Posts by doublelayer

Bill Gates on climate change: Planting trees is not the answer, emissions need to be zeroed out to avoid disaster

Re: Personally, I wish someone would follow through on the other side of the story...

"We can (and did) live from the Arctic to the middle of the Sahara without the support of modern technology and trade."

We did. It wasn't pleasant and involved a lot of dying. I'd like to avoid that if I can. I can't stop a glaciation, but I can take steps to make that the big problem. For the moment, we're having to deal with changes to the climate before the glaciation.

If we had a stable climate at the current pleasant setting until the glaciation, we could focus our energies on doing something to promote our happiness when it does roll along. Given the timeframe, that might give us enough knowledge to go to a new planet which won't have one, or cancel the glaciation through deliberate control which we don't have the knowledge to do today, or decide that we'll deal with it because our smaller population can happily live in the equatorial regions and let the ice take the high latitudes, or any number of other options.

In the meantime, my concerns are not about mass extinction events (which we could cause if we wanted to; cobalt bombs are available). My concerns are about large-scale unpleasant situations. People complain a lot about migration today. How will they complain if a large region quickly desertifies and leaves its populace trying to escape to find water. That won't be an extinction event, but it will result in a lot of pain for those escaping, likely a backlash against them, maybe some wars, definitely an economic problem. I'd rather we avoid that if we can.

"What, really, is the difference between having three children and letting million of immigrants bring in six or eight family members?"

Well, one key difference is that one is relevant and the other isn't. The discussion concerns world population. Total number of people on the planet. Having children increases the number. Moving people doesn't. So if you accept the premise that population is a problem, then births are your problem.

I'm hopeful that modernization will bring down birth rates without us having to force anything. It's already decreased to below replacement rate in a number of developed countries and has been coming down nearly everywhere. In my view, we don't have to spend so much time discussing how to force people to do it if we can spend some of the effort modernizing those areas not as developed. History demonstrates that birth rates will come down on their own as that process happens. If it's not enough, we'll have a much smaller problem to deal with. Malthus was wrong before and I'm confident he can be wrong again.

Re: Personally, I wish someone would follow through on the other side of the story...

That's rather simplistic without deciding what our goals are. For probably a lot of humans, it's keeping things nice for humans, including other organisms which are necessary for our happiness (things we eat, for example). Possibly also including some other life forms for which we feel sympathy. It doesn't take a wiping out to make that a lot worse. If that's not the goal, then we can decide what goal we do want.

If we wanted to, we could take the selfish route, cause any damage we want to, possibly extensive damage, and let evolution sort things out. To use a phrase distressingly popular among people who deny science, the planet will survive. Which is accurate in the sense that there will still be a rock in this location of the solar system, and there's a likelihood that there'd be living things on it. However, that's not really where my goals end. I'd like for those living things to include humans, and humans living peacefully and efficiently. With that in mind, I'd like to set my goals such that things are more likely to go that way. It's true that we've had many climates before which didn't result in global extinction, but many of those climates would be very bad to humanity as it is.

Based on those goals, the question could easily be asked: why don't we decide what climate best meets that goal and try to modify the current climate to obtain it? Unfortunately, I lack the confidence that we have a clue how to do that without causing unexpected problems. We know the climate we've enjoyed over the past few millennia works. It is probably best that we stick with that without trying to change things that can be easily damaged and may be impossible to repair.

UK dev loses ownership claim on forensic software he said he wrote in spare time and licensed to employer

Re: Everyone knows that

That's not really sufficient. He worked on it during his spare time, he claims, and I'm inclined to believe him. The question is whether he did so as part of employment or not. He was a salaried worker being paid by the company to reproduce the software he wrote. At that point, "company time" isn't really how it works anymore. "Company projects" is more like it. For instance, if I work on the projects my company asked for during my spare time, I won't own any of the code; it's still work done on my employer's IP.

The central question was whether he or the company owns the project, which would probably be settled in a license agreement or employment contract. There was no license agreement, which is what you would need if there was a licensing arrangement. That makes it hard to argue that the code was licensed.

LastPass to limit fans of free password manager to one device type only – computer or mobile – from next month

Re: Classic ploy

"so you have to be [...] not literate enough to know password managers are a bad idea (this last bit will probably not win me any friends)."

Care to elaborate? Password managers are juicy targets, and thus they pose a risk to an attacker. Therefore, if you had said something like "Monolithic hosted password managers are a bad idea", I'd be behind you. However, you weren't that clear and if you meant that all password managers are a bad idea, I must disagree. A local password manager means people stop using the same password or multiple weak ones. That's so frequently an avenue for attack that it's probably worth doing something about it. If you have a reason they're a bad idea, you could lay out the details about why so we could debate them or agree and find a solution.

'It's where the industry is heading': LibreOffice team working on WebAssembly port

Re: "good for security"

I also want to know what reasons they think they have for that statement. A document that's stored on a server and rendered on a client is also on the client. The client can take a copy through many means. So why is stored-on-server more secure than stored-on-client when client security is important either way? If it was something like a database where the client only sees a portion of the data, then it would be more secure there, but it's an individual document all of which the user can see.

Now there's another thing on Earth that be can seen from space: UK lappy sales in pandemic-struck 2020

Re: The one-device-per-person trend

I take hardware from people who want it disposed of. That which is too old to be useful, even with a lightweight Linux on it gets sent to recyclers. That which is modern but they didn't want it gets resold. That which is older but functional gets donated. That which doesn't fall into those categories, usually it didn't sell and the people I donate to didn't want it stays here and I end up using it. I'm far over my allocation of devices. For example, the laptop whose battery doesn't work and isn't replaceable, but as a desktop it works fine has been on my desk for at least two years now. I wonder when I'll stop collecting things like that.

Watch this space: Apple offers free repairs for the self-bricking Apple Watch SE and Series 5 wearables

Re: SmartWatch?

"As a young kid I was given an old carriage clock, it runs fine and you can get them on eBay now for about 3k, you think our kids will be seeing an Apple Watch Series 5 or Apple Watch SE on eBay for that level in 50 years?"

No, but they're not the same thing. I bet if I had a time machine, traveled back half a century, and bought a bunch of clocks, few if any would be worth a lot today. Yours happens to be in the nice intersection of A) things people like and B) things rare enough that they have a lot of value, but most people buying clocks don't anticipate that they'll be investments decades on. They usually just want a method of knowing the time. For example, I have a clock that's rather old as well, though only about two decades. It works well. Also, it's a cheap plastic rectangle with little artistry about it and you probably couldn't sell it if you wanted to. Fine with me, because I only needed something to keep the time.

The same distinction applies to a smartwatch versus a normal watch. People buy normal watches to have the time available with a glance. People buy smartwatches to have different information available with the same convenience or to use it as a control device. Thus, you shouldn't expect that they'll be purchased by the same customers. People who just want the time don't need a smartwatch and may opt for a cheap long-life watch which will have no resale value because it's made to be utilitarian. People who want to see messages by looking at their wrist will not be happy with an older watch and may opt for one which needs more powerful hardware to perform the more complex tasks they want, meaning it won't really work later and thus also won't have resale value. There's a group including myself who don't really want any watch. It's all based on what you want the technology near you to do.

Recovery time objective missed by four weeks, but Parler is back online

Re: Who's the audience?

"You cannot have that aspect of free speech and also the protection afforded a common carrier. The two are mutually exclusive."

Let's say I agree with that. No problem. The people choosing not to provide services aren't common carriers. AWS is not a common carrier. Youtube is not a common carrier. If I have the power to invite people to speak somewhere, I am not a common carrier. Few of these places are common carriers. You want to argue common carrier, find someone who was put offline by one, which means an ISP or telco, and wasn't disconnected for breaking a law. If you only want to argue common carrier because you're failing to get agreement otherwise, then it's not helping you if you haven't considered what common carriers are.

UK watchdog fines two firms £270k for cold-calling 531,000 people who had opted out

Re: Lots getting away with it

I don't get that many, but those I do get are usually valid numbers which are probably spoofed. At least once, someone else called back one of the valid numbers and confirmed that it was a normal person.

I have answered them to waste their time, but I never get any of the ones that would be fun to mess with. All mine are automatic ones. I tended to leave them connected with silence until they disconnected, but two have decided to automatically call me back when I did that. Now I'm using a new technique where it will randomly dial numbers at high speed until they disconnect. This has proven more effective.

Hey, maybe we should all be cat-faced eco-warriors on our daily video chats

Re: Bitcoin tax

I think most people who hoped cryptocurrencies would be handy for use as actual currencies have abandoned the hope for bitcoin. Some have given up entirely and others have found different ones to hope about, but now the people buying and mining bitcoin just want to use it as an investment. A bunch of people who have money to burn and who don't really know why bitcoin is useful are wasting their time and resources, which will work out well for some and badly for others. It's kind of like a large chunk of other investing where nothing's done for actual goals of getting some benefit in the future, only hoping to get some money off someone else in a zero-sum game.

Supermicro spy chips, the sequel: It really, really happened, and with bad BIOS and more, insists Bloomberg

Re: The impossible bus

If I was designing something like this, my first attempt would probably be to compromise the firmware or bootloader. If I rewrote the default image to include a rootkit and modified the chip slightly to only start using it after a certain number of boot cycles, that might work. It would have access to most of the hardware, but it would be memory-resident in such a way that the running OS wouldn't detect it. It's not perfect, especially if there are updates to the firmware which this has to handle somehow, but it could function while avoiding a QA scan--a slightly modified chip which was already there and the first cycles are using the correct firmware image.

Re: Trust?....You need to trust YOUR OWN technology!

Again, you're missing the point. A hardware exploit attacks the source, not the network. If the source can be compromised, then the data leaked is the original. If you want to air-gap your machine and physically move data across for transmission, that could work, but it won't fix most of the problems that an embedded chip can create. Your assumption that the only point of a system is to send messages is simplistic. Among other things, do you expect someone to walk back and forth with a thumb drive to encode and decode each step in the process of, say, querying a database?

Machines which could be compromised usually either are air-gapped already or won't be. The air-gapped ones are usually safe. The ones which aren't are the problem. The solution is monitoring of traffic from devices that have the ability to connect, with encryption being useful but not solving every problem. One good example of a problem it doesn't solve is compromised hardware at the endpoint.

Re: Trust?....You need to trust YOUR OWN technology!

We don't think the chip happened, but if it did, cryptography doesn't fix anything. The theoretical chip would attack the source, not the network. It would take the unencrypted contents of memory and report that, which means your cipher, good or bad, would not affect it in the slightest. Please pay attention to where in the chain an attack happens before you declare thee cipher to be the panacea for any and all security problems. Unless you plan that everyone will manually encrypt their messages on paper before laboriously typing it in, in which case I'd encourage you to stay in the 1950s where nobody needs to send anything but short text messages.

Biden administration pauses pursuit of TikTok and WeChat

Re: Err....

"Pursuit" can be positive or negative. It really doesn't have the connotations you think it does. If I am in pursuit of an efficient refactoring of my codebase, my company and users will be pleased. If I am in pursuit of money without doing work,, they're unhappy. If I'm pursuing a person who is lost in a dangerous area so I can direct them away from the abandoned building site, I'm helping them quite a bit. If I'm pursuing someone with the goal of robbing them, not so much. The Trump administration pursued the companies to try to cut them off. There is no question about that. If the Biden administration isn't doing that for now, then they paused that pursuit. If you want to argue bias, go find some bias.

Future astronauts at risk of heart attacks, strokes if radiation allowed to ravage their cardiovascular health

Re: I want(ed) to be an Astronaut

Among other things, you're dealing with some pretty small sample sizes. That aside, the following differences apply:

Duration of trip: Apollo 11 spent eight and a half days outside the atmosphere. Apollo 17 took that up to twelve. People on the ISS spend a lot longer there, usually measured in months. People undertaking a voyage through space would certainly spend months or years on their journey. A longer stay outside the atmosphere means more exposure to radiation, and the ISS is lucky to be as close as it is.

Type of person: Astronauts have to be fit and relatively healthy or they don't get sent, but there are other aspects which are considered. The people sent to the ISS are often sent to work on specific scientific projects, which means that experience with the project can take precedence over physical health. Also, radiation can cause a problem whether you're fit or not. Even if we only sent fit people, they could still sustain serious damage. If they don't because they got lucky, didn't spend much time there, or had a good shield, their later fitness doesn't disprove the risk.

We know it's hard to get your kicks at work – just do it away from a wall switch powering anything important

You want someone fired for moving their feet? Now she should have noticed the switch, but from the sound of it she didn't. I occasionally tap my desk when thinking about a refactor. Am I unprofessional now too? If she ignored people telling her not to do that or if she did it deliberately, that would be a case for discipline, although immediate firing seems extreme. Doing it accidentally and reportedly not even knowing she was doing it seems a lot more innocent.

Apple iOS 14.5 will hide Safari users' IP addresses from Google's Safe Browsing

Re: Tor, DNSCrypt, etc.

"Can a personal phone (not a burner) be made equivalently secure?"

Yes, if you're willing to go to quite extreme lengths, including buying only a specific subset of available phones, hacking bootloaders to let you in, and the like. Some steps don't require it, but some do. I'll take each in turn:

"I can run Linux from a non-persistent thumb drive": This one's hard. Even when a phone supports a custom image, it's a persistent one. Very few phones support an easy non-persistent system. A few exist, all designed for Linux mobile distros, but those are a little rough and don't support everything, so unless you want to hack around with them you likely aren't buying them. If you're using a more normal Android device, your best chance is to backup an image, use the current one, then manually erase and reflash the old one back on. That can take half an hour and requires manual intervention.

"and set up a signal chain that looks like ISP-->VPN-->Tor-->DNScrypt,": This one's easier. Android supports VPN, and most providers will have a client. OpenVPN is one of them in case you're running your own. If Tor is configured on your VPN endpoint, that will work fine. I think any on-device Tor client that works on all Android traffic would conflict with your VPN configuration, but you do have the Tor Browser available in case you can't make your endpoint run the circuits for you.

"then run locked-down Firefox on same.": There is Firefox for Android, or the Tor Browser which is based on it, or a few other options. Locking those down is possible.

The harder part is limiting software placed on the device. With effort, you can find and disable or uninstall some of the stuff, but it's not always possible to determine what everything is or what it's doing. That's why, if you want certainty, you have to get a customized Android or Linux variant. The unfortunate part is that many phones simply will not let you install one, and those which are open enough may not be supported. If you're willing to recompile kernels and the like, then you can get closer to the goal, but that takes time and expertise.

Re: Proxying

"Well yes they're MITM."

Not really. They only get one set of traffic, which uses the hashed URLs. They don't have access to any other parts of the stream. That doesn't make them perfect, but posts here are talking as if they've started proxying all traffic. They haven't.

Myanmar Junta delivers harsh cyber law and more IP blocking orders

"I hope anyone with a Starlink antenna in Myanmar is keeping it well out of sight."

There aren't any Starlink systems there. They're not licensed for the region, downlink facilities are only in the U.S. for the moment, and Spacex's reportedly keeping the radios off when orbiting over nonlicensed areas. Also, the receivers don't work unless they have direct visibility to the sky. I don't have one, so I can't report on tests, but nothing I've seen indicates they'll work through obstruction.

"Am I anywhere near correct in thinking that this is the sort of thing that satellite-based internet will solve? Or is that just hopelessly wishful thinking on my part?"

Usually, the answer is no. Satellite providers usually end up in one of two situations: A) they're willing to censor when the government says to or B) they are not and the government bans their operation. If situation A occurs, the problem still exists. If situation B happens, there are more possibilities, but they usually result in degraded service at best. The local government can easily block payments from people to the satellite companies. Now, it can't get paid for the traffic people are sending. Most companies don't keep working when the billing stops.

Also, countries which like to get more severe than that often go looking for satellite dishes and confiscate them. It's not easy to hide one that needs outdoor access. Nor is it easy to run one inside a building; most won't work and those that do still need relatively precise alignment with the satellites in use. If a provider comes along who is willing to take traffic without payment and whose dishes work from inside, the government has the option to patrol with radio listening equipment to identify those using the service and bring them in.

Dept of If I'd Known 20 Years Ago: Call centres, roosting chickens, and Bitcoin

At least that's nicer than a lot of companies. They actually put resources into that. There are ones that are a lot more frustrating to me, such as the ones with exactly one piece of hold music, which is always heavy on the drums so it fades in and out. When they've cut about 45 seconds of that and looped it, you can go insane fast.

Another honorable mention goes to an ISP I've used before. If you call the technical service line, they'll play music and read messages that suggest you check your cables, reboot the modem, etc. Fair enough. I've already done that and the messages do get annoying after you've heard the same ones five times each, but there are people who can benefit from that, including the support reps who hopefully don't have to waste time on people who could fix their problem by power-cycling their equipment. The only problem is that, if you call their system for a different purpose, like they've billed wrong or you are moving and need to cancel service, which you've indicated on the IVR system before you were put on hold, you'll hear ... messages that suggest you check your cables, reboot the modem, etc.

Open Source Vulnerabilities database: Nice idea but too many Google-shaped hoops to jump through at present

Re: Requires a GCP account?

If this isn't read optimized when it's a database that rarely gets written to, that's on their head. I have no sympathy. Also, it doesn't matter what's billable and not, because it's hosted on their own systems. They don't have to structure it so they pay per transaction to the cloud team. Both can be easily compared to search; they don't have a structure where they have to pay some other department for each search, and it is still a more complex arrangement. They have spent longer optimizing search, but the search process itself is already more complex than a query on this database. Any design decision that leads to the rate limiting is either a stupid design choice ("Should we optimize this database that we expect people to be reading for read operations? No, let's not bother.") or unnecessary ("We're going to host this database as one of our corporate services on servers which are corporate property. Let's set it up to bill ourselves rather than the way we do every other system.").

Re: A correction. Of sorts.

Oh, I read that differently. I assumed "for many projects" meant "for many open source projects that they use internally, but not all of open source since there are projects they don't use". I'm assuming you think it's referring to "for many internal Google projects". I can't tell which reading is correct.

Re: A correction. Of sorts.

It sounds like they are doing what you said they're doing. They maintain private repos, where they store the code and don't allow any outside calls. Which you corroborated. I'm curious why you're doubting their statement when your experience is that they're already doing it?

Re: Requires a GCP account?

"This seems to be a side-effect of the necessary rate-limiting."

Which they need exactly why? They don't have rate limiting on so many other products they develop. I can send searches through their system by automatic means, and each of my searches have to go to many nodes so they can search a massive database quickly, find advertisements for me which means going to another database, and a bunch of sharding and protection against endpoint failure. This one is much easier. A single database. Maybe five queries on it for each search. Yet this one needs authentication and rate limiting?

This is Google. They have plenty of resources to host a database. Also, it's supposed to be an open resource for the benefit of everybody [cough as if cough]. That should mean open access, with an open API which lets me clone the entire thing if I have a reason to. It should also mean open management, where they wouldn't even have to provide all the resources. If this was an extension or replacement of the CVE system designed by Google with others who were going to use it and encourage its adoption, they could get lots of other big companies to chip in for the hosting and bandwidth costs. I disagree entirely that rate limiting of any kind is necessary, let alone rate limiting by requiring a painstaking authentication process with contact information.

We called it

Back when they were calling for all of this, we knew what it would look like and how useless it would be. I warned them, assuming any of them read comments sections:

"If you construct [any new databases or systems you think people need] to lock in developers, expect to be snubbed."

Well, they did and we will. Nice going.

This scumbag stole and traded victims' nude pics and vids after guessing their passwords, security answers

Re: Computer++ sentence

It depends how you want it done. If a stream is generated and sent to a system for it to be embedded by that system, there are two possible problems. The first is that someone wishing to forge a time could get the stream and store it, later to overlay the stream as it was released at the desired fake time. They can also wait until the time they want and overlay a future time. The second problem is that such a stream would require a consistent network connection. If power or network failed but the camera continued recording, there would be no way to continue adding the time until those came back. This might not be important.

I can solve the first problem but not the second. The way to solve the first one is to set up a system which can accept hashes and store them in a database. The video for a given time can be hashed and that hash submitted to the remote service, which timestamps the entry. That would prevent someone specifying an earlier time, which is the most often deliberate adjustment. They could provide an old hash to make something look like it happened later than it did, but they'd have to do it consistently because the chunks before and after the occurrence could be verified true as well. That still requires a network connection and someone external who stores the database. Given the worth to a police department of unverified images, I don't think I'd bother going to that extent on private security cameras.

Re: Kids today...

"what, 10 accounts total?"

The article gives numbers. You didn't pay attention.

"He and accomplice Michael Fish, also a former graduate, worked together for two years afterwards to break into dozens of students' accounts in the university's MyPlattsburgh portal and steal their data.": More than ten, surely. Let's see how many.

"Fish also posted some pictures online, later finding graduation photos of the same students and creating edited versions of them alongside the nude photo, naming the 100 students whose photos he had stolen.": Just to make sure it's clear, that's 100 students with compromised information deemed worthy of releasing, not 100 accounts attacked.

"Faber also admitted asking others to break into another 50 or so accounts, providing them with specific names and sometimes email addresses.": We don't know what happened to those people, but they're not in the previous count.

"He tried to break into over 24 accounts himself and was successful with around 10 of them, using a VPN to try and cover his tracks.": I'm assuming this is where you got the 10 from? You should have read the whole sentence to realize that that's just one of the two and the stuff he admitted rather than the truth. Perhaps the sentences above it to get more accurate totals too.

Phishing awareness gone wrong: Facebook tries to seize websites set up for staff security training

Mostly because, when you're seeing it in a security training email, you just get the URL. If you go to one of them expecting it to be real, it will look different and tell you what it is. Someone going to one of the URLs won't be faced with a lookalike service, but instead a warning that looks like this:

"Hi! This web site belongs to Proofpoint Security Awareness Training. This domain is used to teach employees how to recognize and avoid phishing attacks. This page is here to let you know that this is not a malicious web page. The email that led you here was likely sent by your employer as part of a training program."

And thus, they contend that people are unlikely to misidentify the site as the real one, because they look totally different. Nor would anyone typing in a URL type the other version--'rn' may look like 'm' when you see it, but it's very different to type or say. Those are the points that lead to the statement you quoted.

Microsoft Patch Tuesday gaffe leads netizens to 'Microosft' typo-squatting domain

I doubt it. Sure, they have a bunch of money, but possible mistyped domains are so many that you can't just reserve them all.

Transposed letters: Microosft, Microsfot, Microsotf, etc. 8 combinations

Letter one over on a QWERTY keyboard: Microsofr, Microdoft, Mivrosoft, etc., 18 combinations

More than one letter off by one: Way too many combinations.

Letters off and sometimes transposed: Let's test the budget then.

Easier just to put all those combinations into a spell checker and run it over stuff as you publish it. Or check that links work.

North Korean attacks on crypto exchanges reportedly netted $316m in two years

Re: "… according to a report by Japan’s Nikkei."

I'm sorry, you've lost me.

"the Japanese truly love the North Koreans!": I'm guessing this is sarcasm, given the dog and cat comparison and that it's wrong, but then you say:

"You could not get a more unbiased source.": Did you mean a "more biased source"? Or was that sarcasm too? If both were sarcasm, it sounds weird to me.

By the way, it's not really fair. Japan and North Korea don't recognize each other and frequently argue (not really bias on Japan's part as North Korea has this nasty habit of shooting missiles at them). Still, there are countries that have worse relations with them, including the U.S., France, Taiwan, and places like that. Japan also contains a surprisingly high number of pro-Pyongyang organizations, although they are operated primarily by a small subset of ethnic Koreans and don't speak for Japan as a whole or the Korean community there.

Re: $316m in two years from crypto alone would represent a very decent haul.

Well, most of those people's consumption comes only from food that can be grown domestically and the occasional foreign aid to prevent as many people from starving outright. There are maybe 10k people who matter to the country, which means a much more respectable $31600 per important person.

No phish for the likes of you, thank you very much! Google finds email villains are picky about demographics, country

Re: I don't find Google blocks too well

I would like to filter that, but on occasion, someone in the HR office has sent me an email like that. It's never been an important one, usually talking about some new thing they've set up. Still, I wonder what they were thinking when they decided the best way to create an email which might appear on desktops, laptops, or phones is to make an image of all the text and just send that. It can't scale well. I also wonder if there are any visually impaired people on the list. I checked, and they didn't put in any text layer for people who can't read visually.

Web prank horror: Man shot dead while pretending to rob someone at knife-point for a YouTube video

Re: Born idiots. All of 'em.

Pranks are dangerous, especially when the victim doesn't know what you're going to do. Pranks between friends work because, if a friend doesn't like the prank system, they'll either make this clear and their friends will respect it or stop being part of that friendship. Most others are irritating. Some are like this one and are criminal. There should never be a defense that the crime was meant as a prank; if all involved are happy about it, then no charges will be brought. Otherwise, it was a crime and should be treated as such.

EncroChat hack case: RAM, bam... what? Data in transit is data at rest, rules UK Court of Appeal

"Does the whole process of https (encryption on my side, transport, decryption on your side) count as 'transmission'?"

As the ruling goes, it would be as follows:

1. You construct an HTTP request in plain text in memory. If they seize it on your machine here, it's at rest.

2. You encrypt it to ciphertext which we'll presume you store in memory. If they seize the ciphertext, it's at rest. Also, if they can seize that ciphertext, they wouldn't as they could also seize the plain text earlier and that's easier.

3. You establish a TLS connection to a server and send the chunk along a network to it. If they intercept your encrypted data by watching it as it goes to the server, it's in transit.

4. The server receives and decodes it. If they seize it on that server, then it's at rest.

You can think of it as "Where does the interception occur?". If it's on your computer or the remote computer, it's at rest. If it's in between, it's in transit.

Re: In storage...or in transit....

Yes, I am. I don't need to know the numbering scheme you've used to know what a numbering scheme is. In fact, I can't know the numbering scheme you've used or I'd have broken the encryption. That's analogous to the private key. Meanwhile, by telling me that you're employing a book code, I already know what you're doing to encrypt the message. I'd still have to figure out the book (you gave that away now but you don't have to) and how you're choosing words from it.

A private cipher is sending a message without telling me that it's a book code. In fact, it usually also means that you don't use any public ciphers, which leaves out a book code. I then have to decode the message entirely from the ciphertext, without knowing any structural details about what you've done. That does make the first step harder, because I have a lot of possible methods you might have tried. And in fact it may make you more secure if your code doesn't have any problems. As previously stated, you have only your own analysis to check that, and many have been wrong before. The reason we advise against private ciphers is a two-part one: a) you might be wrong about the reliability of the cipher and nobody has tested it and b) if this isn't your private cipher but someone else's, it's possible they deliberately undermined it to read your messages and kept the structure hidden so you wouldn't find out.

You can do that without the complicated GPU stuff by decoding bytes and manually drawing them on the screen using the CPU alone. There are sufficient registers to do that but insufficient ones to store the whole message. It doesn't really matter much. If your computer has a) the encrypted message and b) the means to decrypt it, a warrant for the data on your computer can give them the cleartext message. Which they didn't have to do in this case since they also had the unencrypted message. The important point was that the message was located inside the user's device and not on the infrastructure of a network. I have no problem with that interpretation. Whether more protections are needed when getting data at rest is an important part to consider though.

Re: Filth

Well said. I think there are two important parts that need clarifying (well, one clarifying and one fixing).

1. It doesn't matter if it's in volatile or nonvolatile memory. What does matter is whose memory. If it's the user's memory, then it's at rest. If it's in a transmission system's memory, then it's in transit. Possibly we need to clarify what a system is that holds a message while waiting for a user to come get it, but sends that message on to the user. I'd classify that as a transmission system.

2. The important part: "Legal protections against unlawful interception, in section 3 of the Snoopers’ Charter, don’t apply to data in storage targeted by police hackers under a TEI warrant." We should consider whether we need to extend some or all of those protections to data at rest.

Re: In storage...or in transit....

"although the anoraks tell me that private ciphers are cr*p, I just don't believe it. Maybe someone from Cheltenham who reads El Reg can IMMEDIATELY decipher this piece of book cipher messaging:"

Hey. That's not a private cipher. We all know what book codes are. The methods of encrypting and decrypting using them are common knowledge. So are the weaknesses which are used while attacking them. The only private part is the book and the numbering scheme, which you can't disclose anyway. You've just used a public cipher.

Private encryption isn't necessarily bad. The only problem with it is that it might be bad, and you haven't exposed it to an avalanche of attack like if it was a public one. So if you've done it wrong, you're more likely to be caught. It's easy to do it wrong. If you're confident that you can do it properly, then go ahead. Many have thought as much and found their mistake cost them. Many more either had or developed the humility to admit they might have flaws and submitted their algorithms to the rigorous testing of colleagues.

Intel sues former staffer for allegedly stealing Xeon cloud secrets in USB drives and exploiting info at Microsoft

Re: MAC address

From the article, that's almost exactly what they've already done. Most discussions here are about prevention, but they appear to already know how to do the detection part.

"If the reason for the alleged data theft is to benefit the new employer (MS) then why are they co-operating with the Intel investigation, or am I missing something obvious?"

For starters, the goal could have been to benefit Microsoft, but could also be to benefit the employee as in "That guy always gets the good prices from Intel. Let's give him a raise". Someone stealing information might want to avoid telling the new employer that he's going to use illegal means to benefit them; they might be pleased and go along with the crime, but they might turn him in. Much safer just to help them without telling them what you're doing, bag the rewards, and have the ability to do the same with someone else in case they don't give you as much reward as you want. I think it's more likely that Microsoft was surprised to here this happened rather than expect the corruption to go to the top.

Meanwhile, whether that's the case or Microsoft wanted to commit the crime, it's dangerous not to go along with the investigation. Stealing data is illegal. If they can claim that Microsoft did it, Intel gets a ton of money and Microsoft gets investigated by law enforcement. Microsoft isn't going to let that happen. Also, if this ever happens in reverse, Intel will help Microsoft investigate too. No reason to throw that away.

Terraria dev cancels Stadia port after Google disabled his email account for three weeks

Re: Keeping the accounts seperate.

Short answer: he didn't. Complaint irrelevant.

Re: This is weird

Google's account system works like this:

1. Maybe something happened. Nobody's really sure, but an event showed up in a log. Maybe they had a video which violated the terms of service. Maybe someone pressed the report button by mistake and didn't fill out the form. It's all the same.

2. Send the user an email describing the problem, just so long as no details about the system are disclosed. In practice, this only really allows an email like "A possible misuse event has been detected associated in some way with your account".

3. Increment a secret internal score with a secret algorithm. Both things are so secret that not even the internal teams know what they are.

4. If the score's too high, ban their account. No need to plan to recover, since after all the code must be good enough to prevent false positives. To prove that, here's a list of times where that happened in the past five years. Look. Only sixteen people had accounts restored!

Don't scrape the faces of our citizens for recognition, Canada tells Clearview AI – delete those images

Re: since they’re all publicly available anyway

"There is also some applied permission once you publish it."

There is explicit permission based on the terms of service for the thing you posted it on. Which usually gives anyone who can see it based on the settings the rights to view the content, but may restrict them from copying it and using it offline for other purposes unless you specifically allow that. The services we know they used do not take copyright from the original creators, nor do they require those people to grant a right to create derivative works. So those rights don't automatically exist.

For example, The Register has a term describing what rights you have to grant when you post:

"8.2 You retain all your ownership, copyright and other interests and rights in your comments but by posting any comments on our Website you grant us a non-exclusive irrevocable and royalty free worldwide licence to use, modify, alter, edit copy, reproduce, display, make compilations of and distribute such comments throughout our Website."

Re: since they’re all publicly available anyway

Wrong on all counts.

"Using an image to train an AI does not necessarily entail copying that image, so copyright issues would not apply."

Wrong. Training requires the software to have access to the image to read features off it. That requires the software to have read access. Which can only be done if the software has the data. Images published online are not licensed for any purpose automatically and it is illegal to treat them as such. If the image is licensed under a noncommercial license, they're in violation. If it's licensed on a royalty-required license, they're in violation. If no license is stated, they could be in violation. It's important that copyright isn't just for distribution; it can prevent you from reading without permission too.

"Nor would it violate copyright if you reduced an image to a set of numbers that you stored so that recognition software could use to match two images of the same face."

Wrong. Data is a series of numbers. You can copyright text, and if I store an array of the unicode values for each character, I've violated your copyright. Now if you summarized the data into new numbers, those numbers aren't covered under my copyright unless they include most of the existing data, but the data you summarized to get them is. You are allowed to keep those numbers, but you weren't allowed to generate them. They could be ordered seized or destroyed as the products of criminal activity. That's unlikely, but possible.

"In addition, you quite likely gave away your copyright to the site that you uploaded the image to (e.g. Facebook, snapchat YouTube etc.) when you clicked on "I agree" to their terms & conditions."

No, you almost certainly did not. Read the terms and conditions. They all have a statement giving the site the right to display unless you revoke it (sometimes they omit that part), but few if any make you turn over the copyright to them. The ones you mention do not, and in fact explicitly state that you retain ownership*. Even if they had, copyright would still apply, and Clearview didn't get the rights to the data.

*Let's look at the text of some of these:

YouTube: "You retain ownership rights in your Content. However, we do require you to grant certain rights to YouTube and other users of the Service, as described below. [...] For clarity, this license does not grant any rights or permissions for a user to make use of your Content independent of the Service."

Snapchat: "Many of our Services let you create, upload, post, send, receive, and store content. When you do that, you retain whatever ownership rights in that content you had to begin with. But you grant us a license to use that content. How broad that license is depends on which Services you use and the Settings you have selected. [...] Snap Inc. respects the rights of others. And so should you. You therefore may not use the Services, or enable anyone else to use the Services, in a manner that: violates or infringes someone else’s rights of publicity, privacy, copyright, trademark, or other intellectual property right."

Facebook: I'd have to disable a block to read it. It's not worth it.

Humble Apple Pie: Cupertino sweetens pot to get its DTK prototype machines returned after developer backlash

Really?

"Still, some users may decide to try to hang on to the machines in the hope they'll become a sought-after commodity for collectors. From time to time, the original Intel Pentium 4-based Developer Transition Kit will pop up on eBay, where they command a steep price."

I don't understand collectors. Maybe I never will.

Windows' cloudy future: That Chrome OS advantage is Google's to lose

Re: Apples and oranges

"and to those who rage about Chromebooks timing out on support - this Windows machine has done exactly that indirectly - it's storage is insufficient for updates to occur so Windows will fall off support in a couple of months."

Wrong.

What your thing has: The manufacturer made it with specs that don't let the system stay up to date in the easiest way.

What the other thing has: The system could update, but they've cut it off so you can't do so in any way.

If we're technical, you can update Windows on your thing by performing a deep clean to remove files, including moving all personal files to external media. That will give you more storage for update files. If that fails, you can reinstall the latest version, which will give you the latest updates. You shouldn't have to go that far and some won't know how to do it anyway, but it's possible to do it without having to recode anything or attempt to hack into locked firmware. Chromebooks are instead killed outright.

How do we combat mass global misinformation? How about making the internet a little harder to use

Re: Wikipedia is far from perfect...

Doesn't matter. If they've reset it to a 200 which says the page isn't there, the archive may have a copy when it was. If it does, you can and should edit the link to that copy. If not, you can remove the reference and invite a re-citation.

Re: Wikipedia is far from perfect...

There's a thing that can help with that. The Wayback Machine. It lets you see what was there when the reference was added, which you can check in the history if it's not written right next to the link which it often is. Also, you can track changes to that page from creation to deletion to see if there's a problem with the source or they've revised the content. Not perfect, but a 404 isn't a dead end unless you try searching about a little first.