Posts by doublelayer

UK privacy watchdog wraps up probe into Cambridge Analytica and... it was all a little bit overblown, no?

Re: Nothing to see here...

"It was personal data supplied TO CA from Facebook - who were supplied by idiot users who filled in stupid quizzes...."

That's a very poor summary of the way that worked. Try this instead:

It was personal data supplied TO CA from Facebook - who were supplied by idiot users who trusted Facebook to only give data out when the user of the profile made it public and only from profiles which consented to the data release, not a recursive search through a bunch of friends who never agreed or knew anything about this.

The small number of users who agreed to the quiz agreed to a limited data release, not the release of everything (which is what happened). The people they had connections to did not agree to any of their data being released (it was), and were not told that their data had just been sold off. As much as the public should know that Facebook isn't to be trusted, it takes things like this to really demonstrate that fact.

After ten years, the Google vs Oracle API copyright mega-battle finally hit the Supreme Court – and we listened in

Re: will have to think about getting a license each time he/she overrides a library method

"No, there's no equivalence between writing your own new function with the same signature and copying 37 files of 11.5 KLOC."

When those 11K lines are a bunch of function declarations, yes there is. If I create enough functions with the same signatures, I'm copying those lines one by one. I want a library that implements archive operations with a different format so I create a class implementing all the same functions that the original .zip one handles, I've copied twenty lines in a row. Then I decide to implement a new module which does mathematical operations faster, so I retype each line in the mathematical module and implement the functions differently. While I'm speeding it up, I think I can get AES functions to take advantage of hardware acceleration, so that's another set of lines copied.

These lines have to look similar because the function name is the same, the parameter names are the same, the parameters have the same types, the parameters appear in the same order, the function returns the same type, and the function is in the same class. Certain other parts might be skippable, for example comments, but if I decide to properly write comments for my functions, they're going to say similar things. Why would I ever do this if I expected the company who wrote the original interfaces to sue me for my hundred copied names?

Google copied the names for a lot of functions and classes. They reimplemented basically all of the ones available. In other words, they did what you just said I could do, and they did it five thousand times. Why am I allowed to do it but Google isn't?

Re: almost certainly prevents me writing down the list of names myself and going from there

Except for some mistaken copying of a few lines, what Google copied was a list. A list of functions. Just like my list of functions. Oracle claims that this code, the declarations of the API they own, is theirs to control. Whether someone copies the file containing the list or writes down the list, it's still a list and contains the same items.

Oracle claims that copying that code is a violation of their copyright rights. They're not hinging it on the nine lines accidentally copied; everyone agrees that wasn't allowed and the lines were removed. They're basing it on the 11K lines that remain. Here's the problem with the argument you're making. Either those lines are copyrightable or they're not. If they are, then it doesn't matter whether I reorder them or make slight modifications, whether I copied them with a clipboard or typed them manually, I'm not allowed to copy them without permission. Oracle owns the text and I'm only allowed to use it if they approve. You are arguing that Oracle can copyright just those declarations, but that it would have been just fine had Google somehow written the list themselves. Not only is that impossible, but it is directly contradicted by copyright law; copyright law doesn't care how I duplicated work, whether I ran a book through a photocopier, got a bunch of blank paper and copied it out by hand, or had someone else play a word game to give me each word in sequence.

There are two logical ways to resolve this. The first method is to state that APIs are too basic to copyright, being lists of names. In this case, Google can keep using their file. You seem to disagree with the legality of this option. The alternative is to say that they are copyrightable, and therefore to copy the essence of them without permission is forbidden. In this case, it's not possible to take the steps you suggest to get around that. The two APIs I wrote above are the same. They're reordered a bit and I dropped some comments, that's all. But copyright doesn't care about this. If I dropped every second page from a book and randomized those pages before publishing them, I still committed copyright infringement against the author. Even if I rewrite those pages without reading them myself through some complex arrangement.

Re: but reimplementing them is what Oracle thinks they can forbid you from doing

Yes, that is exactly what they think they can do. It's simplified, since they think they can prevent you from doing it if you haven't complied with one of their licenses, either the GPL or one where you pay them, but they think they get to set the terms under which you can create functions with the same names and parameters. They think that, if you don't follow the terms, you aren't allowed to create those functions. They might end up being right according to the legal system, but all we're discussing in this thread is what that could mean later.

Reimplementing an API doesn't require copying code, but it does require writing very similar code. If the original API reads like this:

int factorial(int n); //returns -1 if n is invalid

int fibonacci(int n); //warning: negative numbers means undefined behavior

There's only so much you can do to create a reimplementation. You can change lots of things, but probably the most you can change and have it still work is this:

int fibonacci (int x);

int factorial (int x);

The person who typed that may never have seen the code specifying the previous API, but their code necessarily looks very similar. If copyright prevents me from copying a list of function names, it almost certainly prevents me writing down the list of names myself and going from there. No matter how I change the comments, spacing, or parameter names (and I probably shouldn't be doing that), it's going to end up being basically the same.

Re: Nine Laypeople

Judges don't live in isolation, but some things are sort of hard to understand if you've never learned about them. How does one operate a phone? They know that. How do you manufacture a phone? They have a fairly good idea. What is the difference between an API, a language, and a functional implementation? They have no reason to know that.

It's not that they live in isolation but instead that very few people know that kind of detail. Things we assume everyone on the comment board understands are things the general public has never heard of. I present you the following challenge: find ten random people who don't now and haven't before write code or administrate complex computer systems. Ask them the following questions, which I'm sure we could all answer in an instant. One point for understanding what the terms mean, one additional for getting the details right.

1. What does an operating system kernel do and what does it not do?

2. What is the difference between ROM, RAM, and nonvolatile storage?

3. What does compiling code do?

4. What is the difference between little endian and big endian encoding?

5. What is an API?

6. What is the difference between an IP address and a MAC address?

7. What is an ISA and which one or ones are you using?

8. Identify a piece of software you use. What language or languages was it written in?

Run this test on the nontechnical public. I'm guessing you'll see a lot of zeros, the occasional one, and maybe a two. Not a sixteen. You don't need to be isolated to not understand points core to the topic.

Re: The devel is in the details

"* OpenGL is under a pretty liberal BSD-style licence. There is a trademark licence treated separately, but that isn't involved in the Oracle vs. Google case."

This one probably holds. Worth keeping in mind that the person you're replying to specifically stated that they hadn't checked, so while this one's choice of license makes it unlikely to take advantage of a precedent, it could have fallen into it had the developer made a slight change to the license chosen.

"* Octave/Matlab; languages, not an API."

A language and an API are very similar. Both take creative effort and specify a way of running things, the implementation of which is provided later. I would not expect them to be treated differently.

"* SQL is an ISO standard and a language, not an API; anyone can buy a copy of the standard."

Anyone can read a copy of Oracle's Java APIs, but reimplementing them is what Oracle thinks they can forbid you from doing. Someone who decided to license SQL could allow you to purchase a copy and read it, but woe to those who try to reimplement it without receiving permission. This is not unusual with standards; if I try to reimplement the LTE specification from its standard without purchasing licenses to the components, they would be very grumpy. I also contest your language-not-API distinction here. I don't think it matters anyway, but I think it's also incorrect in this case. SQL may be both, but it provides a series of functions with parameters. That's effectively an API, it's a list of possible functions which exist. SQL also includes a language in which the functions are called.

Re: Status quo?

To clarify, it's the legal status quo in this case because it's what the previous judgement is. When cases go to the Supreme Court, it is to either uphold or overturn the ruling of a lower court (simplification, but close enough). The opinion of that lower court is therefore considered the current approach unless it's overturned. This is why, for example, the opinion of the lower court stays if the court has a tie vote. This is smaller than it sounds; it mostly applies to one case. As a case rises through the appellate system, what the status quo is could flip a few times before the case is finally over. Once the case is over (taken to the Supreme Court and decided there or one side concedes defeat instead of appealing), that decision could become a much larger status quo that applies to lots of other cases and people.

Apple's T2 custom secure boot chip is not only insecure, it cannot be fixed without replacing the silicon

Since it requires a cable connection and booting to recovery, it's unlikely to spread without assistance; people rarely connect one computer to another one over a USB cable. The exploit is very serious given the likelihood that someone could do this with minutes access and it could remain resident for a long time. I doubt it's hard to use the access granted here to grab the encryption password and install malware on the victim's system to phone home with the data when the computer is connected to the internet. At least we know about this; had it been someone who doesn't work on security testing with a public interest, it would already be deployed at various countries' border scans.

Teracube whips out cheap, fixable phone with removable battery and four-year warranty

I also appreciate water resistance as a feature of phones I might buy, but it's hard to properly seal a device for waterproofness and keep it this repairable. Some things can be done; waterproof isn't incompatible with SD cards or removable batteries. It does make it a little tricky to take the main board out, put in another one, and still have the result be waterproof. They might instead create a waterproof case to put the phone in, which would make the device bulkier but would mean they could obtain both their goals.

Re: Alternate use...

Could you specify the questions that aren't being answered? In an attempt to inform myself, I searched for the blog posts that were deleted, but I couldn't find them. At the time of writing, the official blog contains nineteen posts from 2020. Going to the Internet Archive, I've searched through their historical captures of the blog and I have not found any posts in those captures that don't currently appear on the blog from Pine64. I only looked at posts in 2020, so if they only deleted years-old posts, I didn't search that far. They do bring up phone-related things from time to time, so I'd be curious to hear the things about which they're silent.

Re: A suggestion for a long life

Possibly, but even when 5G does happen, it isn't going to make 4G obsolete. It took a long time for 2G and 3G to die, and that's only in some countries. Europe especially has kept these around for several more years yet. Therefore, I'm not sure it's that important to include it since it's not core to the device continuing to function; by the time 4G isn't being used anymore, the biodegradable back cover will probably no longer exist.

A suggestion for a long life

To all people developing devices like this, which are supposed to run a long time. There's just one thing you need to do to guarantee my confidence, but it will also help you a lot with extended support. Find a custom version of Android known for releasing updates, my preference would be Lineage OS, and add support for your device there. You probably don't have to worry about updating it to new versions of that either; even if it doesn't happen, people will still be on the latest security update. If your device is popular enough among the community, and being a device with manufacturer-guaranteed support will probably help, someone else will do the update work for you. Meanwhile, I will have confidence to purchase your device.

I use my phones for long periods before replacing them. One of the reasons I can do this is that I use software which continues to have available security patches and even the occasional new feature. I have succeeded thus far without causing damage to the hardware, so the warranty is not the primary concern for me. It is certainly useful, but I'm mostly planning that I won't need it often if at all. Software support is more critical.

Re: Alternate use...

You might want to look at the PinePhone. While its specs are worse than this one, it is designed to run a variety of Linux distributions and provides the resources needed to easily port things that aren't yet in the list of thirteen working distributions. It is also easy to repair (Youtube video demonstrating disassembly. If Linux is what you want, this might be a more reliable way of guaranteeing that you'll get it. One note, I don't have one of these and can't vouch for its quality.

A decades-old lesson on not inserting Excel where it doesn't belong

Re: 65536

I'm guessing they didn't want anyone to say they'd overstated what the screens or image formats could do. Then again, it didn't seem to hurt the storage industry much when they used a definition for kilobyte, megabyte, and gigabyte which was not the same as the definition memory manufacturers came up with, or the portable tech industry when they dramatically overstate battery life.

Re: Thingies cat

You hire people based on a diligent attempt to establish their abilities and responsibility. Only if you made that effort in good faith can you start deflecting blame. It's not enough to find a person, hire them without checking, and blame them for anything that goes wrong. Similarly, if you hire someone to do a task, it becomes your responsibility to get enough information to determine whether they're doing what they were hired to do. Sometimes you may hire someone else to help you manage that task, but this just increases the size of the tree which you still have to monitor. If you didn't do enough to validate that the people you hired were capable of the job and were actually doing it, you still take the blame for things when it turns out they weren't.

DigitalOcean decides to head rivals off at the PaaS, floats App Platform to deploy, run code without juggling servers

Re: Hack attack

It's certainly smaller than a lot of other places, so you're less likely to see it if you just look at who runs the servers for everything you use. However, it's worth looking at all the other attacking IPs in your logs, because they're going to represent a lot of the internet. It's really easy to try automatic logins on your site, and people will use any cloud service, VPN, or botnet to let them do it. Unless some provider makes a point of not taking down the systems of people who are particularly malicious, they're just like any other provider. To the best of my knowledge, DigitalOcean is usually quick to respond to abuse requests and is not at all a bulletproof service provider. People use it when launching attacks because it's cheap and convenient, which is basically the same reason someone else might choose to run things there as well.

UK, French, Belgian blanket spying systems ruled illegal by Europe’s top court

Re: Nothing rhymed

I don't think that's how any of that worked. The history seems to be that some people worked out a way for laws to not conflict maybe while others did what they wanted to, in many cases ignoring even those people trying to stretch the letter of the law. Those who created the spying programs didn't care what the law said they could do, or even what their own lawyers said they could contort the text into allowing, but instead did everything they could come up with. When laws changed or courts informed them that they needed to stop, they just didn't and waited for the next case.

Take this chunk from the decision:

“in situations where a Member State is facing a serious threat to national security that proves to be genuine and present or foreseeable, that Member State may derogate from the obligation to ensure the confidentiality of data relating to electronic communications by requiring, by way of legislative measures, the general and indiscriminate retention of that data for a period that is limited in time to what is strictly necessary, but which may be extended if the threat persists.”

Here's how that chunk will get used:

"in situations where a Member State is facing a serious threat to national security that proves to be genuine and present or foreseeable,"

"foreseeable". "Foreseeable"! "FORESEEABLE"! As long as the people at the spying organizations can foresee something bad, they can do many things. I can foresee bad things with ease, and I guarantee you that they can foresee much worse things. Here they have complete authority to activate the powers granted them in the rest of the quote. But of course that section will still impose serious limits:

"that Member State may derogate from the obligation to ensure the confidentiality of data relating to electronic communications"

All good so far, they can throw away their responsibilities. Restrictions are coming, right?

"by requiring, by way of legislative measures,"

Oh no. They'll have to get the legislature's support. This is a major blow, because they'll have to inform the public about what they're doing and why. Except the laws being challenged here already support the measures, so nothing new is required.

"the general and indiscriminate retention of that data"

Well, they didn't hold back about adding sufficient adjectives to let the organizations do whatever they want, did they?

"for a period that is limited in time to what is strictly necessary,"

Ah, they're throwing us a bone. They can do whatever they want, but only for a limited time. Then they have to throw out their data and start over. At least they'll only have a year of my data at any time. Sure it'll be the most recent year, but still, it's nice that they're giving me that.

"but which may be extended if the threat persists."

Remember that the threat will persist for as long as someone can foresee it. And that nobody gets to decide that the foresight is wrong or question whether the threat persisted. I foresee that a new country will form called Evilania, and it will invade our country. As long as I continue to foresee it, I can extend the retention timeline as long as I like.

Big Tech to face its Ma Bell moment? US House Dems demand break-up of 'monopolists' Apple, Amazon, Facebook, Google

Re: Sounds like the case against Apple

"What Apple would need to do in the meantime is effectively turn iOS into a hypervisor, and make every app run inside a separate VM so it can't possibly touch another app or the OS except through defined methods."

They already did that. The primary worries about an insecure app is that it might find a vulnerability in that hypervisor, which has happened several times, or that they might find a valuable sandbox that allows access to lots of things. For example, if they get into a sandbox which already has access to contacts, the global filesystem, and the microphones, the insecure code doesn't have to escape the sandbox to do malicious things. To the extent that Apple's review is focused on real security scanning, this is the kind of thing they want to prevent.

Re: "AD requires a CAL which means its not financially viable"

Yes, you can. Manufacturers get to choose how they go about it, but some have chosen to sell some of their products with Linux instead of Windows with a corresponding reduction to the price. Dell and Lenovo have done this, but only for specific machines in their lineup. You can of course purchase from a company that specifically focuses on Linux machines, of which there are several.

Re: Give the FTC more power?

While I'm not aware of Joseph Simons having done anything to bring on ire, it's possible that the original poster was instead referring to the person who currently has the power to remove and replace commissioners should they wish to mess with something. Maybe the post was intending to call for increased oversight of a bureaucratic entity should its powers be increased. Or maybe it was just an acronym confusion. I'm not sure.

Bad boys bad boys, what you gonna do? Los Angeles Police Department found fibbing about facial recognition use

Re: Its coming

No, we do not agree. A working facial recognition system, if it's even possible, would be a nightmare. Imagine what a totalitarian country would do with something like that. Imagine what a malicious operator in a democratic country could do with something like that. It could be awful. What it does is provide a mechanism to track a person wherever they go without alerting them and by providing a smokescreen of a potentially useful purpose.

Lots of things would catch criminals faster and reduce crime rates. Some of those things should be tried. Some of those things need to be avoided, even with the extra crime, to avoid creating a terrible situation for the innocent. Systems which destroy privacy or give the police unchecked power are among those types. A working facial recognition system, for that matter even one which doesn't work, does both.

Institute of Directors survey says most bosses expect no mass return to the office if COVID-19 crisis ever ends

"Have we really become such an emotionally weak society that out up-line managers must spend time worrying about out "mental well being" that worrying about getting the job done and making the company more profitable?"

Not quite. It's always been the job of a manager to worry about such things because the workers' mental wellbeing directly affects their productivity. If workers hate you, they'll try to leave and you'll have to hire new ones. Reduced profit. If workers are constantly distracted by a poor working environment, they'll get less done. Reduced profit. If workers are in a combative environment where they have to essentially fight against one another, then they'll spend time defending themselves or planning their own attacks instead of getting stuff done. Reduced profit. If workers are subject to too much work and burn out, expect them to have other health problems, therefore taking more time off and reducing productivity. Reduced profit. It's been known for as long as there have been workers who had a choice about whether to stay working for the company; it is the managers' responsibility to ensure that workers are in a good enough condition to continue doing work, and those who fail to do it usually see productivity slump.

Depends on the state of the office. Put me in an open plan office without restrictions about noise levels, even requiring me to stay there and looking at least a bit productive for all my allotted hours, and I assure you I'll be less productive than at home, where things are quiet, even if I take breaks more than they'd like. The same can be true for lots of environmental differences, from noise to equipment to socialization.

As it happens, your comment is correct for my current home and office setup, because my office had full walls and also gave me an easier way to quickly check things with others. When my team members all return to the office, I'll be there too and I'll be cheerful about it. It could definitely go the other way for lots of people.

Big IQ play from IT outsourcer: Can't create batch files if you can't save files. Of any kind

Re: Classic techie mistake

Again, it doesn't help against anyone else. If he could do it, anyone else could do it. If he was going to do anything dangerous, he'd have done it before, or instead of, telling someone about the problem. It's missing the point and badly to think about sacking him; either you don't care enough about the stuff in the safes to go to the expense of updating the locks in which case you can ignore the problem, or you do in which case your attack landscape is anyone and everyone who could conceivably get to the safes. It sounds like they completely ignored this, and given that their project was being spied on by Soviet agents which they'd rather not have know the information, they probably should have put some thought into it.

Re: Classic techie mistake

I don't think that's the correct response. I have not read his account, although I've just put it on my reading list which is a LIFO stack so I will have soon, so I'm going with the summary outlined above, but in that case, it was a terrible response. If the comment I'm referring to is correct, the reason he could break in was that people were using a small set of combinations and the locks were shoddy enough to take several possibilities. The second problem is expensive to fix, but the first is not. Ban the default combination and require people to change it, with an explanation of how to do so randomly. That should dramatically worsen the chances of having a code which unlocks all the safes or brute forcing a small number of possibilities while distracting the safe's owner.

In addition, this was a government project with a massive budget holding state secrets; if security isn't relevant there, what is the point? Blocking one person from accessing safes protects you against that person, who already proved he was on your side by reporting this instead of stealing the information and choosing his next nation of residence. It does not protect you from anyone who read his report, heard it from him, or figured out the same thing. If they're not on your side, you won't find out until after they've exploited the problem. This is what happens to the least sympathetic of data breech victims; they know there is a problem, know why there is a problem, know how to fix the problem, don't fix the problem, and people suffer as a result. Don't do it.

Apple seeks damages from recycling firm that didn't damage its devices: 100,000 iThings 'resold' rather than broken up as expected

Re: They can't fix it, but I know a man that can..

Welcome to the world of used devices. When you go online and buy a used device, it's usually not from the manufacturer. It's from some user who may or may not have damaged the device, meaning you know you're entering the realm of possibly extensive damage. The same is true if you buy from these recyclers or if you buy from someone random who lives near you; there's always the chance that what they call "lightly used" means "only dropped on concrete three or four times". For this reason, I rarely if ever buy used devices that I think are likely to have become damaged, phones among them. When buying other used devices, I require that I get to test things before payment. Those who choose to enter this market know what they're getting into. I have no reason to believe that the phones sold this time were any worse than the average user-sold used device.

That said, it is still a breech of Apple's contract, which is a legal contract. I would prefer that the contract didn't get made, but it was. I'm not saying here that what the recycler's employees did was right or that they should get away with it without consequence.

Re: The Waste Makers

The article states that the company concerned also operated in the United States at the time, to say nothing of the possibility that phones were shipped to the Canadian recycling facility to take advantage of a good recycling rate or cheap electrical power. We really don't know how many devices were recycled by Apple at all, given that we don't know how many companies they use to recycle for them.

You are trying to prove that Apple's devices are unusually bad, which is going to require extra levels of proof. Their repairability scores aren't great, but their competitors' aren't either. If you want to ban Apple devices for sustainability problems, which they have, you should also prepare for most competitors to be banned as well. Only a few phones I know of are easy to repair, including the Fairphone, PinePhone, etc. so you might be left with only those.

"not sure: if Apple handed them to the recycling firm, then the recycling firm owned them."

Almost certainly not. Apple could have done it two ways:

1. "Here are some phones we don't want. You can buy them and obtain value from them. You have to be environmentally-focused if you get rid of parts." Results in the recycling firm owning the devices.

2. "Here are some phones we don't want. We want them recycled, you recycle, so we'll pay you to recycle them." Apple still own the devices.

I think Apple chose option 2, in which case they are paying the company to do something with the things Apple owns. Since the recycling company didn't own them, they can't cancel the contract on right-to-repair because the devices are not theirs to repair.

I would prefer that the devices get reused when possible, but it's helpful to recognize what legal rights Apple has in this situation if only to suggest ways to make it less likely to happen next time.

Re: Google has short life cycles...

Depending on the history of those drives, the total destruction contract might have been more relevant. If they previously held sensitive information, the destruction could have been to eliminate that rather than to push demand for newer disks. I would be very angry if I gave disks to someone for destruction but they didn't do it. Then again, such concerns shouldn't apply to Apple devices since the internal storage is flash and encrypted with a separate location for key storage, so an erase should be nearly impossible to recover from.

Suffering silicon: Benchmarks for Apple's A14 chip are in, but post-Intel Macs, when they arrive, will tell the real story

Re: Not any more..

This assumes that ARM is going to be critical to all OSes in the future. Given that the public doesn't know what ARM is, that's a hard point to prove. Intel's problems in speeding up their chips are well-known, but AMD has succeeded in producing X64 chips with a smaller lithography and they're starting to get into the low-power space. Meanwhile, Intel still has a bunch of cash to throw at their problems.

ARM has several benefits, but one that hasn't been seen often is performance for large use cases. Existing ARM-powered computers usually take the form either of less powerful but cheaper (things like the PineBook Pro, the long-lived battery Windows on ARM machines, or ARM Chromebooks) or lots of cores for lots of parallel operations (every ARM-based server). Apple will probably be one of the first to produce consumer-level machines that aren't one of these two, but just because they can do it doesn't mean anyone else has a need to do so to stay current; if Apple's chips manage to produce the needed speed, it won't stop AMD's ones from doing so too. Unless you expect AMD and Intel to hit limits which just don't apply to ARM, why does it matter which companies switch to it? If you do predict a limit like this, what causes that limit and why?

Re: Mobile is not laptop or desktop

Almost certainly the laptop processors will be as good or better. However, there's a reasonable argument that the phone-level processors won't really work well enough for laptop or desktop use cases. It depends what they're being asked to do, but some people use their laptops for more intensive tasks that people don't do on phones or tablets. I expect that Apple's laptop chips will be more powerful than their phone ones, but the question still remains: how will they go about it? They could just design similar cores to run under higher power to get performance improvements, which would probably be helpful, but they could also just try throwing more cores into the mix, which will only help some of the time. Depending on what they do, they could have a performance dip in laptops where they've stuck too close to the mobile chips. This probably isn't a major factor since they can quickly change their plans for the next iteration of machines, but if they make that mistake the first time, people might have less confidence.

Something to consider in case Dell freezes over: HP unfolds 2-in-1 laptop with Intel Tiger Lake brains, bigger screen

Re: a button that covers the webcam

If it can be disabled by physically covering it, then there's no way for it to get activated if I have closed it. That means someone can't spy on me through it, either by finding a sneaky way to disable a light, by there not being a light, or by my not noticing the light. Same reason some people really like physical killswitches for some components; we're paranoid people but at least with those we have complete confidence.

Re: Is this the same HP... @A.Coward

"Really? Guess who owns Thinkpads - not IBM - think Asia - think Red...."

That's the point being made. IBM doesn't make Thinkpads anymore, Lenovo does, so if IBM does something wrong, it's wrong to punish Lenovo for it. Substitute "HPE" for "IBM" and "HP" for "Lenovo" and you've got the point they were trying to get across.

If the Samsung Galaxy S20 Fan Edition doesn't make you a fan, we don't know what will

Re: When will I get what I want?

I don't think all the features you mention are incompatible with a feature phone of today. If "keyboard" means "qwerty keyboard", it could be for sending SMS messages. The 4G or 5G could be for a tether connection. Bluetooth for an audio device. Admittedly, asking for Linux or Android is a little hard to understand; if they wanted something like the Motorola StarTac they shouldn't expect an OS that lets users develop and run sophisticated applications. It doesn't really matter though because, if the feature phones using a basic OS and primarily targeting 2G networks are insufficient, the lowest-end option with 4G connectivity is going to have that functionality anyway.

It really comes down to what tasks other than placing calls and messages are important. I really appreciate having things like navigation, meaning I need a smartphone with the kind of processing and internal storage that requires. If someone only wants some basic apps, a feature phone of today may actually have similar sets of features as a PDA of a decade ago.

Re: When will I get what I want?

You can get most of that, but you'll have to resign yourself to some restrictions. The primary one is the operating system involved. There will not be Linux. There mostly won't be Android either. What there will be is mostly going to be KaiOS. It technically has the Linux kernel and a lot of open source code from Firefox OS, but the top layer is closed source. It meets most of your desires:

"I don't want a camera - with one, two or three lenses": There will be one, it will be bad, you can ignore it.

"I don't want a 6.5 inch display": How about 2.4 or 2.8 inches (6.1 or 7.1 cm)? That's what you'll get there.

"I don't want a non-repairable,": Battery is replaceable, expect the rest to be hard to repair.

"I don't want limited use": Not sure what this means, but it has fewer features.

"₤600": Did you mean to use the Lira sign? ₤600 Turkish is €65 or so. Whatever you mean, the basic phone will be much cheaper than the one mentioned in this article..

"I just want a bloody phone: flip design,": Check.

"4/5G,": I don't think anyone has a 5G one out, but 4G is definitely available (some exceptions apply based on your country)

"keyboard,": I don't think so. Numeric keypad, but no qwerty ones as far as I know.

"a week's battery life on idle, five hours talk time,": Yes.

"a bright viewable screen": Not sure about this one.

"and proper way to sync to whatever I want to with a cable,": Depends what you want to be syncing. It can sync some types of data that way.

"Wi-Fi and Bluetooth,": Yes.

"Linux OS preferred,": Kernel only, no shell, not much else from it, apps are written using HTML and Javascript.

"Android grudgingly accepted.": No.

"And no 'apps' unless I want to install them myself.": They'll have basic ones, but they're easily ignored. Other apps are available, but not many and with few features.

Probably not what you're looking for, but it's almost certainly the closest you'll get for quite a while if ever.

Re: A 600£ or 700£ price is now considered not hard to swallow? For a phone?

There will be some improvements, and undoubtedly someone cares about each one of them, but for most people several will be unimportant. This device will have a faster processor. I don't need a faster processor, so not a factor for me. If you want the fastest available processor, you can't get it without paying something in this range. Similarly, the more expensive device probably has slightly faster internal flash, more cameras or better ones, a screen with a higher refresh rate, faster charging, and/or waterproofing. Of this list, the only one I care at all about is waterproofing (and I don't care that much) and you can get that at a lower price, so it does nothing for me. Still, if you care about most or all of the features listed above, maybe the more expensive device has benefits.

Complexity has broken computer security, says academic who helped spot Meltdown and Spectre flaws

Re: Hmm...

Mostly correct, but this is not always the case. The perfect example of this is a hypervisor. The program it runs is specifically another operating system, but the purpose of the hypervisor is to provide resources for the program and restrict it from affecting things that aren't in its virtual environment. Or, at a different level, operating systems for embedded devices often run one program but still restrict it from doing certain things. For example, an OS I'm using for a small device handles Bluetooth for the application running on it, and so as much as the program that is loaded may want to modify the memory reserved for Bluetooth protocol operations, the OS will not permit it to do so (at the moment, it alerts the developer on its own, kills the program, and loads another one allowing a debugger to be attached).

Re: Hmm...

They're also used for different tasks nowadays. In decades past, normal users might do most of their work by logging into that from their basic terminals or terminal programs running on relatively weak computers. They'd do standard work on that system, which was also running the important software since the mainframe was the only large system available. Now, the mainframes are still used to run the large software projects (some of the time), but users usually don't have to log into that mainframe to read their corporate email or access intranet-type services. This means that a lot of users probably don't get accounts for the mainframe, and therefore the worries that an unprivileged user will find a way to attack it or allow someone else onto it to do the same are reduced. It doesn't make it perfect, but it does make it easier.

Re: Hmm...

You are correct about that, but even the mostly secure Unix and other multi-user operating systems weren't designed for situations where one user would need very strong isolation from others. Random examples still exist of this; it's still possible, for example, to read the command line commands another user enters. This is usually not critical, but it's an example of one of the previous parts of the design where security really wasn't a factor. Other examples exist, such as when passwords were really stored everybody-readable or the ability to have a file exist with permissions inconsistent with those of its containing directory. These all are small and relatively unimportant, but compared to now when we're trying to limit processes' disk access inside a user account, they look a little anachronistic. The main reason that we don't care much about the few of these that remain is that multi-user systems are used less frequently; our personal machines usually only have one user account logged in at any time (assuming they even have more than one) and most other systems use VMs for small sets of people rather than one big system with open login for the whole institution.

Re: Hmm...

There's another problem, which is that some of the old operating systems you mentioned or could mention were never subjected to the attack landscape we now force our operating systems to undergo. Early operating systems basically ran themselves and one program, so they didn't have to care about multiple programs running together. Even when they did implement this, the major concern was making sure those programs didn't crash or modify the state of each other, not securing one's operations against another one. Memory protection came along and we took steps to insulate one process's memory from another one, but again this was more to make code correctness easier rather than a primarily security-focused decision. Even in the late 90s, Windows gave every user local admin, with the concept of user accounts only serving to help organize things. Now we expect a secure system to do so many more things that make it harder. We expect a hypervisor to run VMs with total privacy between them (sometimes between them and the hypervisor). We expect that a multi-user operating system will only allow a user and root to access any of the resources of that user. We even expect that processes run by the same user will be sandboxed from some of the resources available unless a separate permission is granted, and it is the OS which has to provide for and ensure that. The operating systems we used to have were not only much smaller, but they also were not expected to provide the kind of security we need today.

Open-source devs drown in DigitalOcean's latest tsunami of pull-request spam that is Hacktoberfest

Re: Same issue with OS but...

This is a great point. The contest as they've set it up is seemingly well-designed to prioritize quantity over quality, and look at what they got last time. It would make a lot of sense for them to change the structure to actually help developers, meaning that really small PRs wouldn't count. Whoever sets up these rules isn't thinking hard enough about the purpose and benefit of what they're doing.

Re: Digital Ocean?

Malicious bots will find somewhere to host no matter what. As far as I know, DigitalOcean does respond to abuse requests and does take down people's servers when needed, but if malicious people find it easy enough to set up servers there, they'll still do it. Block those IP ranges and you'll find that others also attack. Block everywhere where attacks come from and you'll mostly eliminate the internet from accessing your site. I run a server there (almost all of its traffic is to provide services on request, it's not generating much), and if I scan my SSH and web logs, I find attack attempts coming from at least eight cloud providers and twenty non-cloud countries in the past week. Blocking all these ranges isn't a good answer to attacks because you'll at best reduce their quantity. Instead, make sure that not even a good attack will work and ignore the noise as the price of having a publicly-accessible system. If you're getting something like a denial of service attack, you have to worry about the source, but if you're getting automated login attempts, let them try a few times then ban their IP.

I love my electricity company's app – but the FBI says the nuclear industry bribed politicians $60m to kill it

Re: An honest question...

If you need that much detail, a system as you describe is easily implemented. Most people don't really need that though. If I'm trying to identify the cause for an unusually high electricity bill, I can probably figure it out from a usage-over-time thing. If it's the refrigerator as suggested below, my power usage will probably be rather flat at a higher level since that runs constantly. If it's temperature control, then my usage should correlate with the outside temperature. If it's a specific device, the spikes in the usage times tell me when I turned it on and for how long, so I can probably take a pretty good educated guess about what it is. Then I can turn it on for five particular minutes and reload the graph to confirm. I don't think there are many people who have concerns about a particular device starting to use an unusually high amount of power when it hasn't before. Given that, it's probably not worth very much to most people to install a device to catch this unlikely situation and take preventive action, especially as the hardware to do this will require time and money to assemble.

Re: An honest question...

You could easily do this, but only by buying and powering extra hardware. From an environmental and cost standpoint, having the electricity provider which already knows some of this just tell you what they know is better. If you have devices you think will do something worrying, by all means set up this system to have realtime data and the ability to automate. If you just want to know what a spike was, you don't need to do that to every device in your house.

Huawei's UK code reviewers say Chinese mega-corp is still totally crap at basic software security. Bad crypto, buffer overflows, logic errors...

Re: Not sure about this...

They're reviewing it anyway, so why not point out the problems? If they're hiding them from the public, that would be a problem, but they're not. They point out that there are many problems, and from the sound of it, the problems they have identified aren't exactly hidden. Even a very malicious version of Huawei can't get much out of that report other than that NCSC will read code sent to them and has some technical people in it. Meanwhile, if they actually changed some of this, it would mean that networks in the U.K. using Huawei infrastructure would be more secure.

It's Google's hardware launch day, and what do we get? A few Pixel phones, Nest kit, and another Chromecast

Re: Hold For Me?

Either location is capable of placing a call, so only one box needs reprogramming. It doesn't even have to be complex. Store the number in a queue (already done). Now hang up and remember the number exists. When the position of that number is low enough (probably one or two places away from getting answered), call them back and put them back into your normal hold system. The box that does the connection between people on hold and call center employees stays the same. The person at the other end doesn't need retraining. The only changes are an additional option in a menu and a function in a program which activates one of the lines and automatically calls out. Since most systems are built around a PBX package that already understands "call this number", it's not rocket science.

Re: Hold For Me?

My concern is what happens when a person picks up. If I have the phone near me, it still has to inform me of the person so I can pick up. That could take five to ten seconds, and an impatient or busy person on the other end might decide that my silence means I abandoned the call. If this feature makes someone hang up on my call, it won't be very useful. What would be more useful is a function where the automatic system could call me back when a representative can be allocated to me. The benefits of this don't seem to have gotten through to most big companies I've called.

It's 2020, so let's just go ahead and let Amazon have everyone's handprints so it can process payments

Re: Amazon have become greedy and annoying

Oh, the options are definitely there, they just keep trying to change my mind.

What shipping option would you like? Free two-day shipping with Prime*? No. In that case, we'll do the long free shipping.

Are you sure about that? Look at this list of Prime benefits. No? Fine, onto the next step of checkout.

We know we already asked about shipping and this is the payment screen, but about that prime option...

Thank you for placing your order. Might you want to sign up for Prime?

Atari threatens to hit fourth VCS shipping deadline, provides pictures of boxes as proof of product delivery

I'd guess that it has something to do with the link at the bottom where clueless people could pay for one. Maybe they're hoping to rope a few more people into the scam before they go hide.

YouTube axes crowdsourced captioning: Use our buggy speech-to-subtitle code or pay an approved third party

Re: That's daft

Or they could let people switch the community function back on. If it's such a big problem, let them make it disabled by default, but leave the feature available. Taking it out without giving an alternative just messes up the workflow for anyone who used to like it without providing any sort of replacement.