Posts by ThatOne

Web trust dies in darkness: Hidden Certificate Authorities undermine public crypto infrastructure

Re: This should not be a free for all

> Most ISPs are outside sovereign control

I'm talking about the national ISPs you and me use to connect to the Internet: Those are totally local and much likely to be leaned on (real world examples abound).

.

> Hierarchical structures seem to be the most natural for us

They are the most primitive form, inherited from animals. That been said, I remind you that it's ancient Greece which invented democracy, and that the ancient Romans were republican in the beginning (then at some point there was a coup d'etat and they turned autocratic). So one really can't say non-autocratic governments are a recent invention; The only thing one can say is they require an evolved, structured civilization. Each decline of civilization brings back the simpler, more primitive "might makes right".

Re: This should not be a free for all

> what if the motive isn't profit but control of information flow

You don't need to control the CAs for that, you just need to control the ISPs. What would be more efficient in controlling snail mail use? Controlling the issuing of stamps, or controlling the postal delivery?

.

> what have been the longest-lasting regimes in human history?

Definitely the ancient ones! Ancient Egypt remained a superpower for over 2000 years, longevity went steadily downhill since then (Roman Empire 1500 years, British Empire 300 years). You can't pin it to one single reason though, and definitely not authoritarian regimes. Besides, those often tend to be rather short-lived (Nazi Germany, fascist Italy come to mind), even the more powerful and resilient ones eventually collapse (Soviets).

Whatever is is, I do not think Certification Authorities play any important role in civilization longevity. In the list of things any authoritarian government would want/need to seize control of, they come pretty low, somewhere along with the DMV.

Re: This should not be a free for all

Oil and drugs (legal and illegal) yield huge benefits, thus the temptation to create cartels to control that profit. Certificate authorities simply don't compare, profit-wise. The people needing a certificate are very few and the resulting profit small, nowhere near enough to fund efficient lobbying. There won't be a CA cartel for the exact same reasons there isn't an international pizza parlor cartel.

Now I understand you're a stanch advocate of the "Big [something] vs. us" theory. I respect that, I'd just like to remind you to keep in mind Hanlon's razor: "Never attribute to malice that which can be adequately explained by stupidity"... While some conspiracies are most likely real, many are unlikely, as they imply a much more coordinated and intelligent species.

Re: This should not be a free for all

We have arrived at Conspiracy City, ground temperature is...

Re: This should not be a free for all

That's why it should not be an unique actor, but a constellation of independent service providers, so competition and lack of control prevent most of the temptations: If a provider gets cocky or sloppy, he will (should) lose business to the other providers, so he won't.

No, sorry, the only valid argument you could had put up is that this is already more or less what we have, and it doesn't seem to work all too well.

Re: This should not be a free for all

> each country necessarily has its own agenda

That's precisely why it has to be above individual countries, independent from individual governments. This would also make things much easier to get everyone to agree, since it respects the old "If we don't get to control this, nobody else should": No government control, from anybody. (There obviously need to be control, but definitely not political.)

Re: This should not be a free for all

> So you're saying the same thing is happening with money? With public services like police?

Apples and oranges. Certificate Authorities are definitely not a public service of some specific nation, they are (and need to be) international, above individual countries.

If only because, as I previously said, pretty few will trust some other country's official, government-controlled CA.

Re: This should not be a free for all

You have a point there, but the problem is that this unique authority which would decide over life and death of anything security-related can and will be misused. Monopolies never work out for the clients.

First of all it will be considered the perfect cash cow and certificates will cost literally a fortune, since, well, it's not like you have a choice. Pay up if you want or need one. Cert service will be awful or even broken because here again, the point is to make money, not to make clients happy or safe, and as long as the clients can't leave, there is no point in even trying to satisfy them. As long as the Root CA's selling argument is "it's me or nothing" they don't need to make any effort, not even a pretend one.

(And that's even before consider who would get to manage that. Would the USA trust a Chinese Root CA? Or the Chinese an USA Root CA? Why not settle for North Korea?... "Can of worms" would be an understatement...)

Smart things are so dumb because they take after their makers. Let's fix that

Re: Won't work. :-(

> How can they be mandated when the market forces are against regulation?

Oh, I didn't say it will happen (or that it is even possible), I only said it is the only way I can think of to influence the IoT trash production.

Re: What are error messages for?

> Here is what it COULD do instead

Yes, in a perfect world full of rainbows and unicorns... You people tend to forget those gadgets aren't made to make you happy, but to make money, as much as possible, as fast as possible, for as long as possible. In this perspective all considerations on how they could had done it better are exercises in futility: They wouldn't sell more if they those gadgets were more configurable, they would just make less profit per unit.

Won't work. :-(

> Total absence of diagnostics isn't just a complete repudiation of the right to repair, it removes any motivation or ability to manage security.

Well, seems you explained yourself why it won't ever work: The commercial motivation to keep things that way in IoT is too strong, since adding diagnostics would not only increase the price without adding any marketable bling, it would also significantly lower the profits since people would repair instead of buying the next newest version, "guaranteed to have fixed these problems". It might go as far as people using the same kit for many years, without buying replacements!

The only way to force security and repairability to IoT stuff is to prune the market by making those features mandatory. 99% of stuff will disappear, the rest will be solid(-ish).

Now concerning error messages for Tesla users, that problem has no solution. Even if you sent a real human to explain, bow and ask for forgiveness, people would still complain. Because the issue here was not the message (they wouldn't be able to do anything about it anyway), it's the fact there was a problem which disturbed their everyday life.

Re: What are error messages for?

> is there any need for your phone app to talk to a central server

Obviously. The whole point is to 1. force users to pay monthly subscriptions, and 2. to collect valuable user data you can sell for profit. The initial product, the light bulb, is just a loss leader.

The climate is turning against owning our own compute hardware. Cloud is good for you and your customers

Cloud is good for you - Really folks?

Marketing stops from nothing, does it.... Now the green argument, fallacious as possible since obviously a "Cloud" infrastructure isn't much eco-friendlier than the same one on premises. Unlike the marketing blurb tries to suggest computing resources don't magically spring to life on demand, and return to nothing when temporarily not used: The server(s) running those instances is always running, no matter how many VMs they currently run.

Cloud has one single advantage: Flexibility. You don't need to invest in hard/software only to find out you need more/less (or not anymore), you just pay for what you need, for as long as you need it. On the other hand it has a slew of drawbacks everyone here knows, so it's clearly not a silver bullet solution, and it definitely won't save the planet...

What's next? Cloud saves children from abuse?

China plans to swipe a bunch of data soon so quantum computers can decrypt it later

Military plans an AI offensive

ROTFL! AI-driven military, now that's reassuring! We just took hill #234, computer suggests to attack hill #234 (it is 'trending'!).

Or maybe could we interest you in hill #234?

_{"Other generals attacked..."}

Sweden asks EU to ban Bitcoin mining because while hydroelectric power is cheap, they need it for other stuff

Re: How?

> Then perhaps a law to restrict such negotiations.

That law will surely pass just after the one restricting lobbying, and the one about getting cushy jobs for your family and yourself...

Re: How?

This is a very common strategy: Promise some local politicians they'll be able to brag about "creating jobs", and in exchange get a huge cheap/free something (energy, terrain, infrastructure, subventions, tax cut/advantage - or ideally, all of that at the same time).

Then take all that cheap/free something you've got, create a token 1-2 low wage jobs (you always need a janitor), and when you've made your profit, dissolve in thin air (ideally with a puff of smoke). The taxpayers will gladly if unknowingly pay the bill, the local politicians are happy, you are happy, it's a pure win-win situation. Which is why you see it all over the world.

Re: Not Happening

> And what is the point?

The point is to make money without working, especially by harnessing your (otherwise rather dull) capacity for operating a computer. Can't get more appealing for a nerd!...

And then there is the "This is mine! Nobody else can control it!" aspect. You might say that gold has the same, but gold is horribly old-fashioned, besides you can't make gold in your basement if several centuries of alchemists are anything to go by.

Now about the electricity thing, the answer is simple: Keep lighting and warming your home in winter, and use stupid Flanders' electricity to mine your annual free beer. This way everybody who is important to you stays warm, and you get your freebie nevertheless...

/sarc

China's hypersonic glider didn't just orbit Earth, it 'fired a missile' while at Mach 5

> They build a new lab and buy a new set of instruments every time they run an experiment?

Just as much as the Americans do, so I guess your point is irrelevant to the initial question of compared expenses, isn't it?

Now if you're just criticizing my point about cheap labor not making a big difference in cutting edge science, in this specific case I guess experiments are the most expensive part, and I'm pretty sure labor costs don't make an important (or any, actually) part of that. You'll have to take my word for it (or not, as you like).

> an American scientist is likely to be paid more

Scientists aren't an important part of the cost (public sector scientists get paid peanuts), it's the labs, instruments and experiments which make up most of the expenses, and those things cost about the same everywhere. Materials might be cheaper in China, but to process those raw materials you need expensive, sophisticated machinery which would cost about the same to both. There might be a cost difference, but it's definitely measured in fractions, not multiples.

Re: Capital ship killer

> what if your target was 2000 miles away?

I suspect no carrier group is ever more than a couple hundred miles from the nearest "unfriendly" attack submarine lurking below...

I mean what's the point of stealthy attack submarines if not to shadow enemy carrier groups in case they need some quick sinking? Of course the carrier group has its own submarines and anti-sub defenses, but one missile/torpedo/whatever is all it takes to transform a mighty carrier group into a random gathering of ships, it's definitely worth a try.

True, but this allows for three times more pork barrels!

> It's always nicer to be a non-combatant. And neutral. And not a threat to anyone. Just ask the Belgians.

It's because you forgot the most important condition: Be out of the way and more profitable alive than dead. Ask the Swiss.

> R&D in the US is a lot more expensive

Actually it costs about the same, but what increases the cost tremendously in the USA are the associated pork barrels and the eternal turf wars. Do the Army, Navy, Air force really need to have three different, competing R&D projects? What about the Coast Guard, why don't they get to play too?...

So, when another country says "we need to do this, let's get it done", the USA says "we need to do this, let's see now who gets chosen to profit from that".

How a malicious Android app could covertly turn the DSP in your MediaTek-powered phone into an eavesdropping bug

New fresh security holes

Great, another call to buy a new phone. Give me a break people, I hadn't time to unpack the last one yet!

_{Yeah, patches, sure will happen. Want a bridge with that? Premium location!}

The ideal sat-nav is one that stops the car, winds down the window, and asks directions

> routes Google Maps chooses are usually slower

Mostly because of all the cheapskates who use the free Google services (Maps or Waze), and thus all end up driving on the same roads...

The fastest way to go from A to B would be to avoid the Google services' routes. You'd need a meta-engine able to calculate you a route avoiding as much as possible the corresponding Google route.

Re: Wandering Aimlessly

> Like this one?

Almost. Mine had no other signs whatsoever, just those two, which made it more striking.

Yes, I understand the rationale for those signs: "Other directions" is usually paired with another sign, like "This way for [Locality], take the other way for all other places". As for "All directions", it only means that this is the only way to eventually get out of the maze you're in...

Re: Wandering Aimlessly

On a T-junction inside a small village in France, I once saw a sign pointing left: "All directions", and a sign pointing right "Other directions"...

Unfortunately I was driving so I wasn't able to take a picture.

Re: Satnavs

I had a very capable stand-alone satnav (high-end Mio) for years, until the GPS date rollover somehow bricked it (it now randomly loses position for various amounts of time). It had good worldwide maps (I used to take it with me on trips, to use with rental cars), a good, big, easy to read screen, and was always very prompt to recalculate if I missed an exit.

I really regret it, apparently there is nothing comparable nowadays, no matter the price. Instead of going high-end and up their game, stand-alone satnav makers apparently dropped the ball and only release basic units full of "social media" nonsense, and the one thing I definitely require on a satnav is no internet connection. Not only isn't it always available, but most of all I do not (really! I mean it!) want to be flooded with ads - sorry, "suggestions". Even "personalized" ones.

Now I have an (offline) navigation app on my phone, which works quite well, also has regularly updated worldwide maps (you can tell the app to use the SD card if your phone accepts one), but it's obviously less user-friendly than my old dedicated unit (screen size, GUI). It is much cheaper though, about 1/10th of the price. *shrug*

Re: My experience

Previous user had set the satnav's preferences to "scenic routes" perchance?

A tiny island nation has put the rights to .tv up for grabs – but what’s this? Problematic contract clauses? Again?

Re: Nice article

> Not that .tv should have that level of value

It only has value for the marketing departments. Potential clients really don't care, I'm willing to bet there isn't a single user out there who thought "Dooh, look, it's .tv, it means there must be things to watch, like on my TV, see? Let's go spend some money!"...

Or did you ever hear "That site 'Netflix.com' can't be but stupid amateurs, else they would had called themselves 'Netflix.tv'."?

Russia blows up old satellite, NASA boss 'outraged' as ISS crew shelters from debris

Re: Bills for years to come

> repair and replace bills arrive in Moscow

So you're going to sue the Russian government? You and what army?...

That's political and legal nonsense: First of all it's not like there aren't already heaps of rogue debris up there, and you'd have to prove beyond reasonable doubt it's a fragment of this specific satellite which hit you before making any claim. Second, that's what insurances are for. Last, suing people only works if they cooperate. I'm pretty sure the Russian Army won't, and there isn't much you can do about it. You don't seriously expect your country (whichever it is) to start a war just because you pretend your satellite was destroyed by some allegedly Russian debris?...

Re: Russia enters Biggus Dickus contest

They all will, because nobody wants to admit he's got a tiny one...

Seriously, the problem is that dissuasion only works if you prove you can do whatever you threaten to do. So I'm afraid they'll all will try to show at some point that they can, at will, easily and repeatedly.

Tech bro CEOs claim their crowns because they fix problems. Why shirk the biggest one?

Re: But it's up to us

> Profits and saving the planet aren't mutually exclusive.

Profits and savings aren't mutually exclusive, but they don't benefit the same people.

They indeed offer new profit opportunities (like the ones you mentioned), but they mean huge costs (and thus loss of profit) for the vast majority of already established industries. Businesses don't like being forced to waste money in new, unproven technologies instead of simply cashing in on their old, already paid-for investments. And for many industries "green" is not in any way an opportunity (consumer electronics come to mind), just an additional expenditure.

Re: But it's up to us

> the technological world is run to be much more profitable, and upgrade by dumping more trash

Whatever Zoom can or can't do, this ^^ is and remains true. It's all about the money, trying to project any outstanding capacities of problem solving is ridiculous, their only goal and achievement is making lots of money from an initial non-marketing (i.e. original) idea.

"Tech bro CEOs claim their crowns because they fix problems make big profit": Fixed it for you, that's how it works in the real wold. I've met many very capable problem solvers and they don't get any crowns of any kind, often not even a pay bonus.

Expecting profit-driven "new technologies" people to think about the profit-destroying requirements of saving the planet (save our own hides actually) is like expecting Google to distribute privacy tools.

Workplace surveillance booming during pandemic, destroying trust in employers

Re: Replace the boss with AI

> company boards are wastes of oxygen

Any golf course manager, luxury tailor, gourmet restaurant or sports car dealer will disagree. Like plankton, they are the basis of an entire ecosystem, with numerous species directly or indirectly depending on their presence...

Re: Metrics and bullshit

> at my level I must be seen to leave at 8 or 9pm.

Sure, because at your level you have to set a good example, so the peons can't complain about unpaid overtime: "See, your boss does it too."

Also, since your managers most likely don't have a clue what you do, the only objective metric they have is the time spent doing it. Which means that somebody who spends 12 hours a day watching cat videos is a better, more dedicated worker than the one who keeps the company running all on his own in his allotted 8 hours a day... It's the old sad truth that it doesn't matter what you do if nobody sees you doing it.

Turning people into AIs

> for speaking to customers too much, criticising the platform too much, raising too many problems...

In short, the perfect employee is an AI without the abysmal stupidity, isn't it. I guess that while on one side they try to improve AI to be more human-like, on the other side they also try to clip humans to become as focused, docile (and most importantly cheap!) as computer programs.

Delivery drivers are the perfect example, since they only need two abilities: To drive (as quickly as possible) through their allocated route, and to deliver (as quickly as possible) their ware while doing so. All other abilities are not only unneeded, they are actually counterproductive, since they'd make them lose time which is money.

What's happening is that, until an AI becomes sophisticated enough to be able to do that task without too many incidents, they try to turn hapless humans into wannabe AIs...

_{Icon is your future friendly delivery driver}

Earth's wobbly companion is probably the result of a lunar impact, reckon space boffins

Re: Huh?

> Remove the sun and I think we would just drift apart.

Happens to all holiday flings...

Microsoft admits Samsung phones under Intune mobile device management are dropping out of compliance

Re: A typical "upgrade" issue

> upgrade systems to do things that aren't needed by people

How else can you make people pay over and over again for something they already paid for? (Well, at least in the days before the "as a service" con, which is vastly more efficient at this...)

_{I still use a lot of old ancient versions of programs, because they do everything I need to. Obviously they aren't connected to the wild, wild web, but why would they anyway?}

Malicious Chrome extensions are bad. But what about nice ones that can be hijacked? This new tool spots them

Re: I see where this is heading...

Yes, I'm using Firefox myself, but how long before it becomes yet another Chrome clone in the name of "progress" and "security"?...

The issue here is that Mozilla is founded by Google (of all people!), and I'm pretty confident Google won't let it become a competitor. After all Firefox is just Chrome's anti-monopoly shield, something it can still do if neutered to death.

I see where this is heading...

So, Manifest v3 extensions are not vulnerability-free yet.

Which brings us to Manifest v4, which restrict extensions to just showing a small inert smiley face in a corner... At last, our ads and data slurping will be perfectly safe.

_{We need a "rolling eyes" icon}

AI algorithms can help erase bright streaks of internet satellites – but they cannot save astronomy

> I think you may be underestimating how easy it is to miss a target the size of a satellite

If at first you don't succeed, try, try again. Satellites don't just hang there, they move fast, and thus cover a huge surface every day. The ISS makes about 15-16 orbits a day, so those even lower-flying sats will clearly make more, that's a lot of occasions for paths to cross some rogue debris.

Besides, even right now when there are way less than 40k satellites up there, they had to move the ISS to avoid risking a collision. And they do it regularly, which seems to mean that those orbits aren't that evenly spaced all over the planet.

> Yes, and that's *embarrassing.*

Well, we definitely agree on that. Not so much about Musk being the messiah who will save humanity. He does seem to push things more or less into the right direction, but at this point that doesn't mean much, we don't know yet his real goals. Why not blindly trust him? Because he seems, as you said yourself, pretty flawed.

As for the thing holding back humanity, it's mostly the egocentricity of humans: Me, me, me. What about me? Where is my profit? There is a wide gap between the dreamworld of SciFi where things "just happen", and reality where things often don't even happen when they should. Mediocrity is just the lowest common denominator...

Yeah, it sucks...

Re: Smart shutters?

Yes, the problem is that there will eventually be a continuous sheet of them (check the numbers!). Terrestrial telescopes will have to shoot through the gaps, which isn't really possible if the satellites follow every couple seconds and you need 15 minutes exposure to make your deep sky shot.

As for the idea of replacing the missing data with data from another shot, it's a) impossible (You'd still need a 15 minutes exposure, remember?), but mostly b) absolutely stupid and counterproductive: The point is not to make pretty pictures, but to capture what's actually out there at a given moment. If you start fudging it you could as well ask some special effects team to generate your whole deep sky picture from scratch...

Re: near miss meteors

> The reason being, they know how big space is.

Space is big indeed, but LEO much less so.

If they don't care, it's because they are there to make a profit: They've indeed "done the maths", the financial ones actually. Everything else is irrelevant.

> calling the ISS a megastructure is an insult to spaceflight

While it isn't really a "megastructure", it's the most advanced thing we ever made: A permanent, inhabited orbital station. Size isn't all.

There are two major achievements in spaceflight: Landing on the Moon, and managing to build and operate an inhabited structure in Earth's orbit. Even if it isn't majestic looking or slowly spinning on the tune of Johann Strauss' waltz, it's about the only thing from the SciFi dreams of yesteryear which has actually happened.

'Automate or die!' Gartner reckons most biz apps will be developed via low-code by the people who use them

Re: 'The Last One'?

There is also the issue that more often than not the "user" has better/more urgent things to do.

To illustrate, can you imagine a grain farmer machine-tooling spare parts to assemble a combine harvester? That's not his job: His job, what pays his bills, is to grow crops.

Turns out there is something everyone may agree on in Congress: Let netizens use mostly algorithm-lite apps

I Got Algorithm

Well, since it would cost money and those very "algorithms" are what makes the money, there is pretty little chance this law might change anything.

Besides, if you think about it, it's just another name for the already existing possibility to opt out of "targeted" advertising, and we all know how efficient that is. But you can't expect career politicians knowing stuff like that, they just latched on to a techy sounding buzzword they've heard somewhere.

Why machine-learning chatbots find it difficult to respond to idioms, metaphors, rhetorical questions, sarcasm

Re: One word: DUH!

> we can create understanding if we just throw more statistics at it

Indeed, you can teach the software to translate "piece of cake" = "easy", but then what will happen if somebody asks "Would you like a piece of cake?". Context is everything and statistics can't and won't ever cover all the possibilities, human languages are very complex and constantly evolving, even humans don't completely master them, so how on earth would a stupid program be able?