Posts by doublelayer

Open-source projects glibc and gnulib look to sever copyright ties with Free Software Foundation

Re: Why assign copyright?

In practice, this is not required to pursue copyright claims. An owner of some of the copyright has a claim to litigate copyright violations of the entire thing, but if that argument is deemed insufficient, they can litigate the parts they own, without which the rest doesn't work, and obtain the same result. Having multiple copyright holders can help here because the FSF itself wouldn't have a monopoly on deciding whether some use was acceptable or not, so people considering violating would have to stick to the GPL more clearly.

I agree that the FSF is likely to continue to enforce the licenses as they already have done--Stallman is not the kind of person who would want more lax licensing. Still, I don't think the policy is at all necessary, so if projects choose to change the policy in order to indicate their feelings about unrelated FSF decisions, I see no harm in it.

UK competition watchdog begins probe into Apple and Google's total domination of the mobile landscape

It may result in that, but capitalism as an ideal does encourage competition. The "free market" about which the original poster spoke is based on this idea. I was not intending to participate in an argument about whether capitalism works, just whether the phone market is a free market. It is not.

They asked about barriers. That's a barrier. Because most of the time, the driver is written by the component manufacturer to work with an open spec, not by you. That's a real barrier to other OSes, and it's not at all similar to the landscape of computers, where standardization allows most hardware to work because they implement device-specific code on the device and use an agreed-upon standard which is supported by kernels.

Most of the drivers concerned are written by the device manufacturers specifically for Android, not Linux, and they don't give out the specifications needed to write your own. You can, through tedious effort and legal uncertainty, reverse-engineer the component and try to write one, but that's a significant barrier because your competitors just buy the pieces and use the manufacturer's code. That is why I used the PinePhone example. They are using a CPU which is several years old and underpowered compared to modern phones because it's one with Linux support. Despite the fact that Android devices use the Linux kernel, you can't take one and boot mainline on it due to software unavailable for it. Therefore, you are wrong both about who writes drivers and what is currently available for phones.

Most answers wrong:

"Is there a barrier to selling a handset with a different OS on it? No": Yes there is. It's expensive. Software drivers aren't written for anything except Android, so you have to write them yourself (see PinePhone for an example of what it takes).

"Is there a 50/50 split in market share between apple and google? No": Irrelevant.

"Can you launch an android device without Google's shiteware on it. Yes": Not if you also make ones with it on, though, because that's a contract violation. You have to only make AOSP devices for the people who want that. That rules out pretty much everybody who exists today.

"Is this free market ecomonics at play. Yes": No, it's unfair restricted market economics at play. Capitalism likes competition. The lack of it is an inefficiency.

"Can you launch your own app store for both OS.... Erm, not so much.": Only clearly write answer here.

Funny how Sir Tim Berners-Lee, famous for hyperlinks, is into NFTs, glorified hyperlinks

Re: Crazy.

Not with me. I think this and all other NFTs are useless, but I think most physical collection items are also useless and we don't attack those buying and selling, say, a pair of old shoes for scamming each other. We just don't buy them. In my opinion, if someone is willing to buy something worthless and you don't hide what it is or how much it's worth, then that's on them. Honesty is an important part in this, but I haven't seen him make any claims about what benefit the NFT entails--it gives you nothing more than a signed hash, and everyone who is interested has the time to figure that out.

NATO summit communiqué compares repeat cyberattacks to armed attacks – and stops short of saying 'one-in, all-in' rule will always apply

Re: Dear China,

The countries which have democratic governments don't do most of those things, and where injustices do occur, they can be changed. A lot of them have done those things, and I have repeatedly argued that past injustices do require present atonement, but it's not the same thing. When antidemocratic actions as described occur in those countries, you see activism, protest, and eventually change. That is why your comparison is invalid. Democracies don't have to be perfect in order to have the moral high ground. They just have to be better. They are.

Re: NATO Has One Job

I like the spirit, but find me a way to take down the firewall without taking down the entire network. China runs the whole thing on all their domestic networks. You can't easily just cut the firewall rules while keeping all the network routing functions working.

Linux gods at last turn their gaze to Pi 400: Computer-in-a-keyboard receives mainline kernel support with v5.14

"Apart from the novelty factor and educational sector, is there a practical user application?"

Only sort of. There are two reasons I can see for using one of these, but neither are very strong. The best one is insulation--this is in a price range where the competition is likely a VM running on a server. That means you're sharing the hardware, although the hardware is better. If you were worried about a vulnerability in the hypervisor allowing someone to access your data, you might want to run your code on a dedicated server. However, this only sort of works because you're still using network storage and the cloud provider of course has access to anything on your disk if it turns out they're malicious. Most people who distrust hypervisors likely wouldn't accept those either. The second reason is software compatibility--if you had something which didn't work right on other Linux distros but did work on a Pi, this would let you run it. That's most likely to be something compiled for ARM which can't be recompiled for AMD64, although I haven't experienced anything of the kind myself.

"Is it cheaper?"

That depends what you're comparing it with. If you need a VM, then this is in the range but more expensive than the low end of the range. However, those VMs usually have different specs--you often get one virtual core at the low end but it's a faster core. The cloudy Pi 4s are pretty good since they have 8 GB of memory. As long as you can live with the slower processor (much slower on single-core, but the four cores make parallelized things work fine), then it could be price competitive.

Western Australia rushes out legislation after cops access contact-tracing data to investigate serious crimes

Re: Years ago ...

The parallel is not exact but is worth some consideration. The issue with the CIA's action in Pakistan, at least the issue right now, is that people are refusing vaccination because they don't trust those authorities who provide it and say it is needed. A similar loss of trust elsewhere may cause a similar backlash. I.E. Western Australian citizens think the app is only there to track their movements without reason and refuse to install it, actively attempt to break it, or launch an organized protest (I think each of those actions would be justified in such a situation). This would destroy any benefit of the app.

Not only would you not have the data for police investigations, you wouldn't have it for health investigations either. Worse, building trust takes a lifetime and destroying it takes a week. Even if you don't care about this app, the next thing a mistrusted government says is necessary may be distrusted and opposed because the last time it was used unethically. That could be anything. In Pakistan, it's a COVID jab which means we may soon see an Epsilon variant stemming from a breach of trust over a decade old. In WA's case, nobody knows what it could be. All I know is that you probably don't want to find out in 2029 that people won't do what the WA government says is needed because they don't trust them.

The response to this pandemic and most other societal problems relies on trusting authorities. Where the authorities are trusted to tell the truth, act in the best interests of the people, and be beholden to their wishes, you get stability. Where that trust is eroded, you get risk. Where the trust is flaky, you get dictatorship. Where trust has vanished, you get civil war. It is the responsibility of authorities to maintain that trust by following understandable ethical rules.

Re: Maybe a sense of proportion is needed

There are criminals out there, and successfully investigating them is the police's job. That's important. However, there are very good reasons we restrict what police can do. Many powers we could give to police because a lot of them are interested in helping all of us are powers which would be very easy to abuse, so we either restrict them (warrants required for searches) or make them entirely illegal (torture a suspect for information).

A mandatory tracking system is an extreme thing, and it only exists because there is a health emergency. If it was an effective tracking system (I doubt its usefulness), then it's important that people remain confident that it won't be abused. Which is worse: a murderer remains on the run a bit longer because police had to use the powers they already had to catch them, but people remain uninfected or the murderer is caught a little sooner (assumes the data is actually useful) and people get infected because they mistrust the app and refuse to use it? I don't have a perfect answer for this, but not only do you have to consider the negative consequences of giving a very invasive tool to the police but you also have to consider the loss of the beneficial effects of the app if any exist.

Re: Paper sheet

Possibly so they can write it illegibly or accidentally make a mistake. Tracking systems like this don't record who is near someone, so they're blunt tools for tracing possible infection paths.

The AN0M fake secure chat app may have been too clever for its own good

Re: Criminality

They have been criticized, sued, and some have entered bankruptcy. People protested outside them. They suffered consequences, as they should have. All of them, Purdue included.

Re: Kidnapping

That's already happened, repeatedly documented in Mexico which has a large number of communications engineers who can be kidnapped easily. I'm sure it happens elsewhere too. The problem they run into is twofold. First, an individual programmer may not be able to ensure security. Many are not cryptographers or security experts and may design a flawed system. The second is that they have no incentive to do it right and several to do it wrong--if they ever get out, they can use it to get police protection (E.G. El Chapo's communications administrator in the U.S.). So now they need to kidnap programmers to code review each other. At some point it becomes easier just to hire them and pay them enough that they're willing to break the law.

Re: Criminality

"The criticism of the Sacklers would carry more weight if any non-Jewish owned pharmaceutical companies involved in selling opiates were also criticised."

You mean like Insys (public), Johnson & Johnson (public), and Teva (public)? Although that last one does have its headquarters in Israel. But still, it's a lot of companies. Also, it's opioids that generated most of the protests. I'm guessing these won't change your opinion much.

Price-capped broadband on hold for New York State after judge rules telcos would 'suffer unrecoverable losses'

Hence this part from the comment you quoted:

"[T]he decisions on whether and how much to charge between ISPs as data moves are also decided by those ISPs."

Are you an ISP who wants more money from Google? Refuse to peer with their ISP. Require a paid contract to exchange bandwidth. It's been done before and it's your choice. Just one problem: they will reciprocate. Your data won't be peering to them either. The companies have already done this to most of their contracts and figured out what costs them least, and they employ people whose job is to continue to check those things. If they don't get a contract at all, then that's either Google's problem (users can't reach them, stop paying) or the user's problem (ponder doing something nasty to the ISP management, think better of it, look to see how far they have to move to get another option).

The ISP establishes a contract to the users which states how much data or bandwidth the user can pull down. The user pays the ISP for that in order that the ISP can pay its bills, among which are the equipment they need to pass bandwidth through their network. You're expecting the ISP to be paid twice for the same service when ISPs already have a lot of market power due to their being little or no competition. It's unreasonable.

"And then of course there are the other usual suspects. Like Amazon, Google, Facepalm, Netflix, Disney etc who all make collosal sums of money from online activities, but don't really contribute much towards the costs. But that's the thorny subject behind most of the 'Net Neutrality' debate, ie ISPs pay for everything, content providers should be allowed to enjoy their free ride."

Let's take this part, because it's rubbish. The people who send the data pay for the lines and bandwidth they're using to move data out of their servers. The users pay for the lines and bandwidth they use to get the data into their equipment. Both prices are set by ISPs, and the decisions on whether and how much to charge between ISPs as data moves are also decided by those ISPs. So, despite the fact that the ISPs set all the prices and are paid by everybody involved, somehow the people sending data are getting a free ride? Since everybody is paying, the ISPs have the choice to change their prices, which they do often and the direction is always up. Why do they need even more ability to rent-seek on that monopoly?

There was a crooked man who bought a crooked M1 iMac, and we presume they lived together in a little crooked house

"This is nonsense and you should stop posting it."

Why? Because the user can do it themselves? The article says that involves ripping off the display panel. I'm sure that voids a warranty and is not the easiest thing to put back on. Because it's not problematic to take it in for repair and have someone else rip off the panel? Because, although they probably won't bill you, they are likely either to say it's not covered or give it back with some other defect caused by the invasive repair which is needed to disconnect two external parts from one another. I repaired an iMac for a friend a while ago. Back then, the method for detaching the stand was A) activate latch, B) fold stand in farther to reveal screws, C) remove screws. The choice of assembly is entirely on Apple.

Now I don't think I would really notice and care about the screen being slightly slanted, but I've also not experienced it. If you agree that it is a problem, then the complaints about what it would take to repair are valid. If you don't agree that it's a problem and that's your argument, it wasn't clear from your writing.

Pakistan's Punjab province tells citizens to get jabbed or have their SIM card blocked

Re: Seriously?

"Are there really a majority of commentards supporting ostracisation of people who decide not to have the vaccine? It is a personal choice"

It is a personal choice that puts others at risk. Society frequently makes judgements about what personal choices are considered personal enough that choice should be maintained and which other ones impact others enough that we need to impinge on choice. For example, it may be a personal choice to drive at racing speeds on residential roads, but it is a dangerous enough choice that it is illegal.

I oppose the forceful method Pakistan is using, mostly because I think it is likely to be unproductive. I do not oppose restrictions on those who choose not to have the vaccination without a good reason. I would consider personally ostracizing them--after all, that's another personal choice and that one doesn't harm anyone but them. As I would not like to associate with someone who drives recklessly with disregard to the pedestrians they might kill, I wouldn't like to associate with someone who is willing to let others who can't get vaccinated get infected with a potentially lethal disease just so they don't have to have some muscle fatigue for a few hours.

Re: Hmm, awkward

Alright, hyperbole in an attempt at mixing my comment with humor wasn't a good idea. I'll state my point more briefly and without embellishment:

I have some sympathy for those who want a forceful approach to vaccinations, but I think it is unethical and unproductive. I view actions of the severity concerned as forceful and thus advise a more diplomatic approach.

Re: Hmm, awkward

"Typhoid Mary lost her liberty for egregiously refusing to believe that she was highly infectious, evidence be damned."

She did indeed do that, but she wasn't exactly given a workable alternative. The requirements originally set forth for how she could regain her liberty were going through an experimental surgery which had killed people and not working as a cook again. As that was her primary experience and the only one which would pay enough to keep her temporarily out of poverty. Meanwhile, other carriers who protested less were not isolated and infected others as she would have done. This doesn't necessarily make her isolation bad, but one has to admit that such a harsh protocol applying only to one person is at best unproductive in producing a health benefit.

On the topic of Pakistan, it is definitely coertion, and I'm curious what your definition of "forcing" is. Again, not necessarily a bad thing. I know that, whenever I'm in conversation with someone who refuses to get the vaccination, I have a strong urge to force them to get it after about five minutes and it's probably a good thing I don't have one with me because I would inject them there and then, probably doing it wrong and wasting the shot. However, doing something like this in a forceful way could bring with it several problems, including a probable increase in vaccine hesitancy next time. Since the article points out several other vaccines they haven't taken, next time is basically right now. Therefore, I would, despite my preferences for immediate vaccination, recommend that a more diplomatic approach be taken for now. Should that fail, perhaps a better approach for a forceful method would use an easier method of identifying people rather than hoping that all communications companies had perfect documentation.

Amazon exec's husband jailed for two years for insider trading. Yes, with Amazon stock

Re: Got too greedy yet.....

"it is not illegal to short a company to bankruptcy."

You don't short a company to bankruptcy. Shorting a company just means you bet their stock goes down. If it does, they aren't going bankrupt--their investors own the stock, not them. If it goes down, they likely have other problems which could cause them to go bankrupt, but it's not your shorting. Also, the action of shorting doesn't decrease the price. You just hope it does. You are much more likely to go bankrupt while shorting than your target is because being wrong is dangerous.

"Oh and I am still a little puzzled as to why using information about a company is illegal."

Not enough. Using information about a company which others don't have is illegal. Because by doing that, you're benefiting from a situation which others are not in. Imagine that you own some stock in a company, you know that company's failing, but they haven't told other people yet. If you sell before they announce it, you've made money by selling something worthless to someone who didn't know it. That's why it was made illegal. This is subject to disagreement, but that's the reasoning.

Re: Got too greedy yet.....

I doubt it, but it doesn't matter much. The comments about the people investing favorably apply just as well to the unfavorable ones. No insider, not much information, all public information.

UK tells UN that nation-states should retaliate against cyber badness with no warning

Re: That's a delusional idea

Both suggested approaches are dangerous because they are large files which could burden your server with bandwidth needs, increasing your bill and/or providing an attacker a method of launching a denial of service on you. A file designed to decompress to a much larger size is a more reliable method of getting there because it's only a few kilobytes egress from your server but, unless they clear up properly, takes gigabytes of their memory. Other approaches are to use your firewall rules to frustrate them. One functional approach is, instead of blocking them, allow them to initiate a TCP connection (send a synack) then ignore the rest of their packets. It will take them longer to time out the connection and in the meantime you're holding one of their sockets.

Re: That's a delusional idea

"That said, does that mean I can now launch attacks against France (OVH), Canada (OVH) and the US (AWS, Google, Azure) for hosting people that try to breach my websites? Or maybe get some compensation from these operators for not even checking for users with excessive 404 returns?"

Obviously not, but also don't complain too much about the lack of checking. They can't break an HTTPS stream any more than someone else. They don't know if those are 404s or 200s. The only way they could do that is to take information from the VM and break all its encryption. Since you operate websites, I'm sure you're aware how annoyed you would be if someone you used did that to you.

What they should do is have a more rigorous system for automatically registering abuse complaints, which could actually make a larger dent in the problem. But since we know they won't do that, just make sure the inevitable robots aren't finding the obvious holes they're thinking about. Or another useful tactic is to replace some file that you don't have and gets frequently requested with a zip bomb. I've found that works pretty well.

FTC approves $61.7m settlement with Amazon for pocketing driver tips

Re: So, let me see if I get this correctly

I think they likely did involve a team of programmers. That logic isn't simple enough to do by changing variables. After all, they have to do something if the customers didn't tip well enough some day so the drivers couldn't see that they were having their wages stolen, probably increasing their variable rate temporarily. That requires something to be done on ongoing data. They theoretically could have implemented that by telling the programmers to implement an abstract function that took a lot of parameters, but probably they wouldn't have gone to that much effort.

Linus Torvalds tells kernel list poster to 'SHUT THE HELL UP' for saying COVID-19 vaccines create 'new humanoid race'

Re: The echo chamber at work...

"So a genius self-publicist with zero background in the hard science let alone bio-science is now an expert on mRNA vaccines.. I dont think so."

Nice strawman. Of course he's not. He corrected a person who knew nothing and whose statements were complete rubbish.

Imagine what you would say to me if I wrote a comment explaining that you are a mutant cucumber plant. I'm guessing it would be along the lines that there is no such thing and that you are A) moving around, which plants tend not to do, B) have a genome typical of humans, and C) do not have cucumbers growing out of you. I think you could manage to write this rebuttal without being an expert on cucumber horticulture. When the bar's on the ground, you don't have to jump very high to clear it.

Re: Critical Thinking

I've seen it done in a variety of ways. Usually, the less organized and more sincere the effort is, the better it turns out. Some critical thinking exercises took the form of example documents making claims where some were obvious rubbish, which acknowledges the problem but that's pretty much it. The better ones are just pointing out logical fallacies and letting students find them in claims. I also recommend class debates where students can find those fallacies in each other, and hopefully also their own arguments to improve them. Unfortunately, as much as that approach is tried, it works best when the students are interested enough to pay attention to that lesson and keep tracking things down.

Re: A new human race indeed

"You forgot about the auto-updates from Bill Gates."

One tried to install, but it ended up in a bootloop so I replaced it. Open source to the rescue. Now has anyone found a driver which lets me connect my vaccine bot to this USB port I had installed a while ago (XKCD)?

Re: In a stockyard...

They're probably using the non-epidemiological meaning, I.E. prevalent, not requiring external influence to exist. In strictly epidemiological terms, it is much worse as it is not in a steady state, but it meets all other requirements for endemism. Which area? That would be North America, South America, Europe, Africa, and Asia. Some areas do continue to require external influence, E.G. Taiwan. Australia is unclear but may be able to reach such a state. It is hoped that vaccination programs will force it out of epidemic territory into endemic territory and eventually into nonexistent territory, but that's going to require a lot of people getting the jab. To anyone reading this who can get it and hasn't, it's safe. Lots of people have verified this, myself included. Join us.

Whatever you've been doing during lockdown, you better stop it right now

Re: Podcasts?

"Is there some sort of podcast RSS-like program I can use to queue them up and then forget about?"

Yes. Podcasts are one of the original purposes of RSS. Podcast feeds are RSS feeds with audio or video files linked in the articles. You can find programs which do the refreshing and downloading on most platforms. I suggest Antennapod for Android (check FDroid for it) as a nice free start option or the included one for IOS. If you don't end up liking those apps but still like podcasts, there are about two hundred alternatives to be found in the app stores. There are desktop clients too.

"And would it work on my bedside clock-radio?"

That depends what your clock radio runs, but if it has an internet connection, quite possibly. Or if it can act as a speaker for something else, you could run it on that.

You will find a bunch of podcasts exist out there, and a great many are rudimentary or uninteresting, just like everything else on the internet. Still, I've found a lot of them which I enjoy, especially while I'm doing other things where I can't be reading The Register.

It's completely unsupportable. Yes, we mean your brand new system

"If you allow your back office tech stack to dictate tech choices for your core products you'll have a company that can't compete or evolve."

I disagree. If you're like a lot of businesses, your back office tech staff know a lot more about the options than the people managing them. In turn, those technical managers know a lot more than any other department. Ask a financial person whether cloud is suitable for this deployment and all they can do is look at numbers provided by someone else. The tech staff and management should be able to tell you what cloud services they would use, what non-cloud alternatives exist, and eventually generate the numbers for the finance department. The people who generate those numbers are usually making the decision by the numbers they send, so you really need them to know what they're doing.

"Your back office is not unimportant and ppl shouldnt draw that conclusion simply because I say it shouldnt drive your tech choices. But efficiency gains should drive the cost and focus down over time for those support systems."

And depending on what "efficiency" means, that could kill your core service. Business people understand about long-term survival needs, where they will have to take lower profits for a while in order that they continue to have a revenue stream. They don't always go for that option, especially when they don't care about the long-term viability of the business, but they at least understand what it is. Efficiency which reduces quality is dangerous, and it is not difficult to explain this to someone else.

"In the story in the article, I would have refocused the team on the product platform (assuming those skills werent there to begin with) and thought long and hard about my dependence on skills for 'mainstream' systems that didnt make me any money. They had effectively invested in skills and capabilities that didnt offer a competitive advantage."

This is the dangerous part of your recommendation. The focus only on the things that make you money. Most of a business doesn't make you money, but it does permit the existence of the part which does. You have to look at each part that doesn't make you money, decide whether it is needed, and for the most of them that are, how you're going to pay for it. Lots of those things can be outsourced safely, but each outsourcing carries costs as well as benefits.

It's the responsibility of people like CIOs to do that kind of analysis. They have to be connected to their "back office" work because nobody else is going to do it. They need to know what outsourced IT is like, and whether the company can handle the costs involved. Outsourced support is sometimes doable but carries risks as described in the first reply to you. Outsourced administration is usually not because it involves a lot of information you need if ever something goes wrong. Outsourced hardware (AKA cloud) is reasonable but you have to spend some time checking out the financials because the cloud providers won't protect you. Outsourced design can work if you have someone internal who can take designs from multiple people and deploy them, but if the outsourced design people are doing that, then it's hard to replace them when needed. Outsourced development will work in the short-term but you could end up with a dependence on the provider if you're not careful right now. Those are things that somebody has to know and decide, and the operations people who never worked with it won't be familiar with the details.

Wine 6.0.1: For that one weird app on that one weird Mac

Re: Easier to run a VM

I know of at least two frameworks out there for copy protection which will look for and break on a number of indicators of virtualization. When I find such software, I refuse to run it, but it does exist.

Y'all ready to get back to the office this October, Facebook tells staff in the US

Re: Why?

A few attempts to study how productivity changes when working from home have found that it negatively affected people. Perhaps some companies are using those. If they are, they should probably know that another set of studies found that it had no impact or even improved performance, and there hasn't been much of a study about how much of the negative effect is due to people who would choose to go back to the office anyway. I'm guessing they all have some kind of metric for deciding these things, that the metric concerned hasn't been verified to make sense, and that they're going to make decisions anyway because which businessperson wants to read a statistician's report?

Fastly 'fesses up to breaking the internet with an 'an undiscovered software bug' triggered by a customer

Re: DSL Modem, RPI, DynDNS

It's not the Raspberry Pi that's the main problem in the suggestion. Everything involved is prone to failure and indicates a misunderstanding of Fastly. As compared to Mythic's deployment, the suggested system is a lot more fragile.

Re: DSL Modem, RPI, DynDNS

That would be much more reliable, wouldn't it? No way the stuff could go down unless it was emphatically your fault, right? Nobody else could fail you. Well, except for your DNS provider, which has also had a period of not working after an attack, your ISP, which could break your service for any number of technical or financial reasons or could cut your connection for running a server they haven't approved (depending on your contract), your power, which could fail because a transformer responsible for your circuit decided it's tired, your HTTP server which could run out of threads pretty fast when someone decided to spam a login page with credentials, your storage because people have been requesting a lot of different files which the small amount of memory can't cache so it keeps going to the storage and wearing it out, or the board itself when it overheats and throttles performance so often that the server isn't running very well anymore.

No change control? Without suitable planning, a change can be as good as an arrest

And also don't be simplistic

"Anyone who has worked in medium or large organisations will know that there are three levels of change control when it comes to code: (a) the organisation doesn’t have any, (b) the organisation has change control but does it sub-optimally, and (c) change is managed well."

And anyone who has worked in more than one knows that there are a lot more than three options and there's not a nicely compartmentalized right one. What the article lumps together as option B includes a lot of different ways to do change control wrong which have no similarity to one another. It's not three buckets. If we're being simple, it's a one-dimensional scale with the best points being somewhere in the middle.

You can have no change control. You can have change control which doesn't require notification of others or thorough attention to the required steps. That's what the article mostly talks about when it's describing incorrect application. But you can also have change control which is too strong, either because nothing can get done because change control is too onerous (and if that happens, don't expect stagnation, expect circumvention), or change control which puts a lot of responsibility on people unrelated to the change requiring a lot of explanation of the change to people who won't understand it and certainly won't identify problems. Or you could have change control which is implemented correctly in the sense that changes have to be reviewed but is incorrect because the focus is on approval by committee and not the method of anticipating or responding to problems.

FBI paid renegade developer $180k for backdoored AN0M chat app that brought down drug underworld

Re: Just think and consider for a moment ...

"So they're being charged for distributing/running the handsets that the FBI etc. used to gather intelligence."

While this could theoretically be entrapment if the FBI's agents were particularly connected to them, I'm guessing most if not all of those people were distributing the equipment after getting it from others. If the FBI didn't sell them directly to the distributors, they couldn't have suggested it.

Re: Fabrication?

I think this is unlikely. Could someone find out who this is through extremely dogged research of several companies' files (not public), interviewing people in prison, tracking financial payments, and finally identifying someone with sufficient information to give up the new identity of the person they've identified? Maybe. It would take a while and it's not as easy as people here seem to think it is, but it could be done. I don't think that criminal organizations' petulance will rise to that level of interest when they could already be planning to assassinate the much more easily identified FBI and AFP personnel who did a lot more. Yet often they don't bother to spend the resources on killing those people because doing so carries no benefit--those people have already done what they didn't like and someone would replace them--and it also carries cost and risk.

A job well done

This is a great job by law enforcement in many countries and demonstrates the usefulness of thought-out targeted attacks as a method of identifying and tracking criminals. I applaud those who did this and I hope they're able to continue solving crimes like this. If we needed extra points to prove why encryption and security aren't the enemy, this is an excellent one. By hard work and actual policing, the FBI and its friends have done a much better job than they could ever hope to do by mass surveillance.

Law enforcement has methods of hiding people who help them. Also, this guy wasn't known by the criminals--they just wrote code for a company which interacted with them. I'm pretty sure most of those caught recently have never heard of them. Those caught a while ago might have, but weren't told who it was. They'll likely be safe.

Everything Apple announced: Tor-ish Safari anonymization. Cloaked iCloud addresses. Cloud CI/CD. And more

Re: Gotta sell new hardware

True, but that is because anyone running IOS 14 can upgrade to IOS 15 whenever they want. The overlap is useful so people remain secure while watching 15.0 and 15.1. If they're still using IOS 14 even when 15.1.2 comes out, maybe it's time for them to install it.

Re: Forced unlock?

If you unlock by biometrics, they are allowed to force you to submit the biometrics by taking the phone and forcing your finger on the sensor or showing it your face. Those who don't like this may only use a passcode or may use the shortcut to disable biometrics in a worrying situation, but in that case, they'll have to enter their passcode once to show the ID. They can be recorded doing this to obtain the code for future use. Failing to show the ID may itself be punishable and certainly would result in further intense questioning. I wouldn't use this feature either.

Re: Gotta sell new hardware

True, although they do patch old versions of IOS which are running on devices which don't run the latest, I.E. they don't patch IOS 13 but they do patch IOS 12. In any case, they are extending that protection to IOS 14 now even if you can upgrade, so that complaint was valid but is now closer to resolved by their decisions.

Re: Gotta sell new hardware

Not arguing that point, just exactly when it comes into effect. I have one of the Macs that isn't going to get the update, but it's still functional. I will still be comfortable running Big Sur on it for a while before security updates stop and I relegate it to offline Mac OS and Linux for online tasks.

Apple settles with student after authorized repair workers leaked her naked pics to her Facebook page

Re: Details

"Imagine Apple is turning out "privacy" widgets on an assembly line. A few isolated but dramatic failures is not nearly enough to critique their QA department. They need to do better, but at the same time they may *already* be doing better than any hypothetical competitor. Of course they would say that, but just because it appears self-serving doesn't automatically make it false."

This is missing the point. The problem is not that Apple has problems, everybody does and will, but that they're claiming superiority and using that unproven allegation as a measure to prevent third-party repair and regulation of their repairability.

You like analogies, right? Here's one for their argument. You work in a technology-related field, I assume. If you don't, assume for a moment you do. I do as well. I can be trusted to treat data with security in mind, but you're an unknown quantity who should not be trusted. Because I am better than you, you must not be permitted to work without my approval. By the way, my alleged superiority can't be proven by anyone because I refuse to give out any data, and I have a history of breaking clients' systems some of the time. You would definitely do worse; I should have a right to prevent you from working. That's what Apple's trying to do. This doesn't prove that they're worse than everyone else, but it does prove that their assurances are false and that their claim to decide whether repairers are approved is invalid.

Proof-of-space cryptocurrency Chia triggers HDD sales boom in Europe

Re: Just great

But proof of work actually benefits somebody, because it's hard to produce fake transactions fast enough to slot them in. Very costly, yes, but at least there's some purpose to it. Proof of space is not very helpful for anything. If they wanted to do a lottery system, they don't need to make empty drive space the method of deciding how likely you are to win. They could just do a straightforward lottery and forget the drives except for chain storage. It wouldn't be any weaker from a security perspective, although it's already weak enough that I wouldn't put money into it.

Australian cops, FBI created backdoored chat app, told crims it was secure – then snooped on 9,000 users' plots

Re: Pay to Crim

Yes, technically, but who cares? The investigator who agrees to supply someone with explosives to see if they're really willing to blow up people but provides inert blocks is also failing to provide the agreed goods, but fraud doesn't matter when the buyer is a criminal. When investigating a crime, the police aren't responsible for fraud.

Global Fastly outage takes down many on the wibbly web – but El Reg remains standing

Re: Changing times

I'm glad you found one of them has some mental activity going on. Whenever I've tried such logic on people who believe in that or similarly bizarre theories, electrical or technical limitations are always dismissed. Either the conspirators are much smarter than me and know how to do impossible things or I'm just stupid and can't realize that technical things are much better than I thought they were.

Chinese app binned by Beijing after asking what day it is on anniversary of Tiananmen Square massacre

They're weirdly touchy

At this point, the Chinese government is not making much sense. Everybody, inside the country and out, knows that the government murdered a bunch of protestors and they know when that happened. Everybody knows that the government's actions are designed to minimize something, and the Streisand effect is strong with this one. I have to wonder exactly why they consider it so important to hide the event when it's far too late to deny its existence. I shouldn't advise dictatorships on propaganda, but at this point it makes more sense for them to just embrace the evil or at least lie about some details rather than trying to lie about the whole thing. The rest of their propaganda, both internal and external, is at least a bit more disguised. It's a weird decision for this to be the only thing about which they take the North Korea route.