Posts by doublelayer

Samsung reportedly leaked its own secrets through ChatGPT

Re: They copied all the source code, entered it into ChatGPT, and inquired about a solution

"And if everything that gets asked of it also gets re-ingested back into the model, then anything commercially sensitive will automatically become available to everyone else who uses it, making it a total no-go area for anything to do with your business if you have any sense."

Everything said during a session is not ingested into this model, because the model can't do that. It is trained once and if you want to put some more data in, you have to start training it again from scratch, so that never happens. That's why GPT tends to be at least a few months out of date and can't explain anything that involves something happening recently. This means that if you put in some fact it didn't already know, it's not going to show up in anyone else's conversations, nor even yours if you have a later one. That is not a risk.

What still is a risk is that you've still sent a bunch of data to a different company without analyzing what they say they're going to do with it and what they actually do. Nothing prevents them from using that to train the next version of the chatbot, being hacked, or selling your conversation history, so unless you have a legal contract, that could still be a risk.

Version 100 of the MIT Lisp Machine software recovered

Re: RISC Machines

This depends on how complex something has to be before it jumps from RISC to CISC. ARMV9, with over a thousand instructions, or ARMV8 which has most of those and a bunch of others because it supports all the 32-bit instructions as well are pretty complex. It's not just load, store, and some mathematical operations these days. There are a lot of instructions that execute complex operations or that work on multiple pieces of data in one go. Is that still as RISCy as RISC-V which has about 60 instructions in the base set? If not, is RISC-V still RISC when it's used along with a bunch of extensions?

Re: Good or just entertaining

I come back to reply to this comment and notice I made a typo, and that classic one that involves a few characters and totally reverses the meaning:

I said: "It's also not compatible with their being right about what would have been better."

I meant to say: "It's also not incompatible with their being right about what would have been better."

Re: Good or just entertaining

I didn't mean your article; that was a good description and covered interesting aspects. I was referring to the 1991 article you linked to, which I think is a great piece if you want to hear about views and opinions but doesn't provide much reliable context for understanding what happened.

Re: The Forgotten Fifth Generation

"TP compiles really fast, but one of the ways it does that is to not be able to continue past that typo."

I see that as a bit of an asset. When I was learning, I made such typos more often, and I found that compilers weren't very good at identifying what to do after pointing out a typo. It would probably be fine with a semicolon, but if there was a missing parenthesis, it would likely generate hundreds of spurious errors that would go away as soon as I put the parenthesis in the right place. I tended to run the error output through a script that would identify the first three errors then cut off the output.

Good or just entertaining

When the winners forget they've won, or that they were fighting, that means that the losing side get to write some of the best summaries of the war. One famous account is a 1991 article called Lisp: Good News, Bad News, How to Win Big, which says:

The two philosophies are called The Right Thing and Worse is Better.

And an entertaining article that is too, but it's not a good summary of anything. Right from the start, from the quote I use, it's obvious that they're setting up a straw man as the method they don't like. They weren't being subtle about that either, and I'm almost entirely certain that they knew it and assumed readers did as well (the alternative is that they were some of the most irritating and self-deluded people in all of computer science, and I trust that they knew what they were doing).

This makes the article fun to read as someone who came along too late to participate in the war. It's also not compatible with their being right about what would have been better. If I ever use hyperbole to complain about things I don't like*, I'm doing it to make my comments less dry but I still have a reason why I didn't like it and that reason might be justified. However, by taking this attitude, it ends up lacking a lot of important context if you're trying to understand or summarize what really happened. If you say your thing is good compared to an alternative you've just made up, it does not show the reader why it is better than the real alternative that exists. I contend that the description is wrong. It's a great piece, but it is not one of the best summaries.

* For example, I could say something like "JavaScript's developers looked at the idea of error handling and decided that they didn't want to do it and they didn't want anyone else to either". This is not true. There are error handling methods in the JS specifications and people use them. I just don't like them compared to those used by other languages, and I've seen way too much JS code that doesn't use them and needs to. Treating the quoted statement as a fact would demonstrate misunderstanding of the language, but readers can understand that I mean it as a lighthearted way of expressing a less extreme point that, at least in my opinion, is still valid.

Plagiarism-sniffing Turnitin tries to find AI writing by students – with mixed grades

Re: Saving Time??

It might have, since it removes the part of the process requiring original thought. I can't say I've done something like this, but the closest I came was in a literature class I took as a young student. The teacher of this class was not very good, and whenever they assigned a literary analysis assignment, original thought was not recommended. You could come up with an original idea for something contained in a book, rigorously defend it with quotations, comparative analyses of other books by the author, verifiable or likely references contained in the source material, but if it wasn't the interpretation the teacher thought of you would still score poorly. Meanwhile, if I listened to what the teacher said the theme was, paraphrased it, and backed it up with the first quotes that came to my mind, I'd get a good grade. Either that or I'm still deluding myself that some of my interpretations had value and I was always terrible at it.

In that case, I was saving time as a side-effect of writing to get the highest grade rather than the other way around, but it was more efficient to figure out what the simple answer was and write for that rather than to think of a novel one and find the information to demonstrate it. The work was reduced from thinking, proving, and writing to just writing. I was less happy about the result, but it took less time to get it.

Re: ChatGPT isn't good enough yet

I think the suggestion is that, because the raw GPT output wouldn't receive a good grade because it is too bad, that students could start with that and modify it into a good essay. The modification would be equivalent to the work required to write the essay from scratch. This works well as long as the GPT output is really that bad, because any student who knows what they're doing could create a valid essay and would probably realize the GPT output wasn't helpful. It breaks down if GPT can generate working answers for some questions without requiring the student to do a complete rewrite, which might mean that the proposed policy is only useful in the classes the poster teaches and not necessarily anyone else's.

Re: ChatGPT isn't good enough yet

"My experience, from asking chatGPT to generate answers to various exam questions I have set, is that chatGPT answers would get 2ii marks at best, and that it is pretty obvious that they were not written by a human, or at least someone with a good grasp of structuring an argument and use of evidence."

I suggest that this may be due to a small sample set. If you are setting more advanced exams, your questions may be the kind that a chatbot can't answer plausibly. This will affect the lower level classes first, because the answers in those cases are simpler to generate without really knowing the content. Any student that takes something sufficiently difficult will find that GPT is no longer useful, but it could create problems for those taking prerequisites where the questions are easier. I'd expect this to be faced by teachers of younger students before they get to you.

Re: Doesn't add up!

I think it's two independent statistics. Their model probably provides a confidence number based on how likely it thinks the text is to be AI-generated. That number is generated by an opaque process and isn't necessarily correct. They've looked at how well the model is predicting this, but not to try improving the results. Instead, they just ask themselves how high their threshold needs to be to have a marketable statistic for accuracy.

They need to do this because, if their false positive rate is too high, they'll have universities and students alike protesting at their offices. Students told that their self-written essays have been rejected because a computer decided it might be AI-generated and there's no way to prove that it wasn't are not going to be in a charitable mood, and they would be right about that. Universities don't want students to get that angry. To keep this rate down, it's likely that this software is letting all sorts of AI-generated stuff through on the theory that it's better to let a bunch of guilty students through than to punish more than 1% of innocent ones. I suppose I have to agree that false positives are a lot worse than false negatives, but I'm dubious that this software is great on either.

Re: A rather important question

"the fundamental purpose of education itself (to facilitate individual growth of understanding) has been abandoned."

When you're growing individuals' understanding, they start by not understanding something that everyone in the field will need to understand. You need to teach them the basics and then verify that they understand them. Let's take computer science as an example. When you're doing early CS education, the basic code the students write isn't groundbreaking, because they're demonstrating that they understand basic concepts. One student's recursive factorial function will look a lot like everyone else's. Even at higher levels, students doing the same assignment will end up producing similar results. I graded a bunch of students' basic HTTP servers in C. Yes, they all looked a little different, but nobody came up with a radical reinterpretation of how to implement a protocol as simple as HTTP. They were demonstrating that they could write a program that implemented a spec, manage network resources to deal with a bunch of incoming connections, and didn't use up too many resources in doing so. Had they gone to any of the other schools that has an HTTP server as an assignment, they could have gotten someone else's code and I wouldn't have been able to instantly detect it. That's it.

Essays can be similar. Not all of them are new original research. Some of them are intended to check that the student knows about the topic they're talking about, has correctly interpreted what they've read, and can get results from that. Eventually, they will need to do more original work than that, but not at the earlier levels where demonstrating understanding and the ability to describe what they know is being tested. As things get more complex, sending a prompt through GPT will become worse and worse. Even for earlier essays, GPT is liable to end up spitting out wrong answers and causing the cheaters to submit flawed essays. That isn't guaranteed, though, which is why chatbot-generated essays are still an issue.

Re: pointless

Depending on the level, the essay might have two purposes: making sure they understand the topic and helping them improve their writing. They'll eventually have to write something to express their ideas. Those who do not do well with the written word probably need to learn more about how to write well, because in our world, it's rarely optional. That's not universally true, but low-level education is trying to train everyone in general skills, and writing is one of the most general ones out there.

"you're not going to get kids who don't want to do the work to retain any of the knowledge by forcing them to write an essay."

How are you going to get them to retain the knowledge? Some kids are lazy about doing the work in whatever form but understand it, and that's great, but for those who don't want to do the work and don't understand it by themselves, do you have a plan for checking whether they understand it and fixing this problem? I don't think homework in a different form is going to change things very much. You'll have students who don't want to present in front of a class, don't want to have one-on-one discussions with teachers about the subject, and don't want to do the homework assignments. That's a problem with not wanting to do the work, not an indication that we need to change what the work is. There are cases where the essay is poorer than alternative methods, and change makes sense in that case, but not just to deal with students who don't want to do it.

Re: pointless

"If the essay can be fully automated by ChatGPT it likely means the entire subject can be automated (and removed from human jobs)"

Yep, definitely. Writing an essay describing how the cleaning process of a historical oil spill went wrong can be automated, so let's just let the AI figure out how to do the next one. The point of the work isn't writing it up, but understanding what didn't work, being able to explain why it didn't work, and being able to use that to figure out what will work later. Why does C4 explode? Easy to automate, but future chemists need to know that not so they can answer a quiz question, but so that their new compound that hasn't been described online yet doesn't explode unless they wanted it to. Other examples are available.

It's been that way no matter what tool was used. A simple calculator can automate all the primary school arithmetic assignments as long as you can explain to a student that you read from left to right, push all the buttons that have the symbols, then write down the thing the calculator says. If you let them use a more complex calculator, it can handle the next few levels as well without much human input. This would be great for jobs that just involve adding up numbers, but spreadsheets eliminated most of those. We still teach it so that the people know what numbers and operations to put into the spreadsheets, because numerical jobs don't involve a list of formulas people just want solved.

It is now safe to turn off your brain: Google CEO asked Bard to plan his dad's 80th birthday

Re: Asked it to respond as if it were the planet Pluto

Alright, I'll give it a shot.

Hi human. I'm Pluto, and I don't care about any of your problems. You're way over there. I couldn't care less what you do for your father's birthday. Also, tell NASA to cut it out with the probes. I've seen two of them just fired past me out into the rest of the universe and one that was poking around much closer. I'm sure they don't want those probes out there, and don't you even think about trying to land one over here. Bye now, and by the way, I'm going to last a lot longer than your planet will when the sun vaporizes it in a while.

Tesla ordered to pay worker $3M-plus over racist treatment

Re: How about direct support absent the middleman.

What If instead of cash, the company was instead on the line for mental health needs.

All your mental health bills get invoiced to their accounting department to be paid immediately.

We have received your expense report of April 3rd. We will need to see receipts from the providers along with a signed statement from the care provider that you did in fact discuss mental health issues related to this company's previous actions. Please submit this through the web portal, you know that one that someone wrote in 2003 which has a broken script nobody is ever going to fix and a 60 kB upload size limit. Remember that all expenses must be submitted within seven days of the service being provided. We will analyze your claim at our earliest convenience.

How is this supposed to help over the company simply giving them the money to pay for this stuff? It certainly is worse for the victim, but the company also incurs the cost of maintaining this service which adds complexity over being fined and having to pay that fine. I'm sure some companies would accept the trade, but those companies are also going to be the ones who find a way not to provide very much. They're the kind of companies who would quibble which expenses are about mental health and which ones aren't, and I don't have anything approaching a list.

In addition to all that, the penalties assessed in a trial like this aren't just for mental health expenses, but also a punishment for breaking the law in the first place. If you're worried about people pursuing incorrect actions to get money, I'm not sure how often it happens, but I can accept the logic that it could. The solution to that would appear to be to give the victim some amount for their suffering, then assess a punishment fine that doesn't get sent to the victim. You still have to do that or a company won't stop the behavior.

In the battle between Microsoft and Google, LLM is the weapon too deadly to use

Re: Futile

You haven't noticed a change. You've noticed what already was the plan. OpenAI is a company that wants to make money. They're not going to release their models for free as open source. They were never going to, U.S. government or not. They didn't do that with any of their previous flagship models either. OpenAI wants everyone to pay them to integrate ChatGPT into whatever workflows they can, and they'd like them all to do it right now before people realize that it's not as useful as they wanted it to be. I can't automate the boring parts of my job by having a bot write code, because the code won't work right and I'll spend longer fixing it than I would writing it.

Why UK watchdog abandoned its Apple monopoly probe

Re: time limits stipulated in the UK's 2002 Enterprise Act

"Also remember to Apple the EU is a relatively small market compared to China"

China's population is over twice the size of the EU's. That makes it a larger market if you could have all of it, but it doesn't make the EU market inconsequential. Also, Apple doesn't have and will never have the entire Chinese market, so the EU is a bigger one. Let's look at numbers:

Apple shipped about 17 million iPhones in China for the fourth quarter of 2021. That was the highest quarter of that year. They had 22% of the shipments that quarter, but in other quarters, that fell to 12%. In the same quarter, Apple had 31% of the EU shipments. The larger EU markets also have significantly higher market share for Apple. 40% of Germany's market, 35% of France's, 30% of Italy's, and similar levels in most smaller EU members mean that Apple sells a lot of phones there. They would like to increase their popularity in large countries and have been doing a lot with India to be able to do so, but they would be very unhappy to lose the EU market.

Hey Siri, use this ultrasound attack to disarm a smart-home system

Re: Voice filtration may help

"If there's a way to turn off the "specific voice" component, so ONLY pressing the button would activate the assistant, that would pretty well stop these kinds of attacks."

There is, and if you don't train it on your voice, that's the default.

"Bonus points if the microphone doesn't get turned on unless the button is being pushed, i.e. the "assistant" only listens when the button says to."

Yes, it has that. Because it's on a phone, the microphone is still connected, but if you don't have the voice activation turned on, Siri won't be processing any input from the mic.

Amusing typo

"And finally, iPhone 6 Plus wasn't vulnerable to either attack, likely because it uses a low-gain amplifier while more recent iPhones tested use a high-grain amplifier."

I'd like to try a high-grain amplifier. Do you think that it's also nutritious?

Voice filtration may help

They have demonstrated that they can activate a lot of voice assistants, but all but one of them is going to talk to the user while executing the malicious commands. That gives the user a chance to hear that something is going on, and more importantly, for most of the interaction, they can simply shout no to cancel it because most of the questions, such as authorizing a transaction or confirming a lock are going to ask a yes or no question and the local voice will be more easily detected than the ultrasound.

The only one they can activate without making a loud sound is Siri, but that one will pose some extra problems. Unlike some others which listen for anyone saying their wake word, Siri is activated by pressing a button or by a specific voice. Activating the voice wake word requires the user to train the phone to recognize their voice specifically, and it then doesn't generally activate on someone else's voice. If you have a friend with an iPhone, try it and see if theirs turns on. This means that an attacker can't just create a single track to activate Siri on any device, and if they don't already have a recording of the victim saying the wake word, they can only hope to activate with other samples. This might provide some insulation to practical use of the attack.

Paid and legacy Twitter verification now indistinguishable

Me: "Because posting on Twitter isn't advertising."

You: "Sure it is. There's a whole ecosystem based on 'influencers' promoting their 'brands' (ie themselves), which then translates into advertising and sponsorship deals."

Which isn't advertising, you know, the paid-for product kind of advertising. It's useful, but it's different. Twitter also does advertising, it's called advertising, and it works like advertising. Posting there is just posting, and although people sometimes do it to make money, they sometimes also do it just for its own sake.

Me: "Posting on Twitter is free"

You: "Nope. Distributing tweets costs money, just as dstributing newspapers does."

Yes, but Twitter doesn't charge for it. It is not free to Twitter. It would be free to me. It is still free to anyone else, tick or no tick. Twitter can change that but they have not.

But if it's 'worthless', why all the fuss about removing the tick? Surely all the complaints about being de-loused suggest current tick users see some value in the service, but just don't want to pay for it.

I don't care very much, and the people who have millions of dollars aren't choosing not to pay for it because they don't like spending the $96 per year. They either don't like Musk and don't want to give him money, or they think the tick is so useless now that it's not worth $96 a year (and I would agree with them on that). They choose to post about that, but that doesn't mean they care strongly about the issue, since Twitter appears to be used to post random thoughts people have, not all of which are of major importance to them.

So what you're saying is that it's possible to do some sender verification on tweets that don't have a tick? If so, again why are people so bothered?

Of course it is. Check the handle. You can't forge those. The tick was useful for people who were too lazy to do that. Now it isn't useful for anything. Again, I'm not bothered and I don't think other people are as bothered as you appear to believe. Just because The Register chooses to write an article and I choose to write a comment on the article doesn't mean either of us cares that much. So Musk broke another feature of Twitter; that's what I expect these days. Some people who liked Twitter might complain about someone coming along to smash parts of it up, but that doesn't make it everyone's opinion.

"Nope. Closest model is paying for services. Businesses tweet to drive traffic, subscription fees and ad revenues. Businesses would expect to pay for TV or radio ads, why should they expect the Internet to do that for free? Especially when again, they've been busily implementing paywalls,"

Because posting on Twitter isn't advertising. They also advertise on Twitter for which surprise! they pay money. Posting on Twitter is free. Twitter is within its rights to make it not free, but they haven't, so people don't voluntarily pay them for the privilege. The paper could pay for a tick icon, but like everyone else's tick icon, it is worthless. I don't pay for worthless things and neither will most companies.

"look on the bright side, if the NYT, Pelosi or even the Whitehouse lose their ticks, it'll make it easier for them to deny they ever said stuff."

No, it wouldn't, since it is still easy enough to check the history without a tick icon, but given your list of suspects, I doubt you ever do that level of research.

Re: Zuck on that

"here we have a bunch of people who could afford to pay refusing to do so. And the only principle in play seems to be that they're cheap."

Maybe their principle is that they don't pay for nothing, and right now, their tick means nothing. It no longer serves to verify to people that they are who they say they are, since it only translates to "they give us money". If El Reg came out with a new feature where I could pay them something and they'd turn off the ads, I'd consider it (I'm blocking the ads again because something must have gone wrong with the ads in the past, but still I'd consider it). If they had a plan where they took away my badge icon which I didn't ask for but I could pay to get it back, I wouldn't be paying. It's not because I'm cheap, but because the badge icon has no value to me and a meaningless blue tick may have no value to the people who have lost it now that it no longer means what it once did. It may not have had much value to them even then, but it certainly won't now.

FTC urged to freeze OpenAI's 'biased, deceptive' GPT-4

Re: It is singularity already

"what is there in the process of creating a statistical model that is explicitly saying "do not be creative"?"

The goals set for the model to meet. In most cases, the people making the model didn't try to create criteria for the model creating something new. The only criteria they put in were for likelihood of similarity to existing text for chatbots or likelihood of corresponding to captions for picture bots. Neither was trying to have their system create stuff from scratch.

That would be difficult to do anyway. A lot of creativity is basically taking a random idea that is biased by but not directly from learned experience, then subjecting that idea to testing. My brain can come up with a lot of random things, but a lot of those things either need refining to make them good ideas or are just rubbish. The important aspects to human creativity which any computer will need to do are idea creation and idea filtration. So far, neither has been performed by the models. They could do idea creation by pointing a random number generator at their input, but that wouldn't be biased toward good ideas so it would generate a lot of bad ideas. They put only a little effort into filtration, but they filter undesirable output after creating it, not by filtering the original concept which is why ChatGPT will occasionally output something they tried to filter out while humans tend to have more reliable filters for what they consider good or bad things to say.

Re: It is singularity already

"Brains cannot be magic. They must be statistical machines."

Not everyone will agree, but we can forget them for a moment, because I do agree. Brains are statistical machines connected to some pretty good biological sensor arrays.

The problem with this argument is in the next, unstated part. Basically, you're implying that since brains are statistical machines, then a statistical machine should be able to emulate a brain if it's big enough. No, not necessarily. If you build a statistical machine to do something other than what a brain does, you'll get different results. If you build one to do something much more limited than a brain does, you'll get a much more limited thing out of it. We have a machine built to emit some text, not one intended to understand the text it's emitting. Similarly with other famous systems that make pictures or music. They weren't built to come up with ideas for written or drawn things then make the results. They were written to guess at the wanted response from an input phrase and spit it out. Scale them up and they will find more pictures with more comments or more answers posted online by humans who knew what they were talking about, but they won't get creative. This is not because a computer is incapable of creativity; that's again a thing on which people will differ but I think a computer could do it eventually. It's not going to be creative because it was written not to be. You can't build a brain that way.

Re: Late to the party?

Some regulations of that kind exist in law and you take them for granted. Other such regulations were loudly supported, but didn't get passed. The degree of regulation will depend on the country and may strengthen, weaken, or do both in parallel. I'm guessing that, based on other posts you have made where you indicate that you view your employer and every employer as an enemy always diametrically opposed to your welfare, you don't think there is enough regulation out there. I will agree as far as that there are regulations that should exist but don't, but don't let that make you think that no beneficial regulations have come to exist from the advocacy of the past.

Defunct comms link connected to nothing at a fire station – for 15 years

Re: "NEVER SWITCH OFF"

"As long as the change was approved no fallback"

The problem as I've experienced it is that, if they don't understand it, they don't approve it. The change request can be written and sent for approval, but you'll hear nothing. You can bring it up manually to people who can approve it and they'll all say something like "I don't know what that is, and maybe it can be turned off, but wait for someone else to confirm that". Getting the change approved can be difficult. If it's hardware, I have an alternative. Accidentally disable the network port or unplug the network cable. It's an easy fix if people complain because you didn't even turn it off, but you can put it down to unknown failure of something old that wasn't monitored and use that to justify updating it.

School principal resigns after writing $100,000 check to Elon Musk impersonator

Re: But why??

"What possible reason can she have for even thinking such a thing is in the benefit of the school or the students?"

Well, if it did happen, it would be beneficial in the way that any large chunk of money from any donor would be. A lot of schools don't have massive budgets, so that could help provide some expensive upgrades.

"Why does this lady apparently think that Musk would want to get involved in funding some random charter school?"

I have no good answer for that question. My best guess is that she was one of those people who thought and since this has just ended still thinks that Musk is a great person. Such people are out there, but I can't explain why they think what they do. Musk has on occasion done something to help others, only when it would be flashy and bring a lot of attention to him personally, usually less than he claimed to do, and sometimes not actually providing any benefit, but maybe she took those few examples and extrapolated that he was a prolific philanthropist. This is where research would be useful, but she doesn't seem to be the researching kind.

Ukrainian cops nab suspects accused of stealing $4.3m from victims across Europe

Re: Oxymoron alert

Fake cryptocurrency and real but worthless cryptocurrency at least look different, so I contest the oxymoron. It doesn't mean you should buy either, but one has the possibility of making or losing you money basically at random while the other has a certainty of losing you money very much not at random, mostly a 100% loss immediately.

Judge grants subpoena to ID Twitter source code leaker

Re: Plan B. Get on with it.

"It should be quite easy to fork an open source e-mail client to incorporate about 75% of what Facebook does and most of what Twitter does using the e-mail protocol to create a distributed, encrypted social media system. Get on with it, someone."

How about you? You appear to have an idea for some of the parts I don't have one for, like how to make history public when you're using decentralized resources with no server to store the thing. Even Mastodon needs someone who wants to create a central server to store and connect to the rest of the network. I haven't put any thought into this as I don't use the existing sites and thus have little motivation to make something to do the same thing, but if you have, I'm sure there are some people who would work on it with you.

Re: Say 'cheese'

There are, but not all of them would work. You need each of your points to be easily identified by a computer and impossible to identify from the user. If I notice that my comments come back with typos I'd never have let through, I might assume I missed it the first time, but it would become obvious after a few of these showed up. If it was spacing, there are a lot of programs that can respace a file for a specific style, so as soon as I noticed that there were some weird spacing things, I might run one of those even if I didn't suspect tampering just to get this weird spacing out of my way. Some of these things don't apply to a generic text string. For example, there was the famous incident where a lyrics site watermarked the lyrics they distributed by using both ASCII and Unicode apostrophes which has the advantage of being invisible to the reader, but that tactic would break a compiler.

Not only do you have to be careful about where your watermarks are and that they aren't too obvious, they have to work in a file that's constantly being changed. If you planned to have one bit of your identifier be whether the first character of a comment on line 17 is capitalized, then you have to track the comment so that an extra line at the top of the file doesn't break it, a plan for what you will do if the file is changed and there's now a new comment on line 17, and a plan for if a programmer removes the comment line entirely. A refactor of a module that destroys a lot of your identifier could be hard to deal with automatically. This doesn't make it impossible to do, but it does add difficulty.

Re: Say 'cheese'

You could do that, but if my employer or any other employers I've worked for wanted to, they'd have to change the way they operate. Every employer I've been at has either had source control using git or something equivalent or, in one case many years ago, didn't have anything and when I said that we should be using source control, they said I could use whatever I wanted. This means that I can rewind through all the changes out there, so if I wanted to hide that it was mine, I could artificially discard some commits to make the point harder to identify. Git's commit system is also not going to natively handle watermarks because each modification would change the structures in an obvious way. They would have to patch it to handle them silently and could easily find it hard to do so without breaking things unexpectedly. It could still be done, but it's not going to be a turnkey solution.

Pro-Russia cyber gang Winter Vivern puts US, Euro lawmakers in line of fire

Re: This is "good news"

I suppose, but this relies on politicians having a way to deal with it other than saying "Let's pass a law saying that phishing is bad and giving unlimited spying powers to every police officer in the hope that fixes it". I don't have that faith. In fact, I only have a few, limited ideas that I could provide if the politicians asked me how to put a stop to it. My ideas would probably decrease it a bit, but I can't pretend I have a plan for eliminating all or even most of it. Maybe we should start thinking of plans now so we can have ideas ready for when politicians ask us, or maybe we should just give in to the fact that politicians never ask us.

"What was the use case to make hexadecimal encoded JavaScript possible in the first place?"

There was none. That it executes is a bug. That it can accept hexadecimal encoding is just proper use of HTTP. I can put regular characters on a URL unless they need to be escaped, but I can also put any of those in as hexadecimal using the same methods that are there for the characters that need escaping. The following URL is a valid one and it will result in the non-obfuscated one when parsed by any HTTP-compliant server software without any special code needed:

https://my.domain/?a=%61%6c%65%72%74%28%22%49%20%6d%69%67%68%74%20%62%65%20%6d%61%6c%69%63%69%6f%75%73%22%29

Had enough of Android? First 'Focal' based Ubuntu Touch is out

Re: I love the idea of UBPorts

I'm not sure that proves a point, though. It can be upgraded to 8.1, sure, which is a little better, but it's still stuck on a version five ones earlier from the current version. But it's old hardware, so why should they keep supporting it? I think they should do that for a while after discontinuing the hardware, but they haven't done that. I can tell you where you could get another Gemini: from the manufacturer's website where they're still selling these things as new*. I blame Android for the problems that Planet have had keeping them up to date, but I also blame Planet. Both parts of this could have done much better than they did.

I think you're demonstrating a trend here, willing to excuse any bad standards if you like something else. I think Planet's hardware is interesting and I'd kind of like one even with their software support record, just as I want mobile Linux to succeed and would like to run it. That doesn't mean I should forget about the problems that each has and pretend like those things don't matter. If I can't be honest about the software's weaknesses, I can't fix it for those people who won't put up with anything to get the one feature they really want. And if I am recommending hardware for someone who wants a mobile device with a keyboard, I'll mention Planet but I need to tell them about the abysmal software support or I'm being dishonest with them.

* You can buy a Gemini, but last time I checked which was a couple weeks ago, they had sold out of some of the English keyboard options. You could use one with a different language or it looks like at least some English versions are still available, just not the popular ones.

Re: It's a phone

I am referring to the general case. You still could make calls with a headset. If the phone call system doesn't work because of a software problem, it's not that easy to solve. Hence, if it's your microphone failing then it's a problem to be handled by you personally, and you can decide whether you want to buy a replacement, try to fix the mic, or not call people very often. If it's a software problem, it now affects every user and, unless they are good at fixing things the original developers couldn't, they likely can do nothing about this problem. If UB has a telephony problem, and I don't have any information that suggests they do, it is not a good idea to downplay it the way you have done, even if it's not that important to you.

Re: It's a phone

I agree with you that writing off an operating system because of a bad device isn't a great policy. However, I think this part might be correct:

"And your Android had a tiny amount of RAM and storage vs iPhone? I simply don't believe you if you're comparing similarly priced phones."

From the original comment, this was in the relatively early days of Android phones. Back then, I still had a flip phone, but I remember the specs of some of those early devices and I've seen some after they were decommissioned and they could be terrible. For example, I was asked to erase a bunch of Android 2.3 phones for a charity which came equipped with 256 MB of internal storage. That's inconceivable these days when an Android image regularly takes up over 10 GB of space on the internal flash. Even then, most of that space was reserved for the OS, so every one of the phones had a 2 GB Micro SD card for the user's files. I know that because I still have the things here. I erased them and I now have as many 2 GB cards as I'm likely to use for the next decade assuming they don't go bad.

Sadly, I don't know what specific phones these were, but I found a lot of early Android phones with such specs. I have found models from 2011 from at least four manufacturers with 150-400 MB of internal storage. I don't know how painful those were to use, but it can't have been good. They were probably cheaper than iPhones, but if you had a discount from a provider or were buying older models, maybe they were more directly comparable. For example, the iPhone 3GS released in 2009 originally had a base storage version of 16 GB. A year later, they added an 8 GB version. It's true that the 3GS had 256 MB of RAM as well, but I'm more prepared to assume that Apple optimized their OS for that amount of memory than to believe that the consistently memory-hungry Android did so well.

Re: Disingenuous

If your modem doesn't work well, it's not just the phone call feature you're losing. That's why those who never make calls should still probably care about whether their software can support that relatively basic functionality. And if by some miracle that's not the reason it doesn't make phone calls, then it would have to be related to the audio hardware which means that you probably can't use VoIP services either and you may lack, for instance, sound in recorded videos. Since I don't take many videos, this isn't that important to me, but it's still a core feature for any device where the manufacturer put a camera and a microphone in it, so it's not impressive if something that basic fails to work.

However, it was the recommendation to just buy a dumb phone that I thought was the disingenuous part of that. Software which cannot do a relatively simple task isn't good software. It might be flawed software that won't affect your use case, although for the reasons expressed above I doubt that's the case this time, but it is still very flawed. If desktop Linux crashed if you used a trackpad or connected more than one screen, you could still use it, but it wouldn't impress people and we shouldn't expect it to. If mobile Linux can't do something as simple as make a phone call, it's similarly porous. We're talking about an activity that is so easy that basically no review has to talk about it because every device they're reviewing does it just fine. I don't know how well UB handles phone calls because I don't have hardware that can run it. From at least one review, it does have the software to make calls. Rather than refer to that or better yet, find information on whether it works well, the author chose to defend it by basically saying that, even if it didn't support the feature, who cares. That's what I found disingenuous.

Re: It's a phone

We all have different requirements. I would really like to run Linux on my phone, but I have never had a device that is supported by one of those projects. Maybe not buying flagship phones is incompatible with getting much hope of porting. The last time I attempted to port myself, it didn't work and I broke things quickly. Fortunately it wasn't permanent, but it was a complete failure to get things running. Maybe I should try again. I've been toying with the idea of buying a PinePhone which I know will support a lot of variants so I could find one that's good and support it. It is going to have to work at some things though.

Is it? Good heavens. I make calls a few times a year. I dislike phoning people.

Well there are still plain old dumbphones if that's what you want.

I think that's disingenuous. I like calling people a lot more than you do, but a phone that is incapable of making phone calls means that, even if you have to call someone in an unusual situation, you can't. Whether or not you use it often, it's a core feature. After all, you still call sometimes, so if I told you that beginning tomorrow, your phones would never make voice calls again, I'm guessing you wouldn't just shrug it off.

It's also indicative of other functions. If the device doesn't make calls well, it's probably not that they couldn't figure out the microphone; that's pretty basic. It's probably a symptom of support for the modem, and if the modem isn't working optimally, you'll also have problems with SMS and mobile data. I'm assuming that your pocket computer usage does make use of mobile data, and you're not just looking for a pocket WiFi-only computer?

Re: Renaming and discontinuing

I think renaming is sometimes advisable because the projects aren't run from the same group. For example, the Lomiri devs aren't the same group as those developing previous versions of Unity, they may not be maintaining compatibility with old versions of Unity, and they're making a different product. For example, distros that are still shipping the Unity desktop are using older versions of the software, built with the desktop in mind, and this version is intended more for a small touchscreen interface. Not that you can't use this version on a desktop, but there's probably a reason people aren't.

When a big enough change is made, it makes sense to not have multiple projects with the same or similar names. In an ideal world for me, the name would be meaningfully changed if the project isn't trying to upstream their changes to the original thing by that name (the reason why neither WebKit nor Blink are called KHTML even though they both started there). It helps someone know which project is the original and which one took a different path, especially when they have diverged enough that the two pieces of software aren't compatible with one another anymore.

I'm afraid I agree with you about the reliability of Linux-based smartphones. I'd like them to get here, but I wouldn't count on it happening. It's a slow process, and a process that may not be able to get fast enough to ever become useful the way Linux on a desktop or server is. Even the technical user sometimes wants to use a phone to call people, and if it isn't reliable, they'll become annoyed.

EU mandated messaging platform love-in is easier said than done: Cambridge boffins

Re: Not sure it is such a complex task...

"I don't think the issues are technical at all."

I'm afraid you're mistaken. Let's take a few examples as challenges.

First, build me a system that encrypts a video call among multiple parties using PGP. Can you do it? Sure, eventually you can, but it will take some effort. Are you going to use a centralized server to distribute the video or will you run decentralized. The former has the advantage of not overburdening the clients that might be mobile phones. The latter has the advantage of not requiring the server to operate and facilitating self-hosting. If you're not using the server, how do you identify the users you want to send the keys to. This is why apps with video call features, which all the things mentioned in the article have don't operate together.

Now show me how you plan to get keys around. I've done PGP email. I have my key, and I have to give it to everyone I know. I could always use the PGP business cards that some people had, but I never did. I could arrange with a friend to introduce us on a channel somewhere with their keys serving as a secure exchange, which means that we will need a mutual friend every time we meet someone new. Or I can do what I actually did, which was to send my key in an unencrypted email and just hope that nobody intercepted things until after we had set it up. I just sent a message on Signal to someone I know personally, but not well enough that we've pre-exchanged keys. I could do that because I knew her phone number. If I had to deal with keys first, how would the nontechnical user do so? For that matter, how would I do so even when I know what the keys are for, because I'd have to first set up an insecure communication path to provide my key and get hers, and any attacker could pose as me to do that.

There will always be technical tradeoffs between a very secure system and one to which the average user can simply log in and they're there. Signal and most similar apps chose the latter using verified phone numbers as authentication tokens, and PGP is the former. There are some improvements we can make to both of them, but we cannot just combine the approaches.

Your examples aren't interoperable for the same reasons that these apps are not. I can't call your email address from my phone. I can't email you a voicemail. Sending an audio file as an attachment isn't the same. If I encrypt a message and send it to you as an SMS, your email client won't decrypt it. The things you mention aren't interoperable; they're decentralized. I'd be much more interested in decentralized communication apps than in enforced interoperability.

If you're using any of these apps, whatever one it is, it means you have a phone capable of running the apps (or you found a way to make them work on a computer without one, something I'd also like to see more work on). That means that you can have any number of alternatives there as well. On my phone, for example, you can find Signal and Jitsi icons. I can't group together people in video calls placed on both of them, but I can call people on either of them as I choose just by opening a different application. This means that, should Signal break because their centralized system goes down, it doesn't break my self-hosted Jitsi installation or the app that connects to it. If the two had to interoperate, then either Signal would have to connect to a self-hosted version and deal with possible problems or attacks raised by that or that Jitsi would have to drop support for self-hosted versions. Neither option appeals to me.

Re: What a load of bollox

"All they need to do is use a genuinely secure standard and compete on their interfaces."

Yes, but the problem is that the interfaces we had were not secure. Phone calls, SMS, and email were the main standards when these apps started showing up. The former two have no cryptography unless you cobble your own together, and PGP on email isn't understood by several clients and can be confusing to nontechnical users. The next apps to come along happened to include security, but it wasn't the point. WhatsApp was popular at first not because it was encrypted, in fact for a while it wasn't, but because it made communication cheaper in a land of paying per message, especially for those who send messages internationally. By the time that Signal showed up, WhatsApp was being eyed a bit too closely by Facebook, so even though it had become encrypted, people who cared about their security were edging away from it. There isn't a standard that all of these apps speak because many of them were designed in a time where they needed to fulfill a requirement that, in their mind, the existing options had failed to meet. Each new feature that needed to be added would require adjusting the standard, which isn't feasible if every other app has to support them immediately.

If we're adopting a standard, I suggest we make an easier to use wrapper around email; it's already decentralized, so if we add some cryptographic validation, that should handle text messaging. Except we also want secure audio and video calls, so email is out. So maybe we can use something like Jitsi's protocol except that's self-hosted and doesn't have a global network. So maybe we should use the Signal protocol like WhatsApp also does, except that will use different keys if you're sending through Signal-run or Facebook-run servers, and you only know which key to use based on which app you're employing and maintaining a centralized database of keys would introduce privacy risks. So it looks like we might have to take some of the underpinnings and make a completely new one so that apps we trust and apps we don't are all part of one network. Maybe there's a benefit to having disconnected ones for people to choose from after all. I'm all for standards, but not single mandatory standards for something as simple as text communication.

Amazon opens its ad-hoc Wi-Fi-sipping Sidewalk mesh to all manner of gadgets

Re: Chuck everything Amazon in the bin

I assume this isn't an automated bot just yet, so could you please stop this? Whether your username is apt in suggesting you're posting chatbot responses or you're just pasting statements from the internet, it isn't helping the conversation.

Re: USA Only?

So far, it appears to be limited there probably because they haven't figured out the regulatory details for other countries and possibly because they haven't spammed out enough Ring and Echo devices in other countries for the geographic coverage. It will come sometime.

Re: a limit of 500MB a month

It's not your PII. Any of that would be sent by your devices and isn't subject to this limit. This limit is for how much of someone else's data can be sent via your network, data that will be sent by their devices somehow. This mesh network doesn't increase the amount of PII sent out, and if we want to fight that (and I am happy to participate), we have to fight the source of the privacy losses, most importantly Ring cameras but other Amazon IoT junk is also included.

Re: Otherwise One Would Never Know

Having heard stories of people who went on vacation and came home to the impact of a leak that had been undiscovered for days, I think they would disagree. One of the stories told to me concerned people who lived in a place with cold winters such that it also involved a lot of ice having formed afterward. Of course, my guess is that detectors for that are probably not installed unless you've already experienced it (I certainly don't have them). That doesn't justify Amazon's system here, just the leak detectors that can notify absent owners.

FTX cryptovillain Sam Bankman-Fried charged with bribing Chinese officials

I guess you can always use the forgot your password system on the login page to do it, but they really should have an internal method for known password changes. I also don't remember hearing about a breech and a quick search didn't tell me about it. I visit this site a lot. I'd assume the chances of seeing a report if they posted it here would be high. Did your password manager have more information about when and how the breech happened and how they know about it?

"The whole 155 years nonsense just translates to 'life' so I don't know why they bother."

Usually because the crimes in question don't allow for life sentences or place restrictions on when you can have them, but when you add up all the fixed terms that the crimes do call for, you get a big number. It still has meaning, because if you only did one of them, you could get a 5-15 year sentence which is not life and the effective life sentence only comes when you have a bunch of them. Also, there are regulations that apply to fixed-term sentences that don't apply to indefinite ones, which is another reason why indefinite terms have to be authorized in the statutes.

They tend to run as many charges in one trial as they can, so if the jury finds him guilty on all of the counts, the sentence can be a very high number, but if they acquit him on some of the charges, it would be much shorter. At the rate he's going, they're going to have to get him off of most of the charges for it not to be an effective life sentence.

Google again accused of willfully destroying evidence in Android antitrust battle

Re: Destroying evidence

It's a pretty easy distinction:

Not keeping evidence: Sorry, we didn't store that.

Destroying evidence: Sorry, we didn't store that even though we had a legal requirement to do so, the people involved knew about that requirement, and the system was already set up to store it by default and had to be deliberately altered in order not to.

It's the second one.