Posts by doublelayer

Hack to school: Parents told to keep their little script kiddies in line

I wouldn't be that worried if student accounts, especially for younger students, didn't have MFA. Teacher accounts should have it, and I don't think the problems you specify are real problems. I don't think there is any problem with a rule allowing teachers but not students to use mobile phones. Policies on photography would be independent of that, since they may have any number of other things they could use to take pictures. If phone use is that big a problem, issuing teachers with MFA tokens, either U2F tokens or a separate hardware device that generates TOTP codes is a viable option. Teacher accounts have too much access not to have that.

The separate issue of needing to authenticate too often is a good one, and that probably needs more thought to make it work. We would probably want different authentication policies depending on what's being accessed. Services with a login used for teaching without access to sensitive data could be on the low end, where a valid SSO token is sufficient to log into them, thus as long as the teacher has authenticated once today, they won't be asked to repeat it. Access to sensitive student data in the grading system could be on a higher tier where authentication is more frequently requested or usage patterns are used to determine whether to send that challenge. If students have shoulder-surfed passwords and used them to access or, as the article suggests, modify the data in there, this demonstrates that this kind of access control is justified.

Apple's 'Awe Droppings' fall close to the tree

Nice try. The problem was, as you identified last time, failure to meet peak power requirements. Apple knew that would happen when they first saw evidence of it, which is why they throttled their CPU without telling customers. Yes, a battery that ages will also eventually reach that point, but generally, it will work better when it is correctly paired with components that can be powered from what the battery will supply. Choosing a battery that won't catastrophically fail, even when it's slightly aged, is the responsibility of any hardware manufacturer and they, including Apple, generally do it. Battery life falls with battery age, but they usually don't fail in that way because the designers have put enough thought into the load they're putting on that battery.

And, in fact, I did get the battery replaced after several months of this. The first place I took it was an Apple-approved service provider. They told me that they could not replace it because, according to Apple, the battery health was not sufficiently bad; battery health was supposed to be 80% or less, and mine was 84%. I'm not sure why that should be Apple's policy for someone paying for the replacement, but I had to have it replaced by an independent repairer. There are a lot of people using phones with more than three years on the original battery. I don't hear too many stories of them failing in this way. Please don't pretend that this is normal. It's not, even for iPhones. It was a mistake which I have not seen Apple repeat, probably because they recognize internally that it was one.

This may be bad phrasing on my part, but I'm speaking from experience. You are entirely correct that the problem was lower watt delivery, but Apple's problem was that they hadn't designed a system that could work with fewer watts. The problem was that the batteries they used could not provide enough power for the hardware they attached to them unless the battery was almost unused. The result was that batteries reporting that they were nearly fully charged (hence my 80% level) would still suddenly fail whenever more power was requested. In my case, one common way for that to happen was answering a phone call, because now I was using more power to transmit to the tower. The result was that, even if I had recently disconnected the charger, the phone would often simply power down and refuse to turn on until the charger was connected. When it was, it would often report about 15% charge. To prevent that from happening all the time*, Apple throttled the CPU very quickly so that that wouldn't cause similar unexpected shutdowns. Importantly, my experience wasn't after disabling that throttling; I left it in place, got my extra year of no problems, but eventually, I had a device that would fail at random times due to Apple having made a bad choice of battery for the hardware they intended that battery to power.

I knew others firsthand who experienced exactly the same behavior, all with the same model which they kept for multiple years. Specifically, it was people with the 2016 iPhone SE and problems tended to start, for anyone who did not disable throttling, about three years after purchase. I understand that the situation was similar for some other models, but I mostly knew iPhone users who wanted either a small device or the cheapest iPhone available, so the SE was the one I saw most frequently.

* Or, at least, to prevent it from happening during the warranty period. They exacerbated their legal problems by trying to hide it and upsell people on new phones, but bad power design was the first and biggest problem.

I can't say I know much about comparative evaluation of battery tech. I can't say you know much either unless you can add some detail to your message of support. All I can say is that, if Apple's battery tech is now better than the average manufacturer, that is a nice change from the many models released in 2016-2018 which had batteries so bad that they ended up needing to permanently throttle their CPUs just to delay the undervoltage problems leading to 80% charged batteries suddenly dropping to can't-turn-on level. I admit that their repeated losses in group lawsuits and complaints from regulators would have given them an incentive to not make that mistake again, and I haven't heard similar complaints anymore, so perhaps you are correct about their quality now. I would still be interested in hearing why you think they are better than others.

Home Office delays £816M English test contract despite market engagement

Re: £800M?

I did, but now I'm wondering how much of the administration those funds are intended to cover. Proctoring in over a hundred locations internationally will add to the expense, especially if those locations need to be created and aren't just a superfluous closet in a consulate. The actual test, on the other hand, probably requires about two months of a group of three English teachers and a week or two by a programmer to get it into adequate state. I'm betting there will be some higher staffing in those areas.

Everyone needs an AI phone. No, don't hang up, it's true

Re: No, no, no! It is Fantastic!

True, but despite my attempts, I have not found it quite as easy to set that up from a personal mobile phone, running locally. It should be possible if I get down to writing the application myself, but that is a lot of work and I haven't justified moving that to the top of my personal project list. In the absence of a local on-phone model, the alternative requires a server, SIP contract (extra charges*), redirection between the mobile phone and that connection, and therefore plenty more work.

* If you're trying to waste people's time, being charged for your success is not the most pleasant outcome. Most prices I've seen for in-country call rates per minute aren't bad, depending on how often you're using them. Unlimited calling softphone contracts tend to be quite a bit more expensive because they think it's a business paying. Compared to either, my mobile phone contract offers unlimited calling for a very low price.

Re: That kool aid must taste really good

Funnily enough, chip designers who have been building things for battery-operated devices have thought about how to turn off components they're not using to the extent that their power consumption is negligible. Operating systems custom-built for the hardware tend to use those methods.

You will note that there was an option in my table for software you don't want running at all being run anyway, the option that resulted in a power increase in both situations. Your unproven and undefended assertion that this is spying software is possible, though if there is spying software, there's little reason to expect that an NPU will be of use to it, and if there is, CPU-run spying software would give you the same spying result with worse battery life than NPU-assisted spying software. But if you like, you can continue to believe that a custom processor component is what makes spying software possible; it's wrong, but you wouldn't be the first person I've seen say it.

Re: That kool aid must taste really good

That depends on what software you run and what hardware it runs on. I can't put a table in my comment, but the contents would read like this:

Power effects when you run:

No more software than you run now:

On the CPU: no change

With an NPU: no change

AI tasks you choose to run yourself, E.G. voice recognition, image classification:

On the CPU: moderate increase

With an NPU: small decrease

AI tasks the manufacturer turned on and either can't be disabled (haven't seen any so far, but eventually) or you haven't:

On the CPU: large increase

With an NPU: small increase

The inclusion of the NPU doesn't have negative effects on your power usage. Running software can. It just depends whether you find the thing the software does beneficial enough to justify using it. Plenty of tasks that aren't an LLM trying to make arrangements for you run well on NPUs.

Use it or lose it: AI may cause you to forget some skills

Re: Misunderstanding the intent...

And, if they have a program that actually does replace those people all the time, great for them. The problem that was discussed in the article is what happens when they occasionally need those skills, but they don't have them because the people who had them either lost them, left, or were removed because someone else can generate that output. I'm fine replacing people or being replaced myself with an automated process that can actually do the job, but problems arise when that happens with a replacement that doesn't work. The article points out that, even if you retain the employees who used to do this manually, you still might not have the capacity to fix problems created by AI that simulates, occasionally successfully, the ability to do the job.

Pre-owned software trial kicks off in UK as Microsoft pushes resale ban

Ah, so prohibited use of copyrighted information is a good thing now? Great, sounds like anyone who uses and distributes binary copies of software under the GPL in clear violation of the requirement to provide source code is committing a profoundly ethical act, at least as far as GNU Enjoyer is concerned.

Copyright is why licenses like the GPL have power. If copyright were eliminated, the result would not be more things like GPLed software. It would be more things like GPL violations, now without the ability to take legal action. Remember that.

That is not an accurate summary of what I said. I don't think copyright is to blame for any of this. I think that anti-consumer contracts and lack of enforcement are the problems. I did not propose, nor am I proposing now, any changes to copyright. I propose changes to consumer protection law that makes attempts to change contracts unilaterally illegal, which they basically already are, but enforced in such a way that it isn't tried. I favor restrictions on advertising so that you can't tell me I'm buying a "permanent" license if you have the ability to take it away. None of that has to do with copyright.

Re: Licences offer an illusion of substance

"As you pointed out, you can do that for software, so why should record companies be able to have it both ways?"

They have a lot of challenges that software writers generally don't. The software example works rather well because that file which they give me won't work without my license key. And, following the analogy, things get worse if it's the license key I've destroyed, because companies often have some weirdly complicated procedure for getting one of those restored. They can sometimes manage it, but it's less often a problem because it tends to be less than fifty bytes and preserving it isn't too hard. Record companies can't give you a file that's the data you own but only works with your original purchase information, so they have to find an alternative that verifies that you aren't getting multiple functioning copies, which would be challenging for someone trying to do it in good faith. Of course, they have no incentive to bother doing that as long as people aren't making them, and it's not a big enough problem that many have tried. This might actually be a good thing because the only methods that have gotten anywhere close are DRMing the media until it's almost entirely useless, but you can access it again when you log in, meaning you don't need to preserve any media and always have access right up until they shut off the server in which case you lose everything. On balance, I'll take a CD that I have to manually copy for backup purposes (legal, as far as I know, in every country) over that.

This is very similar to Louis Rossmann's piracy reason ranking (video). While I don't entirely agree with his ranking, he puts obtaining replacement for damaged media, for the same personal use, near the most defensible reason end, and I agree with that position. It is difficult to encode some of this into law, which is why I prefer things without DRM and backing them up myself so that media destruction doesn't deprive me of what I bought or require me to try to find some suboptimal replacement method.

This is why I think all terms must be stated in clear, unhidden language before you pay money and that sellers be forbidden from changing them afterward without your explicit consent. I don't mind if people choose to put restrictions on the things they sell, and I can conceive of reasons why they would. Making something nontransferable makes many things easier and prevents classes of piracy, and I don't think that's automatically bad. However, there are two things which have similar results and definitely are bad:

1. Laws making this the default. No, the buyer should have all their typical rights established by law and the seller should specifically enumerate those restrictions they are placing on the terms. If they don't think of something that they later want, too bad, fix it next time.

2. Sellers hiding this behind dishonest or misleading statements. If they can expire the license, they cannot sell something as a permanent purchase. If they mean until they choose to shut down the servers, they must say "until we choose to shut down the servers at any time of our choosing". Chances are that they'll find people aren't so eager to buy that, so they may have to adjust it, perhaps to "until we shut down the servers which will not happen until at the earliest 2035" or, maybe, not reliant on their servers in the first place. Whatever it takes for people to voluntarily pay them money for the thing they described.

At that point, you could easily choose based on prices and terms what you think is justifiable. If there's a price you would accept for something that can be revoked or altered at any point, you could refuse to buy until it is selling at that price. For me, that price would be quite high; I do not like that kind of term and tend to simply ignore things if that's the best they can offer, the same way that I've decided not to buy software even though I liked the price and feature set if they had bad enough DRM on it. To companies looking to restrict your stuff, this is actually quite a nice outlook, since I'm pretty much allowing them to put on whatever restrictions they want as long as they don't hide or lie about them or change them after you agreed. Unfortunately, there are enough who think that hiding, lying, and changing terms is nice and want to take more than that.

I don't think there is any good reason why those should be different. You should be able to lend or sell an ebook, and if they don't want you to, it should be a license agreement, clearly stated before paying any money, not a law, that forbids you. Unfortunately, laws that make this possible likely exist because of the arguments of people like those immediately above your post that, if you can copy it, you should be allowed to do so infinitely and give out copies to anyone. That philosophy breaks many things in an obvious way. Unfortunately, that makes it easy for lawyers to design restrictions that give their employers far more power than they should have rather than trying to implement reasonable levels of ownership, which is likely what happened with ebooks.

Re: Licences offer an illusion of substance

With software, that's exactly what happens. My purchase price was for a disk containing the software and a license code. My disk broke? Oh, just download this file and use your license code on it. If they're very afraid of piracy, they won't make that link public but will email it to me. It doesn't work perfectly, but it's quite common.

From a music store, it's not hard to understand why they didn't make replacement media cheaply available, specifically how could they tell that you had purchased a copy and couldn't access it? The only way I can see is if you presented both proof of payment and the damaged media, which unless you routinely destroyed media quickly, you probably didn't keep around.

Re: What About Cheap Licences From The Internet ?

It really could be either. There are many countries where reselling licenses is completely legal, so you may be getting license keys from one of them. It's also popular to just find some keys and sell them to anyone willing to pay a small amount. If something notices that seven thousand people activated with the same code, that's the customer's problem. It can be worth looking for indications of a reseller to avoid that problem.

OpenAI eats jobs, then offers to help you find a new one at Walmart

Re: What a ridiculous article

That is a philosophical argument that is not universal. I tend to agree with you, but not everyone will. That's when we're discussing automation in general, which I would be happy to do. You haven't done so yet for two reasons. It isn't so relevant to the case of modern LLMs, because they don't free us up from tasks. Instead, it does those tasks badly, but those who choose not to care about quality decide that's good enough. This puts more work on the remaining employees and the customers alike. If the automation doesn't automate, then the argument doesn't apply.

It's also not a great rebuttal to the article which made no point about continued employment being a moral requirement. The article describes the certification and job board program run by AI companies, mostly without commentary. To the extent that they did express opinion, it was by statements like "OpenAI appears to be only scooping the AI cream, and whatever else floats to the top of the market, on its proposed employment register. There's also the question of whether or not the skills OpenAI is shilling will have any validity in the actual jobs market." That's not anything related to whether automation is good or bad, but about whether this certification is, and it's exactly what I was thinking. There are a lot of certifications that are completely useless, and they tend to have the advantage of at least claiming to cover a certain area which people actually care about. I have no idea what the AI certifications are supposed to indicate let alone whether I would trust that they actually do.

Re: At OpenAI, we can't eliminate that disruption.

I didn't mean to stop. I'd also take that, but there are two reasons I suggested that they keep doing it.

The first is that we already have had enough promises on this that, if they just stopped talking about it, we'd be saved having to hear annoying statements but not the continued desire to replace people with AI. They've already pushed this thing up to a sufficient speed that if they stopped pushing, momentum and inertia would take it forward anyway. If, on the other hand, they keep pushing with all their strength, it will hopefully move more quickly to the barrier at the end of the road and crash more spectacularly which should hopefully mean fewer people willing to try the same thing again.

The other reason is that actually stopping this would require that they not only stop saying these stupid things but withdraw their services and shut down their companies. They can't and definitely won't do that, so arguing for it won't help us. Of the actions they could take, I think continued hype is more likely to end this than being honest that they had lied about the capabilities and potential of their technology for as long, because people who like and promote these have already had plenty of opportunity to recognize how unreliable the things are.

Re: At OpenAI, we can't eliminate that disruption.

Admittedly, the best thing they could do to reduce the disruption is to keep pushing LLMs as the replacement for all workers. A few companies will fire their workers and try to use LLMs, bad things will happen to those companies when important things get hallucinated, and eventually others will take notice and stop. I don't think they have the same idea, but they do appear to be following the plan anyway.

I would hope that people would find this out before trying it at full scale, and a few places appear to, but unfortunately not enough for a general understanding that LLMs will always be unreliable so should only be used when you have a plan to handle unreliable outputs.

No more waiting for lines: New Windows keyboard shortcuts output em and en dashes with ease

Re: ?????

The range example is in both style guides and was, as you saw, the example I used to indicate that, while everyone might recommend its use, nobody really needs it. The different dashes used to join sentence parts is a legitimate difference, but either way, one dash is recommended for that functional use and the remaining one isn't needed for much. Of course, if we let the kind of people who write style guides, they can find a way to use any number of different symbols. However, I have relatively little care for most of the things people put in style guides. I don't care if you choose to frequently split infinitives, start sentences with conjunctions for effect, or anything else which everyone understands immediately but leading grammarians dislike. I have similar levels of not caring for many code style guides; I'll do what they say if I'm employed there, but except for some things which I think have actual readability differences, I don't add to them or fight if someone removes things.

Re: ?????

The em-dash (—) is functional, used to separate clauses from the rest of a sentence. The en dash (–) is mostly useless, and wherever it is most typically used, such as ranges, a hyphen would do exactly the same thing. Nobody is going to be confused by 1914-1918 but find that 1914–1918 makes it so much better. Thus, those are flavor, stylistic choices that you can use but don't matter if you do.

Re: Great news

More conveniently typing em-dashes is "fully using" your OS now? We've managed quite a long time without that. Even if that is what you're saying, you realize that it's not going to be a bolt-on tool, because it will be integrated and turned on by default in non-beta releases soon. Not to mention that you could have used various methods to make that easier to type if you had cared before, such as creating a custom keyboard layout with it or making these some of the defaults in the Windows symbols/emoji selection thing that has been built in for some time. Your complaint makes no sense.

Reg hack attends job interview hosted by AI avatar, struggles to exit uncanny valley

Re: RTFA

I don't think that's our problem. I don't object to the idea because of the poor interviewers. I object to the idea because I don't think an AI interview will work like an exam does. An exam has some possibility, if it's set up correctly, to score something objective. A summary of answers to scripted questions, albeit scripted questions which the LLM has rewritten to try to make them flow more naturally, does not do that. All the typical problems of LLM summarization are there to introduce subjective elements, because even if the answers were word for word the same, the summaries will vary with the prompting at all levels and the temperature of the model and the LLMs don't know what is important and what isn't.

But not only is it not like an exam, it's also not like an interview. A proper interviewer understands the questions and what the goal is. If they want more information to properly judge a candidate's response, they can ask for elucidation. If the interviewee keeps talking about something irrelevant, they can redirect them. This is not that. It's just recording answers to prewritten questions.

This concept reminds me of an exam I was given as a student for a foreign language, where they wanted to test my conversational skills but didn't want to have each student talk to an examiner synchronously. How did they do it? They had a recording of someone asking questions, and they taped me responding to those. I can't remember the exact questions, but here's what it would have sounded like if you listened in:

Recording: What is your favorite meal?

Me: Names favorite meal.

[5 seconds of silence]

Me: [Assuming that I'm supposed to go into more detail because there's so much silence] Starts describing the meal and how to make it for about twenty more seconds.

Recording: [Cutting me off because I didn't know when it was going to start talking] How do you make it?

And on and on like that. Long uncomfortable silences, redundant questions, interrupted answers. Not exactly the best indication of conversational aptitude, but it was a simple school test. With an interview, this program will do a better job of not interrupting candidates, but otherwise, you'll get the same thing. I can't go into detail about an experience I think you care about because I can't ask a question like "At one point, I [accomplishment]. Is that the kind of thing you're interested in? If so, I can tell you more about how I did it." I have to guess and hope that the summary extracts anything useful rather than deciding that, because it took a long time to describe, it will focus most of its summary on irrelevant details of a former accomplishment.

Re: If an employer asks you do to this ...

Let's assume I would actually get the benefit of the saved time. Let's say that it even gets tacked onto my salary. It won't, but let's assume it. My answer is still no. There are two reasons:

1. It doesn't work. Summarizing my answers to prewritten questions does not allow the employer to understand my experience or skills. They can't ask clarifying questions, decide that something indicates a useful indicator and go into detail on that, decide something shows a worrying indication and confirm that it means they shouldn't hire me, etc. A qualified human interviewer can do that. Whether I get the job is now more random.

2. And that means that my colleagues are also going to be more random. If they save a little money on the hiring process and end up getting worse candidates, it's not going to be a saving for long.

FCC plans to kill Wi-Fi on school buses, hotspots for library patrons

Re: Control flow of ideas

To clarify this a little, what they've cut funding for is not internet connections inside the library, but library hotspot loans. Some libraries had programs where they would lend portable cellular hotspot devices to people so they could access internet connections from places other than the library building. I'm not sure what you had to do to qualify for that loan, and it's probably specific to each library system. Schools could also do that, probably for students who did not have home connections and schools that wanted to have the remote option or internet-based homework. That's what they can no longer fund through that program, though they are not forbidden from keeping the service around if they can fund it from other sources.

Re: Control flow of ideas

Not really, because all the things that would affect the mirror would still affect the switch-off. There would still be a multiday "warning period" while TTLs expired where effects would be blunted while people implemented backup plans.

But it also wouldn't be very easy. As root servers go, the US government runs a lot of them. Three of the thirteen are operated by government sources, but not the same government source. To switch the .uk zone off, you probably want to coordinate the action from NASA, DISA, and the US Army Research Lab so they switch theirs off simultaneously. That's already hard, but they all come under federal jurisdiction, so you could manage it. The rest of them are going to be harder. They're run by private entities who aren't going to jump to executing commands just because they were told to with no legal justification.

Verisign runs two of them. That makes me wonder why they're considered logically separate, since all the other servers consist of redundant installations and infrastructure, but for whatever reason, they're there. If Verisign messed with them, that would permanently remove them from trustworthiness in any internet infrastructure. Trustworthiness in internet infrastructure is the only thing they do that generates money. They would do a lot to avoid taking this action because of the mortal harm that would come to them if it ended up happening. That action would either prevent this from happening or give people a lot of warning so they can switch to non-US servers. I also think they would have a lot of trouble convincing ISC to do that, since it's a small group of very motivated people who know exactly what would happen.

Running through this hypothetical was fun, but also, I don't think it's a risk we're going to encounter. Most people wouldn't understand that this is an option. Most who did, especially anyone with the knowledge to come anywhere close to accomplishing it, would understand it's a weak option. I'm not sure how we would get to a situation where anyone decided they wanted to try it badly enough to have any effect.

Re: Control flow of ideas

RIPE already operates one from the Netherlands, and there are Swedish and Japanese operators of root servers. Of course, the US-administered ones are global, including many non-US facilities.

Also, operating root servers does not allow you to censor things. Let's say that I have taken over all the root servers and now run the entirety of the system single-handed. I want to censor something hosted in the UK. My options for doing that are to drop all addresses in the .uk namespace or to not. I do not get to pick and choose. The UK name servers are not operated by me, nor can I decide to remove some of their responses from your view since I merely tell you where to find them and you talk independently to them. Okay, so to deal with that, I will set up a mirror of those servers and direct people to that instead of the real ones. For one thing, the TTL on requests to root servers is long, from days to a week. When I make my change, you won't immediately switch over because you or the DNS servers in your path won't have reason to request information from the root until the old information expires. You know who will notice, though? Nominet, who operates the DNS zone for all .uk addresses, who will see the flood from my mirror and will notice that it isn't normal, then call in people who will recognize this for what it is and raise the alarm. UK-based ISPs would then change their DNS settings to avoid my corrupt roots for that zone. In the meantime, Nominet might well block me to reduce the traffic and prevent me from trying to poison things. DNS is not that weak.

Apple iOS 26 set to dump 75M iPhones on the e-waste pile

Re: Hmm

Where did that come from? I couldn't find that statement, but the closest information I could find was a report that 8% of purchases last year were replacing a phone less than a year old. Other information also suggests that 36% of them were replacing a device 2 years or less after purchase. So if Apple actually said that, people don't seem to think they're right.

I do have reasons to question both sources of numbers. The only way to have the accurate numbers is to track iCloud registrations of every device. I don't think Apple is likely to be doing that for a PR exercise. The other ways to estimate it that I can think of are looking at trade-ins, which would likely underestimate the number because people will probably get better value by selling on their year-old devices rather than trading them in or just surveying people which leads to all the typical sampling risks.

Re: Refurbished?

Oh, that sounds great. What phone would that be? Does it lack the major hardware problems the only two open phones generally obtainable* both have? Because I've been hoping for the mobile non-Android Linux phone for a while. Surely, if you say it's out there, it actually is.

* By which I mean the PinePhone and ... actually pretty much just that. The Pro model of that has been canceled and the Librem 5 is still on nearly infinite back order.

Hence the "most". From the developers' perspective, whether people choose to buy another phone is the user's problem. The developer has to ask whether it's worth it to jump through the hoops to have an older version supported when Apple makes it tricky with SDK age requirements when a lot of their users could update without replacing their hardware. A lot of them decide that it is not. If they decide that, there's little the owner of an old device can do to change that.

It depends what that software does. If it's a local program that does a task, it will probably keep working. If it interacts with other services, they eventually stop allowing old versions to do that because they've changed the client and most users can update to the new one for free. This is especially true if they changed the client to fix a security problem, because then allowing the insecure one to continue operating would mean they could be blamed for people who didn't update getting attacked. Not all apps will do that, but it mostly depends on what kind of apps people spend most of their time using.

Re: "75 million iPhones"

They do have a recycling program, and they also have a trade-in program. An iPhone XR is currently worth £90 (undamaged), though if you wait for the next model, they'll almost certainly drop that a little.

Trump tells Big Tech: Your power woes? Totally fixable

You can't bank on a eureka on fusion next year. People have been hoping for that since 1950. If we get it, that would be great. If we want to spend some money to hope at getting more of it, that is justifiable. But you can't plan your energy policy around that any more than I can plan our server needs by assuming that someone will invent the pocket supercomputer; as much power as all of AWS in one box, retailing for £250 and consuming 8 watts, in a year or two, so all we need to do is wait until then and then have two of those, one for everything and one for redundancy. If someone does, we'll buy one and build around it then, and if there's reason to think that someone can build that if we give them some research funding, it's a gamble worth taking, but we have to plan a realistic option if that doesn't come to pass.

And the Green Peace article you mentioned is about fission, not fusion, so continues not to make your case that anyone is trying to ban fusion. As it happens, I agree with you that their complaints about fission are overblown or mistaken, but since I already said that in the last post, you knew that, and you heard my question about fusion, it's irrelevant.

You used a lot of words there to not answer their question, specifically whether your previous statements about fusion were about the kind of fusion we don't have. Because if it does take seventy years to get it, then your statements about its benefits aren't relevant. It will be great if we get it, but there's a possibility that no matter how hard we try, it turns out to be impractical forever, and that even if it isn't, while we don't know whether it works we need to do something else to cover the intervening gap. You appeared to suggest fusion as a viable option, and now you're giving us a "maybe in seventy years". Those aren't compatible.

Also, I'm not seeing people trying to ban fusion. Are you? I've seen people arguing to ban combustion-based electric generation and fission. I do not agree with either of them, though there are some regulations I agree with. But if you insist on claiming that people are trying to ban fusion, why do you think that doesn't make you sound clueless?

DDoS is the neglected cybercrime that's getting bigger. Let's kill it off

Re: Guilt by tenuous unwarranted association

I think their email starts with their ISP-provided address, but then travels through their mailserver at Linode although operated by someone else. I admit I might be wrong, but that's my understanding. They are indicating to something parsing the headers that the message was sent from another source but since the MX records still resolve to a Linode address, overeager filters are dropping it.

Re: I don't much like this idea at all...

From the average consumer's perspective, how are they going to fix this problem? How are they even going to identify the problem?

A lot of botnet nodes are computers or phones running malware. So first thing's first, run malware scans on those. To do that, open your antimalware program and, since the average consumer doesn't run this frequently, update the definitions, except you can't do that, because the internet has been shut off. And it might not work anyway. DDOS attacks are among the most basic ones, which does mean that the kind of people who want to do them often go for a preexisting program to do it. It also means that, if I want to do that and want to go undetected by standard antivirus software, I can write a new one from scratch in about ten minutes, and so can everybody else.

But we've been talking about routers and IoT things which the average homeowner can't do much about. How are they going to identify which among the things they have is doing this, especially if the software has received a relatively basic patch which can be summarized as "if internet went offline, don't DDOS or even contact the servers for several hours so it's a pain to try to get them to find us".

These questions are important. If it's us with an unworkable solution which will cause big problems for people at a whim versus a problem most people never see*, who do you think is going to win? There are two approaches to making this happen globally: get ISPs to do it, or to expound, make ISPs anger their paying users to help people who don't pay them. Good luck. Or it can be mandated by legislation. To get this passed as legislation, we have to be a lot more convincing.

* One problem making this convincing is that DDOS attacks are not things the general public ever feels. The last attack I remember even getting noticed by the public was the attacks on Dyn which was nine years ago, not deemed remarkable then, and quickly forgotten. Ransomware, on the other hand, was the cause of hundreds of attacks which people experienced consequences from, and little has been done about that. It's hard to convince people a problem is a big one with that kind of experience.

Re: I don't much like this idea at all...

Not hard at all. Here's the workflow:

1. I create a website that is intended to take this action. If I want to be sneaky about it, I'll use someone else's.

2. I create a simple page which includes references to hundreds of files on that site. If someone loads that page in their browser, their browser will request all those resources.

3. If it was my site, I report the flood of several hundred requests all at once from this IP address. If it was someone else's, I may have to get some more requests to make them take notice unless they've done as suggested and automated their reporting.

That kind of link wouldn't actually make a DDOS unless I can get a few thousand people to click it, but it does do a very good job of making them look like they're doing it. If there's another step where a real DDOS must exist for this to count, then I could use actual nodes to create an attack, then send my target a link. The reporting system will conclude that they're just one of the nodes in that botnet.

AI code assistants make developers more efficient at creating security problems

Re: Hold on there

Except even then, you can run a syntax check very quickly through the files. It's true that Javascript and to a lesser extent Python won't catch anything near as much as C, C++, C#, or Java compilation. Those latter two won't catch a typo in a variable name during compilation. In Python's case, every line is checked for syntax errors before the first one gets executed, and Javascript can have that done to it easily. We also have unit testing which is intended to find that kind of simple bug, among other things which it is also intended to do but often doesn't do as well.

I don't know what they're referring to with a decrease in syntax errors. The only idea I have is that I've seen studies that take badly written code, paste it into an LLM, and tell it to fix the code. Syntax errors generally get fixed there. This isn't very relevant to me because in a file I've just written from scratch without testing anything, there might be at most one or two typos which I might notice myself and if I don't the compiler will point out to me, whereas the last example file I was shown with an LLM doing it had about sixty of them.

Atlassian acquisition drives dream of AI-powered ChromeOS challenger

Maybe Liam will be happy

Given the many calls from our own Liam Proven for another browser-only OS, maybe he would like this one. He didn't mention AI, but this would at least remove the Google login requirement, so maybe that's enough. Unfortunately for pretty much everybody else I know, another Chromium-based browser that gives me no local options isn't something I've heard anyone else asking for.

If they're going to do it, I think they must focus on the business case with lots of management tools. Nobody else is going to adopt this. They need to aim this at the IT admins who want something easily locked down. Of course, the IT support people who spend a lot of time in Jira* aren't going to like being stuck with them, so that's something they'll need to overcome, but I still think that is their best chance.

* There are many types of people who can probably do many of their tasks entirely from a browser and use something Atlassian writes to organize it. There will definitely be a subset of people who can't work with that and another one who can if they change everything about their workflow but it drives them all insane. I specifically mention IT support because, although some of them probably could use something like this, they have the closest proximity to the people who can find a reason why it won't be adopted and most of those I know aren't fond of Chrome OS or something with the same restrictions.

GNOME Foundation boss exits after just four months

Re: Steven is not the right fit ..

It's a commonly used phrase for any reason why someone isn't doing something. I've used it, for example when turning down a job someone suggested. I think they would interpret "I'm not the right fit for this" a little more kindly than "That sounds terrible. Good luck finding someone willing to endure that". I don't think it's related to diversity or related characteristics.

Re: "Mutual"

That's one interpretation, but the other common one is that one side wanted to get rid of the other side and the other side didn't want to explain it. That includes both "we wanted rid of them and they didn't want us to talk badly of them" and "they wanted out and we didn't want them telling others how crap they think we were". It doesn't actually have to be mutual as long as the two parties decided that was an easier story than going into detail.

Programmers: you have to watch your weight, too

"It helps marginally in a few very specific edge cases."

Specifically, general desktop use. It doesn't help if you've got a lot of CPU-intensive stuff, because it doesn't give you any more cores. But when you have a lot of programs making intermittent use of things, it does help with that. Or in other words, it's a specific edge case which is what a majority of computers experience most of the time, and before it was economical to do what both AMD and Intel are doing and just shove in lots of cores, it was better than not having it.

Of course, the original statement wasn't about hyperthreading. It was about cores, which absolutely do improve the performance available for most use cases, with the primary exception being things that could be but aren't parallelized (there are some nonparallelizable tasks out there, but they're not the most common). Interpreted literally, the original statement suggested that cores didn't help at all, which is not what you were trying to say. That more cores have diminishing return is a very different statement, and since pretty much anything has a diminishing return at some point, I think we knew that.

Re: Misleading summary of security implications

If I misunderstood, I'm afraid I'm going to have to blame you for writing badly. If I write "If people had listened to me, we could have been saved a lot of trouble. The thing exploded today.", I'm implying that I predicted the explosion and had a way to prevent it. People did not predict the XZ backdoor because it had nothing to do with the problems they're bringing up, even now that you've added extra, incorrect justification.

The problem that led to accepting the help of an attacker is only one: the lack of other contributors. That lack was not related to the quality issues brought up. Any program, whether well or badly designed, can have that happen. Many do. Nor were the design deficiencies responsible for the lack of contributors. If people were refusing to help with the coding because of those, they would also not agree to use it, and yet the reason the attack was dangerous was that people were using it. Compression software is often maintained by few people, whether it's Igor Pavlov for LZMA and 7Zip or even Diaz Diaz himself for lzip. People who use compression often don't contribute to the libraries that implement it, whether or not there are format problems within. Either of those could have accepted the help of a seemingly motivated assistant who turned out to want to insert malicious code. You've linked these things, initially without justification, and now with incorrect justification. They are not linked.

Format problems have no correlation with maintenance capability; someone can have a bad design they think is adequate and successfully maintain it, or someone can have an excellent design and for other reasons not have the time or interest necessary to maintain an open source package. We've seen plenty of that before. I know bad open source software which was maintained for decades because the people who created the design were tenacious about not letting Linux updates break their thing but less tenacious about improving their design, and I've seen software I liked and thought was well-structured die because its single maintainer got bored, got a more intense job, get medical problems, etc. In a couple cases, I tried to assist or take over to preserve those things, which is only good if you trust that I won't turn out to be a malicious attacker.

And if you're going to claim that I once again misunderstood by interpreting two sentences next to one another in the same paragraph as having a relationship, I have my own XKCD for this: XKCD 1984. From your response telling me I misunderstood, you're saying exactly what I think you were saying, that the design problems with XZ were predictive of the attack (they're not) and that people should have seen the former and prevented the latter by eschewing XZ (which wouldn't do anything about the problem). I still think that's wrong.

The removal of IR35 was posited right up front. Those goalposts were there the first time I asked you for your opinion. There are places where IR35 does not apply. They are called the world outside the UK. I have a feeling, given your posts, that if you moved to somewhere else, you would find some other reason why people are unfairly restricted there. I'm not sure how reliable I'd consider that view. If positing the removal of IR35 is too hard, although I know you'd be calling loudly for it if it was ever proposed, then imagine you're living in a different country where you find the market more fair.

The dichotomy you posit between workers and employers has led you to make a lot of moral statements, not just legal objections to one piece of UK tax law. I was interested to hear your moral philosophy. We all know that you're very free with it on pretty much all occasions, but evidently not when asked for it, only when you can make your pronouncements vague and generic. Although you've written a lot of text here and elsewhere, I still don't have that good an understanding of that part. I know you don't like IR35. I know you see massive differences between workers and employers. But I don't know what you think is fair, and since that's what you build all your specific points on, it's a question I thought I'd give you an opportunity to explain.

"First, IR35 hasn’t been abolished."

And the UK has not named me Emperor Without Review. It was a hypothetical. I think you know that.

"If I hire someone, I obviously have to pay enough for them to agree. That’s not the same as paying what they’re worth."

Hence my question. Imagine that you are going to hire someone, and the legal obstacles you name have been removed. You have the option of paying the general level that others are paying for the same skills and getting someone. That's the minimum, because without that, nobody agrees to work for you. You could, though, choose to pay more on a purely voluntary basis. One complication is that in a job market, paying more can often get you a candidate with different skills, but for the question, imagine that those are not skills you need so you're getting the same level of used skills whether you pay market rate or higher. Would you, knowing that you did not have to? How much of the value you are getting from having their work available to your business would you give to your employees?

This is a relatively common philosophical question with plenty of useful standard subparts. For example, everything is worth a different amount depending on who is using it. I would value a laptop more than the average person because the kinds of things I want or need to do require one. However, I pay the same amount as they do to buy one, assuming that we end up with the same level of hardware. Should I be paying more because I need it more, or should I be paying a standard amount that reflects the costs and profit margin of its manufacturer? When it shifts to workers, should I pay more for the same activities if I have a more lucrative operation? If a business is losing money, should it pay less? You've raised this issue, so I'd be interested to hear what you think the moral requirements are and which things are not required but you would do anyway.

White House nixes NASA unions amid budget uncertainty

Re: I'm not a Yank but...

The whole concept of an executive order isn't structured because it's not a specific process. It's just a command from the President to do something. If that's within the President's powers: "Send some of the diplomats from the embassy to negotiate with that country", it works. If it's not: "Find that guy I don't like and have someone shoot him", it's illegal. While the term "executive order" suggests a neatly packaged process, and the existence of numbered documents helps to imply that, there isn't really that obvious a process.

The only question is whether the power to declare tariffs is the President's. By the Constitution, the answer is no, but neither is it explicitly denied to the executive. Congress, however, did grant the executive emergency control over tariffs. Trump has decided to argue that the US is in an emergency, so he can use that emergency control. So far, two courts have decided that he is wrong and can't, but there are some more courts, so he is appealing this in the hopes that it will be overturned. If enough members of Congress wanted, they could remove this power because they granted it in the first place. They are not trying.

In the example of NASA, it seems that membership in the group where national security restrictions apply is something the President can decide on his own. Again, that would have to be a power granted to him by Congress, and if he just made it up, he should lose in court. The original structure of most of this was that Congress was supposed to have most of the power, but for some time, Congress has decided that various parts of the executive, whether the President directly or someone who follows the President's commands, should be able to take action without them, so they have been voluntarily relinquishing some of their powers. When presidents asserted other powers, that has often gone unchallenged as well. This empowers the executive without having been the initial design or necessarily being permanent.

Re: I'm not a Yank but...

And when was the last time when the monarch or monarch-appointed representative overruled the democratic government by decree? Because if that actually happened, I'm not sure the results would be as obvious as you claim. The last one I can think of was fifty years ago when the powers were used to remove the Australian PM, which was rather unpopular including an unsuccessful, but close attempt to make Australia a republic. Written documents can be the subject of court rulings, which frequently tell leaders that what they tried to do is not allowed. That happens in the US frequently, although if the Supreme Court there was showing a desire to do that, that would be a more convincing argument. Still, a document which is clear which can be interpreted by independent people is something I'd feel a bit more confident about than hoping a person who did nothing to earn power would take reasonable action with mostly untested authority.

Laravel inventor tells devs to quit writing 'cathedrals of complexity'

Re: There was a very old term for this

But what kind of efficiency, because that's generally the problem when discussing this kind of thing. For example, when you say "Use the l[e]ast amount of code to get the most amount of results", the literal interpretation means code golf. I'm sure that's not what you mean, but a less literal interpretation is not to write for the future. Write the code that achieves the goal you have right now and let expansion be later's problem. Also not a good idea.

Most considerations of efficiency focus too much on one resource. For example, it's popular to complain about RAM usage having increased, and most of those complaints are wrong, something that old-school programmers know better than anyone. They were faced with many conflicting resources which were significantly limited and had to decide how to manage them. If that meant that you waste a bunch of CPU cycles so that you can fit all this data into RAM in a compressed way, that might be the only way to get the program running on the computer they had, so they did it. The same is true if it was RAM they had to use more of to get speed out of the slow CPU at their disposal. They had to pick between those tradeoffs lots of times and they had to choose correctly each time or their software wouldn't run in the environment it needed to.

When someone uses a ton of RAM today, they might be doing it for speed, because being able to use a hundred megabytes when you probably could fit in five can make some types of actions much snappier, but even when they're not, they may be optimizing for another limited resource, with one of the important ones being developer time. It's expensive and in short supply, whereas until you get to a certain level, RAM often isn't. Libraries versus writing it yourself is relevant to that tradeoff. Even if we ignore the many ways that doing everything yourself can mean building the same untested code when someone else's tested stuff exists, there's still time spent building code that is already out there. Every manufacturer of an embedded device could write their own code to access the hardware. Every application could be written in assembly. We built operating systems and compilers to save us time, and to protect us from making mistakes. Libraries can be the same. In both cases, that doesn't mean that you should use anything and everything; it'd be a bad idea to build your embedded devices off a bad kernel (people who build them sometimes need to learn that), and a library might introduce more risks than it solves. Neither of those are guaranteed, and efficiency is not a good argument against them unless you have specific numbers about what inefficiency exists in the specific library you're considering and why the resource it's using more of is among those you need to focus on most.

Re: There was a very old term for this

And on the other side, we have people who think that the right approach is to write everything yourself, which means that we end up with twenty different implementations of similar but not identical subsets of the same thing, most of them containing the same bugs, which they will eventually find and need to debug and fix manually. Meanwhile, someone who did that in a portable way found and fixed those in 2004 and has built a lot of useful functionality that will eventually be added. The only question is whether they added enough other stuff to counteract the benefits of having something mature and under active use elsewhere.

Google kneecaps indie Android devs, forces them to register

Re: FDroid?

We don't know Google's terms, but because they didn't write everything in their repository, I wonder if Google might object to that. The idea is that Google wants to identify all developers, and if they didn't identify me but my code can be installed, logic suggests they wouldn't be happy about that. The problem is that logic left this process as soon as they started claiming they cared about security, so it's hard to know what they want and how they would react to any of the suggestions we make.