Posts by doublelayer

Trail of Bits security peeps emit tool to weaponize Python's insecure pickle files to hopefully now get everyone's attention

I'm not seeing it in the article. It runs in a sandbox, perhaps though I'm guessing, but the problem with malicious code is that it's run in the first place. It's not hard to put untrusted pickles in a sandbox, but if you don't or they can do whatever they want to do from in there, it hasn't fixed anything. The best way to handle this is to create a restricted language which can be serialized and runs only in an interpreter which has no OS access. It only does math and has no hooks elsewhere. That would work, but nobody would end up using it because people who so far don't have any problem unpickling random things and running them aren't going to go to extra effort for provable security, especially if it means not using one of the libraries they're used to.

Re: pwned by default

This is correct. Pickles are just serialized objects. And that means basically any object. If you pickle a function, then it unpickles into runnable code. If you're not careful what you do with it, you could run it. For ML models, this can end up being the intent; you just load your preprocessor, run it, then run the model. If the attacker submits a preprocessor function which does other things, you don't know what it's going to do and should protect yourself or not run it at all. The same issue occurs everywhere where you can serialize something which can execute. Unless you're careful about using it later, you could end up executing something malicious.

What happens when your massive text-generating neural net starts spitting out people's phone numbers? If you're OpenAI, you create a filter

Re: So much for "AI"

The problem is that a random number generator can produce valid or invalid numbers and, even if it produced a valid number, it has no idea what it is for. This has collected a bunch of real numbers and starts handing them out. Admittedly, it's not malicious about doing it, because it just hands out real numbers whenever they're tangentially connected, but it's not just random strings of digits which happen to be callable. If I run a random number generator to produce a number that looks like a credit card number, the chances are incredibly high that it will not work. If I collect real credit card numbers, the chances that at least one of them will work is significant. That is the important difference.

Re: A little idea

I did read that. I didn't care. It needs to read real phone numbers to learn what a phone number's like? Two solutions. First, replace all phone numbers with a tag indicating it's a phone number, but without the content. If you're afraid that your code is so bad that it will read a single [phone_number] over and over and weight it too heavily, append a random number so it will see them as different. Second option: don't bother. Why does the AI need to know about phone numbers? It shouldn't be printing them. Phone numbers should only be printed if they go to people who are supposed to be contacted, which means they should be provided manually. Otherwise, it's actually doing a worse job at its task because it is including not just information which is irrelevant, but information which is actively wrong. I think those are reasonable options for handling the phone number problem.

A little idea

In case OpenAI is listening, I have had a brainwave that might be a little handy. Your engineers are busy writing some software to scan output for phone numbers? Then the software will remove that output so people don't see it? I think it might work pretty well if you reversed this process and applied that filter to, you know, the input. So the big blob doesn't have phone numbers in it. That way, it would only generate numbers by randomly adding digits, which is much less likely to be a valid number and wouldn't be able to associate it with other information. In fact, while we're having brainwaves, maybe it's not so useful to give it the option to randomly spit out digits; we already have random number generators thank you, and they only give us numbers when asked.

Any chance OpenAI is looking for a chief sanity officer? I'd apply as long as they don't prevent me from working another job simultaneously. I think I might need a backup job when the data protection authorities come along.

Apple accused of unfairly banishing Watch keyboard app for the visually impaired from its software souk

Re: Apple aren't one for banishing people only to pick them up later at a discount

Some of your points are characteristic of Apple, but others, while logical, aren't necessarily used.

"I'd guess that most countries have at least some legal impediments around driving the value of a potential acquisition into the ground; if nothing else, there's a definite overlap with the kind of predatory behaviour which anti-monopoly laws are meant to address."

It is not clear. Using a monopoly decision to do that is illegal. But there are many other methods which are not illegal. There is a certain amount of activity which gets dismissed as "bargaining well for a better price" and therefore accepted. In this particular case, the app team have a reasonably good case because Apple abused its monopoly position, but that would work as well if Apple didn't want to acquire them. I.E. it's only Apple's App Store monopoly which makes that happen rather than another law.

"The first is that if the acquisition has value to you, then it presumably has value to other people/companies. So if you do drive the price down, the odds are good that someone else will step in and buy it at a higher price."

Good point, although it doesn't apply much for this example. The app in question works on phones and watches, but there are lots of keyboards for phones. The IP in question is for their watch app, as their phone app is still permitted on the App Store. There are only three smartwatch platforms with enough functionality to make use of a keyboard with the multitouch and processing requirement of this keyboard. Apple is by far the largest. Samsung's platform is believed to be dying. So the only other purchaser is Google, whose platform is also not in great health. Given that Apple has the most users and that the app doesn't run on Android at this stage, they're by far the most likely to buy it.

"Another point is that by driving the value down, there's a risk that you'll lose the things which made the acquisition valuable. E.g. the target may sell off some of their assets to stay solvent, or lay off people with the domain knowledge needed to make the acquisition valuable."

Again, not a bad point but it doesn't apply in this case. The tech is a single application, although some of its functionality is open source released by another developer. The staff is two people. Not all that much they can do except try or give up.

"And if it becomes known that you're responsible for driving down the value, then people may choose to leave the target of their own accord rather than working for you."

I doubt that's a factor for most acquisitions. Apple can hire new developers to understand and develop a codebase. What they need most is the code that already works and the rights to any patents involved. It's a bigger problem when there are lots of people and the acquirer wants to keep that running, but for something IP-based like this, not as much.

Your final point about PR problems is good and applies.

'Business folk often don't understand what developers do...' Twilio boss on the chasm that holds companies back

Re: Bottom line.

It's not humanities which are at the root of the problem, and I see no comments which suggest it is. Check most people who manage without understanding. They're often not humanities people. Nor is management necessarily a problem. They have a role to play which is important, and without them, there is more chaos. What is the problem is that management is more often able to exceed their role and cause issues because they have more power.

I posted on this topic a while ago. I noted there that it's not just engineering that needs this consultation. The discussion here has mostly been about engineering since A) most of us are engineering people (software included, please let's skip the linguistic discussion this time) and B) the article was about engineering. The general sentiment applies to any work where there is someone making the product and someone managing them. That product may be a technical one requiring hard science, or a legal one requiring lawyers (a lot of whom are humanities people), or an artistic one, or literally anything. The problems and suggestions apply equally well to them all.

Re: Bottom line.

In general, developers know what is possible better than do the marketing and management sides. Not always, but when the product is technical, yes. For the same reason, if your product was carpentry, you might want to include the people who know whether something's feasible or easy to build when deciding what products to advertise or which contracts to use. If your product had legal consequences, you might want to have the lawyers review what you were planning before you publicize it. The expertise in actually building the thing needs to be consulted before making management decisions, with the management responsible for coordinating actions afterward.

Take a program someone suggested I write a while ago. They had seen that passwords were a problem, both simple-to-guess ones and reused ones. They thought it would be a great idea to write a program which could go through a network, check the passwords in use for strength, verify that they weren't reused on other services, etc. They thought this was a relatively easy thing to do and they could sell it to lots of places if we could just write it up quickly. Since I was interested in security and could write code, how would I like to be the lead [only] developer on the project? Fortunately, they hadn't already marketed this, because they found it a little disheartening when I described how salting and hashing meant it was basically impossible to do the first thing on any proper system, that salting and hashing were more important fixes than verification on any improper system, and that checking against other services would be at best a profound breach of privacy. If they had tried to promise things before, they would have been stuck with a promise to produce an impossible project.

UBports community delivers 'second-largest release of Ubuntu Touch ever'

Re: Why not fork Android + make it a shell

Primarily, because they want a more controllable thing. If they fork Android, they can do a port without changing much, like the various semipopular custom distributions, which wouldn't make you happy since the Android UI hasn't been changed. That is the option which keeps most app compatibility, but you have to live with Android's UI.

Or they could do what you ask, keep some of Android, but do a bunch of work to make the UI different. Result: some Android apps wouldn't work because the UI's too different, so now they have to do extra work to emulate the old structure so things aren't broken. In the meantime, they have to work with other problems in Android which they might want to fix. For example, Android's handling of external storage devices which isn't the clearest or easiest to manage. People who are used to the old Android interface may not recognize this one either, meaning more complaints about how they don't like the UI choices made. Meanwhile, Google keeps developing new Android things and, if this fork is to stay up to date, the devs have to keep backporting the Google updates which are important. That's a full-time job for several developers even when few changes have been made; doing it with a very different fork is intensive.

For people willing to do some of this work, they're probably not that happy with half-measures. If you're going to change a lot of things in Android, why not give a full Linux-style interface a go? If you want to solve Android's storage thing, you could do a bunch of work on Android itself or just run more typical Linux userland software which already knows how to manage that. This also lets you develop things without having to worry about Google changing Android in such a way that it's hard to integrate again.

Alibaba Cloud quietly tests desktops-as-a-service

Re: Two whole gigabytes?

The point is that, to use these, you already have to pay the electricity for most of the parts. All the peripherals including the displays, but also something capable of doing the computing work of establishing the connection and driving the peripherals. That's likely to be a full computer capable of working locally. If it is, it probably has specs superior to the lower tier of possible VMs just on its own. So you could pay for the electricity to run it yourself or you could pay for the electricity to run it and also for a remote VM which is no more powerful than it.

Two whole gigabytes?

I note the office A configuration has a single virtual CPU core, likely shared with others and 2GB of RAM. Now we probably can survive just fine on the specs of a cheap laptop in 2009, but I'm not sure how likely people are to pay for that. Especially if that configuration ends up running Windows, where it will not be very fun. Even Office B only takes that up to two cores and 4GB RAM. That's serviceable, but there will be complaints. You have to go up to "Advanced Office -" to get the specs we all expect from machine purchases, and I'm guessing the "advanced" means the price is quite a bit higher.

I sort of see the point of doing this for higher-spec VMs, but how likely are people to create a bunch of basic desktops which users are accessing from similarly-specced local computers. Sorry Alibaba, you missed March 2020 where people urgently needed remote work machines and might have set up VMs so people could access work stuff from their personal machines. Now, people have either purchased laptops for those who didn't have them, used remote desktop from a personal computer onto a work desktop, or decided not to care about mixing work and personal.

Google fails to neutralize lawsuit that complains Chrome's incognito mode isn't very private at all

Re: when the win finally comes.....

Probably not. They'll likely try to buy off the people bringing the suit. If they succeed, that moves anything down a year at least. Let's assume either this one or another one wins against them. What will happen then is they will update the terms of service to include a bit of new legalese and continue as normal. Like what happened with GDPR. They're clearly collecting stuff and they're not in compliance, but the various data protection authorities aren't doing anything. Unless somebody actually brings out a big fine, they won't do anything. The fines from small or class-action lawsuits are not sufficient for the purpose because the lawsuits are always run by lawyers who want a payoff rather than to see change.

US govt indicted me because I make privacy tools, says crypto-chat app CEO accused of helping drug smugglers

Re: So tomorrow Signal, Telegram?

"Does WhatsApp use strong encryption? By strong encryption I mean the US Government's definition of strong encryption. Not yours."

Yes.

"Is WhatsApp purposely designed with intent of evading detection of criminal activity by a US Law Enforcement Agency?"

No. Is Signal? No. Was this? Hard to tell, but they'd need to prove it, you know. You can't just say "Criminals use it, therefore it was designed for them." You actually have to prove a statement like that.

'No' does not mean 'yes'... unless you are a scriptwriter for software user interfaces

Re: Modals

Of course, but that's just failing to do the UI work. If they left out the save button, I'd have a similar problem. Bugs will break stuff until they're fixed. Meanwhile, it's not hard to test modals to make sure that's not been missed.

Re: Yes/No/Cancel

"Better still would be to ban modal dialogs outright, and force designers to come up with a UI that doesn’t need them to interrupt you to ask stupid questions in the first place…"

Please no. What you get when you do that too much is a bunch of important questions or information hidden away. Modals are really useful in the case of warnings. I was using a new program recently and ran the export function. Fortunately, I got a modal informing me that, unless the program was mistaken, I was about to export a project file which contained several subregions that hadn't been attached anywhere, so basically I'd get a mostly blank result. Did I really want that? If modals were forbidden, where would that information show up? Probably a tiny button on the toolbar next to all the other tiny buttons saying something about warnings. Given that the export phase of this could take an hour and that testing the result is long and I might skip it, I'm quite glad it warned me before I exported. You might point out that, now I know about this, I won't do it again and I don't need the warning, but I kept it turned on because I might do that again by mistake and it always helps to get told about it.

Re: when to use the word "fewer" instead of the word "less"

Greater, probably, if they're using something abstract. Of course, if we analyze this too much we'll find out that "more" works just fine for both situations where the number increases and that "less" could serve for both where it decreases if we surpressed our doesn't-look-right instinct for a month or two.

Asahi's plan for Linux on Apple's new silicon shows Cupertino has gone back to basics with iOS booting

Re: There one law for Apple and ...

I disagree on most points.

"Well the very first response was questioning the sanity of anyone wanting to run anything other than MacOS."

No, it was questioning the sanity of buying a Mac to run Linux on. You can choose to view that as "only run Mac OS", a clear Apple fan, or "don't bother buying Macs", a clear detractor. Given that the comment also advocates ignoring Apple and building your own machine to run Linux, doesn't seem that one-sided to me.

"Then someone chipped in Apple is so big they're their own standard."

I'm not reading that as an Apple fan either. They're saying that Apple doesn't have to adhere to standards for business reasons, so it's unlikely they'll opt to do something in an open and standard way because they have market power.

"It doesn't really matter about numbers for or against. It's just that if any other company did this sort of thing there would be an almighty outcry."

Disagree. Basically every Android OEM has done this already. There was some annoyance and people circumventing it, but we don't think it's a conspiracy. We just don't like it. To some extent, it might be more muted with Apple just because we've come to expect it. They've always been less than thrilled with people messing with their products. They've locked down their mobile devices, soldered in everything on their computers, and have the only modern OS you can't run on something else (well, legally at least and it's hard). We're perhaps not surprised when they do something and it's not completely open.

Re: There one law for Apple and ...

I would agree with this sentiment if it actually held true. The problem is that there are relatively few Apple apologists here. The comments I'm seeing mostly either fall into the categories "Apple should have opened this more" or "Apple isn't going to open this more". How are either of those supportive of Apple's move? The "Apple won't open it more" people haven't said they're keeping things closed for our benefit, which is the most obvious Apple apology you could come up with. In fact, the most supportive comment I've seen so far basically says Apple won't bother because it won't add many customers, which seems only slightly supportive of their move.

Re: Serious questions

"1. Why would anyone spend the kind of money necessary to buy one of the M1 Macs and then nuke the warranty by erasing the drive and installing a Linux?"

They might like Mac OS for some things, need native Linux for others, and want to have the ability to use one machine to do them both. If it turns out to be impossible, they'll deal with it then. Might as well try first before giving up.

"2. Related to above... given the limited disk [...] is there a way to create a separate Linux partition and install a bootloader of some type so that users could dual-boot Linux and macOS?"

Probably. If they can get Linux booting, they can also port a different boot system which can present a menu and launch each OS. More work certainly, but not more difficult work unless Mac OS has been written to break it deliberately.

"3. Wouldn't it be better to run a Linux in a VM?"

I wonder how well the VM hosts will work. If they're emulating X64 Linux, it will slow down quite a lot (Rosetta 2 isn't going to convert the entire VM to ARM-native) and stop working when Apple pulls Rosetta. Given they are already pulling it for unspecified reasons, it likely doesn't have a long life. If the VM hosts are now going to run ARM builds, that's nicer but most of them were not able to run them at all previously so expect bugs for a long time. Also, there are cases where native performance or access to hardware is necessary, and some may prefer to avoid a VM for that reason.

"4. What will they do when Apple changes the (undocumented) boot system, which I'm absolutely certain they will?"

Shout in annoyance. Then some of them will start reverse-engineering the new one and the others will curse Apple and run Linux on something else. Eventually, if Apple does it enough, there will be relatively few people willing to put up with it anymore and the prospect of actually running Linux on an ARM Mac might die. It mostly depends how often Apple does that.

Why yes, I'll take that commendation for fixing the thing I broke

Re: Change control is good - when it is properly controlled

"If the client software can't handle a disconnection, then it's not enterprise grade anyway (My reasoning on this: once you start using resiliant/distributed databases, server switches will cause client drops anyway."

I think this reasoning is flawed. If your database gets transferred to a different node in a distributed database, you'll lose connection very briefly because your new node is already available even if the previous one isn't. A simple DB down, retry, connect, and the system recovers. At worst, the client has to store a log of the stuff the previous node might or might not have done to check, not as bad if the operations are idempotent.

When the database isn't distributed, that doesn't happen. The DB down happens, but the retry doesn't immediately turn up an alternative. What should the client do? This could be the database went down. Or the network went down. Or the network cable came loose from the computer and the connection isn't going to get fixed until the user puts it back. The client can easily cache the operation the user wanted to perform and have it ready to resume when the database comes back, but depending on what happened, that might not be a good option. If it was a problem at the user's end and nothing happened for an hour while it got fixed, repeating an hour-old operation might be a problem if other data has changed in the meantime. The client has to do something, and it's unlikely it can guess at the users' intent all of the time. Best in those cases to just tell them the database can't be reached, invite to troubleshoot, and not to start doing things automatically when it comes back. As long as it doesn't crash, I don't think it's fragile.

We can't avoid it any longer. Here's a story about the NFT mania... aka someone bought a JPEG for $69m in Ether

Re: What is this

It doesn't have to. You want to see it, you can go to the website where it's published and look all you like. You want to keep a copy? Just save image. No need to pirate it when it's already free.

Well, on the bright side, we basically just did. Some rich person was willing to buy something worthless for a bunch of cash. The sale would incur taxes. Then the auction house paid the artist a chunk of that. That is his income, so it too gets taxed. The auction house took another chunk as revenue, which increases their profit. So they'll be taxed on that profit soon. And, if the rich person decides to sell again, that's a capital gain and gets taxed as well. I mean it's still really pointless that anyone wanted it, but we did get tax revenue from it.

Re: It just goes to show ...

"Except the seller will have to pay taxes on it, and the transaction is a matter of public record, which kind of defeats two of the main purposes of money laundering."

What? Those are the exact purposes of money laundering. The problem faced by criminals wishing to launder money is that they have some, but they don't have an explanation of how they came by it. If they make a purchase with it, the tax authorities will become curious how they managed that and why none of the money came to the government. The criminal therefore can't buy the expensive stuff they want.

Laundering that money means it is now known to the legal system and can be used without triggering alarms. In order to do that, they do have to pay taxes on it, but they also have to have an explanation for the tax man. If they claimed they just got paid millions by a friend, the tax authorities are going to be suspicious and investigate it. So in order to launder money correctly, a criminal wants a transaction that looks completely legitimate and passes a tax audit. Taxes and public record are required features of the system.

Re: What is this

But you don't own the copyright. What you own is a number which identifies you as an owner of a right to a file which others have a right to, but your right has a serial number and you can sell it. It does not mean you have the ability to deny access to others. Most resources with an NFT attached are already available publicly by design.

Re: I Have This Rock

Here's what you do:

1. Keep doing the same thing you were going to do with the rock. People don't want old-fashioned physical things they might do something with. You're going for digital.

2. After taking the photos, keep them. These are what you will sell.

3. Download SQLite. Your computer can handle that.

4. Run the following query: "CREATE TABLE ROCKCHAIN (photoname text, owner text);".

5. Get your photos auctioned. Publish them first so that everyone can see or copy them for free.

6. When each photo sells, update your database table.

7. When all photos have sold, hash the database and publish the hash.

8. Yes, that's not a blockchain, but nobody cares really. As a bonus, you can also publish a blob of text that says something about a blockchain and people will give up and assume you did it right.

9. Enjoy the cash.

Re: Say what you will...

Nothing's wrong with the art. He may be quite a good artist. He's also a smart artist; he realized that if he put existing art in a grid, someone would pay him millions for that. All credit goes to him. The person I don't understand is the one who chose to buy it.

Re: Outrageous!

I don't see anyone getting really angry here. I mostly see people laughing, saying the buyers are wasting their money, etc. You can do lots of things I think are stupid without incurring my outrage, and it looks like most comments here agree.

Re: Dumber than a rock?

I'm not sure about this one, but in most of the other NFTs sold recently, they don't own the copyright, they may not be the only owner of a token for it (the number is public though), and the image they "own" is also available for free. But they're one of the few people with a signature saying it's theirs, and that is what counts. It reminds me of the people who take money in order to name a celestial object or even assert ownership over it, but all that actually happens is that the new name or ownership claim is entered into a database unrecognized by anyone else. The only smart thing to do in this environment is to find some junk and see if someone will be convinced that, since there's only one of it, it must be a valuable investment and they're more than happy to hand you a pile of cash for it.

Re: What is this

A relatively good point, but the original Mona Lisa is valuable both for its artistic value and for the fact that museums get people to come look at it and pay for the privilege. Since an exact copy of this image and most of the other NFT-backed data is available for free, there's no value as an exhibit. The owners of the tokens have to hope that others will continue to care about the ownership rights to something they can get for free. But then again, I would never want to purchase the original Mona Lisa, even if I had infinite money available, so I'm the wrong person to argue for this.

License to thrill: Ahead of v13.0, the FreeBSD team talks about Linux and the completed toolchain project that changes everything

Re: @bombastic bob - Says it all

As I've said in previous comments, this is not a reason we have to care about. I'm merely illustrating that there can be a reason for a company to avoid GPLed code that is not purely profit-seeking anti-user stuff. This is not my problem, nor should it be yours. Companies can make whatever decisions they want to just as we who write the source can. I just think it's worth it to keep in mind the actual results of a license decision like this one so that decisions can be made with real-world effects in mind.

I said: "If you use a GPL3 library somewhere, they have to be able to replace it somehow"

You said: "Err, where does it say that ?"

From section 6 of the GPL version 3:

"If you convey an object code work under this section in, or with, or specifically for use in, a User Product [...] the Corresponding Source conveyed under this section must be accompanied by the Installation Information."

And above that is the definition of that:

"'Installation Information' for a User Product means any methods, procedures, authorization keys, or other information required to install and execute modified versions of a covered work in that User Product from a modified version of its Corresponding Source. The information must suffice to ensure that the continued functioning of the modified object code is in no case prevented or interfered with solely because modification has been made."

Which means that, if the software can be modified, the user must have the ability to modify it. Which, except for a few rare cases, is all products. There is an exception for a product where it's impossible, like ROM, but pretty much every product uses software which theoretically can be updated and in that case, they have to make it possible for a user to update it themselves. Again, I like this because I quite enjoy hacking my stuff, but companies have reasons not to want to give that access out other than wanting to lock out the users.

Re: @bombastic bob - Says it all

I'm not following your disagreement. If you use a GPL3 library somewhere, they have to be able to replace it somehow. If you make the system such that, if they put a file in that is not identical, it breaks, then you have not complied with that requirement. Therefore, you must accept a version of the library which does not break the system. If they supply a modified version which crashes itself, that's not your problem, but if the one they provide runs, then you must accept it.

Which means that the library could be replaced by one giving the user effective access to the system with the privileges of the original library. This is one reason I'm all in favor of people using GPL3 libraries, because I can write a replacement and use it to gain relatively unrestricted access to the underlying system. I like doing that. I got a library to open a network port and run a telnet server to a root shell, for example. The manufacturer I described above is not as keen on my doing that for reasons I've explained.

Now theoretically, the manufacturer could take steps to prevent a replaced library doing anything by isolating it in an environment without privileges. So if a company really wanted to, they could do that. However, that takes a lot of work and slows down the program as it sends data in and out of a sandbox for the GPL3 stuff. That's why few companies ever do it. They either just don't use the GPL3 libraries at all or they use them without giving access and thumb their nose at those of us who know they're violating the license.

Re: @bombastic bob - Says it all

I have to admit there's a point there. Not that it is anyone else's problem, but there are times where allowing a user access to something may make it harder to produce a good product. Here's an example. I was looking at a product (made by others, I don't get any blame or credit for this just so you know) which used a proprietary library to interpret images. I know of an open source library that is useful for the same purpose and, in fact, has a few features theirs didn't have. What would be really nice is to include both libraries so the users can use features from each. However, the open-source library is GPL3, so if they used it, they would have to make it possible to replace that library without breaking the system.

If they did that, I as a user wouldn't object. The provider of that proprietary library, however, probably would as they extracted license fees from the manufacturer. Allowing user-provided code access to the system means the users would have access to the binary of the proprietary code and may also have been able to extract the license information. So the company didn't include the open source library. Before you ask, the open source library, while having some nice features, didn't have some of the core ones so a device using only that would not have been fit for purpose.

This is not a problem anyone else has to care about, but there are reasons companies might avoid GPL3 other than "I want to extract money and give nothing back". They may have to where open source lacks the features of proprietary and their users value a good product over access to the code.

Huawei CFO's legal eagles take HSBC to court in Hong Kong to obtain evidence against US extradition

Re: Sanctions are messy, politics is worse.

You are broadly correct, but the courts in Canada have also had to resolve claims by her lawyers that the crimes were invalid under Canadian law. These disputes have at times involved discussions of what fraud is, whether sanctions apply in multiple countries, and the like. Some of these discussions have indeed handled questions of culpability if she is found guilty, and thus the intent I described. When such claims were made, Canadian courts have decided that it is a crime to make fraudulent claims about sanction compliance, which is why she is still hinging her defense on procedural issues. Your description about what those are is quite good.

Re: Sanctions are messy, politics is worse.

Some of your facts are not exactly correct.

"a) a "Crime" that is only such because America has unilaterally decided it is, followed after some delay by its Allies."

In a way, but this is not unusual. It is not a crime for you to do business with Iran if you're outside the U.S., but if you are in the U.S., then it is. This is acceptable because the U.S.'s laws are set by politicians, and voters can replace those politicians if they disagree. You could therefore make it not a crime anymore by voting in others. Huawei is involved because they were selling their plan to a bank which operates in the U.S. and therefore chooses to follow U.S. laws.

"b) a Person being held directly responsible for that "crime" rather than the Corporate Entity itself."

This isn't the case. The reason Meng (and it's Meng, not Meg) is being charged is that there was a person making the claims to the bank which the U.S. claims are fraudulent, and it was her. The company may have directed her to do it, but she actually stood up and said the things which would be a crime if proven.

"There seems to be very little requirement to prove intent or harm by Meg herself"

The courts in Canada and the U.S. have been trying to do that. They have already had to deal with questions of intent, and her lawyers have tried to prove that she didn't have ill intent. They have so far failed to do that and are therefore more likely to get the request denied by pointing to procedural problems.

"and very little to be gained by holding her responsible for the actions of her company, which has already had its business model crushed by Sanctions itself."

The former part has already been contested above, and the latter part is unrelated. The sanctions against Huawei in particular are related to a different allegation, and one which in my opinion is much weaker. The point of the fraud case is to prevent fraud. The point of the sanction on Huawei is either to protect Americans from dangerous Huawei equipment (if you believe the drafters) or to gain an advantage in a trade war (what I think). Therefore, the fraud case can be legitimate while the sanctions could be unwarranted.

ZIPX files that aren't: Keep a weather eye out for disguised malware in email attachments

Re: Any word on the vulnerable version of 7Zip?

It doesn't sound like 7zip has a problem. It saw an archive and extracted files from it. It doesn't sound like it ran them. The same feature that lets you run it on an arbitrary file and it will try to find any archives inside it allowed an incorrectly-named archive file to be extracted anyway.

Re: There was almost a standard here

From Wikipedia:

"WinZip, starting with version 12.1, uses the extension .zipx for ZIP files that use compression methods newer than DEFLATE; specifically, methods BZip, LZMA, PPMd, Jpeg and Wavpack. The last 2 are applied to appropriate file types when "Best method" compression is selected.[27][28]". It doesn't explain how clicking on that executed an autoextractor, but maybe I'm overthinking it and people actually did decompress it with a compatible archive program and manually launched the files within. It's a little weird how many people will go to rather extreme lengths to execute code that is so suspicious. Last year, El Reg posted an article describing a partially successful campaign requiring users to download a RAR file and then decrypt it just to open a PDF, which some people in engineering fields actually did.

Huge if true: If you show people articles saying that Firefox is faster than Chrome, they'll believe it

"With Palemoon I can at least choose DuckDuckGo or whatever as the search engine it sends it to. So far I haven't succeeded with FF although I haven't tried hard because I can mostly avoid it."

And

"it's admittedly not as easy to change those settings as one might like."

Really? Here's how you do it. Tools -> Options -> Search category -> Default search engine. And right next to it, the settings about the address bar. A total of five clicks. How is that hard? Some settings are buried. These are really easy to find.

Re: Speed means nothing

"Is browser speed significant when all you are trying to do is click on all the squares with a mosquito in them?"

Of course. You see, if you run the captcha system and slow it down or even break it from time to time when it runs on the browsers you don't make, then you either drive people to your browser where you can collect all their data or at least you get more captchas done which means more free training for the AI department. Just be careful not to break it too much so you remain the primary captcha provider for lots of sites which have an email address field you can scrape.

Huawei's first desktop PC to be sold outside China is a sleek business machine with optional 'smart' keyboard

Re: "like your favourite coffee table book."

Why do they do this? I thought that phrase was trying to talk about the size of the machine, but if it is, it's not doing it well. It's not at all similar in dimensions to either a coffee table or a book. More importantly, I know a lot of Chinese people who speak English really well. It can't be hard to find at least one person who understands how to write naturally. Especially as, if they run out of candidates in China's 1.3 billion options, they can always use some of their money to hire a person fluent in both languages from many other countries. Proper translation for a marketing release would be very cheap since it's usually at most six paragraphs and a spec list. And yet a lot of large Chinese companies (other countries do it too but usually not as crazily) have descriptions that don't make any sense.

Privacy purists prickle at T-Mobile US plan to proffer people's personal web, app pursuits to ad promoters

CCPA time?

T-Mobile clearly does business in California and has enough customers and revenue to hit the limits specified in the CCPA. For anyone having an account with them and living in California, now is the time to prepare the requests and complaints to fire at them. Maybe the enforcement of CCPA will end up working better than has the enforcement of GDPR. I won't hold my breath, though.

As battle for future of .UK's Nominet draws closer, non-exec director hits a nerve with for-profit proposal

Re: To: [e-mail]

It's never too early to transfer a domain. As long as it's before your renewal period, you can transfer to someone else. I just did it, though more because the registrar in question was annoying me than their yet unannounced stance on this motion. I moved it to a supporter of the campaign. By the way, you can see a list of the supporters on the publicbenefit.uk site. There are 413 of them, but at least that's a starting point for choosing a new provider.

Remember that day in 2020 when you were asked to get the business working from home – by tomorrow?

Re: Hats off

That's fair, but still, it's not all that different. It wasn't unusual at that time to have a house with multiple people working, but it was typical to have a single phone line. If the companies required remote access at all, there'd be contention between the people as they used it to use any networked services and the inevitable meetings, which would have to be a conference call. They might not have to be using it constantly, but I'm guessing there would be many collisions unless the companies could provide extra lines.

Meanwhile, a lot of the things that weren't done with network services wouldn't be feasible anymore. If you could go to a filing cabinet to find a paper record in the office, it wasn't pressing to digitize that. If the workers are all at home, it would have to be digitized if either more than one person needed access to it or the contents were private enough that the one person who did need it shouldn't take it home.

You're right that I'm young enough not to have experienced that myself, but I think at least some of these statements aren't missing the point too much.

Re: Hats off

I think most of your reasons are good ones to prove it would have been a disaster. In 2020, we mostly have internet links which can take multiple users and run multiple simultaneous services. Imagine a family with two working parents trying to get work done using a single modem. Even if you could get extra lines out there, it would be hideously expensive and require a bunch of extra provisioning. Compared to a bunch of helpdesk tickets which say "move closer to the access point and use ethernet if you have the option", it's a lot more work.

The paper issue is important too. We have a lot of stuff digitized now, which means extra work for IT, but also means we can go home without having a problem getting information to people. If we still had a bunch of paper, a lot of the workers would either need to digitize it themselves or to have a scanner and printer at each home. 90s scanners were big and inefficient, so that would have been a mess.

End is nigh for iMac Pro as Apple stops offering custom configs of high-spec desktop

Re: M1x, discrete graphics, expandable memory - maybe not.

Yes, it is. I wouldn't be surprised if they implement an ability to support slower external memory, but they're going to have to work a bit for GPU support. I'm imagining an M2 with 32 GB of memory inside it for fast access but with lanes allowing more standard memory to serve as additional but slower resource. At least that's what I would probably end up doing. Let's see if they even bother. I mean they tried putting all of this in a very difficult to repair iMac, so they might not want to go to that effort just for the people who want to repair stuff.

Re: 5,1?

Apple has a variety of naming mechanisms which they apply to their hardware. One of them is a version number system which does use commas. Thus, the M1 Mac mini is known as Macmini9,1. Or A2348 or a variety of numbers which look like MGNR3LL/A which are different depending on what specs you chose.

Hacking is not a crime – and the media should stop using 'hacker' as a pejorative

Re: I'll bite. You should be in jail.

That's not what normally happens, nor is it a problem in my mind.

"Then blackmail the company "we found a hack, pay us to fix it", which is extortion."

That is not extortion. Now there are people who will do the extortion, which looks like "We found a hack, pay us or we'll use it", but there are many who won't do that. Those who do not use it aren't committing a crime unless they have done so to find the hack in the first place.

"Or how they find holes in things, and go on to document the hole, and sell the fix, and again, describe themselves as the "good guy"."

In this case, they are probably the good guy. If your thing is flawed, and you're selling it, you are the bad guy because you're selling something shoddy and putting your customers at risk. A worse guy could come along and abuse your shoddy thing to deliberately cause harm. Someone who identifies where you failed is protecting themselves and others. As long as they don't do something to your systems to figure it out, then they haven't done anything wrong. Probing your system is a grey area. Actively entering them without permission is wrong. Reading the client-side code you sent, testing a product they purchased from you using their own systems, or entering information into fields you have sent them to enter information in are perfectly normal things they have the right to do. If they find a problem, they may try to sell a fix to you. You are under no obligation to buy it. You could find it yourself and fix it. You could have done that before you sold it too. Quite often, the ethical security researchers wait until either you have fixed the problem or you have indicated you're not going to bother before they disclose. If it's the former, then you're patched and have no problem. If it's the latter, it's a fair warning that all us customers want to know before we give money to someone who builds dangerous products and refuses to fix them.

Redditor thinks they have a solution to Surface Laptop 3's overheating issues: Elastic bands and USB fans

Or, for half the price

People already built that into a product. Basically a USB-powered array of fans on which a laptop can be placed. They're pretty cheap. I recently gave one to a friend who insists on running unnecessarily inefficient Excel formulas that run so long that the computer gets heat warnings. Although I have to admit some of the blame goes to Dell who decided to put only one ventilation grill on the laptop and put it on the bottom surface.

A lot of manufacturers would be well-served by investigating what happens when their computers run at full power for an hour straight. Heat management is important not only for hardware longevity but also for performance. The latter can be important to their marketing. The former may not matter too much to them but does correlate with warranty claims.

The 40-Year-Old Version: ZX81's sleek plastic case shows no sign of middle-aged spread

Re: ZX81 option for Raspberry PI?

I hadn't thought of that, but now you've mentioned it, I want it. Especially if the Pi can be shut down and restarted by the RP2040. The most limiting factor of the Pi for me is the power consumption, meaning I can't run them off batteries for a long-term project. Having a low-power coprocessor which could run some native code which could invoke the boot process and spin up Linux whenever I need something more complex could be really nice.

I haven't bought new pants for years, why do I have to keep buying new PCs?

Re: When you say "pants",

"Back on topic in a vague sort of way: would links and something like alpine have run under DOS on a 286? or were they just too advanced. Was there a tcp/ip stack even?"

Links wasn't released until 1999, so that likely wasn't an option. According to the Wikipedia page, Lynx (not the same thing) was ported to DOS in 1994. So that probably would work except it doesn't do anything graphical. I suppose that's an option, but which would you rather do: convince a relative to buy a newer computer or endure their complaints about how the internet keeps telling them they can see pictures but all they see is text (with the bonus feature of complaining that their 286 also can't run [insert other possible software])?

Re: One thing people tend to forget about FOSS.

The point is that code can become dead if things outside of it break. Just saying "duplicate everything" doesn't necessarily change that fact since not everything exists to be duplicated. For example, I know what the CPU in this embedded thing was like, at least I know the specific type of ARM and the manufacturer. I have no clue what kind of networking chip they used but maybe I could find it somewhere, and if I could find it, I don't have one. You might, but in twenty years you probably would not. It's not critical to me that I emulate this successfully, so this isn't a big problem. I'm mostly planning to hack out some parts and rewrite the rest.

At some point, Windows won't be used anymore. You could still duplicate the hardware and run it just fine though. At that point, the code would have gone out of copyright and even if Microsoft died really fast and it hadn't expired yet, there'd be no Microsoft to defend it. I would still call it dead though, because it likely wouldn't run on modern hardware anymore. The same can apply to FOSS, and therefore I think it too can die. It might be less likely to die, but the world's full of code which doesn't work anymore unless you do a lot of work to nurse it back to life. That doesn't make me anti-FOSS. I prefer free software under almost all conditions. I do so because of the benefits it provides me and others today, not because I think it will have immortality.