be a few pence, or free because of the personal data collection that comes with a lot of modern DRM -- pay the access that way or provide a DRM-free copy for purchase, or I don't want to see your content.

For now I make do with second and third hand DVDs/Blurays -- it's nice to know the studio isn't getting any more money from my viewing the content and good luck monetizing me with a never Internet connected older Bluray player.

Audio CDs, though, I buy new at retail. Something about not having DRM and playing anywhere with open source software means they have intrinsic value. Like a paper book...

Probably cheaper than defending against the class action lawsuit over unfair / illegal EULAs. And besides, Microsoft's had use of that money for all that time -- try getting a 0% loan on that scale from a standard bank!

I take it one step further into the future that Google etc. pioneered. I won't pay anything to rent a DRMed work, I expect the rental fee to come from the (unwanted but unstoppable) monetization of my personal data (e.g. viewing habits etc.).

Hey, the content studios wanted this future. Hope they like "earning" a fraction of what they would have without DRM and without Google's personal data exchange model.

Re: And people frequently laugh "who buys CDs?"

That much? Remember the DRM also phones home and monetizes you, you're part of the product. I don't touch DRMed stuff unless it's at no cost to me and isn't wasting my time. Maybe 1-2 pence a view if it's got really high production values, a good cast and acting, and great plot, but I won't pay anything more that that for something that I can never share with anyone (i.e. loan it or invite someone over to watch with me) if the studio doesn't want it. Humans are eusocial creatures, studios forget this.

I'd shell out a lot of hard cash for a DRM free version of the same content. Ah well, that DRM stuff is just making a lot of money for the studio anyway, right? /sarcasm

It's a fullblown Crysis: Gamers press pause on PC purchases, shipments freeze

Re: Mature Product

Myself, I got sick and tired of the "digital rental" crap, dumbed-down, unoriginal games, constant Internet connection requirements, games shifting / morphing into un-fun mere shadows of the original (now unavailable) game, etc., and simply stopped PC gaming outside of some of the (not really very good) open titles (to be fair Xonotic is decent, if dated). I then bought a console that was cheaper, has actual resale value, along with various games on physical disk that actually work offline (!), and also have resale value versus some nebulous individual-locked download. Why would I want to spend double the console price on a gaming rig, then pay for Windows, pay for antivirus for Windows, then pay for digital rentals of the games AND microtransactions on top of all that?

I may not be typical, but I was a PC gamer back in the day. Bought lots of GPUs and cutting edge hardware for the games I bought (and still have) on CD and DVD. I can honestly say the console does everything I want at this point, including displaying graphics that are pretty darn close to (if not at) top of the line PC graphics. YMMV of course.

Where this ties into the article is that I haven't bought a top of the line GPU since, and the only high end "PC"s I've purchased are workstations to run Linux. My phone and console are more than enough games for me, and if I'm going to be tracked on the phone anyway, might as well have some fun.

I'll just clear down the database before break. What's the worst that could happen? It's a trial

Re: The best I've managed...

This. 1000x this. Saved my butt on more than one occasion on production systems against fumble-fingered commands.

Parliament IT bods' fail sees server's naked OS exposed to world+dog

Isn't that criminal copyright infringement? Shouldn't some government employee(s) be going to jail for several decades for that?

Or is this yet another case of some pigs being more equal than others?

Dev darling Docker embraces Windows Subsystem for Linux 2

Idiocracy was a documentary...

I primarily want my source of truth (my files) to be on the Windows side of things.

That is just about the dumbest thing I have ever heard. Not to worry, this "developer" will have a fine career in marketing after whatever latest windows ransomware encrypts his "source of truth" and he doesn't have the bitcoin to pony up for a decrypt.

Or a stint in Her Majesty's finest accommodations, if the source was actually important and some malware got quietly inserted for deployment under the developers name.

Idiots.

This isn't Boeing to end well: Plane maker to scrap some physical cert tests, use computer simulations instead

Re: Really?

The info on the weather conditions helps even if it opens up even more questions. Your point on the artificial horizon makes that degree of pilot error even more unforgivable -- even in sims, the first thing I do when in any way potentially confused about orientation of the aircraft (e.g. in IFR) is check the gyro immediately. Never mind that the gyro is supposed to be part of the normal gauge scan pattern that any pilot should be following -- it kind of sounds like if those pilots had an engine on fire or other emergency that might come along with more than a handful of computer warnings they wouldn't even have noticed it at the time.

I'd assumed that the artifical horizon had somehow failed as well, but thinking about it more you're right, it should have stayed operational the entire time. At least enough to reliably indicate a 35+degree nose up attitude.

Human factors. What fun.

Re: Really?

I couldn't find anything detailing the weather conditions at the time, but assumed it was VFR below the cloud deck. I might be wrong, but in any case 35 degrees or higher AoA is quite significant -- just a basic seat-of-pants check (literally) should have indicated something was amiss.

It's a known problem that cognitive loading decreases in highly automated environments, below the minimum needed to keep response time where it needs to be when the automation fails. There's an entire field of research devoted to basically keeping the operator busy with routine tasks with the automation helping, so that if things really do go south the operator is ready to assume control of the higher level functions while the automation takes over whatever it can still handle. I don't know if this has ever been applied to aircraft though.

Re: Really?

bear in mind that an Airbus is effectively a flying flight simulator

Well, Airbus doesn't have a reputation for unscheduled, insistent lithobraking on the whim of an internal computer. The Airbus incidents I recall involve unqualified pilots doing stupid things in the cockpit, including flying at least one aircraft with perfectly functional core systems straight into a land barrier near the ocean. Or my favourite, not recognizing their aircraft was in a stall for tens of thousands of feet in VFR -- these things called "windows" are useful to determine aircraft attitude, and I know the cockpit has at least a few...

On the whole Airbus seems to get software (mostly) right. Boeing seems to cut costs until people die. Which one would seem to be more qualified to move tests to software?

Samsung reminds rabble to scan smart TVs for viruses – then tries to make them forget

Am I the only one agreeing with some of the more vocal responses to this that involve basically holding the manufacturer responsible for all patching, scanning, updates, etc. for their Internet-connected product for the physical life of the product (meaning, if you remote brick it early to save maintenance, you get to pay out the sticker price of the item at purchase back to the owner)?

This is a product that is locked to prevent the owner from tinkering with it in any way (DRM etc.). I'd go so far as to say that requiring the "owner" of a product like that to do anything should be illegal --- it either works, or it doesn't and the manufacturer gets sued for creating the botnet. Isn't that what DRM is, that the vendor always knows best and the idiot user can't be trusted to follow the law? Door swings both ways -- idiot manufacturer should be sued for every bit of damage the botnet(s) do, every privacy invasion, etc. as they *explicitly* locked the end user out and put themselves in the drivers seat here, then basically jumped out of the car and said "passenger, it's all your responsibility now but you can't touch the steering wheel or pedals!".

I have a dumb telly. I have zero interest in upgrading to a "smart" telly unless I can dig around in its guts and reprogram it the way I want. If that's not allowed, I have a shelf of good books, a nice game system that works just fine offline, and plenty of other ways to keep myself amused not involving telly at all.

Sad SACK: Linux PCs, servers, gadgets may be crashed by 'Ping of Death' network packets

Re: So, not great, not terrible

Windows 10 goes down for upgrades, crashes, etc. so often there'd be almost no difference in actual service provided...

Why are fervid Googlers making ad-blocker-breaking changes to Chrome? Because they created a monster – and are fighting to secure it

Oh, I don't know. As long as it's a store and Google has the keys then Google can be held liable.

I wish. What happens in reality is Google makes you agree to waive all damages etc. to get access to the store, with the threat of being banned from Google services permanently if you do dare to sue.

The house Google wins in the end, guaranteed.

Re: Or, simply...

move ad-blocking outside the browser to the DNS level.

Unless you can compile and run your own browser after inspecting the sources, sorry, doesn't work that way. DoH made sure of that --- even if you MITM all traffic, the genie is out of the bottle. Custom resolution protocols over HTTP are quite feasible, protocols even a MITMing firewall may not be able to detect without constant updates and analysis.

And, quite candidly, looking at the history of DRM what would happen if the revenue was seriously threatened by technical means is that new DMCA-style law would be passed criminalizing MITMing and blocking the ad traffic to "protect the Internet" or some such nonsense. Precedent is already set to invade one's flat when corporate revenue is on the line for BBC (TV license) and Hollywood (HDCP/AACS) content, do you really think extending such law to criminalize ad blocking would be that far fetched?

Maybe the law wouldn't even have to be extended -- just send the encryption key in the ads and encrypt the page content. Presto -- blocking the ads and decrypting the page puts you afoul of some of the most draconian legislation on the planet by breaking an effective DRM system.

Re: At some point, they'll have to sell Chrome - and Google search ...

If I'm not seeing 24 $ worth of ads in a year, no.

It's not just ads though. It's monetizing you, tracking your purchases through third party site integrations you have no control over (since it's a site backend link, not something in the browser), monitoring your phone and location, etc. That is probably where the real money is made -- even if you never see a single ad, companies will pay big bucks for access to that kind of market research. Full stop.

Re: At some point, they'll have to sell Chrome - and Google search ...

I call it "the Netflix model". I pay Netflix for their content, and NOT to have ads.

Maybe call it something else (is there even a subscription service these days that doesn't require insane amounts of DRM and is still ad-free?). Netflix requires Widevine, only runs on specific devices, and at least last I saw mates try to use it was most definitely shoving unstoppable ads for its own stuff down the wire.

Google: We're not killing ad blockers. Translation: We made them too powerful, we'll cram this genie back in its bottle

Re: Executives are allowed to ignore anything they want because they deserve it.

The Pi-Hole software doesn't have to run on a Pi.

Today I learned something new. Apologies for that, too long in the enterprise sphere I guess, using larger machines to do basically the same thing (no MITM, but public DoH addresses completely sinkholed etc.)

Re: Executives are allowed to ignore anything they want because they deserve it.

Yeah, I did that reluctantly. I put a lot of thought into it, balancing the pros and cons for my situation, and doing that was the least-bad alternative that I saw.

Unfortunately it puts the Raspberry Pi, which is a device relying heavily on closed source firmware and software, in a position to spy on and modify all traffic leaving and entering your network. At the very least, if MITM is the least bad option, invest in something actually secure in that role -- something with open firmware running a BSD or similar is my recommendation. Otherwise you're just asking for silent intrusion.

Re: Executives are allowed to ignore anything they want because they deserve it.

The easiest (but incomplete) solution is what Pi-Hole has already done: include a DoH server, so it's the one doing DNS lookups.

How does it cope with hardcoded DoH addresses (e.g. to Google or Cloudflare slurp) and/or pinned certificate checks on the same?

And MITMing SSL is almost always a really REALLY bad idea!

Re: Executives are allowed to ignore anything they want because they deserve it.

we will just see the same level of accelerated interest in using HOSTS and Pi-hole blocking

Hate to break it to you, but DNS over HTTP basically breaks this by design. Would be worth seeing who the largest champions of DoH were, given the relative timing of DoH and this.

I'm afraid were fighting a losing battle here. The Internet is now just a commercial pay per view content channel for the most part, and HTML5 has the DRM hooks to enforce it the hard way at some point if certain large companies revenue falls enough.

No idea how to do a decentralized Internet v2 though -- politicians won't let that happen easily as they like the ability to slurp from the slurpers and censor dissenting opinion.

Idle Computer Science skills are the Devil's playthings

Re: Run for it!

I'm partial to taking them out behind the shed and applying gunpowder and projectiles.

...which will leave the data-containing silicon bits largely recoverable in their plastic packages, and scattered to the wind to compound the problem. Not really a good way of doing anything other than getting visceral revenge on "that dang compootah!".

Now a hammer to the chips in question, that's cheap, effective, and 100% guaranteed...

Re: find is your friend

find is your friend

Not when even it was choking on the sheer number of files. Can't recall the exact problem at this point but could have just been too slow or was chewing up too much RAM given the degree of, ahem, filesystem abuse that had taken place.

Otherwise yep, that's a great way to recover from something like this.

Something to keep people up at night: what happens to a BTRFS volume that has this happen? Nothing good I imagine, but I suspect the solution is more "mkfs.ext4 and restore from backup" than "fix it" given how BTRFS handles certain things.

Re: Run for it!

I've done something similar, or rather a program I was in charge of for a security system. Turns out ext3 doesn't like millions of files in a directory (hindsight 20/20, yada yada). Didn't so much run out of inodes as made things nearly impossible to remove -- rm -rf of the top directory didn't work, rm * inside the directory just caused the shell concatenation limits to be hit and nothing to happen. For extra fun there was data outside that directory that needed to stay intact -- ended up writing a small program to loop over the files sequentially and remove them one by one. Took hours to run IIRC on a fairly fast disk subsystem...

Oops!

Re: Friend did something similar

While I can guess, I'm still trying to figure out what kind of idiot firewall / scanner compiles code it comes across and runs it. Or was there something left out about sending a few samples of the output along with the code?

Re: Oops.bat.

In the days of spinning rust, perhaps. In the days of solid state storage, urandom is a good compromise between tricking the disk write routines (i.e. ensuring blocks are erased instead of marked for garbage collection) and having to constantly buy and dispose of destroyed media.

If anything's going to cross security domains, physical destruction is important of course. If it's just being wiped for reuse at the same security level, and the recipient isn't authorized to access the stored data, urandom does a pretty good job of wiping things out.

HP boss: Intel shortages are steering our suited customers to buy AMD

It's kinda buried and I had a hard time finding the original source, but "bridgman" is an AMD employee with knowledge of the hardware designs:

https://www.phoronix.com/forums/forum/hardware/processors-memory/1032782-13-way-ibm-power9-talos-ii-vs-intel-xeon-vs-amd-linux-benchmarks-on-debian?p=1033245#post1033245

"the vast majority of our [AMD's] sales still come from the OEM PC market, which brings a non-negotiable requirement for DRM that can not be tampered with or disabled by the owner, backed by assurances from the HW vendor. Signing the microcode and keeping it closed are two things that help to get us over the (loosely defined and constantly evolving) threshold for "good enough" DRM."

His definition of microcode is any firmware, including the "security processor" that I've been choking on above -- he doesn't mean just the CPU microcode. This is the new and improved AMD though -- if something makes them look bad, they redefine basic terminology so it looks less bad.

Oh and DRM? Too bad the Oz citizens didn't reign in their crypto snooping law -- guess which hardware will likely eventually be leveraged to keep that nasty unauthorized open source encryption away from the masses or upload keys via side channel? Perhaps the thing that the user can't change but the vendor can be forced to, the thing that has the sole purpose of limiting what the user can do?

Clear enough now?

AMD does NOT "retain control of their systems at all times" Nor does AMD hold any any mystical "Key" which can somehow unlock your system.

Hmmm, a quick Internet search pulled up a decent overview of the problem, with the exact black box in question, the fact that AMD has the signing keys, what the black box can do behind your back, etc. How much was AMD paying you to post nonsense again?

https://www.reddit.com/r/Amd/comments/bnxnvg/computex_swiftly_approaches_and_so_too_does_zen_2/

Just be aware AMD has been busy copying "features" from Intel, like their version of the famous Management Engine. It is not certain they are actually more secure than Intel on their current products -- in fact there are apparently statements from AMD that they must retain all control of their systems at all times, not the organization or consumer using the machine. Whether that's actually safe or not probably comes down to whether you trust AMD's keys not to be stolen or AMD not to be legally forced to get data off the customer machine with a technical notice from e.g. the Oz government.

I'll pass. Computers are supposed to be obedient tools not spies and leashes. Now get off my lawn!

Amazon, Apple, Google, Facebook in crosshairs: Politicos stick monopoly probe into Silicon Valley

Re: "control all access to a century of at least leftpondian cultural heritage"

What a narrow view you have. What part of Disney taking written works and effectively destroying them don't you understand?

I don't want movies for free. I don't care about Star Wars. I want to purchase a work ONCE and view it however, whenever, and wherever I want in complete privacy. Like these things called "printed books" that IP law was fundamentally designed around and for. Disney wants their "vault", timed conditional access, streaming only, etc. -- those were NEVER part of the deliberations leading to copyright or other IP law. Read a history book sometime, but be sure you don't go to a library -- in your view that would be "stealing".

I know you are a copyright maximalist. Again, why do you give Disney a hall pass for not paying my ancestors for the works they took from the public domain, making billions from those aggregate works they stole (using your maximalist view) from my ancestors without permission? Where are my royalty payments as a great grandchild of some of those authors? Why weren't my ancestors allowed to say that their works shouldn't have been used in a Disney movie at all under any conditions? Many would have said " absolutely NOT, you will not use my music or story in a cartoon under any conditions!". In fact many authors did exactly that -- why do you think early Disney raided the public domain instead of using more current / culturally relevant, but still copyrighted, stories and music?

Door swings both ways you know...maybe you would be fine with film as an art form never coming into being, but that would also have been a tremendous loss for society. You do know that the earliest film works either took from the public domain or were porno flicks, right? And that the latter almost got the entire technology banned?

I get you want to charge rent on your lucky photos and have your greedy great grandchildren able to dictate terns and conditions for access. You want to be the next Disney, the next copyright lottery winner. Well, here's reality -- everyone has a cell phone camera, or even maybe a DSLR, these days. There's almost always a second source photo available under much better terms, and even if technically inferior guess which one people will remember after it's widely spread under those better terms?

Kinda scary knowing your life work is a complete waste, eh?

Should add Disney to that list. They now control all access to a century of at least leftpondian cultural heritage. Either get rid of the DMCA and its ilk or get rid of Disney.

Roast mouse, rotissarie style please...

Germany mulls giving end-to-end chat app encryption das boot: Law requiring decrypted plain-text is in the works

Re: Mystified; how will they force it?

Well, technically the phone is always listening for its wake word. I've personally seen the Android (Samsung) phone of a relative trigger repeatedly during normal conversation that sounded nothing like "OK Google", then quietly send all kinds of private conversation to Google, only being found out after the text message was transcribed or the maps lookup (for nonsense) was completed. At that point it's far too late, the conversation and transcript are permanently stored by Google's own admission. There's some spirited (and healthy as far as I'm concerned) debate about whether Google or its partners actually is listening randomly if not 24/7. Unfortunately since Silicon Valley tech companies lie routinely, and Google's already been caught out on Nest* it's really kind of hard to dismiss the phone listening in at least to "interesting" conversations.

On the TVs, well, sorry, but yeah they do listen in: https://money.cnn.com/2015/02/09/technology/security/samsung-smart-tv-privacy/index.html

And some have cameras now too, so your example is at best a few years away, not some far fetched tin foil hat conspiracy.

So the backup's only on your laptop. That's about the only thing in your favor here, though if you say the wrong thing about one of our illustrious leaders in today's climate you can bet the physical access barrier suddenly fails...

* https://www.washingtonpost.com/business/2019/02/20/google-forgot-notify-customers-it-put-microphones-nest-security-systems

Buy, buy this American PCIe, drove my PC on the Wi-Fi so the Wi-Fi would fly

Re: Well this is stupid

Security could well be very important too.

And with the Orwellian double-speak branded "Platform Security Processor", completely out of AMD's reach...

I for one don't need a digital nanny in my computers that I can't control, replace, or remove*. It's the Intel Management Engine all over again, it just hasn't been targeted as much for CVE hunting and zero day disclosure technical analysis yet. I'd take anything else other than Intel and AMD at this point, they're two sides of the same privacy-invading, DRM-shoving coin.

* From Wikipedia (https://en.wikipedia.org/wiki/AMD_Platform_Security_Processor):

"its functions include managing the boot process ... and monitoring the system for any suspicious activity or events and implementing an appropriate response". Given that this is firmware, not hardware, and could be regionalized by fiat, try the following substitutions:

"Managing the boot process" -- "Only allowing (regionally backdoored?) Windows 10 or (regionally backdoored?) specially approved, prebuilt Linux kernels to boot"

"Monitoring the system for any suspicious activity or events" -- "Detecting unauthorized open-source encryption routines and sending the keys to a central server, temporarily storing said keys in the BIOS Flash chip if needed."

Scared yet? No wonder China was so keen on using AMD's technology at one point, though at some time they also seem to have realized what a bad idea this is for state computers and are now pushing for wholly domestic chips not using any Intel or AMD technology...

Re: Well this is stupid

Probably because there's PCIe 4.0 stuff in the wild now? Just because your average gamer doesn't know about it or want it doesn't mean it's not used in industry.

E.g.

Motherboard with three 16 lane PCIe 4.0 slots, it's been shipping for well over a year now: https://www.raptorcs.com/content/TL2MB1/intro.html

And the kind of card you plug into it: http://www.mellanox.com/page/products_dyn?product_family=266&mtag=connectx_6_en_card , also shipping for quite some time already.

Or this: https://www.tech-critter.com/gigabyte-unveils-aorus-gen-4-nvme-aic-8tb-ssd/

Not exactly something you'd have in your bedroom as a teenager, but quite cool anyway.

One last comment: AMD wasn't first to this party. They’re quite late despite what they want to say for marketing reasons, it's complete BS but AMD learned quite well from Intel. Copy the Management Engine and call it the "Platform Security Processor", disclaim any responsibility for bugs in it. Lie like a rug if your product lags in any way. Make empty noises about doing things people want (like making the PSP optional) then quietly back away from those statements once enough chips are sold on that marketing-fuelled rumour and the resultant furor dies down. Work with OEMs to restrict supply of any technology that makes yours look old (like PCIe 4.0 SSDs when your chip is stuck on PCIe 3.0).

Old tricks from Intel's playbook.

Quick maths refresher: Intel CPU shortages + consumer stock bottleneck = no computer sales growth in EMEA for 2019

Re: Good news for AMD

Someone else pirated them on non-AMD gear though. And the PSP is not static, sometime in the future you might have the choice of ignoring a blatant security hole in it or enabling some kind of watermark detection at playback.

Play with fire, get burnt.

We ain't afraid of no 'ghost user': Infosec world tells GCHQ to GTFO over privacy-busting proposals

Re: They'll never get it.

just to take a few big scalps so that most of the population are using at least one affected app.

...and that's why I only use open source applications if the data is any more valuable than the latest game save on a Nintendo. No open source application available, or TiVoised mobile? Maybe I really didn't need whatever it was in the first place even though Silicon Valley thinks I did.

Not that I've done anything intentionally wrong or criminal mind you, but let's stop pretending anyone that thinks they haven't done anything wrong isn't actually a technical criminal due to our dizzying array of laws and regulations. In the immortal words of Cardinal Richelieu, "If one would give me six lines written by the hand of the most honest man, I would find something in them to have him hanged." Even the politicians calling for this have probably committed some offense or other in the past, it's just that the more connected you are and the more resources you have the easier it is to hide the indiscretions (more to the point, people tend look the other way on purpose around such individuals, drawn like moths to a flame to the perceived power of the person).

Yes, I'm aware that this may mean not using mobiles. Or only carrying a candy bar phone for safety when going out, and treating it as the electronic bug, spy, leash, and tracker it is. And yes I'm also aware we may end up like China where you are legally forced to carry one. At that point Blighty is, quite candidly, fucked and some other country will be taking over in a few generations -- not to govern its people, mind you, but to thoroughly subjugate them and take whatever resources are left from the remaining subsistence farmers.

Ah, Karma. Sometimes it operates on scales of centuries. No less sweet.