Posts by doublelayer 11418 publicly visible posts • joined 22 Feb 2018
Yes, that approach always ends well. Nothing sounds better as a future than a war between governments that have cast off the burden of democracy and corporations that view people as resources to be mined. And by the way, neither is the victory of either of those sides. I hate Facebook for what they do, not who they are. Replacing them with another entity doing the same thing, whether a company or a government, is not going to fix it.
That's quite unlikely. Unisoc chips are heavily used in Android devices. Yes, they have a couple low-end SOCs that get used for KaiOS devices, but they have a large number of other models that are too powerful to be used in them. They're quite popular for the low and mid-range Android devices produced by Chinese OEMs.
I don't think you'll ever find a keyboard you like for that. There are phone keyboards for technical stuff, which just have the extra punctuation on the main keyboard. Adding extra things like syntax and variable prediction would take even more screen real estate, and writing code needs quite a lot of that for other stuff. Phones just are ill-suited for writing code, and I don't think a different keyboard organization will fix the reasons why.
For clarity, it's not quite a British company, as it's registered in the British Virgin Islands. This is still subject to UK laws and possible interference, but it has some insulation. This is, however, a thing that any VPN will have; if you're using one for privacy, the country where it is based is an important issue.
India could block their IPs. We'll just have to see if they choose to do so. For now, the VPN still offers a way to maintain some degree of privacy in India's growing authoritarian use of the internet.
Probably there was something wrong with that interface. People use devices with that or less all the time, often with significantly less processing power. Anyone who, for example, runs a Raspberry Pi as a desktop works with a lot less and there are many people who do this successfully. I have used many low-end machines for desktop use. Depending what you are going to do with them, it is generally sufficient, including a lot of browsing. Using an ad blocker helps with the speed of operation, but I've had misbehaving scripts cause problems even when a much more powerful processor and a lot of memory is available for the browser to monopolize. Badly written web scripts can take down anything.
It's not, though. I've used both on 4 GB machines. I wouldn't recommend you buy one, but that's just because, if you're paying money, you should get something with more capacity. If you already have one, though, it works fine. The OS runs fine. Running several programs on top of the OS runs fine. It's a suitable spec for low-end devices and Windows can use it without crimping other applications' performance. I wouldn't spec new machines with it, but it's unfair to claim that Windows won't run in it or will have unforgivable performance problems,, as neither is the case.
Do you honestly think that's likely? They've been making Surface devices for a while and none of them (except maybe the ARM ones but I just don't know how they work) have had any restrictions with booting Linux. In fact, I've found they generally have good driver compatibility in Linux. I see no reason to expect this won't be the same. When making accusations, it helps to consider for at least a few seconds whether they're at all based in reality.
This doesn't worry me as much. With Android, a lot of the security risks are just getting the patches that already exist and putting them on the phones. Yes, the custom code for each device may contain bugs and vulnerabilities, but those only work on that specific version of the hardware. Attackers generally want to target a lot of devices in one go, so because a lot of Android devices don't have security updates, they can target those vulns and get access to many more with one exploit. If this OS is any good, it will include more frequent access to security patches. It is a fork of Lineage OS, which often offers daily patches if you're willing to install it every day. If they keep that level of patching, the Android used should be very secure compared to the average device, leaving a smaller attack surface available.
You have indeed mentioned this in the past, and sometimes when you do, you're missing the point. Like now.
This article is about client-side scanning. The key words here are "client-side". Therefore, the data doesn't have to enter a public channel, because the scanning occurs before you transmit and even if you didn't intend to do so. Encryption on the communication is unrelated. Encryption on the device is what this is designed to get around, and if they implemented it in the way that Apple was going to, it would work.
Is it? The only way I've seen that companies avoid using that is to claim unlimited vacation, which I don't trust. My theory is that this will turn out to be vacation limited by something other than a stated quota, and thus with even less clarity on what you're allowed to do and even more methods for a manager to tell you that you can't have it or that by having it, they'll penalize you in some other way.
How else can vacation be given without giving managers the power to cancel it out?
No, I'm afraid you are wrong. All of that would be nice, but:
1. He won't say that.
2. He will still have a bunch of money if Tesla collapses because he owns other things and because he would sell out before the final bang.
3. Tesla won't collapse into nonexistence, though it could take a massive valuation dive.
4. He would never say that. "Never admit you have been wrong" and "never admit that the people you order around are important" are central to CEO attitudes.
We can hope, though.
You can patent an algorithm. This has been accepted in lots of patent offices. The algorithm can consist only of mathematical and logical operations, as long as the purpose of these operations is an invention otherwise deserving of patent protection. A program, also, is composed of mathematical and logical operations. I think I was clear what I was talking about earlier--you can't patent the bytes of code implementing the algorithm (you can copyright that, which in some ways gives you more power), but you can patent what it's going to do. Thus, a program can be patented in that you can be forbidden from implementing the behavior it does.
Now let's look at your suggestions for why an AI program can't be used to make a patentable thing. I should reiterate that this isn't about making the program the inventor, which is wrong.
"All current AI systems work basically the same way, and so the method (give data to this program, which has been constructed by a statistical inference method) is known."
All compression systems work basically the same way , and so the method (give data to this program, which will find patterns and either change the size of chunks or eliminate unimportant ones) is known. Yet you can patent specific ways of doing this and many have. Thus, if you can find a new way of automatically analyzing data, it could be patented. You admitted this yourself. Thus, if you invent a new method of analyzing data and use it to create something, you've invented something others could not. The result would be a product of your ingenuity and eligible for a patent.
But what if you're using someone else's model? You covered that too:
"But once you've got the machine, you give it some data, it churns a lot, and out comes whatever. You haven't contributed anything, except the data, and the program was constructed using known methods."
You contributed the data, whatever that might be. You probably also contributed a lot of code around the statistics. Most machine learning libraries, often what people mean when they say AI (unless they're the kind of marketing people who think an if statement counts) don't come with lots of friendly "Drop your data here and let's see what we get" boxes. Parsing data into a usable form for analysis and making the result obtain a goal takes effort. That effort requires ingenuity. If the ingenuity and effort are used to create something that didn't already exist, you've got an invention.
Moreover, when the result of such a program is an invention, the data itself is probably evidence of ingenuity. I'll use a concrete example for this: you're going to design new safety equipment for better outcomes for passengers in a car crash. One method to do this is to design some options, build prototypes, get some cars and test mannequins, and start crashing. If you get a good product by doing this, it would clearly be patent-worthy. Now that we have the computing power, you might also use computers to simulate designs and their results and evolve options. Both cases could use AI, probably neural nets: one to determine and improve simulation accuracy from the real-world tests and one to check the results of the designs and figure out where to make changes to improve it. If you did this, and also produced a good product, should it not be patent-worthy? After all, if I ran the same program in the same way, I could have gotten that product. However, had I designed them manually and done manual testing, I could also have made the product. The patent is given when you choose to use your skills to produce an invention, and you did. That someone else could have is not part of the process unless they also literally did so.
Wrong on several levels:
"If the something can be repeatedly invented by running a given program over and over again, then the combination of that program and its input data are mechanical, and its output must be deemed obvious."
No. The input data required effort to create. The program required effort to create. The output is a result of those things. That the program is deterministic does not matter. Otherwise, I could copy something nonobvious, write a program to print it to the console, run it three times, and by your logic call it obvious. It doesn't work that way.
"Can you patent a program?"
Yes. People do it all the time. I think they're often undeserving of the patent, but there are cases where they are. You can patent an algorithm, and a program is just an implementation of some algorithms attached together to be useful.
"Can you patent data?"
Not directly, but you can patent its results. The data of how well all your prototypes worked can't be patented, but the final product you got from doing this can be.
You misunderstand how patents work, and while I think you probably agree with me that this suggestion to give programs ownership rights is ludicrous, you're going a lot farther than current law does or, in my opinion, than a perfect patent system would.
They also misunderstand how patents work now. Here's their quote on the matter:
"If courts and governments decide that AI-made inventions cannot be patented, the implications could be huge,"
Yeah, that's not what's happening. What's happening is that AI-made inventions can't be patented by the AI. They can be patented by the person who used the AI program to generate some results they are using in their patentable thing, and companies have been doing so successfully for years, including both correctly issued and frivolous patents. The court cases about putting the program on the inventor list have never said the stuff isn't patentable, and they have often said that they're perfectly happy to give the patent to the user of the program.
Assigning ownership to a program would, if anything, make things harder; if you did that, then the AI program would have the right to sell the invention and the people involved would not. You would then need to establish that a program has the right to sign a contract that lets you sell the invention and another contract that says you can keep the profit from doing that. Depending on the country, for instance Germany where there is a level of patent that cannot be sold by the original inventor, you also might need a third contract that says the user can hold the money due to the AI since the AI would not be able to open a bank account with most countries ID requirements. As soon as you do that, someone who likes arguing pointless philosophical things as much as these guys do (or someone who has gotten annoyed enough) can claim that an AI that can sign contracts and own money and intellectual property isn't something you can own, has been illegally enslaved, and that the contracts it was hard-coded to sign are thus nullified. As fun as it would be to watch these people fight about this, they can do it by shouting at one another. They don't have to clog up the courts and patent systems.
If we ever get AGI, we may have to answer these questions. We don't have it. These things are not it.
How often, when starting a game, does it either say it's loading something and make you wait or have an unusually high resource usage while displaying the initial menu (and on occasion other ways of artificially stretching the time from clicking the icon to being able to play to give it time) because it's doing that as you select options? Things take a while to load, verify, and make available for fast access. Games have to load a lot of assets into memory to get that speed. The OS has a similar requirement to run stuff quickly once it's turned on, and thus it spends more time preparing that.
As for older machines, they were indeed doing less when they started, which is important, but as you don't like that argument, they were also using techniques that you can use here as well. In many cases, their OSes were on ROM chips with some caching for the initial state, and you can do that with modern OSes by saving memory contents to disk and restoring them. It's more fragile if things have changed, but it will speed up the process of booting. Most Linux installations don't bother doing that because starting the components from scratch isn't that hard. The boot process also includes a bunch of stuff for hardware management which older computers didn't bother with.
To use their reward system, however that works. If you earn points and have to identify yourself to spend them, that's one of the only ways. I think if you don't care about that system, you can refrain from setting up an account and just drive the thing. You would then lose whatever advantages there are in the reward points, although I'm having trouble imagining how they could set it up to be very useful.
They would still need to deal with the laws of other countries, just as Facebook must make at least some effort to lie about complying with GDPR and having some kind of backdoor preventing the Irish DPC from investigating them. If you operate in a country, even if you are incorporated elsewhere, they will be able to apply their laws to you. With the internet, this isn't always strong. For example, if I put something on my website that China doesn't like, I'm not going to comply with their censorship law and they can either block me or not as they choose. If I were selling something or had my systems located in China, they'd have more leverage to do something about this and could successfully force me to comply. Social media companies sell advertising and thus earn money in the countries where their users are, so those countries have a method for punishing it if laws are not obeyed. Your solution will work as soon as we have a social media company that doesn't care about earning money or having anything located in in the countries of which they don't like the laws.
I don't like Chrome either and would be happy if they took it away from Google. There are good arguments that Google is also exploiting monopoly power with it and should be restricted or broken up. However, these do not change that Apple's doing the same thing and Apple's actions don't prevent the situation you suggest.
There already exists a version of Chrome for IOS. It uses WebKit internally, but it still has the Google devs and familiar logo. If they wanted, they could set up something that allows websites to only function there, and web developers can detect whether you're using Safari-WebKit or Chrome-WebKit and send users to get the Googly variant. I've seen a couple sites do that. Apple's ban on a browser having features they don't have doesn't prevent that kind of abusive behavior. It does let Apple restrict OS features in a way significantly stronger than anything Microsoft did with IE, and we know how well that ended for web standards. You don't have to like Google for Apple to be wrong.
I didn't say they were perfect, and in fact I pointed out that they can have major imperfections. They have the authority to selectively prosecute and they lack the resources to prosecute everyone in existence, so whatever your view on how well they use those things, it's useful to know they have this. This is not just the U.S., by the way. It's typical of all investigation and prosecution systems everywhere. Describing how financial crimes are judged and investigated, when something counts as a financial crime, and how you can legally do something that causes financial problems is not relevant to the security research situation, so I'll spare you that essay.
Because sometimes, your actions are either legal without permission or unplanned, and in both cases, being denied permission could be a problem. I'll use an example for each one.
Legal without permission: I've bought a device, and I'm going to run security tests on it. This device is mine, and I have that right. I do not require the manufacturer's permission to try gaining extra control of the software running on it. If I find a vulnerability in this one, I'll inform the manufacturer in the hope that they will fix it for all users of the device. If I asked them for permission to test something that I own and they declined, it would have no effect on my rights but they might think that it allows them to come after me. Manufacturers that don't want their vulnerabilities disclosed and don't want to fix them have frequently taken this approach to attempt to silence researchers who discover real problems.
Discovery is unplanned: I'm using a service legitimately and find a problem. This may be entirely accidental (I mistyped a URL, for example) basic (oh, look, this form reacts wrongly when an SQL query is put in it), or more active (look, they've got private information in the HTML of this page which they're sending to me without authorization) but in all cases, it's something that is made available for my use. Even in the SQL example, I'm putting text in a box where I'm supposed to do so, and if my message actually contains a valid SQL query, it's valid input. Having found this, I inform the company that there is a possible issue. Again, I haven't done something invasive to discover they have a problem, but if they're annoyed or don't understand what I've done, they may react badly. I shouldn't need their permission to do that.
There are many cases where you do need permission to do a test, and where failing to get it makes your activities criminal. A penetration test without permission is nearly always an obvious crime. These are pretty clear. Unfortunately, when the activity is clearly acceptable, researchers are not always treated well when they disclose it to the owner, which is why more protections are needed.
"Does the US Department of Justice really get to decide which part of federal law does not fit their agenda and thus can be ignored or is that neglect of duty?"
No, they just get to do that. They have to use the laws to decide who can be prosecuted, but they have the authority to focus their efforts at any subset of those people they want. This is the case so they can optimize the use of their resources (they don't spend all their time on small-scale criminals and run out of employees when bigger criminals come along), but it can lead to abuse and neglect.
"Security Researches should not be prosecuted for doing their job responsibly but relying on the current agenda of the DoJ to protect them seems to be wrong on muliple levels."
It definitely is. It's just that it's the only thing they can do. They are not allowed to put this into the law, so it's just a direction about who deserves their attention. It can be reversed at any time.
It's not in it and the department does not have the authority to make any changes. There are people who could put this into the law, but they probably won't do it and it wouldn't help much. They wouldn't do it because it takes a lot of effort just to add a weak protection and some of them (all of them) don't really understand what security researchers do. If they did, it wouldn't necessarily help because it isn't clear. A lot of laws include such ambiguous terms, meaning that if a prosecutor wants to, they can easily spend months in court arguing whether something was "good faith" or not, decided by a judge who also doesn't know what security researchers do. We've already seen politicians attempt to get someone prosecuted for something that already doesn't come under the definitions in that law, so they're certainly not going to be stopped by a platitude. That's why the EFF wants stronger protections.
And also that cables are shape shifters. I have a box of mostly USB cables, but even though there appear to be at least twenty in there, there is never the old variant of USB that I need when I search it. This is even when I've searched it for different things on separate occasions: when I need it, it's not there. I do have a USB-A to USB-A cable that just makes the wire longer, though. I'm sure I'll need that eventually.
It's easy to prove that something was stolen (or in this case, sold without permission which is similar but not identical). At one point, you used to have the ability to sell this signed URL, and other people didn't. Now, you don't have that ability, and someone else does. You have clearly lost something. How much that something was worth is a different thing, but we don't have to figure that out yet. We were just asking whether it was an asset, not how valuable an asset it was.
This is an asset. It is something that you can buy and sell and there exist people willing to pay for it (for some reason). It was obviously one and there was very little chance the court would disagree. Courts have dealt with lots of nonmonetary assets before, from property rights to patents or contracts. They would have little issue figuring out this one.
As for monopoly money, if you can find some that people are willing to think is tremendously valuable to the extent that they'll give you real money for it, then congratulations, you now have an asset. Even if they're willing to give you a tiny bit of money for yours because their set is missing some cash and they don't want to buy a new set, you've got an asset. Assets are common.
But you can, in fact, make copies of the painting. I can go buy a copy if I want. I'm sure that there's a sufficiently good reproduction if I just like how it looks and want to put it on the wall.
The only thing the original painting gives you is the knowledge that this was actually touched by the painter, unless someone's swapped it. This is the same with the NFT; you know that this URL (or data, sometimes it's not a URL) was signed by the creator's public key, so if you do the basic effort of checking that it was the artist's and not someone else's, you can have the knowledge of that unique ownership. I don't consider that worth anything, but I don't see the original painting in a sea of copies as any different.
That's intentional, I think. They could have used normal words: "make a ruling to disallow use of a digital thing that it's possible to sell against someone who isn't here so we had to send the messages over the internet", but that doesn't sound as complicated. This lawyer wants this case to look revolutionary. Admitting that it's a very basic loan case and there was no expectation that the court would refuse to recognize this as an asset when they already deal with every other kind of asset wouldn't help with that.
That's a pedantic difference without a distinction. When malware infects a computer running Windows, but it used something other than a kernel vulnerability to install itself, do we say that it's non-Windows malware? No, we don't, because it's running as a program on a Windows host. In this case, the malware can run as a program on a Linux host, thus it can infect Linux systems. You still have to leave something for it to find, but that's true with Windows in almost all cases.
I'm a Linux proponent, but I have to say that some of us sound like those annoying "You don't get viruses on Macs" people. When anything infects a Windows machine, someone is there to say how bad Windows is and how much better Linux would have been. When malware infects a Linux machine, they find some excuse for why it doesn't technically count. Malware runs on everything and there are variants intended for running under Linux. We all know that's true, so let's stop pretending it's not.
"The Pi4 is now 1.8GHz, not 1.2 (as incorrectly stated in a comment). You can usually overclock to 2Ghz with no issues."
The 1.2 number is wrong, but so is yours. The only thing that gets 1.8 is where they put the Pi into a keyboard and have a massive metal plate for dissipating heat. The board itself and the compute module used here both have a base rate of 1.5 GHz. They also run hot, meaning that if you overclock and don't have any power problems, you still might have automatic underclocking due to overheating. That gets worse when you pack them close together, although I haven't checked whether this includes cooling or if you need to add it.
This isn't the first board of its kind, although it's unusual. If you too can find a product idea that three thousand people want, you can make a nice chunk of money by selling it to them. Of course, then you have to go make that thing, which leads to the perennial misunderstanding of small businesses where a million in revenue doesn't result in much profit at all. Why not try it, but understand that the money they've made wasn't easy or cheap.
If they took out their money in Bitcoin, that still has value. They can exchange it for normal currency or keep it in Bitcoin without having to be in this particularly unstable thing, and if they were shorting it a while ago, they almost certainly did that. Bitcoin didn't have the same collapse as this did.
Yes, unless you do it very wrong, it's a more legal way to scam someone (you haven't lied about what they're going to get). If you advertise it as an investment too much, however, you could still find someone willing to test whether they can get a court to agree that you've stepped over the line. It wouldn't be the first thing advertised as an investment that had no value and no reason to expect people to keep wanting it.
In some ways, yes, the bank would survive this. They would do it by making some panicky calls to the central bank, but that's why they have set up relationships with the central bank. If it ends there, a run like that doesn't kill a bank because they become more conservative to keep control of the 75% they've still got in loans and other investments. A while ago, they wouldn't withstand that, which is why banks are usually required to do at least some of this and often voluntarily do even more than that.
Why Tether should withstand it is different; they should withstand it because their product claims to be designed so that they have to withstand it. If I tell you that I'll store all your money and it's available to you whenever you ask, without waiting for me to move things around, then I have to do that. If I'm lying about doing it, then that's a problem. Doing that gives me nothing, which is why banks don't give you that guarantee. Tether said they'd set it up that way.
That's not really surprising, given that these are hosting locations, not residential users. Yes, some people may VPN through these, but overeager blocking means it's difficult to do that without seeing a lot of captchas or people who block altogether. How many packets do you get from other places that primarily expect inbound connections? For my services, I don't see much normal traffic coming from AWS or CloudFlare either, but they're obviously not just a haven for spammers.
Two problems. First, at-home generation is great, except the methods available tend to be inefficient. You can have your own generator without spending too much money, but you'll be wasting a lot of fuel that generates power you don't need right now. There's a reason they tend to be used only in emergencies. The really big ones tend to be a lot more efficient. Solar panels are a bit better, but storage systems so you can use power at night less so. Again, it's out there and can well be used, but there's a reason many with home solar setups put excess power into the grid during the day and power on something else at night.
Now for the less important problem: "Apart from large hadron colliders, football stadiums and cryptocurrency mining, who needs massive amounts of electricity on a daily basis ?"
Server farms. Factories. Industrial kitchens. Hospitals. Airports. Skyscrapers. Any place with a lot of people. Any place with a lot of machines. My home usage is tiny, but there are a lot of nonresidential users out there.
"Data are already there, but mismanaged so badly they become useless. If that's what you want because you "fear the State", you don't understand that you are the State, so you're actually fearing yourself."
Let's get the most wrong part done first: I am not the state. I am a member of a state, which one is not important right now. The state can still abuse one of its members, and many have been known to do so in violation of the laws agreed upon by the state and me as a member. Thus, I wish to avoid those abuses. If I was the state, then I would have the power of the state and I would eliminate those abuses (though making me a dictator is probably not the best way to fix things, I at least promise to be a better one than usually seen).
The whole point of privacy isn't to eliminate the existence of data. It is to avoid the misuse of that data, including collection by people who should not possess it. Disorganization is basically the goal. I'm in favor of avoiding organizing data when it is not warranted and approved. My ISP does know my name and payment details, but they did not need my identity paperwork to plug in a wire. I think it is possible to pay some of the utilities in cash, so if I wanted to avoid giving them my name, I could do that with extra effort (it's not worth bothering, but it's possible). Facebook probably does know a lot about me, and this is exactly the problem I want solved, so pointing out that it's true is not going to change my mind. A record of property ownership is not the same as a centralized repository of every utility connected to every resident. If I'm renting, my landlord can know who I am and collect documents to prove it if they want without having to record this for government usage which has already been specified to be illegal.
"It was quite interesting that the Canadian government was able to block the exchange of bitcoins that US citizens donated to the Freedom Convoy truckers."
Why does that surprise you? When it was available to the people that Canada didn't want to have it, it was in Canada. Where it started wasn't very related since it got there. Also, I only saw cryptocurrency being frozen at exchanges, so a direct transfer would probably have worked. I'm curious what part you found interesting, as both aspects seem predictable and ordinary to me.
Some of that's been done, and other parts of that I don't want done.
"In other countries getting a driving license without the required stay permit is not so easy."
In the U.S. as well, which is why they had to branch out. Various methods are available for proving identity, but obtaining a license, especially a federally-approved one, requires documents people who immigrated illegally won't have.
"Even utility bills could be an issue (of course people renting houses illegally can still have bills in their names or using front people)."
I don't want to have to prove my identity to connect utilities. I disapprove of a tracking system that can easily link my identity to my ISP connection. It is unnecessary for anyone following the laws, and for any criminal investigation that needs the data, it can be collected in a limited way during the investigation instead of collected indiscriminately and retrieved from that cache. An updated system does not need to collect that data.
I'm not sure about that. Both groups have different ways of being annoying. I think your descriptions are accurate, which leads to the following interactions:
I know everything guy: Argues with you for a long time before you prove what needs to be done. Embarrassed that they don't actually know everything, they will eventually back down before they get extra proof. Next time, they will do what you showed them so they don't need to ask for help.
I don't know how to use computers guy: Much more humble, asks for help, you show them what to do, and everything seems fine. Tomorrow, they're back asking you how to do the same thing, or something similarly easy. They can also get less humble later on if they think that not learning is an appropriate course of action. This can end up taking a lot longer and giving them the impression that it's fine to waste your time with basic questions because you're always happy to help so why should they figure it out?
Neither kind is good, and depending on the specifics of the situation, either kind can end up being much worse.
I don't know the system, but both of your statements could well be incorrect.
"First, I'll note the customer got the same info, whether the computer was used as intended by the software designer, or whether the manual shortcut was taken."
You don't know that. What else was on the dispatch note? Maybe it was just a copy of the list with serial numbers, but maybe it included extra information. The description we have doesn't indicate this. I'll also note that the computer might have done other things with that information, such as tracking who has each serial number for tracking product defects or allowing the customer to look it up later.
"Second, I'll ask: was it faster for product-pickers to write down the serial numbers by hand than it was to work the computer as intended? If the answer is "yes," then the program design is at fault."
Or the product picking process was. Either way, it sounds like they had to note the numbers and come back to copy them in, so by definition it was faster. Unless they could take the computer with them and write them at the point of picking, the computer approach is probably slower. This is acceptable if there is a benefit to doing it. We don't know if there was.
You have two problems, both large.
"Why isn't Windows secure? That is the question we should be asking."
Why do you assume it's Windows? You can run programs on everything else as well. Those programs can read, write, and delete files which is all you need for ransomware.
"It shouild not have been possible for any unauthorized programs to install themselves without seeking permission from the user."
Why do you assume it did? Maybe it got permission from a user who didn't understand what it was. This is quite frequently the mode of initial infection. Alternatively, it could exploit a hole left by a user, such as an open SSH or RDP port with insecure authentication. Do you assume that every infection requires an OS vulnerability to succeed? That happens, certainly, but it's far from the majority.
True, but in order to have usable backups, you have to test them. You should also have cold backups that are kept offline. If you did either of these, the chances are good that you can use them with some work. If you did both of these, you probably have functional backups in that case. You can't encrypt a backup after it's been written to a tape and is sitting on a shelf, and if you encrypted it before it was written, a test will demonstrate this.
This page indicates no CVEs for Z/os. It doesn't indicate that Z/os doesn't have security issues. If it didn't, there would be little use for the portal IBM has for announcing them:
IBM Z offers a Security Portal that allows clients to stay informed about patch data, associated Common Vulnerability Scoring System (CVSS) ratings for new APARs and Security Notices to address highly publicized security concerns.
It's possible that IBM doesn't particularly want the publicity of announcing detected vulnerabilities. I cannot see anything important on this portal because I am not a registered customer.
In addition, a CVE is not needed for ransomware to work. I can log into an account to which I have access and run a program to encrypt stuff. The only vulnerability involved is whatever gave me access to that account, which could be in the user who gave out the credentials, the authentication mechanism that was easier to crack, or the administration process that made obtaining privileges simpler. So if your implication was that this couldn't happen if they used Z/os, you're wrong. It couldn't happen in exactly the way it did as the attackers probably weren't trying for it, but it would have been possible.
A lot of universities that came early to computing knew a lot about administration because they couldn't buy in management of all the equipment. This is why most universities I know about have two essentially disconnected networks: the main one with all the university web apps, campus workstations, and student emails, and the one run by the computer science department, which does all the same things but only for those students and occasionally other important systems. For example, I've seen where the CS admins maintain the HPC systems, even though it's mostly the other sciences using it. There are a few exceptions where, when the universities needed administration, they expanded what they already had, but most appear to have taken a more basic approach.
No, the constitutional argument is clear. I have the freedom to decide whether you can say things when you're using my property to do so, as in I can tell you to leave if you're doing something I don't like. That freedom applies to the people who own the company, thus the company can exercise it if those people choose to let it. This is not a new argument and has been used successfully. It also happens that, if that law continued to exist, there would be negative consequences, but even if there wouldn't be, it would still be invalid in the U.S.
Two problems. First, the concept of corporate personhood in the law is more complicated than you state and was set up for a different reason. You have the misconception that "companies gained "person" status to make political donations". This is not true; the existing status as persons allowed that. The concept is common throughout the world, allowing a corporation to have some of the rights and responsibilities to act in a legal way, for example to sign a contract as a company instead as its owner (this is necessary so the company is still responsible for the contract after the owner at the time of signing dies or sells the company). The court case that established the concept in the U.S. wasn't about donations either; it was about the difference in tax laws between individuals and specific kinds of corporations, a problem that was solved by making different tax forms.
Now that we've defined terms, there's a reason corporations should have rights. They need to be able to do some of the things that people do. A company needs to be able to have responsibilities and the freedom to take actions. It's an instrument for carrying out the goals of its owners, who are all people with those rights, and those people can be held accountable if it breaks the law. This argument may be a bit abstract. I'll provide an example to make it a bit more definite:
1. If I run a website in my personal capacity, I think we can agree that I don't have to publish your comments if I don't want to.
2. If I run it with a friend so that both of us have admin access, we still don't have to publish your comments.
3. If I run the site with donations that come to me personally, I still don't have to publish your comments.
4. If I set up a company so that the site's income can be divided or invested in its operations, it's still being run by the same people and still making money for those people. Why should I have to publish comments now?
The gap between points 3 and 4 doesn't change what the service is. It just simplifies the tax forms and makes it easier to share ownership. The people still have the rights they had before. Thus, the corporation they are using should have the ability for them to exercise those rights. This doesn't prevent having different regulations for corporations than for individuals, as the act of forming a corporation can activate laws that apply only to them.
Yes. It's worse with some interview-related tests I've had, where there is a time limit for all questions but the system will not allow you to see any future questions or go back to ones. You have to judge when to stop working on question 1 and hope you've left enough time for questions 2 and 3. If you did and you'd like to improve your answer to question 1 in the time remaining, too bad for you. I've seen this too many times, given that not all interviewers even have take-home timed tests.
In general, we do have a lot of negative effects of big tech on our infrastructure and standards. This article appears to be hitting that drum, but from a drummer who just whacks the thing with a stick at random, only landing on the right surface by chance. This starts right from the beginning. The first example to be used to demonstrate that we have a control problem is Apple's Private Relay. This is a VPN. A completely normal VPN. It works like the VPNs we have had. It's also completely within our control, as a user can turn it on and off at will (and it's turned off by default). It takes some information away from the local ISP, which is in fact probably a good thing given what some ISPs like to do with those records. I don't use it because I'm using my own VPN, set up and managed with standards and software that I have complete access to and denying exactly the same information to the ISP. This is not an issue of over-control by big tech.
The same is true of the caching. The article correctly points out all the performance and efficiency benefits of using local caching, then somehow paints it as bad anyway. No, it's not. Once again, it's a thing that can be circumvented if you want extra latency. The systems that implement a CDN are almost always using open standards and quite frequently open source. I can rent someone else's or set up my own. The existence of those networks does not create a barrier to entry. If I choose not to have one, the internet still routes people to my systems. No company locks me out of using or refusing to use CDNs. Once again, this fails to demonstrate any control by big tech.
The sad part of this is that there are a lot of areas where tech companies have major and deleterious effects on important standards and this article had the opportunity to cover many of them. Tech companies have cornered the markets for browsers, mobile OSes, software distribution (in many cases), and membership on a lot of standards bodies. Any of those could have gotten a few paragraphs of legitimate complaint. None of that is something I can opt out of. As this stands, the best example in the article is the complaint about IPV6 which, while accurate, is not the most concerning problem out there.
"I think we need new battery tech before that becomes reasonable."
You're correct, we need it not to kill batteries in no time. Unfortunately, we don't need new tech for it to sort of work, so it's being sold by many phone manufacturers right now. The selling point is that it can charge your phone in twenty minutes if you forgot to do so. That you have to buy a new battery (or phone) when doing that renders it unreliable is somewhere between not their problem and one of their goals.
