Posts by doublelayer

Slacking off? It used to be there was pretty much one place to chat with your fellow developers: IRC

Re: ew

So include those in the package. There are mechanisms for managing Python dependencies so you can deal with outdated systems. Alternatively, have the installation process rely on those dependencies and then check at install time whether they're met satisfactorily. If not, you can still do the full install method.

Even with that, there's no need for it to install a database server for you. Make it clear it needs a Postgres installation, and ask for credentials just like everything else which has a database does. A user can easily install the database from their package repositories and let the install scripts do all the setup if they don't want to manage that themselves.

Scam-baiting YouTube channel Tech Support Scams taken offline by tech support scam

Re: I was a bit surprised by this bit

It's not really tech knowledge that protects one from most scams. Knowing how to make the computer do what you want it to doesn't help you figure out that the bank alert is not real. We would hope that technical knowledge leads to checking links, but that's more a factor of laziness. Meanwhile, young people have less experience with a lot of life's details; if you've had a bank account for five years, you may not have seen what actually does happen when someone has compromised your account details, so when the call comes that someone has done that, you don't know that it's unusual.

I think the only reason that we more technical people are better at avoiding scams is that, since they involve a computer somewhere in the chain, we're told about them more often. Awareness, rather than knowledge, is our primary strength. However, I must warn those who think it's an impenetrable shield that we can get scammed too if the other side is convincing enough.

Re: Always trust Microsoft reports - not

In fairness, just because someone has been calling you more doesn't mean the aggregate goes that way. If we're battling anecdotes, I have been waiting for a tech support scam call because it seems much easier to waste their time when they have to have a person on the call. I'm still not sure if it's disappointing or nice that I haven't gotten any. I do get automatic scams where the robot wants me to confirm I'm gullible before they put a more expensive human on the call.

Thinking about upgrading to Debian Bullseye? Watch out for changes in Exim and anything using Python 2.x

Re: "the value of exFAT support is mainly"

FAT32 has a limit on the file size, which is a problem if you store things like OS install images, large video files, backups compressed into large archives, or anything else where you might need something big. I welcome exFAT support because that has already been the most efficient way of using physical storage to transfer large files between other systems (Windows and Mac OS have supported it natively for a long time). Of course it was possible to do so already through extra layers, but native support will just make things faster and easier.

You, too, can be a Windows domain controller and do whatever you like, with this one weird WONTFIX trick

Re: Right to repair

Would this spell an end to Intellectual Property?

No? There's still copyright. For the most part, you can't simply copy anything more than small code fragments without permission.

Yes, it would. If you make it legally required to release the code, then either you have to let people change that code by fixing it or the required release will achieve nothing because it would still be illegal to do anything with it. The argument about whether this is good is one I'll let others have, but you can't have your enforced-open-source cake and expect copyright to continue to have any real existence.

Dell won't ship energy-hungry PCs to California and five other US states due to power regulations

Yes, for the stated power states:

"The standards [PDF] specify energy consumption targets that cover four non-active usage modes – short-idle, long-idle, sleep and off-modes – tied to the device's "expandability score" (ES), based on the number and types of interfaces, and on additional power requirements arising from add-on capabilities (graphics cards, high-bandwidth system memory, etc.)."

The power consumed while idle is important to these standards.

It all depends on idle power consumption because that's what the law is about, so even if one is significantly more efficient under load, this law doesn't care. When running at idle, a lot of things consume power other than the CPU, which is probably why gaming computers are the ones that don't fit within the bounds. Only if one manufacturer can make large enough cuts in their processors' consumption when idle will that make a difference, and it's more likely that the PC manufacturers will find a way to make the more power-hungry components run better instead.

Private cryptocurrencies make lousy national currencies: International Monetary Fund

"The exchanges and the miners drive the fraud, often one and the same but they don't need to be."

In fact, if you're attempting to prove that it's a Ponzi scheme, then they not only have to be, but their activities have to be fraudulent, not just worthless and speculative. The term has a meaning and it's quite specific. It does not mean "of dubious value" no matter how much you try to define it thusly. A Ponzi scheme is a method of someone stealing your money, not of you throwing it away. Cryptocurrencies frequently are the latter.

Well, duh

When a country changes or adds a currency, they select something that's been at least somewhat stable. Just looking at the exchange rates between the popular cryptocurrencies and fiat ones over the past couple years confirms that one of them isn't stable, and living on Earth confirms which one that is. No sane country would look at that and decide to make one of those an additional currency. The closest they might get is using it as a short-term payment method, but few would be desperate or experimental enough to try that either. Most common cryptocurrencies are doing a terrible job as currencies, and everybody knows this.

No, it's not a Ponzi scheme. That doesn't, in itself, make it a good idea, but if you're going to argue against it, do so accurately.

A Ponzi scheme requires a central entity transferring real value to handle transactions in falsified value. In clearer terms, someone has to run the scheme and commit the fraud. Cryptocurrencies do not have such a person. This disqualifies them as Ponzi schemes. In your argument, you said "you're supposed to think if everyone sold off, there would be something left of value, but there would not.", which is correct, but doesn't a Ponzi scheme make. In fact, that statement is true of any other real currency--if we all decided tomorrow that the pound was worthless and sold ours, it too would go to nothing.

Most cryptocurrencies are bad as currencies and weak as investments, with no external worth and hideous volatility due to investor activity. That almost certainly means that you shouldn't rely on them for storing or making money. They aren't fraudulent though.

BOFH: You say goodbye and I say halon

Re: Not the Halon!

I'm betting it did. They didn't need it anymore, so they had it discarded while pocketing a large "disposal fee". If they left it, that's just more problems when they use it on someone. Replacing it with a perfectly good alternative which is now known and therefore unsurprising is a neater way of throwing off investigations.

London. The company has moved premises from time to time but has always remained in or near to London. Of course, sometimes it's a London as envisioned by a New Zealander, but London is the goal nonetheless.

Re: Not the Halon!

They don't need to keep it. They just need some gaseous method of keeping people out of the room, and if they've implemented the nitrogen method correctly, that will work as well. Or, for that matter, if they've pretended to implement it correctly, that might be as good a deterrent as any. More importantly, if they had an event where halon was detected, it's a worse excuse if it's illegal to have around. They might not be found out for the original use, but they'd have consequences already.

What is your greatest weakness? The definitive list of the many kinds of interviewer you will meet in Hell

Re: Why do you want to work here?

You have money, I have the skills you are looking for, and I wouldn't mind having some of your money.

I always find it strange that they think I have some burning desire to work for a company--there are companies I want to avoid working for, but I've never marked a specific employer as an absolute goal. This question becomes all the stranger if it's somewhere that contacted me.

Re: Reverse

I don't like that approach, or rather I only like it in a very restricted set of circumstances. Unless the candidate has already been told a lot about what they will be doing, they don't have a lot to ask about. After the obligatory question about what the job involves, and some necessary clarifying questions, the candidate is likely to know what it entails. So one of two things happens:

1. The interviewers know everything about the details and are willing to share that information, so the interviewee has to ask about active tasks that they would be working with, essentially trying to solve problems without ever getting to see the system, code, or whatever else is involved in the problem. This is if the interviewers tell the interviewee that they're doing this, because most interviewers don't even know that stuff so the interviewee usually knows well enough not to interrogate them on the internals.

2. The interviewers either don't know the details or don't want to disclose that to anybody who can get into the interview, so the interviewee has to come up with enough questions to fill the time. Instead of learning anything about the interviewee's qualifications to solve the problem, the interviewers learn of the interviewee's ability to improvise and fill time. While improvisation is a useful skill, it's not very useful if the more important qualifications are lacking. Filling time uselessly is a negative except in sales or law (and isn't necessarily great there either).

By all means let the interviewee ask questions, but unless you give them enough information beforehand, which questions they ask isn't going to prove much about their skills.

I don't think it's having the opinion that's the problem, but instead how you express it. If an interviewer asks what systemd is, they want you to describe what it's for and how it's used, not what you think of it. Commenting on its design decisions which you think are good examples of something you will avoid later is a middle area. Shouting that it's the worst thing you've ever seen is, even if they agree, not a great harbinger of your ability to accept things that you don't entirely agree with.

"As the article says, the employer needs to avoid anyone who is applying solely because they're desperate for a job."

I'm not sure about this. There can be several cases where someone does need a job badly and is also quite capable of doing the work involved. That someone is applying because they need a job doesn't automatically mean they lack the ability to do it properly. For example, someone who took time off to deal with an emergency which has also depleted their savings could be very desperate for an income stream, but that situation could also happen to any one of us given a sufficiently bad emergency. On another level, anyone getting their first position in a field will have faced some difficulty proving their qualifications without citing experience, and they could be very interested in finding a position, any position, so they can prove their abilities as a professional. Yet everyone here who has a job at one point didn't have any job experience but still had skills.

As an interviewee, if you're desperate for a job, hide it. Many interviewers will follow this quote faithfully. To interviewers, I suggest you become the exception to that rule.

Re: Oh yeah…

That's fine if you're at the offer stage when you decide you don't want to do that job, but if you're still in the interviewing stages, the costs are higher. Especially if the later interviews have time or location costs for you. Taking a day off work to travel somewhere to interview for a position you don't want in the hopes that you can suggest a ridiculous salary and they'll accept it is not very useful and certainly unpleasant. For similar reasons, I don't automatically start interviewing for positions when recruiters find me--having a bunch of one-hour initial interview calls isn't that hard, but it's often time wasted.

Re: That Meme

Okay, I'll ask. What is it that you want to hear when you ask that question? I've seen a few basic answers, either listing qualifications of use to the position (you already have that in front of you) or platitudes about a hard-working, motivated, interested, team-working self-starter (useless). This becomes even worse if it's the kind of interview where someone might end up in a few positions, because now they're not sure what specific qualification you're hoping they'll tell you about.

Re: It's a two-way street

"to people who neither know nor care about its products, ethics, "work-life balance" or anything else except the number on the offer letter, [...]"

Mostly agree, but I really do care about their work-life balance. I currently work a normal working week and I know how to request time off (and it's easy). If they want me to work long days or weekends, they'll have to pay me a lot more if I agree to go through that at all. Sadly, even though I care about this, I've never heard anyone tell the truth about the balance. Nobody ever comes out and says "To take time off, you must submit three forms through the complex portal with at least two months notice then wait for manager approval which should take about seven weeks", even if that's the case. If they ever did tell me, I would be listening with close attention.

Cloudflare slams AWS egress fees to convince web giant to join its discount data club

Re: Man in the middle attack

It sounds like you should be writing an extension for Firefox. That behavior regarding certificates is more complex than a browser typically supports--you can easily remove or distrust a certificate, but providing the data on each load isn't going to get added. It should be easy enough to implement by someone willing to write the code though.

Is it broken yet? Is it? Is it? Ooh that means I can buy a sparkly, new but otherwise hard-to-justify replacement!

Re: Ah, "I will know it's new".

If you store batteries for a long time, storing them at colder temperatures may extend their shelf life. How much it does so depends on the chemistry of the cells. I've seen people with more space than they need put batteries in the fridge for that reason.

A warning that if you're going to do this, do not put them in the freezer. Everything will fail if you make it cold enough, and the freezer is usually too cold for batteries. They could become mechanically damaged. If in doubt, check if the cells have a temperature rating and adhere to that. If they don't and you're still in doubt, room temperature is going to be fine enough.

Facebook gardening group triumphs over slapdash Zuck censorbots

I hate Facebook quite intensely. I feel I should state that right at the beginning so I won't give any misconceptions here.

They are neither "a quasi-state" nor "a government", nor are they particularly special. Reasonable arguments can be made that they are abusing a position of power, but they do not have the kind of power you think they do. Specific allegations include that they could close the pages used by businesses, which is true, but the businesses have the choice to operate their own business site or to use one of many other networks happy to host it for them. The fact that many businesses choose to only use Facebook does not mean that there isn't an alternative, and in this case the alternatives are cheap and better. Similarly, Facebook may be someone's only communication mechanism, but only if that person really hasn't bothered to get a phone number or email address from their contacts, which is not that hard.

Facebook has committed many violations of their users and those who try to avoid them, but you can't just declare them to be states without evidence. The large number of alternative superior ways to communicate and publish indicate that they aren't preventing those activities. It doesn't approach the restrictiveness of a company town, given that it can be avoided without significant cost. Its deplorable actions should be countered, but without elevating it to a position it does not and must never be allowed to inhabit.

Akamai Edge DNS goes down, takes a chunk of the internet with it

Re: Bad days happen to everyone

If we consider how much of the internet uses these services and how infrequent these events are, despite the attention each one gets, you could come to the conclusion that the services are actually pretty good at keeping sufficient resilience such that you don't have to worry about them most of the time. I don't know if that's a positive or a negative though--if they were less resilient, then maybe people would have more than one and they could better withstand the failure of one such system.

Re: Thankfully!

I assume they wanted to use two icons, and they're only allowed to select one.

You're not imagining it. Amazon and AWS want to hire all your friends, enemies, and everyone in between

Re: "I don't know how much AWS gives back to the ecosystem"

"Oh- wrong again. Go and download it and run your own X node cluster, where X is as big as you like, and pay Elastic nothing."

Yes. And when Amazon did so in order to charge people for it, Elastic got annoyed about Amazon using the right they explicitly gave them and attempted to adjust the license to take that right away. Currently, their new license still lets me set up a cluster for my use if I don't sell it, but if I make money off that, what's to say they won't change the license again because they don't think I'm giving back enough when I donate the amount I think they deserve? This is the debate. Should they change the terms because they want more money, which they have the right to do? I think doing that is against the spirit of the licenses they used.

Re: "I don't know how much AWS gives back to the ecosystem"

"I see that you thrown in "rent seeking" buzz-word, but in the context you used it, why don't you accuse workers of rent-seeking? Why company should pay workers every month?"

The difference is what they said before. The workers signed a contract saying they would be paid, whereas Elastic didn't. Therefore, the workers are asking for what they already agreed they would get, whereas Elastic were asking for something nobody ever agreed to give them and, in fact, something their license said wasn't required in the first place. Once again, I can see why Elastic wanted it, but changing the license terms is not a very nice thing to do, especially given that there were other contributors to the code whose contributions were being exploited just as much as Elastic's were.

Re: "I don't know how much AWS gives back to the ecosystem"

What did you say about the water when you put it out there? If you explicitly said that anyone could take as much as they liked for any reason, commercial or not, then it's an act you expressly allowed. It's fine to be annoyed at someone who uses something you made without paying you, but if you want to prevent it, you need to factor that in when you license it. The open source licenses explicitly give people rights which decrease your ability to make money just by selling the software. If you don't want companies to make money off your software without paying you, then by all means make your license free for noncommercial use; you won't be the first and I'll be entirely behind you. Just don't make it something else then act all surprised when people do what you said they could.

Re: "Open Source software was never meant to be used the way AWS use it"

"Why GPL didn't make a provision stating that if you rent the use of code to others, or anyway use it commercially, you have to publish your changes as well?"

Because they didn't envision a world where code is run for users rather than sold to them. However, that change would not fix the Amazon payment situation. Amazon already did release their changes. They just made money from the use of it and weren't generous about giving back financially as well as with code.

Re: "I don't know how much AWS gives back to the ecosystem"

"Rent seeking? Are you saying it's unreasonable for Amazon to throw a few coins into a few hats to support all that open source software they copy and paste wholesale and make billions from?"

No, I'm saying I don't agree with someone who demands it when they chose an open source license. Just as I don't agree with someone who makes something GPL and then complains that they can't make it noncommercial use only. You choose your license and it gives others freedoms, including the freedom not to pay you. It's reasonable to be unhappy about this and to complain vociferously, but to unilaterally change the license terms is something they have the right to do but I don't like.

Re: "I don't know how much AWS gives back to the ecosystem"

Not to praise AWS here, but if you're talking about Elastic,, that's not exactly the way their decision got made. They didn't like the fact that open source means you're allowed to use it for free. I get why someone at Elastic might be annoyed at AWS for making use of something that was given away, but that's part of the calculation when you use a license which effectively says "no support and you can use it without limitation". AWS didn't pay them very much, but they did upstream patches. Elastic wanted to rent-seek on their code and switched the license, and AWS chose to use the freedoms they were given. When you consider that Elastic got assistance from many external developers and didn't pay them for that, you can see why not everybody is on Elastic's side.

Europe mulls anonymous crypto-wallet ban, rules to make transfers more traceable

Re: Inevitable

This is tough for me, because some of your points are great and some are very wrong. I suppose I'll just have to go down the list:

"1) Environmentally damaging": Yes, very much this.

"2) Unstable": Correct and important.

"3) No sensible control of supply, the "Mining" is the stupidest part.": Incorrect. The supply control is built into the specification of the currency in the first place. There is a finite number of Bitcoins that can ever exist, for example. Most proof of work ones have difficulty levels which act to restrict supply. This is one of the things the designers intended right at the start.

"4) Transactions don't scale.": Probably the most important point you brought up and one I've had to explain to cryptocurrency fans for years.

"5) Transactions are 1000s of times more costly in time and computers and energy than IBAN.": Yes, this too, although it's kind of a necessary corelary to 1 and 4.

"6) The only reason for Blockchain is to decentralise, have no control and enable a degree of anonymity. All naive and stupid design decisions.": Why are those naive or stupid? The users don't trust central control, so they remove it. They also value privacy. I can see not caring about those yourself, but is there a reason it's stupid for others to care about them? I'm not an adherent of cryptocurrencies and yet I think those points have value.

"7) It looks like a Pyramid scam": Other than having a central controller, using others' money to pay back previous investors, or the person who is going to walk off with the money. It's missing most aspects of a classic pyramid scam. You can scam with it, and it's a very risky investment, but it is not nor does it look like a pyramid.

"8) It is purely speculative in value.": A lot of things are speculative in value. Avoid investment, if you will, but many others don't view this as a deadly fault.

"9) Not actually a currency.": Not a good currency by any means, but you can have it and pay people with it, it is fungible and can be exchanged. Functions like a currency.

Re: Inevitable

I'm sorry, but what?

"the transfer limit would mean that assume an average of a 1k ransom, then 10 "customers" could be directed to a given wallet a day, having to create many hundereds of legit wallets a day would lead to throttling and easy detection"

No, it wouldn't. They don't need to set up legitimate wallets to receive payments if they can exchange somewhere other than the EU. They can even live in the EU and exchange elsewhere. The people who need to set up registered wallets would be those paying the ransom, and they would only need to set up one. The creation of unregistered wallets is easy.

"2 the internet is ultimately answerable and licensed for operations by governments, if they say no they its a no, freedom online is an illusion"

Well, sort of, yes.

"icann answers to the US govt, RIPE to the eu and uk govts,"

So what? So the ransomware operators can have domain names taken off them (and it wouldn't be ICANN doing that anyway). And if they registered their own IP blocks, those could be taken away too, although they never do that. How would this affect them at all? They mostly use Tor hidden service domains, which ICANN cannot take away, and they'll operate on anonymous hosting accounts or compromised computers which can be shredded whenever they're concerned. How does the regulation of basic internet operations impact this and if so, why hasn't it been used before?

Re: Inevitable

I'm afraid this isn't correct. The regulations require tracking of people setting up wallets and moving money inside the EU, but don't have control over the technical systems of any cryptocurrency. Without a regulation making the payment of ransoms illegal, this would do nothing--user identifies themselves, exchanges cash for crypto, pays crypto to anonymous wallet, ransomware operators exchange that crypto somewhere outside the EU without identifying themselves (which they're already mostly doing).

The only thing this gives you unless you make payment of ransoms illegal is a list of people who paid the ransoms. They would still be able to do so easily.

That doesn't break this system unless you mined or bartered for all the crypto you have. If you wanted to exchange some cash into crypto without being known to this proposed system, you would have to go to an exchange that's outside the area where you live (or is willing to break the law). Therefore, for most users who got the crypto by exchanging local currency, they and their wallet public keys would already be known and stored.

Thales launches payment card with onboard fingerprint scanner

Re: "There are concerns over using fingerprints as an authentication system"

True, but this doesn't really change that. They're going to pay that whether their customers use fingerprint cards or normal ones. The only way to avoid that is to not accept cards for payment. I've only seen a few places do so. With that in mind, there's not really a benefit to the user of the card to use this system, and therefore not much benefit to the company in using these more expensive cards and dealing with technology issues getting them accepted.

NSO Group 'will no longer be responding to inquiries' about misuse of its software

Re: This is a strawman.

Yes, that is what I assume. AWS has a lot of rented servers. It would be hard for them to know what each one is being used for. They identified some as being connected to NSO, but we don't even know if they got that from the account details or were just told of the service IDs. Either way, it wouldn't be hard for NSO to come back with a fake name and do it all again.

Re: SWaaS

"I bet this all started with some suit ordering their techies to do it over their objections."

I don't think so. Technical people have the option not to do this, and they especially have the option not to do this well. To get a successful set of exploits and use them to this effect, it wouldn't appear they have technical people doing this under duress. I would be comfortable assigning guilt to any programmer on their software and I wouldn't be so quick to assume the blame only resides with a subset of those who know what's happening and do it gladly.

Hijacked, rampaging infrastructure will kill humans by 2025 – Gartner

Laziness. Convenience. Desire for short-term profit. Failure to consider consequences.

This answers a number of similar questions too.

Can I get this job

I'm wondering how I can get the job where I say what I think will happen and then people report on it and presumably somebody pays me for that. I think that people will try to use technology to cause harm, like has already been done by attacks on critical infrastructure. That's not a surprise to me. As wars start, attacks designed to cause inconvenience to civilians should be expected, and inconvenience to everybody almost certainly also means significant negative consequences for a subset (E.G. those who happened to be in medical distress during an electrical blackout). This should be prevented by rigorous security procedures, at least in line with the severity of consequences of a successful attack. How much for this prediction, calling all buyers?

In a complete non-surprise, Mozilla hammers final nail in FTP's coffin by removing it from Firefox

Re: True

If you have a particularly determined MITM attacker, they'll check whether you read the hashes of the file you're downloading and switch them for the hashes of the file they're sending. I admit that's not a very likely event, but if they're already prepared to modify your download, that is a way to bypass your hash check.

A larger risk is people who don't know to check for integrity or who are lazy enough that they don't, in which case there could be a security risk. Not in my opinion a strong one, but strong enough that I'll give users an encrypted method to download things.

Re: Fine advice, but not relevant to the article or browser

That is unfortunate, and as you probably already determined, I don't really like this. Even so, it doesn't change my original point. If the web browser is displaying a document which is effectively an application, then someone else can with great ease implement an SSH client that runs on it. There is still no reason for that to be integrated into the browser.

Re: Cleanliness is next to godliness

I don't think it ever supported uploads over FTP. I think that was just for downloading files or browsing the directory tree. FTP clients exist for that purpose, and they'll probably do it better than a browser does.

Re: Fine advice, but not relevant to the article or browser

"And yes, they should have added support for sftp/scp/ssh to the browsers decades ago."

Why should they do anything like that? SSH is a control protocol, which has very little to do with browsers. Why should a browser do the job of an SSH client when you can go get an SSH client? At least with FTP, the browser's job of downloading files is part of what FTP is for. Similarly, I don't think a browser should implement the uploading features of an SCP/FTP client, because that's not its purpose.

A browser, to me, is a tool for getting files over certain protocols and displaying them to the user, and shouldn't try to do much more than that. Opinions vary on what documents a browser should display (run scripts in them, have a PDF viewer in them, etc), but I would hope that we don't also have to shove every other kind of program into that.

Ad tech ruined the web – and PDF files are here to save it, allegedly

Re: re-sizing and re-wrapping text

"In fact, for most purposes an editable form should just be a text document with spaces to fill in stuff."

No, it shouldn't. Unless you're processing everything manually. Having a HTML-based form lets you get the contents of boxes without having to do any parsing and insulates you from whatever people might have done to the surrounding text. A text form is fine if you want to handle it that way, but nothing is wrong with a more common solution that's been supported for decades.

"With a special place to be reserved in Hell for the writers of anything with compulsory fields unless said information is of absolute necessity"

No problem with that either. They have to put something in fields which you want because it's your form. If you don't want to provide that information, you can probably just put in junk. If you don't like a form which requires you to enter an email to send them information, then don't send them information; they're obviously not interested in anonymous input.

Re: Yes, but let's miss the point and argue about trifles

These discussions aren't as pointless as you think. We all agree that ads are a nightmare, probably useless, and that we'd be happier without them. Well, probably some people don't, but I think most of us here do and I'm prepared to skip the people who don't for now. The problem is what we do about this belief above the ad blocking systems we have running. The stated solution in this case is PDF, which isn't really a good solution because, if it was used by others, ads could be integrated in it as well through JS integration. This guy has simply decided not to put in any ads, which is great, but he could have used lots of formats to do that.

Since many options are available, it's worth discussing what format is optimal. Let's say I wanted to kill adtech so I decided to send you all my pages as image files of the rendered text, and to prevent possible bugs in decompression software, in an uncompressed format. That does technically solve the problem of active code in documents--you're not getting any scripting in a raw array of pixels. However, that's a terrible solution and you should tell me that before I waste my time on it. PDF is not that bad, but it also has problems that make its use suboptimal in this case. Hence it is worth discussing what would be best for a format without advertising or tracking.

Re: There's a lot of truth in what he says....

His complaints are true, and his reaction doesn't do anything about it. You can write very ugly pages with HTML, you can have lots of ads and trackers, it makes a lot of the internet a pain. His solution, however, is just not to do that, which could be done as easily with clean HTML as with PDF (better in my opinion). It doesn't change the calculations of the ad-supported business model, nor does it really fix problems. Not only that, but he also has to use some HTML so users can find the PDFs; they do hypertext badly. The complaints aren't original, and the solution isn't an efficient way to resolve any of them.

Re: re-sizing and re-wrapping text

This implies that feedback forms are necessarily wrong. I don't have them on most of my pages mostly because I don't want to deal with the readers' feedback, but if someone does want to give that ability, why should they be limited to writing an email address for someone to copy and paste over? It can be done without JS, it has been done for as long as the web was a thing, it doesn't prevent archiving, so what's the major problem with it?

Re: re-sizing and re-wrapping text

"BUT, if you don't allow scripting, how are you going to do"

"slippy maps (Google Maps, OSM, etc)?": Well, you could have a client program which you download and run so you know what is running what code, but at some point you either have to let a complex program run on a browser or not.

"Editable forms?"

With the HTML tags form, input, etc. They've been there since 1990. That's what JS pages use too, they've just got extra junk around them.

"Spell checking?": Your browser does that. It sees a texttarea tag and uses its local spellchecker on it. It works pretty well especially because you control the dictionary and it doesn't have to send the typed text to a remote server to check against their dictionary. Most sites where you see spellcheck in action are doing that. Try turning off scripting on this page and writing some misspelled words in the box and I'm guessing it will be the same. It certainly is for me.

Ubuntu on a phone, anyone? UBports reaches 18th stable update, but it's still based on 16.04

Re: Linux phone

You can get one of those. A few devices out there support a straight Linux OS without any Android additions. The problem with them has been that they're not polished for nontechnical use; some software is beta quality and requires you to enter command line commands in order to do some things. From your requirements, I'm guessing that's not going to be a problem for you. Calling from bash should be pretty easy with it.