Posts by doublelayer

The dark equation of harm versus good means blockchain’s had its day

Re: We know it has no future

Power in El Salvador is neither cheap nor always environmentally advisable. Perhaps fortunately for them, a lot of Bitcoin mining isn't done there. I will grant that they do generate a large amount of renewable energy. Unfortunately, that is not enough for their demand. They burn hydrocarbons for a lot of their power generation. They use hydroelectricity, which like most countries in the region is seasonal such that in the dry season, there is often a need to limit power usage as the hydro plants aren't generating as much. They are also a net importer of electricity by a large margin (imported about 11.9 times the power they exported), opening them to the environmental consequences of the methods the countries around them use to generate the power that they import.

"BTC is unique among "cryptos", in that it's limited, decentralized, unconfiscatable."

Come on, there's a whole bunch like that. Not all of them, certainly, but if you want to sell the benefits of Bitcoin, lying about its uniqueness is not a good start.

"This piece might have some relavance if it was written around 2015 but things have moved on a lot since then."

Could you clarify? I do not see that the last six years have done much to change the points listed in the article. I think the original idea of a cryptocurrency has some potential benefits. A currency that is available to everyone because it runs worldwide could reduce the inefficiency of international money transfer. One that is free of external control could weaken dictatorships that use it as a stick to punish the populace. One that cannot be inflated could prevent some types of ill-considered monetary policy (though that one has an obvious counterexample). One that is truly untraceable could limit the invasion of privacy we are frequently subjected to (though that also includes helping those who want to commit crimes with it as well).

Whether or not you agree with these potential benefits doesn't matter though. The reason is that the successful cryptocurrencies do not live up to any of those potentials. They are hideously inefficient, they have not been adopted in a decentralized way, they do not have any stability in value, even when they have temporarily stable trading, and they do not maintain the privacy of the users. Without the benefits of cryptocurrency as a currency, you have little other than an otherwise useless thing to speculate on while it consumes lots of resources just to exist.

This House believes: A unified, agnostic software environment can be achieved

That's true, but it's going to happen anyway even if everything was open source and free. People just don't agree on what the best thing is. We have a lot of languages that are freely available, for example, but that doesn't prevent people from rejecting them and making more, or for that matter rejecting anything released after 1990 and complaining that anyone who doesn't hand-code everything in assembly is just lazy. We could do a lot to create a unified standard for basically anything, but it's not going to be universal no matter how much effort we put into it.

Cuba ransomware gang scores almost $44m in ransom payments across 49 orgs, say Feds

For a direct military response, where would you have them strike? A lot of ransomware is individual criminals working remotely. Would you have their houses destroyed from above? Their neighbors would not approve. Even when a country ignores their actions, they aren't hosting them in a location that can be targeted. If they did and someone attacked it, that would be an act of war. Since they don't, it would be an act of war and a war crime at the same time. Perhaps a bit extreme.

For a hacking response, I don't think there's anything preventing someone trying to hack the systems used by criminals. The authorities are unlikely to arrest someone for doing it, in large part because the criminals are unlikely to report the crime to them. Providing support for such privateering, on the other hand, would lead to similar complaints that the supporting government is also helping criminals.

I think some harsher responses are justified, but these ones are risky or unethical.

I think Cuba is the name assigned to the ransomware group, likely from names they use themselves, rather than an attempt to attribute the behavior to the country of the same name. I was looking for information to prove this, but they seem to be quite new as an attacker and most searches are just giving me a bunch of articles about this same announcement. None of the ones I've read have said that the country of Cuba has a connection to these, and if it did, they would be likely to call it "Cuban ransomware" to indicate its origin. I'm pretty sure therefore that it's just a name.

Update: PC Mag says it's probably based in Russia.

How to destroy expensive test kit: What does that button do?

Re: Touch is enough

If it hadn't been the broken one, I would have asked why they left something really tiny and sensitive somewhere where anybody could pick it up, and therefore any accidental movement by people, objects, or even the air could cause expensive damage.

NixOS and the changing face of Linux operating systems

"thus /user became /home ... except in the appleverse, where they "simplified" it to /Users (Caps in a system directory name? WTF‽‽‽)."

I have to ask. Why is that a problem? I distinctly remember you defending the case-sensitive filesystem a while ago (I was too), so you don't seem to mind having capitals in some filenames. So why must a system directory be lowercase if other ones can be uppercase? When I use Mac OS, it's a little annoying so I would prefer lowercase, but I don't think that's a firm rule. It also allows them to use PascalCase for multi-word names, which is probably why they're doing it.

Re: rm -rf /*

"There's a perfectly valid prevention for that particular accident:"

Yes, but how often does that particular accident happen? It's pretty deliberate, you have to be root, not know where you are in the filesystem, and frequently use the -f flag without knowing you have to. It surely happens, but I think it's probably minor compared to the various other ways one could destroy a system by accident (it's much easier to accidentally destroy something with a dd command typo).

Re: ITYM ...

Consumers have this nasty habit of wanting things updated, especially when they're always online and running software from other people. In DOS days, maybe a read only OS would still have worked, but by now, it would not. We could try monolithic OSes where everything is updated at once and can only be replaced in its entirety, but that's just going to hide the small changes that still happen at the cost of a lot more bandwidth and storage used for updates.

Dev loses copyright appeal over forensic software after judges rule suite was owned by his employer

Re: From memory...

It depends on the contract. The employer had turned it down, so most likely, they have waived their rights to have that project (if they had those rights in the first place). So on the face of it, you're probably fine. This is contract law though, so that's not good enough. Here are a few reasons you could still be restricted:

1. If the project competes with their products, they could have a clause restricting competition. You couldn't distribute the project without angering them.

2. If it used information they considered proprietary, from common code to knowledge of an algorithm, they could claim that your project was violating IP rights they held and sue you for that.

3. If the contract says that they get ownership or first right of refusal over your external ideas, then you have to make sure that the right person turned it down. It's not enough for your manager to say they don't want to use it. Often, there will be a separate person who needs to agree. You really want to have the acknowledgement that you can develop it without them taking it in writing, stored on your own equipment, and unless really obvious, reviewed by someone at least familiar with contracts.

Re: Contract versus open source?

Your first question is easy: your employer owns the copyright. This means you'll want their permission before you upload it. They might want to review what parts you're taking out first. Since they suggested Apache licensing to you, I'm guessing they already planned for this, but it never hurts to have an email saying so to avoid the problem this article describes.

Your next question seems to be around the use of the software. This chunk:

"However, there is/was talk to embed the tool into a wider proprietary tool stack of (soon to be former) employer. There it may play a small but crucial role."

I'm assuming that the employer you're talking about is the one you originally wrote this for. If not, only the first point below applies. Your employer has no problem here for two reasons. First, Apache 2.0 is a permissive license, so you can put code into proprietary systems. Unlike copyleft licenses such as the GPL, you don't have to use the same license for other components. Second, as they own the copyright to the code, they are permitted to apply a different license to it. If this had been the GPL, but you wrote all of it, the employer that owned it could still use it in a proprietary system because their version would use their own license instead. Therefore, your component can be used in a proprietary system without having an effect on the licensing or distribution of that system.

Re: From memory...

I don't think they were lucky*. Essentially, he received a bonus that was directly proportional to the revenue his work generated. A lot of places tie bonuses to results in that way, although often without telling the person how they'll be calculated. Just receiving a separate payment for performance isn't that unusual, and it furthermore indicates that they were the ones selling the work (and the only ones to do so). That sounds like a normal setup to me and the suggested alternative sounds like a setup that would have undoubtedly had a contract to specify it.

* I think they had the advantage in this case, hence not lucky, but that doesn't mean I think they're right. It's entirely possible that they intended a licensing arrangement originally and are now reneging on that intent. The problem is that neither side can prove it and, without proof, the company's story is a lot more plausible. Whenever you're doing something like this, make sure you have the contract and know what it says.

American diplomats' iPhones reportedly compromised by NSO Group intrusion software

I suggest three alternatives more plausible (to me at least) than that the NSA and its ilk outsourced something we know they like to do themselves. In increasing order of likeliness:

1. Israel supports them (obviously), so asked for a few countries to be left off the list unless they do an additional review.

2. When they were claiming not to do any business in the U.S. to avoid a lawsuit, they added it themselves to use as an argument.

3. They're lying and no such exception exists now or ever. These are criminals who aren't in court, so nothing prevents them from tossing out falsehoods.

When it comes to renting tech kit, things can get personal, very quickly

Re: Why wasn't THE major problem mentioned here?

This is very true. I have no doubt that there are people who think renting is a great way to handle every asset, but the comments alone make it clear it's not 52% of people. However, I can explain how the vote got that way. Here's a list of what not to do next time:

1. What hardware? Some people interpreted it as only servers, and therefore being a debate on cloud versus on prem. Since some articles mentioned desktops, this wasn't the only argument. This is a basic detail of the premise that the debaters didn't agree upon, so how could the readers know what the topic was?

2. What's the actual disagreement? Renting hardware is just bad in general? Because the debaters covered lots of different reasons, most of them completely ignored by others. A narrow debate like "Renting hardware is better for the environment" is clear, but a general one works well enough if you make the debaters talk about it in general. As it was, only Tuesday's article mentioned the environmental impact, and it didn't mention anything else, so it makes it seem like that debater was addressing a different proposal than everybody else.

3. One short statement on what the debate was. As it is now, the proposal is a paragraph of background that doesn't necessarily state an opinion. The debate proposal should be a simple, non-compound sentence that clearly states a point. Ideally, the sentence is so simple that the insertion or removal of a "not" clearly indicates what the against side thinks. In my opinion, you should also replace the for/against voting buttons with this sentence and its negation. In this case, the proposal could have been "Renting desktop equipment is a bad decision". The negation would say "Renting desktop equipment is NOT a bad decision". Unless it wasn't desktops, see point 1.

4. A little less necessary, but have the debaters respond to one another. We heard four speeches and now have to vote, but a lot of debates allow the debaters to make their addresses, then ask one another questions, then summarize what they think best supports their point. I think that's helpful.

5. Either allow people to change their votes or hold voting back until the arguments have ended. Again, this is more an opinion, but I think it helps make sure people are reading more than one article before casting a vote. When I vote on these debates, I tend to wait until Thursday to do it because sometimes the against side argues a point that I didn't think they would, so I no longer support them. If I disagree with Monday's article and vote against, that doesn't indicate that I support Tuesday's point.

Re: Duhhhhh...

"then decided to check the largest data set on a binary question which is easily accessible to him: the last US presidential election's popular vote. Sure enough, if memory serves, Biden won the popular vote with something like 51% to Trump's 49%."

Yes, that election fits the pattern (51% to 47% including votes for other candidates), but it doesn't always hold. Just looking at U.S. presidential elections, there are several that don't end up going that way. 2008 was 53-46, 1996 was 49-41, 1984 was 59-41, and 1972 was 61-38. Source. It's not surprising that there are many binary choices that don't have a clear majority, though. The reason is that a lot of the binary choices where there is a clear majority don't need to be asked (Do you like to eat food? Would you like to suffer an injury?). I'm not sure there's anything special about a 4% margin that makes it more likely.

Nextcloud boss: You gotta fight … for your right … to 'plug into Windows and offer the exact same service'

Re: Er what?

"There's no need to break it [Nextcloud] on purpose, it will get broken anyway just by updating the APIs without telling anybody."

No, because Nextcloud runs their own service. They don't emulate OneDrive, so if Microsoft does change those APIs, Nextcloud will be unaffected. Windows does change, and it's the duty of any company making software to run on Windows to read the updates and deprecations so their software keeps working, but as companies go, Microsoft is pretty good with backward compatibility on such things. Can you point me to a single example where Microsoft broke Nextcloud's integration, intentionally or not?

"Microsoft breaks their own products all the time, so I don't understand the responses here that they wouldn't break a competitor's product, because they wouldn't do anything illegal, because it's not the 1990s anymore, because ... oh shut up."

Break your own product and your users are grumpy. Break someone else's product by accident, and people are still grumpy. Break a competitor's product on purpose, the competition authorities that care (which does include the EU's) can hand out a fine in the hundreds of millions, which they have done before. That's why they try not to break the law.

"What NextCloud wants is an open and stable API as a contract between Windows and client software that doesn't favor Microsoft's own client software."

And does what, precisely? Because most of the Windows APIs do that already. They have to be specific about what they think Windows is doing to negatively affect them. The only thing I can see at the moment is that OneDrive is present on all Windows installations, which they can argue is harming competition, but it's pretty minor. If they did something to prevent Nextcloud from working, the situation would be different, but they haven't and no APIs exist which give OneDrive powers that Nextcloud can't have.

Paranoia doesn't help legal arguments

"The earlier complaint left out Nextcloud's name for fear of retaliation. [...] 'if, at some point suddenly, somehow our cloud would not work on Windows anymore … we will be out of business.'"

Yes, and if Microsoft did cut off Nextcloud in some way, we would have a really big problem. That would be clearly illegal, and I think we would all agree it would be an unacceptable action. It's also a ridiculous leap. Microsoft could have done that before, as they could with other storage providers, and they've taken no steps in that direction whatsoever. They know it's illegal, and they should know enough to know that Nextcloud users would not switch to their product if they broke it. They're not about to break someone's product and incur the wrath of a competition authority in the hopes of a few hundred users. They could use a much easier and cheaper method to add OneDrive users who don't already have cloud storage.

The actual complaint might work, in that OneDrive does have icons on Windows when they're not in use. It's more annoying than anything, as nothing in Windows prevents me from adding as many competing cloud storage folders as I can find. Nextcloud will have to be clear about exactly which closed APIs and functions they wish to see opened. They do not help this point by alleging that Microsoft is planning to kill their Windows compatibility or blocks third parties from installing their software, because those things aren't true and they know it.

Computers cost money. We only make them more expensive by trying to manage them ourselves

Re: Two unmentioned benefits

Both those benefits are real, but I don't think they really work with this debate. Those are reasons that the cloud product could be technically superior than physical servers you run. These articles were talking more about rental or ownership of hardware. Some of the articles only talked about desktops, and even when they were talking about servers, they didn't say they would necessarily be running in a cloud provider's DC. While the debate isn't clear, I'm taking the arguments as including desktops issued to staff--three of four articles have unambiguously included mentions to them. In that case, the topic is much broader than "Use cloud" and I must answer the poll accordingly (I voted for because I think desktop rental is in most cases inefficient).

The climate is turning against owning our own compute hardware. Cloud is good for you and your customers

So what hardware is this debate about

Today's article focused quite narrowly. It only talked about the climate benefits of renting hardware, and it only talked about servers. That makes some sense as the servers are equipment where the renting option is likely to have a climate benefit, but the previous debate article mostly talked about desktops and finance. So what hardware are we going to rent or buy here? Is it just everything the IT department ever sees?

This is an important issue in the functioning of this debate. If we're actually talking about desktops, even as part of the argument, then we can't jump to a "be green, rent" solution. Rented desktops don't use less power than purchased ones, they don't use less materials in construction, they are likely to be transported more, and they may be replaced more often than an owned one which increases the pace of waste electronics. This environmental argument could therefore be twisted to represent the opposite side of the debate. In a good debate, the debaters understand what they disagree about and they make this clear to the audience.

Re: Not just that

Please tell me what disability means you can't press a button, but you can still load cups and pods into a device the button is on. If the device had an automatic loader so they could advance it without touching it, then you might have a point (though in any case you still have to have a method for them to retrieve their coffee when it's done), but it sounds like this doesn't have an industrial new cup supply belt.

Disability is a good example of the usefulness of a lot of this tech that's often mocked, but it doesn't always apply.

Microsoft adds Buy Now, Pay Later financing option to Edge – and everyone hates it

Kill it now

This is going to annoy anyone using Edge. If they wanted to erode the set of users still using that browser, this is an effective way to do it. I also can't imagine why they thought this was a good idea. A lot of sites already bother people about these useless payment systems, so they're already facing a lot of competition.

Renting IT hardware on a subscription basis is bad for customers

Re: Debate scope is vague

Exactly. It really changes the point of the debate what hardware is included in this. For example, renting some infrastructure, such as servers in a cloud provider's DC, can make sense because it's easy to change how much you have. If you need more servers today, you start renting them then, and when you don't need them tomorrow, you shut them down and stop paying immediately. The article, however, seems to focus on desktops. Those are less likely to have such a spiky profile and renting could come with a variety of complications. If you have a rented desktop, who puts in a new disk if the original fails, who images it when it changes hands, and who decides when it's old and will be replaced? I could see it working somewhere maybe, but there are so many ways I can see it failing badly that I would be very cautious.

BOFH: What if International Bad Actors designed the vaccine to make us watch more Steven Seagal movies?

Re: Disappointing

I disagree. Look at the article. Yes, it's fiction, but the person was not dissuaded by logical questions. That happens in real conversations too, although often in a different way. They don't see how illogical it is to assume every doctor is secretly on board with an evil plot, so asking them why they do it, what the goals are, how they possibly manage the logistics, all lead you into a loop. Worse, if someone else is watching the conversation, the idiot is stating all nature of lies to bolster their point, and I'm not allowed to point out the inaccuracies because it makes me too smug, then the observer sees a knowledgeable person with all these anecdotes and the stupid supporter who can do nothing but ask for details. The liar is happy to keep providing those; their original anecdote was a lie, so they won't mind piling on some more.

Take your own example. If Galileo had decided to counter the prevailing theory only by asking questions about it, he would have gotten answers. The geocentric model wasn't only supported by stories from religious books. It also had a lot of work put into understanding it. For centuries, people had been observing objects' movements and making models to explain those movements using a really complex series of geometric orbital paths around the planet. Those models could correctly predict the movements of the objects quite well, until they couldn't, when they would be changed to account for the problem.

Had Galileo asked questions, he and any observers would have been presented with thousands of pages of rigorous, precise, meticulous, and mathematically accurate calculations showing how everything circled the earth. The only problem is that all that correct mathematics didn't work with the real physics going on. It would have been one questioner against centuries of provable effort and he would have been ignored with ease. He had to say "This model is wrong, I can prove that it's wrong, and I can prove a replacement". Doing that meant that others could verify that the inaccuracies he found were real and that they could similarly verify what he thought. That is what he needed to do and he did it.

Re: Disappointing

Be careful what you wish for, because they have struck here before on serious articles. It might seem beneficial to correct them, and it might seem fun to troll them, but it doesn't take very many of them ignoring your correct points and not caring about your jokes while making it clear that they are putting others at risk to make the exercise a lot more frustrating.

In addition, I have identified a pattern of argument among those who argue against the vaccine. When they think they have an advantage, they'll use all these stupid arguments in the hopes of convincing others. When they know they're talking to someone who is smart enough to recognize those as the rubbish they are, they go into defensive mode. That means they will use a lot of vague arguments that you can't immediately dismiss (the vaccine has reported side effects which can be dangerous, and you have to acknowledge that it's technically true while most of the ones they're talking about never happened). They'll also do the very specific lie, the kind that takes thirty seconds to make up but takes you fifteen minutes to research in order to disprove. This tactic isn't limited to vaccines, but it is popular with that group.

Crypto for cryptographers! Infosec types revolt against use of ancient abbreviation by Bitcoin and NFT devotees

Re: how about "Cryptography means Cryptography"?

The cryptography is both integral to the concept (not bolted on as with many other systems) and differentiates it from the previous currencies. This was an intentional design decision in the initial cryptocurrencies to make it impossible to have a central authority, and the initial designs and arguments for it indicated how important this feature was to the concept. It's really quite different than some other system that uses SSL for security of communications.

Re: aguynearphilly - If I'm not mistaking

It doesn't encrypt, but nobody said it did. SHA256 is in a category called "cryptographic hashes", as opposed to hashes that can be used for storing and retrieving data but are weak on uses for security-sensitive operations, and therefore it still counts. Cryptographers decided this.

Re: @Paul Hovnanian - But it is crypto

The difference in this case is that cryptocurrencies use cryptography as the only verification step and have no central control. Your communication with your bank uses cryptography to throw off a listener, but it doesn't use a cryptographic key to establish your identity and it doesn't use a cryptographic system to ensure your money is only controlled by you (for example, if you pay your bank fees, they'll remove them without you having to authorize it).

The same distinction applies to email. Normal email uses cryptography only between you and the servers involved. Cryptographic email, not usually called cryptomail but you can if you want, uses something like PGP to secure and authenticate the messages themselves, and it really is a different thing.

That doesn't mean that you have to call cryptocurrency that, or if you do that you have to accept the "crypto" abbreviation as applying to it, but there is a reason the word was used that is valid.

Re: how about "Cryptography means Cryptography"?

They might not think of them as digital, but they are. If we decide on a name because some people don't understand one thing, and by doing so we're inaccurate about the thing we've renamed, we're doing two things wrong. Hence why it isn't a proper use of digital.

The things called cryptocurrencies really do have distinct features from all currencies issued by central banks and from purely digital currencies that didn't have the same goals in mind. It is not unreasonable to use a different term to limit discussion to that type of currency. If we used "digital currency", we would constantly have to add qualifiers to our statements to ensure we weren't talking about someone's SQL database with account numbers and amounts in it. As such, "cryptocurrency" is easier to say and understand than "digital currency, specifically a decentralized one using a distributed blockchain and cryptographic access mechanisms" so nobody will use it. If we dislike "cryptocurrency" as a term, it's a good idea for our replacement to have similar exactness and simplicity as the term we want to replace.

Re: how about "Cryptography means Cryptography"?

"Shirley a simple 'Digital Currency' more than covers it?"

No, it doesn't. Any of our currencies are digital currencies, as are tokens stored in one company's database like the virtual currencies used in videogames. Cryptocurrency or blockchain currency, I think either works, is quite distinct because it is decentralized by use of a blockchain and secure by use of public key cryptography (hence why it can use crypto in its name in my opinion). I think from the suggestions that blockchain currency is probably a better name for it, but digital currency is insufficient.

Apple sues 'amoral 21st century mercenaries' NSO for infecting iPhones with Pegasus spyware

Re: I sense this is not going to be a popular opinion...

If you're still uncomfortable based on your points from the first comment, then your discomfort is based on a misunderstanding. Apple never said what you think they did. Maybe you will also dislike the argument they did make, but you do have to understand the argument they're making so you don't assume they have exerted an ownership or control right that they haven't done. When they have implied that elsewhere, most recently in their App Store monopoly case, I have agreed with you and opposed them. That's not what's happening this time.

Re: A bit Streisand...

You don't need a lot of technical knowledge to realize that the marketing on more security doesn't mean perfect security, and that you'll never get perfect security. All Apple's marketing means is that you get the security updates they make faster than their competitors (no waiting for device manufacturer and possibly a carrier reseller to release the patch as some Android devices do). They're also happy to praise their App Store review which keeps out more malware (though not all), but as NSO didn't post theirs to the App Store, it's irrelevant in this case. You are asking Apple to produce effectively bugless code and claiming that, when they don't do so, it invalidates every security claim they've made. It doesn't work that way.

And whatever your insurance contract may say, if I walk through your unlocked front door and take your stuff, I've still committed a crime and can go to prison for it. NSO didn't attack a device with no protections; they had to break some protections to get what they wanted, but even if they didn't, it would still have been illegal for them to do it.

"the very fact that they allowed this software to be installed means that they are jointly responsible and should compensate their customers."

They did not allow it to be installed. They didn't know, so didn't allow or deny. They do not have the responsibility to police everything you do on your device, and when they take a few steps toward even thinking they have the right to do that, we complain about them and they get sued for limiting user choice, actions I emphatically support.

"OK mate so what you're saying here is that Apple phones are vulnerable to malware installation? Something that Apple keep on denying."

No, they don't. They call out security fixes in literally every IOS update. That indicates that IOS was in need of security fixes then, and they've never said it would now be perfect.

"You're also effectively admitting that you can't do anything to prevent this without resorting to legal action?"

No, he didn't. He said that the abuse of security holes was illegal, so they were justified in bringing legal action. He did not say that was the only method available to him, and Apple's patching of NSO's exploits proves that it is not.

Re: I sense this is not going to be a popular opinion...

Please read the article. They didn't say that they're entitled to damages because "You ran code on devices we made and those are ours". They said that NSO used Apple's services, the ones that run on Apple's servers, that you have to agree to a contract to use, and that you can choose not to use, and that NSO broke the contract in their malicious use of those services. Entirely different.

You have objected to an argument they never used, and your conclusions are entirely built on your failure to follow their claims.

Re: A bit Streisand...

Ah, yet another call for perfect code. I like this site as a news source because most articles assume a degree of technical knowledge, and most participants on the forum seem to have that. Sadly, not always. If I come to your house and determine that I can break in without you knowing, it's still a crime if I do it. You should know this.

Theranos' Holmes admits she slapped Big Pharma logos on lab reports to boost her biz

Re: modified COTs equipment

"So if the testing requires less blood wouldn't this be mentioned to the operators, if not then it's just more blood being flushed out at the end of the cycle."

That's what they were going to be selling. Unfortunately for them, it turns out the original machines used more blood for a reason, and their attempts at diluting it made the results unreliable and worthless. They didn't like that, so they lied to pretend it worked anyway.

"Admitting in court that secret changes were made will likely bring the FDA into play with whole new set of charges"

They never got FDA approval. The FDA kept telling them they needed proof, and never got it. More lies were told about that though.

Apple's Pegasus lawsuit a 'declaration of war' against offensive software developers, says Kaspersky director

Re: There is a big difference...

I am observing the legal concerns of the half of the problem this discussion is about. The malware affected user's devices, not data in transit. If you want to discuss something unrelated to this discussion, maybe here's not the right place.

Re: Apple & C. want the information control - and power to decide who is under surveillance or not.

They may not have been, but I will. Yes, those are courts I include on the list, which is why I take a dim view of NSO and companies like them facilitating the penetration of technical defenses. The U.S. may not be using them; I have not seen them on any of the lists of NSO clients that have been released so far. However, the U.S. develops similar exploits and I want them to stop. I want everyone doing such things to stop committing these crimes, and if NSO is the low hanging fruit on the issue, then start there.

Re: There is a big difference...

Rubbish. I'll make it simple: search for exploit, allowed. Have exploit: allowed. Use exploit to invade a device you don't own: not allowed. That's all this would do, and that's what the laws currently say anyway. If you think the only way that security researchers can make money is selling their findings to malware creators, you're wrong. If existing security researchers do that, they've committed a crime.

Re: Offensive Researchers

No, it couldn't, because you already have all the legal rights you need to sue the U.S. over Stuxnet. The problem is that they will deny that they did it, and it's hard to provide sufficient proof otherwise. You would also have to prove that you were damaged by Stuxnet in order to have standing. If you can do both of those things, you don't need a new legal precedent for it. If you can't do both of those things, you still don't need one but you're likely wasting your efforts.

China trying to export its Great Firewall and governance model

No, they wouldn't be. Most standards do not have the weight of law, so holding an election for the technical expert who will cast your country's vote is just stupid. Even for standards that do have a connection to laws, the local country should make those on its own--we allow each country to decide what it will view as crimes rather than letting the biggest countries decide it for everyone. Nobody is arguing that China should be excluded from making standards but instead that it should be done with caution because some of the attempts are organized for reasons other than technical superiority.

Should be easy to win the rights to .tv when you're name-checked in the contract's tech reqs – right, Afilias?

Re: Questionable value for money?

People generally don't choose whether to follow a link based on its TLD, but when they're selecting the domain they're going to use for their project or organization, they try to get a memorable one. We all do this when setting up our own domain names--we want something easy to remember, relevant to the service, easy to type, etc. .tv is popular for doing that for video services, and often because a lot of .coms are taken by squatters. The people using the TLD would care if they knew, and given that .tv accounts for a healthy chunk of Tuvalu's GDP, their population should also care.

Alleged Brit SIM-swapper will kill himself if extradited to US for trial, London court told

Re: Keep him please.

Point 3 is classic victim blaming. People don't know that SIM swapping is so risky. Maybe the technical systems should be changed so it's safer, so it's not their fault. Maybe we need to tell more people about it. As for keeping millions that way, it added up to millions, but you don't know who they stole from. In order to get there, you can bet that they were taking large amounts from each victim, likely most or all of what they could. So it really is the same as "Cf. a doddery pensioner being bilked out of their meager life savings through phone fraud."

Point 2 is irrelevant. This crime stole cryptocurrency. If there wasn't any, they would have attacked other investments or bank accounts. SIM swapping attacks go after those all the time, using similar methods, with similar effects, cryptocurrency absent.

Re: No excuse

"It just puzzles me they all are subject to extradition proceedings, what they did is criminal under English law and that’s where they (allegedly) committed their crimes."

Extradition usually applies when the victims are in another country. The UK can of course turn down that request, but it's not unusual to be asked when American victims are involved. For the same reason, if someone steals your money from Russia* and you're in the UK, the UK has the right to charge the criminal, may request extradition from Russia, and may request extradition from somewhere else should the criminal travel there. The U.S. is doing the same in this case.

*Russia used as an example of a country that rarely extradites.

Just because you can do it doesn't mean you should: Install Linux on NTFS – on the same partition as Windows

Re: Boot … reboot … dual boot …. FFS what year is this?

"conceivably with multi-cores, SOC’s etc. the BIOS could be written to allow 2 OSes to run at the same time accessing different SSD’s on the same machine flicking from one to the other with a keystroke."

They could, but that's basically putting a hypervisor in firmware. You could just run a VM platform on a normal OS and then you have less hardware worries since it has the resources of the host OS to use. It's done quite often on servers at the moment. You could boot natively to your main OS and run your others from VMs on that, or you could run something lighter as the host and run all your OSes on that.

Yes, it could do that. And it could do that already. If you let your Windows image see the partitions your existing Linux is on, they have the access they need to modify them. The malware concerned would need to have some extra code in it to write to the unfamiliar filesystem, but any malware sufficiently advanced to detect your Linux and inject a Linux service could bring Ext4 with it. Most malware isn't going to bother doing that, but if you want it prevented, you'll have to do more than just not having the OSes sharing a partition.

Munich mk2? Germany's Schleswig-Holstein plans to switch 25,000 PCs to LibreOffice

Re: Not saving money?

"Lock in" means that you are in some way forced to use it, or at least that changing to something else is painful. If, for example, you use Microsoft's cloud services, you very well might be locked in because their database config can't just be immediately shifted onto your own equipment (if you only use their infrastructure, then you don't have that problem). Nothing of that nature exists with Office.

If you have an IT department that likes Office, and that's your reason for not switching, then that's not at all Microsoft lock in. They are using it because they like it and want to. If you have a problem with that, tell them not to or replace them. Microsoft didn't put them there and do not have any mechanism to force you to listen to them.

Re: Not saving money?

"And that getting ready would involve a lot of running around in blue-arsed fly mode. Far better to be there ahead of time."

I didn't say they shouldn't, just that there's no lock in mechanism available to Microsoft. Microsoft benefits by having lots of subscription customers. I wouldn't be surprised that they try to get everyone to use that licensing method, but an inflation rate that ends up forcing customers out is stupid and they have enough people to recognize this. Lots of organizations have shifted to using Google services including Docs even though it's painful, so Microsoft should be well aware that their dominance in office software is fragile.

SSL keys, sFTP passwords and more exposed after someone broke into GoDaddy Managed WordPress using 'compromised password'

Re: Why are they even holding "passwords"?

Specifically how the passwords were stored. The article and their statement does not make it clear whether they hashed the passwords or not. Hence, they could be doing it wrong, but there is a chance that they did that part correctly.

Their broader security though, that they're definitely doing wrong.

Re: Why are they even holding "passwords"?

They could be doing it wrong, but they might just mean that the properly hashed passwords were exposed. However, if I remember correctly, Word Press uses MD5 without salting for the passwords. That's a lot better than plain text, but not good enough.