Posts by doublelayer

BOFH: They say you either love it or you hate it. We can confirm you're going to hate it

Re: So he was "visiting" during working hours

What if it's a keyboard which does that? Whatever the device looks like, it will tell the computer it's a keyboard. So you have three options:

1. Trust any USB keyboards, including the prospect of a malicious one.

2. Do not trust any USB keyboards, using something else to connect the trusted keyboard.

3. Go through a registration process to trust only a certain kind of keyboard. Some methods include only allowing a certain set of known keyboard IDs and therefore a randomly-chosen ID probably won't work or requiring the keyboard to enter a certain set of keystrokes to be added to the trusted list.

In any case, this has nothing to do with USB. A fake PS/2 keyboard could do all of the same things and you would have exactly the same trust problem. USB having the ability to connect multiple devices doesn't cause the keyboard attack. The closest it can get is that you can make a USB device that looks like something else, but the only way to solve that comparatively minor problem is to have separate connector types for everything which still doesn't fix the larger problem and also makes hardware a lot less convenient.

Re: offline backups on the recovery laptop?

My guess is that the recovery laptop has the clients for the backup servers and the encryption keys which are not stored on the tapes. Destroy those and you won't be able to decrypt and you'll need a new machine even to start reading. Of course, I'm sure the BOFH has plenty of other places where those keys are stored for insurance purposes.

Re: Jim and the long game

I doubt it. He wouldn't have to infect the BOFH's personal computer in that case because that doesn't affect anyone. From the description, the PFY appears to have really been sick. And we know that sometimes someone without the skills gets loose on a computer because they volunteered to help. I'm sure there are backups which this guy couldn't infect--there is no way they would let him get to the server room, but still a lot of work for them ahead which isn't going to end well for the clueless idiot.

On this most auspicious of days, we ask: How many sysadmins does it take to change a lightbulb?

You may have done all of those things, but that doesn't make those things your job. While the action of the tech in this case was something I'd never do (though mostly as I wouldn't want the consequences), I would have politely told them that no, it is not my responsibility to fix your lamp and I don't have the spare time to do so anyway. Had they asked me when I wasn't doing something related to my job and had they asked politely, I would have helped happily.

If I am the generally helpful person who does what everyone wants and because of that, I don't get my actual job done, management isn't going to care that I'm useful to my colleagues. They are going to complain about why the stuff they wanted isn't there, and I am going to face consequences. I will therefore not interrupt the important responsibilities of my job for people who demand my time without reason. I'm entirely on board with being helpful if I can do so without compromising that, but at some point, this is a thing I do by choice and therefore I may choose not to when circumstances are different.

Great reset? More like Fake Reset: Leaders need a reality check if they think their best staff will give up hybrid work

Re: Going on-site has certainly been made redundant in IT

Those are issues, not insurmountable obstacles. Thus, a company can decide not to care about them and nonetheless get what they expected.

Take the whole time zone issue. I currently work on a team which is all located in the same place but we have been working from home. Given the way we do our meetings and collaborate, I could do this without changing from up to four time zones away. If I was allowed to change the scheduling, I could expand that further. That's if we even have to meet on such a schedule. So it's not necessarily a problem to outsource to someone with a radically different time zone unless that doesn't work with the specific job. The other issues listed are similar--they can cause major problems, but if they're accounted for at the beginning, there can still be benefits.

Re: It Depends…

"slogging away in a hot factory, whilst everyone else sits at home isn’t really fair."

No, it's completely fair. You could make the same argument about the previous situation. It would sound like this: "slogging away in a hot factory, whilst everyone else sits in a nice air-conditioned office and just has to type isn’t really fair." It combines inaccuracy about what the others are doing with complaints about the job they knew they were doing.

If the people in the factory have been subject to bad working conditions, that should be repaired. I can imagine a lot of ways that work could be terrible and a lot of valid complaints. However, complaining that a factory job is not the same as an office job is not as productive. The complaints are true; I would much rather work an office job, but making the experience of the office workers worse doesn't help the factory workers in the least. I'm guessing that they have more concrete complaints that would really help them.

Re: Going on-site has certainly been made redundant in IT

If they're going to outsource, they could have done that at any time during the past decade. For that matter, they can do that just as well now. Some places have decided that their workers that are more expensive are still worth the expense. The question of whether they're worth the expense while not in the office is very different than wondering if you can hire someone elsewhere for cheaper.

In more pragmatic terms, there are a few issues with outsourced workers which companies know about and may factor in to their decisions. Time zone differences, frequent turnover in contracted staff, language issues, and administrative overhead of the outsourcer are all things that may change their decision. For workers they already have, they already know all those things and they're likely not to be very problematic.

NFT or not to NFT: Steve Jobs' first job application auction shows physically unique beats cryptographically unique

Re: The truth

How informative that was. Very original.

Some adjectives which really apply: incorrect, irrelevant. But thanks anyway.

Israeli authorities investigate NSO Group over Pegasus spyware abuse claims

Re: Israel seems to be a hotbed for evil tech companies

This isn't really accurate. For example, you've mentioned Cellebrite, whose most well-known product is a tool for breaking into mobile devices. They aren't the only company to make products for that purpose. Another well-known one is Grayshift, which is based in the U.S. You can find companies producing malware with government support in many countries.

Israel is a special case mostly because they have an unusually large tech sector for the size of their country, and many of their tech people have trained in security-related issues and chose to make that the core of their companies. They just have a lot of companies in that area, meaning they're bound to have some well-known malware ones in that mix. Some of those companies also get unusual levels of support by the Israeli government, but that's not unique to them either. This doesn't exonerate Israel for the crimes its companies engage in without investigation, but there are other countries who are culpable of the same.

Re: How does it work?

We don't have knowledge of everything in their code, so these points are based on partial information which has been released:

First, NSO operates several servers which are used to install and operate the malware. This means they know at least some of the targets because they are infecting them on behalf of their clients. We don't know whether it's possible to change those servers to ones that NSO don't operate. Similarly, we know that NSO has target limits where certain licenses are paid depending on how many devices you want to force spyware onto. That implies but doesn't necessarily mean that there is some mechanism for checking whether a client has complied with those licenses or preventing them from infecting others when they have run out of credits. This would also imply that they know when and by whom someone was infected even if they go to some effort not to know who the victim was.

More speculatively now, I think NSO must continue to control the malware after they've sold it because they are operating in a very ambiguous area. They do have some protection from Israel for some reason which has never really made sense to me, but if Israel decided they no longer supported NSO, there would be major problems for the company. Therefore, NSO needs to make sure that, whichever governments or groups (yeah, I'm not buying their claims) they sell it to, they don't sell it to someone who will cause Israel to abandon them. For instance, they could sell it to governments for repression of the local populace, but selling it to someone who would use it against Israeli government figures is something they'll do a lot to avoid. Making a version available which is easily controlled without their knowledge is an invitation to do exactly that. They have strong financial and safety incentives to control who gets to buy and who gets to be the victims, and I'm going to assume that they know these things very well.

Scam-baiting YouTube channel Tech Support Scams taken offline by tech support scam

Re: not for publicity

"Your point about number of subscribers as a reason for it not being a stunt only holds up if you assume someone who makes a living from YouTube wouldn't want to make more."

Not sure about that. Deleting a channel could put a dent in your subscribers if you have trouble recovering it, if recovering it doesn't automatically add followers, and least speculatively because none of us who weren't subscribers can subscribe right now when the name is in our mind because the channel's down. If this were for publicity, it would be best to have it recovered really fast after the news broke so people could come watch videos. I'm guessing it will stay down long enough that I won't end up watching it because I won't remember to go looking for it days from now.

Re: Scam bait at major printer co.

From the sound of it, you got hit by ransomware or something like it which destroyed your data. That means you don't have to replace the disk and could probably just wipe it and reinstall. I'm not sure if you've tried that, but unless they have some unusual method of actively destroying your disk or you had a coincidental disk failure, you might be able to resurrect it.

Back on topic, it's very useful to hear stories like this to prove to people that mere knowledge won't save you from all scammers out there nor does getting scammed mean you weren't smart enough to avoid them. I think this is important to better educating users including ourselves that the risks are higher than some might think.

Re: I was a bit surprised by this bit

It's not really tech knowledge that protects one from most scams. Knowing how to make the computer do what you want it to doesn't help you figure out that the bank alert is not real. We would hope that technical knowledge leads to checking links, but that's more a factor of laziness. Meanwhile, young people have less experience with a lot of life's details; if you've had a bank account for five years, you may not have seen what actually does happen when someone has compromised your account details, so when the call comes that someone has done that, you don't know that it's unusual.

I think the only reason that we more technical people are better at avoiding scams is that, since they involve a computer somewhere in the chain, we're told about them more often. Awareness, rather than knowledge, is our primary strength. However, I must warn those who think it's an impenetrable shield that we can get scammed too if the other side is convincing enough.

Re: Always trust Microsoft reports - not

In fairness, just because someone has been calling you more doesn't mean the aggregate goes that way. If we're battling anecdotes, I have been waiting for a tech support scam call because it seems much easier to waste their time when they have to have a person on the call. I'm still not sure if it's disappointing or nice that I haven't gotten any. I do get automatic scams where the robot wants me to confirm I'm gullible before they put a more expensive human on the call.

What is your greatest weakness? The definitive list of the many kinds of interviewer you will meet in Hell

Re: Resources

Beats a company I don't work for and never have who decided that "resources" wasn't impersonal enough. They decided to call their skilled employees "human capital". I don't know how they treated those employees, but that always struck me as unnecessarily honest. Yes, it was a financial company.

Re: Why do you want to work here?

You have money, I have the skills you are looking for, and I wouldn't mind having some of your money.

I always find it strange that they think I have some burning desire to work for a company--there are companies I want to avoid working for, but I've never marked a specific employer as an absolute goal. This question becomes all the stranger if it's somewhere that contacted me.

Re: Reverse

I don't like that approach, or rather I only like it in a very restricted set of circumstances. Unless the candidate has already been told a lot about what they will be doing, they don't have a lot to ask about. After the obligatory question about what the job involves, and some necessary clarifying questions, the candidate is likely to know what it entails. So one of two things happens:

1. The interviewers know everything about the details and are willing to share that information, so the interviewee has to ask about active tasks that they would be working with, essentially trying to solve problems without ever getting to see the system, code, or whatever else is involved in the problem. This is if the interviewers tell the interviewee that they're doing this, because most interviewers don't even know that stuff so the interviewee usually knows well enough not to interrogate them on the internals.

2. The interviewers either don't know the details or don't want to disclose that to anybody who can get into the interview, so the interviewee has to come up with enough questions to fill the time. Instead of learning anything about the interviewee's qualifications to solve the problem, the interviewers learn of the interviewee's ability to improvise and fill time. While improvisation is a useful skill, it's not very useful if the more important qualifications are lacking. Filling time uselessly is a negative except in sales or law (and isn't necessarily great there either).

By all means let the interviewee ask questions, but unless you give them enough information beforehand, which questions they ask isn't going to prove much about their skills.

I don't think it's having the opinion that's the problem, but instead how you express it. If an interviewer asks what systemd is, they want you to describe what it's for and how it's used, not what you think of it. Commenting on its design decisions which you think are good examples of something you will avoid later is a middle area. Shouting that it's the worst thing you've ever seen is, even if they agree, not a great harbinger of your ability to accept things that you don't entirely agree with.

"As the article says, the employer needs to avoid anyone who is applying solely because they're desperate for a job."

I'm not sure about this. There can be several cases where someone does need a job badly and is also quite capable of doing the work involved. That someone is applying because they need a job doesn't automatically mean they lack the ability to do it properly. For example, someone who took time off to deal with an emergency which has also depleted their savings could be very desperate for an income stream, but that situation could also happen to any one of us given a sufficiently bad emergency. On another level, anyone getting their first position in a field will have faced some difficulty proving their qualifications without citing experience, and they could be very interested in finding a position, any position, so they can prove their abilities as a professional. Yet everyone here who has a job at one point didn't have any job experience but still had skills.

As an interviewee, if you're desperate for a job, hide it. Many interviewers will follow this quote faithfully. To interviewers, I suggest you become the exception to that rule.

Re: Oh yeah…

That's fine if you're at the offer stage when you decide you don't want to do that job, but if you're still in the interviewing stages, the costs are higher. Especially if the later interviews have time or location costs for you. Taking a day off work to travel somewhere to interview for a position you don't want in the hopes that you can suggest a ridiculous salary and they'll accept it is not very useful and certainly unpleasant. For similar reasons, I don't automatically start interviewing for positions when recruiters find me--having a bunch of one-hour initial interview calls isn't that hard, but it's often time wasted.

Re: That Meme

Okay, I'll ask. What is it that you want to hear when you ask that question? I've seen a few basic answers, either listing qualifications of use to the position (you already have that in front of you) or platitudes about a hard-working, motivated, interested, team-working self-starter (useless). This becomes even worse if it's the kind of interview where someone might end up in a few positions, because now they're not sure what specific qualification you're hoping they'll tell you about.

Re: It's a two-way street

"to people who neither know nor care about its products, ethics, "work-life balance" or anything else except the number on the offer letter, [...]"

Mostly agree, but I really do care about their work-life balance. I currently work a normal working week and I know how to request time off (and it's easy). If they want me to work long days or weekends, they'll have to pay me a lot more if I agree to go through that at all. Sadly, even though I care about this, I've never heard anyone tell the truth about the balance. Nobody ever comes out and says "To take time off, you must submit three forms through the complex portal with at least two months notice then wait for manager approval which should take about seven weeks", even if that's the case. If they ever did tell me, I would be listening with close attention.

eBay ex-security boss sent down for 18 months for cyber-stalking, witness tampering

Re: What about EBAY

"I wouldn't assume anything and what's your evidence this went wider?"

Your caution is good, but I wouldn't assume they're innocent just yet. There isn't evidence known to me to confirm that someone higher in the organizational structure knew this, but the situation is such that it would make sense. This is not a thing someone does just for fun. They obviously had a business reason for doing it. The question is whether these people found the problem themselves, decided on this plan of action themselves, obtained the resources themselves, and then carried it out themselves? While not impossible, I don't think that's likely. I'm almost certain someone else found the potential PR risk, although that person could well be innocent and just introduced it to the people involved, but the following questions are worth asking and I hope investigators will be doing it:

1. Who came up with the idea? If not one of the people involved, they should face consequences.

2. Was anyone else asked for permission to conduct the behavior? If so, they should face consequences.

3. How did the perpetrators obtain the resources to conduct their behavior? From which budget were they taken, and who controls it? If not one of the people involved, they should face consequences. Additionally, who was in charge of reviewing their resource usage and how did they evade that person?

4. To whom did they report, and was that person aware of what they were going to do? If not, how did they hide their plan?

It's possible these people were just really driven to be horrible to someone else and they found the targets and hid everything from everyone else, but my admittedly small experience with companies making decisions suggests that this may not be quite what happened.

Slacking off? It used to be there was pretty much one place to chat with your fellow developers: IRC

Re: ignoramus

"Why need server for peer-to-peer chat? Why not keep list of friends like email address book?"

Because most chat systems allow someone to join. That means the person joining needs a place to contact with a request to join and everyone involved would need to update addresses. If you have ten nodes in the network, that's ten possibilities to have different contact lists until they all figure out what they're doing and sync it. If you send big messages (files mostly), then you need to send ten copies even if nine of the people don't intend on using it. Also, you need to relearn everybody's IP addresses each time they change, which can be a lot if using the IPV6 privacy extensions or on an unstable IPV4 network.

"Then we need to little more than give our mail/address book apps a chat protocol alongside mailto/pop3/smtp/webmail/blahblahblah."

You can put the chat protocol into your mail client if you want to. It won't do that much other than keeping it all in one process.

Re: ew

So include those in the package. There are mechanisms for managing Python dependencies so you can deal with outdated systems. Alternatively, have the installation process rely on those dependencies and then check at install time whether they're met satisfactorily. If not, you can still do the full install method.

Even with that, there's no need for it to install a database server for you. Make it clear it needs a Postgres installation, and ask for credentials just like everything else which has a database does. A user can easily install the database from their package repositories and let the install scripts do all the setup if they don't want to manage that themselves.

Thinking about upgrading to Debian Bullseye? Watch out for changes in Exim and anything using Python 2.x

Re: "the value of exFAT support is mainly"

FAT32 has a limit on the file size, which is a problem if you store things like OS install images, large video files, backups compressed into large archives, or anything else where you might need something big. I welcome exFAT support because that has already been the most efficient way of using physical storage to transfer large files between other systems (Windows and Mac OS have supported it natively for a long time). Of course it was possible to do so already through extra layers, but native support will just make things faster and easier.

You, too, can be a Windows domain controller and do whatever you like, with this one weird WONTFIX trick

Re: Right to repair

Would this spell an end to Intellectual Property?

No? There's still copyright. For the most part, you can't simply copy anything more than small code fragments without permission.

Yes, it would. If you make it legally required to release the code, then either you have to let people change that code by fixing it or the required release will achieve nothing because it would still be illegal to do anything with it. The argument about whether this is good is one I'll let others have, but you can't have your enforced-open-source cake and expect copyright to continue to have any real existence.

Dell won't ship energy-hungry PCs to California and five other US states due to power regulations

Yes, for the stated power states:

"The standards [PDF] specify energy consumption targets that cover four non-active usage modes – short-idle, long-idle, sleep and off-modes – tied to the device's "expandability score" (ES), based on the number and types of interfaces, and on additional power requirements arising from add-on capabilities (graphics cards, high-bandwidth system memory, etc.)."

The power consumed while idle is important to these standards.

It all depends on idle power consumption because that's what the law is about, so even if one is significantly more efficient under load, this law doesn't care. When running at idle, a lot of things consume power other than the CPU, which is probably why gaming computers are the ones that don't fit within the bounds. Only if one manufacturer can make large enough cuts in their processors' consumption when idle will that make a difference, and it's more likely that the PC manufacturers will find a way to make the more power-hungry components run better instead.

Private cryptocurrencies make lousy national currencies: International Monetary Fund

"The exchanges and the miners drive the fraud, often one and the same but they don't need to be."

In fact, if you're attempting to prove that it's a Ponzi scheme, then they not only have to be, but their activities have to be fraudulent, not just worthless and speculative. The term has a meaning and it's quite specific. It does not mean "of dubious value" no matter how much you try to define it thusly. A Ponzi scheme is a method of someone stealing your money, not of you throwing it away. Cryptocurrencies frequently are the latter.

Well, duh

When a country changes or adds a currency, they select something that's been at least somewhat stable. Just looking at the exchange rates between the popular cryptocurrencies and fiat ones over the past couple years confirms that one of them isn't stable, and living on Earth confirms which one that is. No sane country would look at that and decide to make one of those an additional currency. The closest they might get is using it as a short-term payment method, but few would be desperate or experimental enough to try that either. Most common cryptocurrencies are doing a terrible job as currencies, and everybody knows this.

No, it's not a Ponzi scheme. That doesn't, in itself, make it a good idea, but if you're going to argue against it, do so accurately.

A Ponzi scheme requires a central entity transferring real value to handle transactions in falsified value. In clearer terms, someone has to run the scheme and commit the fraud. Cryptocurrencies do not have such a person. This disqualifies them as Ponzi schemes. In your argument, you said "you're supposed to think if everyone sold off, there would be something left of value, but there would not.", which is correct, but doesn't a Ponzi scheme make. In fact, that statement is true of any other real currency--if we all decided tomorrow that the pound was worthless and sold ours, it too would go to nothing.

Most cryptocurrencies are bad as currencies and weak as investments, with no external worth and hideous volatility due to investor activity. That almost certainly means that you shouldn't rely on them for storing or making money. They aren't fraudulent though.

BOFH: You say goodbye and I say halon

Re: Not the Halon!

I'm betting it did. They didn't need it anymore, so they had it discarded while pocketing a large "disposal fee". If they left it, that's just more problems when they use it on someone. Replacing it with a perfectly good alternative which is now known and therefore unsurprising is a neater way of throwing off investigations.

London. The company has moved premises from time to time but has always remained in or near to London. Of course, sometimes it's a London as envisioned by a New Zealander, but London is the goal nonetheless.

Re: Not the Halon!

They don't need to keep it. They just need some gaseous method of keeping people out of the room, and if they've implemented the nitrogen method correctly, that will work as well. Or, for that matter, if they've pretended to implement it correctly, that might be as good a deterrent as any. More importantly, if they had an event where halon was detected, it's a worse excuse if it's illegal to have around. They might not be found out for the original use, but they'd have consequences already.

Cloudflare slams AWS egress fees to convince web giant to join its discount data club

Re: Man in the middle attack

It sounds like you should be writing an extension for Firefox. That behavior regarding certificates is more complex than a browser typically supports--you can easily remove or distrust a certificate, but providing the data on each load isn't going to get added. It should be easy enough to implement by someone willing to write the code though.

Is it broken yet? Is it? Is it? Ooh that means I can buy a sparkly, new but otherwise hard-to-justify replacement!

Re: Ah, "I will know it's new".

If you store batteries for a long time, storing them at colder temperatures may extend their shelf life. How much it does so depends on the chemistry of the cells. I've seen people with more space than they need put batteries in the fridge for that reason.

A warning that if you're going to do this, do not put them in the freezer. Everything will fail if you make it cold enough, and the freezer is usually too cold for batteries. They could become mechanically damaged. If in doubt, check if the cells have a temperature rating and adhere to that. If they don't and you're still in doubt, room temperature is going to be fine enough.

Facebook gardening group triumphs over slapdash Zuck censorbots

I hate Facebook quite intensely. I feel I should state that right at the beginning so I won't give any misconceptions here.

They are neither "a quasi-state" nor "a government", nor are they particularly special. Reasonable arguments can be made that they are abusing a position of power, but they do not have the kind of power you think they do. Specific allegations include that they could close the pages used by businesses, which is true, but the businesses have the choice to operate their own business site or to use one of many other networks happy to host it for them. The fact that many businesses choose to only use Facebook does not mean that there isn't an alternative, and in this case the alternatives are cheap and better. Similarly, Facebook may be someone's only communication mechanism, but only if that person really hasn't bothered to get a phone number or email address from their contacts, which is not that hard.

Facebook has committed many violations of their users and those who try to avoid them, but you can't just declare them to be states without evidence. The large number of alternative superior ways to communicate and publish indicate that they aren't preventing those activities. It doesn't approach the restrictiveness of a company town, given that it can be avoided without significant cost. Its deplorable actions should be countered, but without elevating it to a position it does not and must never be allowed to inhabit.

Akamai Edge DNS goes down, takes a chunk of the internet with it

Re: Bad days happen to everyone

If we consider how much of the internet uses these services and how infrequent these events are, despite the attention each one gets, you could come to the conclusion that the services are actually pretty good at keeping sufficient resilience such that you don't have to worry about them most of the time. I don't know if that's a positive or a negative though--if they were less resilient, then maybe people would have more than one and they could better withstand the failure of one such system.

Re: Thankfully!

I assume they wanted to use two icons, and they're only allowed to select one.

You're not imagining it. Amazon and AWS want to hire all your friends, enemies, and everyone in between

Re: "I don't know how much AWS gives back to the ecosystem"

"Oh- wrong again. Go and download it and run your own X node cluster, where X is as big as you like, and pay Elastic nothing."

Yes. And when Amazon did so in order to charge people for it, Elastic got annoyed about Amazon using the right they explicitly gave them and attempted to adjust the license to take that right away. Currently, their new license still lets me set up a cluster for my use if I don't sell it, but if I make money off that, what's to say they won't change the license again because they don't think I'm giving back enough when I donate the amount I think they deserve? This is the debate. Should they change the terms because they want more money, which they have the right to do? I think doing that is against the spirit of the licenses they used.

Re: "I don't know how much AWS gives back to the ecosystem"

"I see that you thrown in "rent seeking" buzz-word, but in the context you used it, why don't you accuse workers of rent-seeking? Why company should pay workers every month?"

The difference is what they said before. The workers signed a contract saying they would be paid, whereas Elastic didn't. Therefore, the workers are asking for what they already agreed they would get, whereas Elastic were asking for something nobody ever agreed to give them and, in fact, something their license said wasn't required in the first place. Once again, I can see why Elastic wanted it, but changing the license terms is not a very nice thing to do, especially given that there were other contributors to the code whose contributions were being exploited just as much as Elastic's were.

Europe mulls anonymous crypto-wallet ban, rules to make transfers more traceable

Re: Inevitable

This is tough for me, because some of your points are great and some are very wrong. I suppose I'll just have to go down the list:

"1) Environmentally damaging": Yes, very much this.

"2) Unstable": Correct and important.

"3) No sensible control of supply, the "Mining" is the stupidest part.": Incorrect. The supply control is built into the specification of the currency in the first place. There is a finite number of Bitcoins that can ever exist, for example. Most proof of work ones have difficulty levels which act to restrict supply. This is one of the things the designers intended right at the start.

"4) Transactions don't scale.": Probably the most important point you brought up and one I've had to explain to cryptocurrency fans for years.

"5) Transactions are 1000s of times more costly in time and computers and energy than IBAN.": Yes, this too, although it's kind of a necessary corelary to 1 and 4.

"6) The only reason for Blockchain is to decentralise, have no control and enable a degree of anonymity. All naive and stupid design decisions.": Why are those naive or stupid? The users don't trust central control, so they remove it. They also value privacy. I can see not caring about those yourself, but is there a reason it's stupid for others to care about them? I'm not an adherent of cryptocurrencies and yet I think those points have value.

"7) It looks like a Pyramid scam": Other than having a central controller, using others' money to pay back previous investors, or the person who is going to walk off with the money. It's missing most aspects of a classic pyramid scam. You can scam with it, and it's a very risky investment, but it is not nor does it look like a pyramid.

"8) It is purely speculative in value.": A lot of things are speculative in value. Avoid investment, if you will, but many others don't view this as a deadly fault.

"9) Not actually a currency.": Not a good currency by any means, but you can have it and pay people with it, it is fungible and can be exchanged. Functions like a currency.

Re: Inevitable

I'm sorry, but what?

"the transfer limit would mean that assume an average of a 1k ransom, then 10 "customers" could be directed to a given wallet a day, having to create many hundereds of legit wallets a day would lead to throttling and easy detection"

No, it wouldn't. They don't need to set up legitimate wallets to receive payments if they can exchange somewhere other than the EU. They can even live in the EU and exchange elsewhere. The people who need to set up registered wallets would be those paying the ransom, and they would only need to set up one. The creation of unregistered wallets is easy.

"2 the internet is ultimately answerable and licensed for operations by governments, if they say no they its a no, freedom online is an illusion"

Well, sort of, yes.

"icann answers to the US govt, RIPE to the eu and uk govts,"

So what? So the ransomware operators can have domain names taken off them (and it wouldn't be ICANN doing that anyway). And if they registered their own IP blocks, those could be taken away too, although they never do that. How would this affect them at all? They mostly use Tor hidden service domains, which ICANN cannot take away, and they'll operate on anonymous hosting accounts or compromised computers which can be shredded whenever they're concerned. How does the regulation of basic internet operations impact this and if so, why hasn't it been used before?

Re: Inevitable

I'm afraid this isn't correct. The regulations require tracking of people setting up wallets and moving money inside the EU, but don't have control over the technical systems of any cryptocurrency. Without a regulation making the payment of ransoms illegal, this would do nothing--user identifies themselves, exchanges cash for crypto, pays crypto to anonymous wallet, ransomware operators exchange that crypto somewhere outside the EU without identifying themselves (which they're already mostly doing).

The only thing this gives you unless you make payment of ransoms illegal is a list of people who paid the ransoms. They would still be able to do so easily.

That doesn't break this system unless you mined or bartered for all the crypto you have. If you wanted to exchange some cash into crypto without being known to this proposed system, you would have to go to an exchange that's outside the area where you live (or is willing to break the law). Therefore, for most users who got the crypto by exchanging local currency, they and their wallet public keys would already be known and stored.

Thales launches payment card with onboard fingerprint scanner

Re: "There are concerns over using fingerprints as an authentication system"

True, but this doesn't really change that. They're going to pay that whether their customers use fingerprint cards or normal ones. The only way to avoid that is to not accept cards for payment. I've only seen a few places do so. With that in mind, there's not really a benefit to the user of the card to use this system, and therefore not much benefit to the company in using these more expensive cards and dealing with technology issues getting them accepted.

NSO Group 'will no longer be responding to inquiries' about misuse of its software

Re: This is a strawman.

Yes, that is what I assume. AWS has a lot of rented servers. It would be hard for them to know what each one is being used for. They identified some as being connected to NSO, but we don't even know if they got that from the account details or were just told of the service IDs. Either way, it wouldn't be hard for NSO to come back with a fake name and do it all again.

Re: SWaaS

"I bet this all started with some suit ordering their techies to do it over their objections."

I don't think so. Technical people have the option not to do this, and they especially have the option not to do this well. To get a successful set of exploits and use them to this effect, it wouldn't appear they have technical people doing this under duress. I would be comfortable assigning guilt to any programmer on their software and I wouldn't be so quick to assume the blame only resides with a subset of those who know what's happening and do it gladly.

Hijacked, rampaging infrastructure will kill humans by 2025 – Gartner

Laziness. Convenience. Desire for short-term profit. Failure to consider consequences.

This answers a number of similar questions too.