Posts by doublelayer

Turns out humans are leading AI systems astray because we can't agree on labeling

Re: I think I see the problem

Yes. Mechanical Turk pays the participants so little that they have a lot of data pollution problems. Also, they have the problem that the people doing the work are either bored people who will give up in fifteen minutes or people who really don't have better ways to get money, so you can't expect consistency or strict attention to detail.

It's along the lines of all those studies they do at universities where students are paid to participate in research with an amount of money which could be used in a vending machine in 1995. Especially the economics studies which effectively boil down to "Would you take this action if we cut your meaningless money to even more meaningless money?". I participated in a few research programs while studying, but always because I was bored and didn't mind wasting a few minutes. I did actual work to earn money.

Android, iOS beam telemetry to Google, Apple even when you tell them not to – study

Re: Can we mess with them?

You could VPN through your home network and get the firewall. There are a few other methods of doing that, but the VPN option is the one with the fewest security risks. I once considered just making my own blocklist a public though unadvertised DNS resolver, but since DNS resolvers can be used to DOS others, I didn't bother. Maybe I should set it up with DoT and DoH now.

Can we mess with them?

"iOS shares additional data: [...] the Wi-Fi MAC addresses of nearby devices, specifically other devices using the same network gateway."

First problem: why in the world are they doing that? That's not helping with any of the device's features. Even if the device was communicating with those devices or detected them so the user can see them, there is no reason Apple has to know about them. There are several good reasons Apple should never know about them.

Second question: what happens if I put an iPhone on a network device which also has a raspberry pi programmed to authenticate with different MAC addresses every ten seconds or so. How much crap can I send through Apple's servers before they discount the data from that iPhone? Time to crank up the random number generator--there are 2^48 addresses I need to cycle through and I don't want them catching me in a pattern until they've gotten most of them.

Re: Find my?

The article specifies that they were looking at collection when there is no account signed in. In order to use the feature that finds a lost device, you need to associate the device with an account and access that account to get the data. By definition, they did not have that feature enabled and it sent data anyway. If the data was only sent when people had requested that service, it would be different.

Re: It's this sense of entitlement that get's me

Basically yes. You don't have to sign in if you want to use it as a phone. You'll get the Apple apps, including browser, can use it as a phone, get OS updates, all that. If you want to install apps though, you'll need to sign in. It could be worse, like Chrome OS, but it is limited without an account.

X.Org says it's saving a packet with Packet after migrating freedesktop.org off Google Kubernetes Engine

Re: Are the numbers correct?

You might be correct in this case, but the same applies if you have an existing team and a much higher usage. A company serving a bunch of data may be at a threshold where it's cheaper to have someone do a bit more admin work rather than pay the bandwidth bill. It just has to be calculated before making the final decision, which a lot of finance departments don't bother doing.

I've got the power! Or have I? Uninterruptible Phone-disposal Stuffup

I'm sorry, what?

"an ecoATM, a device designed to take unwanted smartphones and handout payment to customers without the need to trouble a salesperson."

Now I have to look that up.

So, it's a real thing. I would have guessed that distributing thousands of machines which have enough hardware to inspect phones wouldn't be an economical method of entering the used phone market, but apparently they're giving it a go. I wonder what the machine does if you feed it phones that aren't all that common, for example the old phone from a relatively unpopular manufacturer I have in the closet. Then again, I'm also wondering how it will detect various types of hardware issues that aren't easily visible with a camera.

Biden's $2tn infrastructure plan includes massive broadband rollout, equates internet access with water and power as essential utilities

Re: Infrastructure

They have been fighting about what speed people need for a long time and likely they won't end now. Given the use of videoconferencing, remote desktop, and multi-user homes all working or studying from home, I would define acceptable speeds as capable of running at least two videochats and one graphical remote session simultaneously. Choose the services you like best and we can measure exactly how much that is. Of course, for a larger family, that's not going to be enough, but that should be a minimum.

Starlink, do you mean? If so, no, it doesn't.

Until they can release a lot more satellites, Starlink can't cover the whole world nor can it provide bandwidth for everybody. It can provide some bandwidth, which is why it's being sold now, but if you put millions of people on it, it wouldn't be functional. Starlink needs satellites in orbit which requires a lot of rocket launches. It also needs a lot of downlink facilities which scale arithmetically with the user count. To be most efficient, those downlink facilities will need to be geographically distributed, which means there will need to be enough cables to serve all the places with such facilities.

In addition, there are problems with satellite which make it unusable in some areas. Areas where a receiver can't be positioned correctly, where that receiver is likely to be damaged by local conditions, or where the receiver will be occluded by clouds, storms, etc are all places where people will prefer the reliability of a cable if they can get it. It's also usually cheaper once it gets built--even with U.S. prices being higher than most other countries, Starlink contracts are quite a bit more so. A Starlink-style system does provide some advantages, but as much as Spacex's advertising copy might claim, it's not a panacea for all network-related problems.

Nominet ignores advice, rejects serious change despite losing CEO, chair, half its board in membership vote

Re: Put your money where your mouth is

Yes. Everybody reading this who owns .uk domains should do this. It's likely another vote is coming and anything we can do to increase the power of those registrars supporting it is going to help. Nominet has already had experience losing one vote and really doesn't want to repeat it, so they're likely to bring out as many methods as they can next time. In fact, if you don't have .uk domains, still move them to someone who supported this vote because they're likely to be better serving your interests if the domains you hold have a similar experience. All my domains are with a supporter. If you would like to see a list of options, consult the publicbenefit.uk home page.

Wi-Fi devices set to become object sensors by 2024 under planned 802.11bf standard

Re: Stalker's dream

I get that the calculations are a lot more than one instruction. Still, it doesn't seem particularly difficult to implement should somebody want it enough. Transferring 75 MB in ten seconds is easy, especially given that most of the towers concerned will have fast cable connections running straight to them. Calculating the location based on that data does require more information, but a few methods can cut down on the effort required. First, some cities or businesses operate connected infrastructure which stays in one place. The server could identify something which, for example, has not moved for a week and treat that as a point of reference for future calculations. If the leaves fall off the trees, then it will have a better connection to tower 3 and the servers can factor that into their calculations. Second, devices can be correlated with one another. If lots of devices go in relatively straight lines, then it's probably a street. The assumptions can be factored in as well. If you're worried about I/O getting the data to the server, the towers themselves can do some of the calculation so the data gets compressed before sending it to the main servers for more extensive calculations.

Now your main point, that this is inefficient for the goal, I completely agree. Doing this would be ridiculous when we have lots of ways to get traffic information. However, that doesn't make doing it at all impossible. If someone wanted it for their own reasons and chose to sell the data, they could.

Re: Stalker's dream

"you have to make 6 million calculations a minute on 18 million datapoints. Just to get the 'raw' location data."

Sorry, but this doesn't sound as difficult as I think you meant it to. My desktop can process millions of operations per second. A server can do it even faster by throwing more cores at the problem, because it's completely parallelizable. The only tricky part is getting the large databases into the processing system, but since they have high-speed connections to send user data, it's not that difficult to do that either. Existing software is available to take that raw location data and display it on a map, and I'm sure there are companies willing to build a system to analyze that kind of raw intelligence.

Amazon’s critical Alabama warehouse workers union vote has started … and may be some time

Re: Sealed Ballot Boxes

I doubt it. The article points out the probable reason for the demand: to complain and hold up anything if they can find a mistake. Someone unsealed the box to count but there weren't three people logged in to check, so it will be embroiled in lawsuits for two years. It's basically the same reason that the organizer of the Nominet vote wouldn't make a speech during the meeting, because he figured they would lock him out so he couldn't vote. When you can't trust the other side, it's good not to give them ammunition to obstruct the process.

And that's yet another UK education body under attack from ransomware: Servers, email, phones yanked offline

I don't know about this situation. That is true. However, I do know about a lot of other situations where ransomware has struck in the past. A lot of those which had problems were due to configuration problems. People got hit with ransomware and you don't know about it because they limited the spread and recovered quickly. The ones who get articles here usually had more trouble, either a more pervasive spread, difficulty recovering from insufficient backups, or both. Therefore, if an organization is having a lot of trouble because of a ransomware situation, I view it as more likely they didn't take a backup step than they were hit with a very sophisticated ransomware variant.

Any network will get malware on it eventually. Some networks get malware on them a lot more often than others. These things are not contradictory.

Any system will lose data permanently eventually. Some systems have no backups and therefore will lose data permanently more often and in a more damaging manner. These things are not contradictory.

The most sophisticated attack will eventually get access through a very good security system. A good enough security system will block less sophisticated attacks. These things are not contradictory.

Some of this is about doing the job well. Ransomware can be prevented more often by employing security measures that make it harder to install. While it can't be prevented in all cases, the risk can be reduced. If ransomware does strike, it will be debilitating, but if there are good backups, it will lessen the cost of fixing things. A sophisticated attacker may manage to infect the backups too, but it's possible to avoid that. Therefore, it is justifiable to say that a place with local admin rights for everybody and no backup system has failed to do its job related to security. We're not being sanctimonious any more than you would be if you told me not to leave the keys to my car in the car and then walk away. It's a precaution they have to take and they didn't. This doesn't apply to everybody, but you'll find it applies to a lot of them.

Intel accused of wiretapping because it uses analytics to track keystrokes, mouse movements on its website

Re: Well...

The law is clear. Parties which can record when one-party consent is permitted are those parties known to be on the call. I initiate the call and am one of them. The recipient of the call receives the call and is known to me, therefore they are also one of them. Another person is listening in and I didn't know they were there and I didn't consent to their collection. That's illegal. If they sold their software to Intel, only Intel runs it, and the data is only stored on Intel equipment, then that's not a violation. If any of my data goes to the operators of the library, they are violating it with Intel's collaboration.

Even if Intel runs it all locally, they are violating legislation in states requiring two-party consent (this does mean all-party consent) and privacy legislation in the mold of GDPR, including the CCPA.

Re: Well...

"In some jurisdictions, recording ("wiretapping") can be legally done with only one party's consent"

Yes, but not with a third party. In such jurisdictions, if I call you, I can record our conversation. However, if I call you and a third person not on the call records it, even if you know that, it is not legal. Also, California doesn't allow this. Florida does, but that proviso applies there.

Satellites, space debris may have already brightened night skies 10% globally – and it's going to get worse

Re: Blankety Blank

Why? You can choose to open in a new tab if you want to. You can even make that default. Why should a link to a different page on the same site open a new tab by default? That just leads to ten tabs including eight zombies which I'll have to close later. The browsers give you an easy way to ask for that if you want it.

Apple expands third-party repairer program, mostly in Asia

Re: A growing “right to repair” movement

"I'd also argue that it's not a cartel if anyone can apply to join. Sure, they have to meet a minimum standard - but surely that's a good thing?"

Cartels aren't limited in entry criteria. This is a cartel:

"1. (economics) A group of businesses or nations that collude to limit competition within an industry or market."

OPEC, for example, is a cartel. Yet they're happy to let people in. If you run a country which produces petroleum and you're willing to restrict production to manipulate the price along with the other members, OPEC will welcome you with open arms. It's not about how you get into the group. It's about what the group does.

In this case, Apple is making it such that any company needs to meet their standards to work on any Apple product and therefore deny the right for people who haven't had that certification to do so at all. They will have all the repairers in their corner, and since the repairers must purchase all their plans and parts from Apple, Apple will control the market. Apple sets the price. Apple sets the supply. Apple says what is going to be allowed and what isn't. Apple also controls the supply of repairers if they want to. That's a cartel, albeit one where Apple has nearly all the power.

As for whether that's a good thing, I'd argue not. For the moment, people who advocate the right to repair have a reasonably good argument. "Apple won't repair our stuff and they also won't let us do it. We should fix that by making them allow us access to the necessary parts." Apple, by letting people open restricted repair shops, is cutting off this argument without fixing the problem. If their repair shops exist and theoretically could fix a product, then there must be options and thus no need for access. However, Apple's control over the repair shops can make it so repairs aren't available or economical. Break a screen? Pay 90% of the original price for a replacement. Break a button? Sorry, that's not available so you'll have to buy a replacement. Meanwhile, they're attacking anyone who attempts to go around them. People who make replacement parts or people who recycle broken phones for those parts which work are being attacked by Apple, both with lawsuits and increased software locks to make sure the parts don't work.

5-year-old Fairphone 2 is about to receive a major update to Android 9

Who's heard this before?

"In December, Qualcomm and Google teamed up to re-architect how Android versions are made, aiming to increase the number of OS versions a device will receive. These changes, which apply to devices released with Android 11 and the Snapdragon 888 or newer, will conceivably allow vendors to provide three major software upgrades."

How many times has Google re-architected Android in order to make it easier to update? Or easier to install the newest version on something? I've heard this over and over and over. Android 2.2 was supposed to help with this. It was one of the selling points of Android 4.1. It was announced with fanfair sometime around the release of Android 7. And it was announced with triumph that Android 8.1 would finally achieve it. They're just lying, aren't they? Either the manufacturer tries or they don't, and the architecture means it's trivially easy for chipset designers not to hand the solution over to a manufacturer which in turn decides not to do the work themselves. Google clearly doesn't care.

Re: Who still uses a 5 year old "smartphone"

Well, me for one. My main phone is from 2016. Why? Because the newer phones provide only a few benefits. They're larger. That's a downside for me. They have more cameras. Given that I use the camera maybe four times a year to demonstrate something, that's not very important. They have 5G. If I was using my data connection outside WiFi range a lot, this would... probably not make a difference because 5G coverage is still limited. As it is, I don't use the data connection very often and 4G has been just fine for it. They have faster CPUs, which I wouldn't mind, but I don't do heavy lifting with my phone's CPU so its speed is relatively unimportant to me. I have nothing that I want from a new phone, and by not spending money on a new phone, I can have the ability to buy something else which will be more useful.

Now that half of Nominet's board has been ejected, what happens next? Let us walk you through the possibilities

Re: GoDaddy, but that will be changed at the next opportunity.

"I'm still waiting for an answer to that question from Fasthosts"

Based on the publicbenefit.uk site, they're a subsidiary of 1&1 which voted against. I'd say that's enough to go on.

Free Software Foundation urged to free itself of Richard Stallman by hundreds of developers and techies

Re: "Punishments" vs "consequences"

Yes, it is. Your threat of punching is a crime though. Your actual punching is another crime too. You have the freedom to tell your boss or client that you hate them and think it would be best if they were locked up just for annoying you, but if you do, they will not be your boss or client much longer. This is a deliberate decision on their part. On that basis, you may call it a "punishment". Too bad. It's a punishment that they have the right to give to you.

Re: Oh how the woke wimper

Freedom of speech means the government can't be the one giving you consequences. This seems to be required teaching about once a month, so let's do it a few more times. North Korea does not have it because, if you say the wrong thing, the government comes to arrest you. If I don't like what you said and tell you never to come to my house again, that's not a violation of your freedom of speech. If I don't like what you said and make it so you can't post on my site again, that's not a violation of your freedom of speech. If I don't like what you said and say something to you that you don't like, that's not a violation of your freedom of speech. If I don't like something you said and refuse to associate with you ever again, that's not a violation of your freedom of speech. If I don't like something you said and I tell other people that you said it, and they also don't like what you said, that is not a violation of your freedom of speech. As long as the government doesn't come to arrest you or otherwise affect your rights, your freedom of speech has not been violated.

Guilty: Sister and brother who over-ordered hundreds of MacBooks for university and sold the kit for millions

Re: "Gentlemen do not read each other's mail."

Police surveillance is bad ... when the police don't have a warrant. This was a situation where they almost certainly had one. They accessed a specific person's records because they had probable cause to suspect that person of committing a crime. That's clear and justified use. Also, this line:

"I feel a bit sorry for them. Victimless crime an' all that..."

That's stupid. It's not a victimless crime. The employer who spent extra money is out millions of dollars from their crime. That's a victim. It's a university, meaning most of their money comes from student tuition payments and grants. Those payments probably went up to handle their increased budget. That's more victims. These aren't even secondary victims who lost a potential benefit. They lost money directly. You need to learn that.

Re: Why is the second part of:

It's not PayPal's job to validate each transaction to determine whether the sale is valid or not. They just move the money. As long as they do the checking to determine that it's not money laundering, they're in the clear. How should they know if the laptops are stolen or not? In fact, they won't even know the exchanged items are laptops.

Outsourced techie gets 2-year sentence after trashing system of former client: 1,200 Office 365 accounts zapped

Re: Thank god I work for a company that makes something

Er... there's a lot of useful work that's done that way. Your company makes something, right? I'm guessing you build that thing? There are people who receive emails from people buying the thing. Those wouldn't be available. There are more people who receive emails for contracts for the components. They're cut off too. Lawyers review your thing for compliance with regulations. This is useful work which requires communication, and your company needs them too.

That's possible, but it's not guaranteed. There are a few options. For example, the employee might not have entered on such a visa. He might have other rights of residency, or have been hired as an outsourced worker who visited only a short time. For that matter, he could have been a dual citizen which is unlikely but possible. Also note that the victim company also didn't get their name printed. Maybe they just don't want to be known as the people who broke the system that badly.

The kids aren't all right: Fall in GCSE compsci students is bad news for employers and Britain's future growth plans

Re: Full time IT education courses

"What I do find unfortunately is a tendency for new starters to want to go straight in to an IT specialism (such as Cyber Security), without having done the hard miles first on the likes of an IT support desk, or infrastructure teams."

Because they don't want to work on the helpdesk. It won't help them all that much, will it? If they waste a couple years helping people turn the computer off and on again, run antivirus scans, or the like, they haven't learned anything other than how users mess things up. If they're using that as a way to earn some money while they learn stuff elsewhere, that's fine. If they actively enjoy the role, that's fine. But if you think that's actually going to teach them something useful before you'll let them do what they want to do, they'll just leave. A helpdesk position only gives someone experience dealing with users and user-facing equipment. You don't learn how the server's run by doing that. You don't learn how to use databases by doing that. You don't learn how to manage networks by doing that. Theoretically, they could get some useful experience by impressing someone who tells them "Hey, stop doing that and come learn something better with me for a while", but that's not guaranteed and they could also just learn that themselves. So as an educational tool, it's not very good.

Fine. I'll concede that you are an office admin. The IT people who do more than that, though, are not. A person who does easy stuff with desktops like you describe is doing something users should know how to do. The person who made that default image probably knows more. The person who configured the network and got everybody online while monitoring their machines for security incidents knows more. The person who ensures the necessary servers are available so work can continue know more. These things are clearly IT. We can draw a line between IT and software development if you like and still acknowledge that there are roles on the IT side requiring more advanced skills.

America's Supremes give Facebook nothing but heartaches: Top court won't stop '$15bn wiretap' lawsuit

Re: Be careful what you wish for.

Right. Facebook is a hero which lets me do all sorts of things I couldn't do with a webserver or any of the thousands of forums that existed before they started, quite a few of which still exist today. It's all down to them that we have an open internet, even though they keep buying up parts of the internet and making it more centralized. This is a forum of technical people. We know what's possible without Facebook there. Talking is still possible. We also know what's related to Facebook and what isn't. National spying, for example, is perfectly possible with Facebook there and in fact easier with all their data in one convenient place. You are wrong.

Re: The Impossible Wall

That's correct. You can't FOIA Facebook. If you live in a country with GDPR or California with CCPA, you have the right to get a copy of their data on you. Be prepared to give them a bunch of identifying information so they can find the data on you. Be prepared for them to keep that information and not tell you about doing that. Also be prepared to see some lies about what they don't have.

Re: The Impossible Wall

"How do I go about ascertaining whether or no that Facebook has or doesn't have any of my information?"

Flip a coin. If it lands, they have some information about you. It might be wrong, but they have it. If it doesn't land, you are not on Earth. Since you have access to the internet, we presume you're on the ISS, in which case they have information about you. All paths return the same value.

Chairman, CEO of Nominet ousted as member rebellion drives .uk registry back to non-commercial roots

Re: One question

"To encourage registrars to sell .uk names instead of .whatever."

Seriously, they don't do that and don't need to. That's an issue for the new GTLDs because A) nobody has seen them so they don't have any existing credibility and B) there are hundreds of them available. Neither is the case for .uk. .uk is what you buy if you want to look like you're connected to the UK. Everybody knows that. It doesn't have a massive selling point otherwise. It's also very popular as TLDs go just because the UK has had sites for a long time. Anything they're spending advertising .uk is money wasted.

Re: Looking for a new registrar

If you want a registrar that supported it for a while, the publicbenefit.uk homepage lists the supporters. The largest ones who supported for a while are Gandi, 20I, Coherent, Crystal, and ANY-Web. Two even larger ones, TUCOWS and Namecheap, also voted in support but made up their minds later. There are about 480 other supporting members available. I have only listed those managing over 30K .uk domains. There is plenty of competition available while allowing you to stick with companies supporting the motion.

Richard Stallman says he has returned to the Free Software Foundation board of directors and won't be resigning again

The thing I'm taking issue with is the "moral" part. To argue that something is "moral" usually means something specific. More than "It's good of you to do it", it's usually "It's bad of you not to do it". In the same sense that it's moral to be kind to people. That is what the original comment seemed to say, and I've seen lots of people say just that. Therefore, that is what I'm arguing against.

It does take a lot of resources to actually create the software. Writing code which functions takes time. Making that code not crash takes time. Creating the resources which most nontrivial code uses takes time. And not only time, but also a lot of specialized resources like programmer knowledge, equipment, attention to detail, etc. Copying may be cheap, but that does not make the rest of it free. It is not. I'll grant that the car analogy is not perfect, but then little is. I'd try a book analogy, but some people also think those should be entirely free whether the author wants to do that or not, so it isn't as illustrative.

There are people out there who hate GPL with a passion. They have often taken the argument that licensing code under the GPL is violating their rights because it doesn't let them use it in proprietary software. I am very annoyed with those people. However, there are people who make similar arguments about anything not licensed under the GPL, including proprietary and permissive. They are wrong too. It is an issue of choice. What they have to realize is that copyleft is based on copyright, just like proprietary is. The reason GPL has the freedoms of GPL is that copyright law makes it happen.

Re: It's FLOSS btw

This argument is nice, but it doesn't always work. If you write code and make it copyleft, I'm happy because yay, free code. If you build a car and give that away too, yay, free car. This is not a moral imperative though. It's just a nice thing to do. I write code and release it for free (variety of licenses, but I have written GPL3 stuff because I want the license terms to apply). When I do, I understand that I'm not going to get money for the work unless I'm very lucky. It is also my right to create software which I don't release so freely as long as I don't use others' GPLed code to do it.

If someone writes some code, not using any copyleft components, and doesn't give that code to everyone but instead sells it, that's not an immoral act. Acting like it is is weird and is exactly the kind of thing that makes the original poster not want to take you into a meeting. Not having access to the code may be a sufficient reason not to use it. That's your choice, not an ethical certainty. Sadly, we don't always live in a world where code written from pure altruism is available or superior to proprietary code written for profit, which means that people who either don't care about or don't understand the license wars may choose the proprietary option.

I read the comment as giving Stallman credit for the Linux kernel. Now that I'm reading it again, it could be that or they could be correctly setting it apart and giving Stallman credit for the rest. I'm not sure which it is. If it's the latter, then my original critique is incorrect.

If it is the latter, it's unfair to lots of people who are not the FSF. This is the problem I have with those who are intent on calling Linux GNU/Linux. Yes, GNU deserves credit for lots of nice code they've written, but by including them in the name as some demand, it does two things that I see as harmful. The first is that it implies that GNU code is required for a Linux system that respects user freedoms. This is not true. Almost all the most popular and required GNU programs have non-GNU alternatives. There are alternatives for libc, GCC, the core utils, and quite a few other things.

The second problem is that plenty of other projects deserve some credit and don't get it when GNU and Linux are listed as if they're the most important. Most running Linux installations, desktop or server, have lots of software written by people who are neither the Linux foundation nor GNU. If the name of the system has to list all the important players, then it will be a very long name. KDE/Mozilla/Python/TDF/ApacheFoundation/Apple*/GNU/RedHat/Linux describes a basic desktop distro before the user installs anything, and there are undoubtedly plenty of others who deserve membership in the list but I stopped listing them. Not that it diminishes the real contributions made by the GNU project and the FSF, but such statements are often a lot more limited than they should be for honesty.

*Apple, in the Linux company list? Yes. Several important components rely on Apple-maintained components. They include CUPS for printing, OpenCL, LLVM and Clang, etc. One could list each project by its independent name, but so the name fits in this comment box, I'm recommending we don't just glob together all the installed package names.

"I think Stallman ought to be recognised for his tremendous contribution to FOSS (as Linux is much more than just a kernel),"

Sorry in advance for the pedantry, but this is the wrong way round. Stallman didn't write Linux at all, and the people who did are not associated with the FSF or GNU. What those projects created are a lot of the utilities that go around the kernel. This has led to arguments between the two projects, for example Linux sticking with GPL version 2 only while the FSF is intent that version 3 is much better. Also, insert the Linux versus GNU/Linux argument here.

John Cleese ‘has a bridge to sell you’, suggests $69,346,250.50 price to top Beeple's virtual art record

Re: We have lots of non-fungible tokens

No, they can't. If you buy an NFT, you get a copy with a digital signature which is signed by a couple of keys including one you have. So you can authorize a transfer if you want to and you can prove that you have the key and others don't have it. But you can also just chop off the digital signature and send the part of the file you can look at out to anyone you like and they can't tell who sent it or who received it.

What could be worse than killing a golden goose? Killing someone else's golden goose

Re: "Things were purposefully not documented"

It's pretty clear those things don't apply. Nothing went "contrary to internal procedures". The other person wasn't annoyed because it should have gone through a meeting. They were annoyed because they deliberately created the mistake. In literally every scenario, your objections do not apply. Here are some likely options:

The change didn't go through procedures and the creator didn't do anything deliberately: Have it reversed then go through procedures. That didn't happen. This scenario isn't right.

The change didn't go through procedures and the creator was trying to hide their mistake: Don't complain about the change and nobody finds out who made the mistake. That didn't happen.

The change didn't go through procedures and the creator was annoyed enough about someone not following procedure that they wanted to fire that person: Discipline them for not following procedures. That didn't happen.

No, this was clearly malpractice and there's no reason for it. The senior developer should have been fired for it following the procedure to figure out who knew about the code and why they didn't do something about it.

Encrypted phones biz Sky Global shuts up shop after CEO indictment, police raids on users in Europe

Re: "paint encrypted mobile phone services as something used exclusively by criminals"

You have now proven my point. The indictment linked is entirely about complicity with criminal clients. What did I say about that option? I called it "plausibly true".

My complaints are about application of export law which doesn't apply outside the U.S. Is that in the indictment? No, it's not. Is it in the Dutch or Belgian reports? No, it's not. Why not? Because it does not apply. The lawyers and I agree on what charges are valid. We also agree on what's plausible. To prove it true instead of just plausible, they'll need more proof than I've seen. They probably have it. That's their job.

They are likely correct. You ... are not. They are focusing on a crime which they will have to prove. You're attacking cryptography on fallacious arguments and incorrect application of limited legislation.

Re: "paint encrypted mobile phone services as something used exclusively by criminals"

You are wrong several times. Let's start with the obvious one:

"The culpability in this case is two-fold: (a) he sold strong encryption to drug dealers for the purpose of evading detection while committing a crime and (b) in the process of committing (a) he violated ITAR and US Export Control regulations."

A is covered in my original comment, short version is "more proof than that needed". For B, no, he did not violate U.S. export controls. He and his company are Canadian. The exports happened from Canada. U.S. export controls only apply to people exporting stuff from the U.S. Same with ITAR. It's a U.S. law and applies only to the U.S. Other countries have similar legislation, at times structured to be compatible, but it's not ITAR. Canada has export control legislation. Calling it ITAR and alleging that U.S. export regulations apply to Canadians makes it clear you do not understand how those laws work.

Now let's consider Canada's legislation. Actually, it's best we don't, because Canada hasn't charged anybody with breaking its export legislation, and they are the ones who would have to. But let's consider it anyway. In the list of controlled items, it originally seems somewhat damning since symmetric cryptography which works is prohibited (limit of 56 bit keys). However, there are long lists of exceptions. One of them looks like this:

"e. Portable or mobile radiotelephones and similar client wireless devices for civil use, that implement only published or commercial cryptographic standards (except for anti piracy functions, which may be non-published) and also meet the provisions of paragraphs a.2. to a.4. of the Cryptography Note (Note 3 in Category 5 - Part 2), that have been customised for a specific civil industry application with features that do not affect the cryptographic functionality of these original non-customised devices;"

Well, the phones themselves are mass-market with hardware modifications unrelated to the cryptography. So as long as they use public algorithms, they count under this exception. Public algorithms include AES and RSA. So now, if Canada wants to charge him, they will have to identify the encryption in use. I'm guessing it's likely to be a public one, in which case they have already allowed it.

Also see this FAQ about cryptography exports. It's useful in determining what is allowed and what is not.

By the way, you'll find that no charges for breaking export controls, whether Canadian or U.S., have been filed. That's because the lawyers understand what is illegal and what isn't. They are hinging their entire case on point A, and point A is quite plausibly true. Still, it needs more proof than you have.

Re: "paint encrypted mobile phone services as something used exclusively by criminals"

Well, they can both be used to commit a crime. A car lets a criminal get to or away from a crime scene a lot faster or you can kill someone with it. For the same reason, encryption can be used to hide information about your crime. Both can be put to nefarious use. They are also similar because both are heavily used by others for entirely legitimate purposes.

The important detail is whether the operators of the encrypted communication company knew their products were being sold to criminals. The wording there is important. It's not enough that the equipment was being used by criminals; car companies know that criminals will use cars and ISPs know that people will send malicious packets. The business has to know that they're interacting with a criminal for them to share culpability. Again, the wording is important. If they went to strange steps not to know their customers because they knew they would be criminals, then they knew and the circling around doesn't help them. If they actually thought the products were being used by normal businesses which would have a reason to want secure communications, they aren't culpable. This is the reason the trials of these companies have to be based on specific evidence from each company. There have been many companies deliberately aiding criminals and this might be one of them, but that has to be proven and just saying "they provide useful stuff that criminals used" isn't enough.

Staff and students at Victoria University of Wellington learn the most important lesson of all: Keep your files backed up

Re: No....not 3.....but 4......

You have to test and check. Verify that, when it says everything, it's actually everything. That catches you if you misconfigured it once or it didn't back up a file because it wasn't unavailable. Verify that, when you restore, it actually restores. That catches you against a corrupted file that broke something. Verify that, when you want to restore and you don't have stuff, you can. That catches you in the case that the software needed for restoring is unavailable or doesn't work, for example it requires a network connection, license key, or dependency which you didn't have before but now will. This is part of using proper software in a proper way.

What could possibly go wrong? Sublet your home broadband to strangers who totally won't commit crimes

Re: Sounds “interesting”

I didn't have that because I was using my own equipment and not about to change it. Also, that's limited to customers of that ISP, which I didn't want to do. Basically, I anticipated that my neighbors could use it if their connection broke but mine didn't. Or someone else who was in the area and needed to connect. I also doubt there'd be that much risk of abuse since it would only be available relatively close to the access point, but I decided that if things did go wrong, they would go horribly wrong and I didn't like that idea. I mentioned to a neighbor that they could have the password if ever it became useful and gave up on the rest of the idea.

Re: Sounds “interesting”

"I once knew someone who left their wifi completely open (was a few years ago) so anyone could access it. Know I don’t know why unless he planned on hacking everyone who connected...."

I once considered doing that basically as a service. I already had a guest network set up which couldn't see my normal network, had bandwidth limits, and could support automatic cutoffs if I wanted them. I was thinking that I had a reasonable connection rate, never got near a bandwidth where they'd reduce my speeds, and therefore wouldn't mind letting others in WiFi range use it if they needed to move some data. Then I considered what would happen if the police showed up for information on a user, which I wouldn't have, and decided that my technical knowledge meant the lack of logs proved I was erasing them. So I didn't. Still, my idea to do it was basically altruistic.

Trail of Bits security peeps emit tool to weaponize Python's insecure pickle files to hopefully now get everyone's attention

Re: A fly in an ice cube in a microwave.

It usually comes down to laziness. There's probably harmless laziness, like using pickle to automatically serialize something because you don't want to write the thing which converts it to XML or JSON or something. Then there's harmful laziness, where people pickle code just because that makes it easier to import without giving people the actual code.

What people receiving such models should keep in mind is that they're getting binaries, and those binaries should be treated with the same mistrust as a more typical one. If you wouldn't run an executable from these people, maybe don't run their different-format executable just because it takes a few more steps to execute.

Re: pwned by default

Not exactly. Just unpickling one can't run code. It can produce an object that is runnable. It should be treated like anything that can be executed, but not like something which automatically executes. It's one level below a document which can run data just by opening it.