Posts by doublelayer

Chromium devs want the browser to talk to devices, computers directly via TCP, UDP. Obviously, nothing can go wrong

Re: Trustworthy?

"Forced? Were they holding a gun to the head of your firstborn or something?

Or do you mean 'I had to because SHINEY!!!!1!'?"

Well, I wasn't that person, and I haven't been forced to run browsers for a while, but maybe it was one of those services that it's not that easy to avoid. For example, services where you have to submit paperwork that your employer or government is asking for. Those sites have a distressing tendency to demand one browser, and while they sometimes work in other ones, sometimes they just don't. You could hope that the system concerned has a mail or fax option (if you don't mind printing things and waiting a week for the post and two or three for someone to pick it up and process it), but otherwise you're a little forced to use what they're asking you to use. Not deadly force, but force nonetheless.

Re: "Like WebUSB, WebMIDI and WebBluetooth, …"

It hasn't worked so far--their Chromebooks keep gaining new features for some level of Android or Linux compatibility because people have realized that computer that runs most things beats computer that only runs a browser. Why do they want this so much anyway--they could just make Android laptops (just add more keyboard support) and get users to hand over all their data that way. It seems to me that if they want to capture all our data, they don't have to do so much work to try to force a limited OS on us when they've already got one that people use.

Reap it in the family: Four brothers accused of cheating Amazon out of $19m in wholesaler fraud caper

Re: Amazon screws it's business customers every day

"Whats the harm in a tiny payback"

Well, if you use Amazon, you've probably had to pay a little extra so they could handle the costs of the fraudsters' payback. So, in effect, the frauds got some payback but you were the one paying. There's the harm. I figure you already know this, but you felt the need to ask and I felt the need to answer.

Someone please have mercy on this poorly Ubuntu parking machine that has been force-fed maudlin autotuned tripe

Re: Full fledged consumer desktop environment?

You are entirely correct. They included enough storage to give me more of my utilities, but they have chosen not to. Similarly, they have chosen to fry logs on shutdown (or they've hidden them really well), which is making my job tricky as I'm trying to figure out why it keeps shutting down and all the log I have is the one from the last time it rebooted. I found a list of all the utilities available to me, but I keep typing the ones I don't have out of muscle memory.

Re: Full fledged consumer desktop environment?

Well, as I'm currently trying to debug a network device which has decided to provide me basically no utilities, maybe we can find a middle ground. I'm getting tired of seeing "command not found" on nearly everything*.

*So far, commands I expected to be available but aren't include less (and more), uptime, grep, and scp.

Aw, Snap! But you should see the other guy – they're in dire need of a good file system consistency check

Re: Rocket science or crash

To be fair, a request for a FSCK doesn't necessarily mean drive failed. It could have been a power or software problem which caused a shutdown without syncing everything. So that could possibly be down to an OS error, although it could also be one of two hardware failures or a non-OS software failure.

Bluetooth SIG strives to make wearables work as COVID-19 contact-trackers

Re: Not quite thought it through

If I squint at it, maybe they're hoping that children will have some other device which picks up contacts over BT, then that syncs with their parent's phone to do the tracing. Which would actually work perfectly if not for the fact that most Bluetooth devices never get software updates, most of them don't have the storage to keep logs of their own identifiers (which change somewhat frequently) let alone identifiers for every passing device, children probably don't have many such devices, and most devices you could hope to put this in wouldn't serve their primary purposes unless they were linked with the phone the users don't have. Unless they're planning to design a custom device intended only for this purpose, they have little chance of success. If they are planning to help create custom devices, they don't need to modify the specification to do it. So I have no clue what they want to do.

Pretty wild that a malicious mailto: link might attach your secret keys and files from your PC to an outgoing message

Re: Lets see ...

It has nothing to do with your server. That's as secure as it was before. It's your users who might have the problem if you decided to alter the content of the pages you are pushing out. Specifically, if you modified the link, they clicked the link, their mail client didn't block your change, they didn't see your modification, and they sent a message, you could get them to divulge a file from their system.

SQLite maximum database size increased to 281TB – but will anyone need one that big?

Re: How is that possible ?

Original: "Primary keys are they to help you find things, if you don't need to refer to a table using a foreign key there is no real need to have it."

Reply: "Um, if you don't need to refer to a table in a relational database, then what's the use of having it ?"

The operative part there is "using a foreign key". You need such an identifier when you have a table refer to rows of another table so you can quickly find them. In various cases, you don't need that. For example, there are these:

No selects between tables option 1: Table is used as a method of data storage. Like any other data structure containing only primitives, it is read in in some custom way by the program without necessarily meaning specific records or single rows that need to be found alone. Quite possibly, it's only used to maintain the data on disk, meaning only writing operations and a single set of reads are performed. No specific selects are run.

No selects between tables option 2: The database contains a number of rows, but the rows aren't important on their own. Therefore, there's rarely a need to refer to a single row. Instead, users filter based on columns, which won't get sped up at all by having a key for each row. For example, this would apply in many cases where a database's primary interface is a big page with a lot of possible filter and search options. Keys are still used on a lot of these, but it's only to make selecting rows for editing or deletion a little faster. If people don't edit or delete rows very often, this is less important.

Re: Looks like I need to

"You can joke but what the hell is going on with memory capacity anyways? People are rolling with 16TB drives on a system with 8GB of RAM..."

For most of them, that's what they need. If you're doing something like training a neural network, you need a lot of RAM. If you're editing video, you may need less but you still need a lot. If you're organizing your massive photo collection, you don't need very much. I think this might actually be a good sign. For several years, the 8 GB RAM amount has been a functional amount and modern operating systems can even survive with 4 GB and be usable for most tasks (Linux may always have been this way but I think we all know about Windows 8). OS and application developers may have realized when they're being too free with their memory usage and focused on holding their hunger back.

Samsung slows smartphone upgrade treadmill with promise to support three Android generations on Galaxies

Re: Competing with Apple

"The original SE was based on the iPhone 5S platform, so it is still receiving security updates for iOS 12.x despite being left behind feature-wise by iOS 13 last fall."

Not exactly. The SE was put into the same case as the 5S but includes the internals from the 6S, so it has continued to get support for new versions of IOS including IOS 13 and 14.

Linux kernel maintainers tear Paragon a new one after firm submits read-write NTFS driver in 27,000 lines of code

Re: Bit harsh

"Why should there be a "call to arms" if the prospective contributor has put (charitably assuming) minimal effort into preparing the contribution to be usable, and better alternatives already exist?"

Do better alternatives exist? Ones that run quickly and support a lot of functionality? Ones that don't require complex installation or configuration for distro devs, one of the main reasons short of performance that stuff gets put into the kernel? I haven't seen that.

A call to arms doesn't mean that everyone drops what they're doing and starts focusing only on this. It could be much more basic than that. For example, a call to arms among a couple of people who could read some of this code and give advice to the original developers about how to modify it to more easily connect with the kernel and get through a review. Unless the code is worthless, it would seem like there might be some benefits in doing something like that, especially as the original developer claims they're planning to continue to support it. They might be liars, but if they didn't care at all, they wouldn't have donated this in the first place. Maybe it's worth believing them and allowing them to prove it by helping them to make it kernel-worthy. If they don't bother, we're only a few emails down.

Reply-All storm sparked by student smut sees school system shut down Google Classroom for up to a week

Re: Clearly run by dummies

"Why isn't a mailing list set to provide emails to each person in turn, or to a dummy address with everybody else stuck in BCC? I'd be pretty pissed off if a school was willingly sharing my email address with all of the other students..."

Almost certainly, it is set up as you suggest and they aren't giving out addresses. It's just that they forgot to change the all-important setting of who can send to that list and have it operate for them. Usually, there's an address which sends the message to all the addresses in the list without showing that list to the original sender, but if anyone on the list can be a sender you end up in the same place.

Pot, meet kettle: Google claims Australia's pay-for-news plan could see personal data put to nefarious uses

Re: Paying El Reg

They would have you log in, which we already are, and then if you had purchased a subscription they would delete the ad frames, the Facebook share button and secret pixel, the various other buttons, any other third party scripts, etc. They could do that and I would pay for it. No tracking doesn't mean they would be blocked from having a log in system, but that they would be blocked from collecting information based on it or letting someone else do so. I already trust them, so the only important bit is "letting someone else do so".

Mozilla signs fresh Google search deal worth mega-millions as 25% staff cut hits Servo, MDN, security teams

Re: Sad to see the end of Firefox

And how often do you make new accounts? How often do you completely erase Chrome, including those secret tokens it stores somewhere (or maybe it doesn't, but try proving that). Because unless the answers are "every twenty minutes" and "every five minutes", your efforts are likely not as useful as you think they are. If you create new accounts but use the same Chrome installation, then it could just link those created accounts together. Eventually, it will create not only a profile of actual information you've entered (for example, any time you made a payment it has a reasonable chance that you entered trustworthy information), but also a comprehensive list of pseudonyms and dummy accounts to which you have access.

Re: Diversified to death?

"There's no money in a browser engine?!! Come again? They're raking in $400 million (!) a YEAR."

But not for the browser engine, for the market share. The engine itself isn't making them the profit. Should Google succeed in getting Chrome to 98% market share, they wouldn't have any reason to keep paying Firefox to send users to their pages and earning them ad revenue. The engine is the thing that is most reassuring about Mozilla, because they haven't abandoned it and it continues to allow some competition, especially important as Google keeps putting things into Chromium that rely on Google-run services. Basically, the thing that makes Mozilla money is their history of having a great browser, and they are currently using at least some of that money in maintaining a good browser engine.

That doesn't help. Firefox security is critical, and it's the main security team that I care about, but Mozilla's recent product is a VPN, which is one of the ways they are planning to make money. That isn't Firefox, meaning the Firefox security team probably doesn't work on it. Who does? I probably wouldn't be that confident investing in a VPN if the main organization security team had been completely eliminated, and Mozilla is facing a market that already has established competitors while their effort is only a couple months old. I would have thought that it would be in their interest to put as much behind this project as they can to ensure customer confidence and hence customers.

In addition, they must know that firing workers without a clear indication of funding problems is going to cause concern among those of us who pay the most attention. Those people who pay a lot of attention are also the ones most likely to understand the benefits of and need for a VPN. So they are going to risk harming their image amongst what is probably the largest demographic of VPN customers. I don't understand that decision.

NHS tests COVID-19 contact-tracing app that may actually work properly – EU neighbors lent a helping hand

Re: Like to have an expert check the privacy statement & app

I believe your downvoters (for the record, I'm not one of them on either post) are concerned that the app will collect or retain data not specified in more readable statements. It is possible to do one's research by reading the published source, manually build, and attempt comparisons between that and published binaries, but it's not easy. I'm sure it will happen. If I was in the U.K., I would probably spend time doing so. Depending on your level of trust in the government, you may disagree on the need to do such research anyway.

Re: Over sensitivity

"Why is there so much of a concern that the app may be too sensitive, and is likely to over estimate the risk of infection from people 2m or more away?"

It is a lesser concern than various other potential problems, but mostly the worry is that people will become desensitized to requests to quarantine. If the app detects people at a distance, then it will probably pick up lots of them who are on the other side of walls or windows. If it produces a lot of warnings from this then people will be frequently requested to quarantine. If people quarantine without symptoms for a few times, they may think the app isn't doing anything, meaning they ignore it next time it says something. These particular ifs haven't been proven too happen yet, but it could reduce the efficacy of the app if they did. There are other concerns which are more important, including the opposite (no reports because of lacking adoption or testing leading to complacency), but it is at least worth some consideration.

Well, what are we waiting for? Three weeks later, Windows Embedded Standard 7 still didn't have the answer

Re: The old laptop killer

That's annoying. We should see if we can get all the boot encryption systems to have a timeout after which they power back down. At least one I know of does that--if I don't enter my encryption password within two minutes or so, it shuts down again.

The Surface Duo isn't such an outlandish idea, but Microsoft has to convince punters the form factor is worth having

Re: Does it run Windows?

Out of curiosity, would you want it running Windows? It's running Android, which well I'll admit I don't like it very much, but at least it's open and compatible with other mobile devices. In addition, Android has been designed for mobile devices with touchscreens as the primary or only interfaces, which is what this has. Windows has been adding that support, but I don't think the Windows tablet experiment worked very well given that I haven't seen any of the cheap tablets still around and every Surface I see has a keyboard connected. Then again, they're also working on a Windows-based thing that's shaped kind of similarly, so maybe you'll want that when they get around to releasing it.

COVID-19 has done what Microsoft and Intel couldn't – given people a reason for a PC upgrade

Re: Upgrades not replacements?

If the business bought it, it's probably a Thinkpad so it's easier to standardize and repair. I think that was probably most of it, as Lenovo is better known to businesses than to the average home user. Home users may have gone out to buy new machines to some extent, but they probably buy whatever is available at the local shop, which probably means cheaper machines from Dell, HP, or Asus. Also, home users are more likely to slow their purchases while businesses which previously used desktops had reason to buy lots of laptops at short notice, so that might also contribute to a primarily business-oriented buying spree.

Texas jury: Apple on the hook for half a billion dollars after infringing 4G LTE patents

Re: It really is time that anything included in a standard is royalty free.

Updating my comment immediately above: I wanted to provide more information on a topic more relevant to this case. My example on radio broadcasting still stands, but since it's not mobile telecoms, let's instead look at OFCOM's regulations on mobile telecoms. On the above page, there are documents describing frequency bands which can be licensed by providers for use in a wireless telecommunications network. Below this is a list of standards documents that have been regulated into use by EU directives, the U.K. government, or both. These include technologies known to us under the headings 3G and LTE. They do not include a do-anything-you-want provision. They also include a requirement to interoperate with international service providers. In my opinion, this counts as government endorsement of specific standards.

This endorsement is a good thing. This allows phones to be in use worldwide, assists the development of better communications technology, etc. I feel that this endorsement also gives governments a good reason to have more control over the standards they are using in such ways, up to and including extra powers to increase requirements for FRAND-style IP regulations. For all I know, the ones in use here are entirely fair; I'm still not knowledgable about this case. In the case that a standard is created and given assistance in a similar way, and the terms are not fair, I view the conditions to which these standards are often put means that there is adequate rationale to restrict what licensing provisions can be applied to the IP.

Re: It really is time that anything included in a standard is royalty free.

"I think you misunderstand how 3gpp works. It is not a governmental organisation and the standards developed by 3gpp are not approved by government"

I'll be the first to admit that I'm not particularly knowledgeable about the IP included in this particular case. My comments were more generic, and if they don't apply here, they still apply elsewhere. Plenty of standards in wireless communication are approved by regulatory bodies and include proprietary technology. For a basic example, digital audio radio broadcasting. It's not exactly the closest match to this situation, but I'm using it as my example because the technology is so simple. There are a few technologies in common use in different countries, but in most cases, each country has one standard which is in use while other standards are not approved outside of experimentation. The most common standards are DAB+ (Europe, Australia), DAB (U.K.), HD (Canada, U.S.). Each one contains different proprietary technology, including which audio compression engine is required, meaning license fees from all radio stations and possibly all radio receivers (some standards require it, some don't seem to). Each is supported by a government-enforced monopoly in those countries in which it is used. This is the kind of situation I am talking about. Perhaps I should have done a better job to indicate the general coverage of my original post, but in my opinion, such monopolies may warrant more expansive FRAND restrictions.

Re: It really is time that anything included in a standard is royalty free.

Original: "meaning the holders of the IP now have a license to print money at the expense of all the other manufacturers and consumers"

Response: "No, that's what FRAND is for - Fair, Reasonable And Non-Discriminatory royalties, if your invention gets adopted into the standard."

Exactly. I understand that. What I am suggesting is that possibly the FRAND standard allows too much leeway, and in some cases where standards are supported by an external party, it may need strengthening. You'll note that there seem to be many disagreements between IP holders and IP purchasers about whether terms are in fact fair and nondiscriminatory, which are rather important. Legislation may not be able to handle the fair price part, as the more leverage the IP holder has the less likely they are to agree to any price short of their original ask, but legislation might be able to produce better terms that enforce nondiscrimination. Only by investigating where the current FRAND process fails can we figure out what if anything is needed and how we can apply policy that will improve the situation.

Re: It really is time that anything included in a standard is royalty free.

That is concerning, but so is the alternative which is that a standard is made and soon adopted by a government which makes it the suggested or only approved option, meaning the holders of the IP now have a license to print money at the expense of all the other manufacturers and consumers. If some standards organization without any conflict of interest wants to make their own standard with proprietary technology, it doesn't harm people very much. If it's a standard that can be forced on people, not so good. Mobile communications standards usually require regulatory oversight, meaning that if you get a patent into a standard and get that standard approved as the only accepted way for people to use their phones countrywide, you have a lot of money on the way. And since we get a lot of benefits from using similar technologies all over the world, if you can get that standard in use somewhere powerful before other countries adopt their own standards, you have even more chance to get money. With that kind of gift being provided, I don't feel it's too much to require that standards that are part of a governmental requirement be subject to more restrictive requirements on royalty rights. We could work to ensure those restrictions don't allow a small company with a really good idea to be trampled, but if that small company is planning to trample others by charging them ridiculous prices once they get a monopoly on standard compliance, I lose my sympathy.

How is Trump's anti-Chinese rhetoric playing out? 70% of smartphones sold in the US are – surprise – made in China

Re: HTC Korean

Samsung and LG are Korean, and they manufacture a lot of their components there, but they've been known to use Chinese assembly and even sometimes Chinese components. Should they be forced to move out of the Chinese supply chain, they're better suited for it than most. HTC is based in Taiwan. I'm not sure where all of their stuff comes from. It looks like they have manufacturing capacity for assembly in Taiwan, but that might not be all of it and I don't know where they get components. So they might not have such an easy time if China's components become unavailable.

Re: One Possibility

"Between robots that actually work, much enhanced 3-D printing and the possibility of shipping much stuff to folks as "kits" that any twelve year old can assemble, the classical "factory" may largely fade away in the next few decades."

Your first two are possible, but your last one seems unlikely to me. That would be nice, but I don't think much will be made in kit form for two reasons. First, companies like their planned obsolescence, and making it easy to assemble and probably disassemble their products isn't going to appeal to that kind of place. Second, the places that do make kits for things often don't make one any twelve year old can assemble. Instead, they make one that twelve year olds who already know how to assemble things because they have all the tools and have broken enough stuff to know how to operate them can assemble into things that still look a bit fragile. With people wanting durability and convenience, I can't see many things going that way, especially things like phones with expensive components (and dangerous ones giving the high-capacity battery) which people would like sealed for water resistance.

This is node joke. Tor battles to fend off swarm of Bitcoin-stealing evil exit relays making up about 25% of outgoing capacity at its height

Re: Passwords Everywhere

That's weird. I'd have thought that you wouldn't need very much code to implement it. I would think that the following offline code should do it:

on event UserRequestsPage(string url) {

if "http:" in url {

UserReallyRequested(url.replace("http:","https:"))

}

}

It should only need access to the address bar, not the page itself. Maybe it's browser permissions looking weird. If it's doing more than that, maybe it's time for us to write a replacement.

Re: Too stupid to care?

Sadly, it's not exactly that. A server implementing HSTS has to say this and not allow normal HTTP access. However, a site can implement HSTS and still allow HTTP connections which get redirected, and a lot of them do to avoid looking broken to people who aren't familiar with it. Take my site for example. If you request any page over HTTP, the server sends a 301 saying it's been moved to the HTTPS site. So you can't retrieve something over HTTP from my server directly. However, an attacker who is replacing your traffic could intercept that HTTP request, not give it to you, fetch the real page from me using HTTPS, and present it back to you as if my server hadn't attempted to do the redirect. There are some pretty good solutions to this, but each comes with a downside:

1. I could block HTTP requests rather than redirecting them. This forces all connections to be secure and makes it harder to pull the redirect on someone. It means that people who type my domain name and whose browsers attempt HTTP will think my site is down though.

2. The user could check the address bar for the secure site icon and the domain name they're trying to access. This would take them all of three seconds.

3. The user could type the HTTPS. This would take them all of two seconds.

4. The user could install a plugin that does 3 for them. It might break and they'd have to remember what they did so they could click the button to allow the two exceptions.

5. The browser makers could modify their default policy for when a user enters just a domain name and try to send an HTTPS request first. If and only if it fails send an HTTP one.

Re: I continue to be surprised

"Now, conversely, if I were running a Bitcoin exchange, I would definitely want https to be the default setting, if for no other reason than wanting to ensure that the Dunning-Krugerrands wind up in my pocket and not someone else's when I decide to fake my death and abscond to a foreign country with the proceeds of my clients' ill-placed trust."

The problem there is that the attacker probably does use HTTPS to connect to the exchange, just with them impersonating the client. It's probably not easy to determine that it's not the user on the other end, and almost certainly such a coordinated group has different nodes making the connections so they can't be identified as exit nodes and blocked that way.

"If I were the client of such an exchange, I would definitely pay close attention to whether https is being used as well, but I'm not sure what the interface for such a thing looks like, so maybe it's not obvious."

The exit node can't easily provide a forged certificate because the client's machine will still verify it, so they're probably seeing the insecure site icon like on any other HTTP-only site. Either that or they get redirected to a secure site that is controlled by the attacker and therefore doesn't use the same domain name. It would really help the clients to make sure that is not there whenever they're accessing something sensitive, but maybe it would be better for there to be a setting to enforce that. That doesn't seem out of character for the Tor browser to warn or even block HTTP-only on the clear web and 301s pointing to different domains.

Re: I continue to be surprised

"HTTPS doesn't stop your ISP, TOR exit node, etc, from seeing what sites you go to. This is mentioned in the article."

The article mentions that connections are often made to cleartext HTTP pages first before being redirected, which gives an attacker an opening, but that's just the first page. It gives some detail about the domain, but that's it. For example, I'm not even using modern security but my ISP doesn't know what pages I visited during my session here. They would know that I'm active and reading The Register, but not which articles I read. I don't really care if they do know that, but I might care about similar information leaked from a different site. For this reason, HTTPS is useful even when you aren't sending information. In addition, more advanced security measures can keep my ISP from knowing some of the information they could get before, (although since this site uses its own IP addresses, I couldn't hide everything without VPNing through my ISP).

Can I get some service here? The new 27-inch iMac forgoes replaceable storage for soldered innards

And why do you do that? A disk failure can happen to any of your disks, so you're no safer your way than the other way. If you're concerned about software writing over the files because it's on the OS disk, you could create a separate partition on the same disk. If you have enough data to use seven external drives, more power to you. If you want duplication so you use seven drives, that's fine too. Some people either don't need that or are happy to have that on their backup system. For example, I use multiple drives to store backups, but I use a single disk in my laptop to do everyday work. It is faster to compile a bunch of code if it's read from inside the machine than if it has to be pulled off a RAIDed set and over a USB cable or the network. Worse, the original post suggested that this would be happening with cloud storage--retrieving from RAID on my local network isn't great, but retrieving from I don't even know what the hardware's like from the nearest data center is going to add plenty of problems while I'm trying to get work done. Back up there for off-site media, certainly. Read production media from there every day for performance-sensitive tasks, not a chance.

Of course the professional users will have a backup. Unless they are only professionals in their field and don't know how to, but most of them will have a backup. The backup is useful in case of drive failure, because you can replace the drive and restore the backup to it. Oh, wait a minute, I meant that the backup is useful in the case that the drive fails and the user has to either boot to the backup disk, probably over USB, or restore the backup to a new drive in something else. Neither is a good approach if you need fast throughput, because you probably didn't buy two machines to do the fast professional work on when you only need one. You could buy a spare iMac, and if your work is really important you might, but it might be easier just to buy something that can take a new disk and put a new disk in.

As for network storage, no, that's not going to work. People who need local processing usually also need local storage so their processing actually helps. If you get a processor that's twice as fast as the old one and put your data on a network connection that slows you down, there's little reason to have bought the faster computer in the first place. Sure, the data gets synced to the network eventually, but it's for a rolling backup and for easier access. When you're doing complex stuff with said data, you want it on the same machine that does the processing, and usually with the fastest access you can get, which is why there's a business for really nice SSDs and in-memory caching.

What are you gonna do? Give me detention? Illinois schools ban pyjamas in online classes

Re: Hmmm, how the hell?

"better still to have the kids cameras disabled unless absolutely necessary. Not least the privacy aspect"

I agree entirely, but I have recently heard that many schools are requiring their students to keep the cameras on to enforce the attendance policy. I'm not sure how I feel about this other than glad I don't have to experience it. If it happened to me, I might have to try the "my camera doesn't function because it got damaged" gambit. Fortunately all of my current meeting members don't care in the slightest that I don't turn my camera on because most of them don't either.

Publishers signed up to Apple's premium News may be less than 'appy to discover the iGiant snatching readers

Re: Walls

"Try getting Outlook to talk carddav and caldav, and you'll see what I mean."

I think you'll find that, if Outlook won't do it, Thunderbird might, or one of various other programs. Openness doesn't always mean that the included tools do everything, but instead that if they don't, you can replace them with something that does. On Windows, you can. On Mac OS, you can. On IOS, you can't.

"As for browsers, I have seen Brave and Firefox on iOS, and I doubt they're the only ones."

They're not. There's also Chrome and the Duck Duck Go browser and Edge mobile and they all run the same engine so it's still not open. But you knew that already, saying this:

"That iOS isn't open, well, duh. That wasn't the point."

Maybe all of us are pretty stupid then, because that's what I thought your point was. You* started by saying "One of the original reasons you'd use iOS or MacOS was because it would at least interface with Open Standards so had choices and could use a back end that was Open Standards compliant (aka nothing made by Microsoft other than by accident)." Openness seemed to be somewhat important there, at least the openness of choice, which is what all of us were talking about. If your argument isn't about that, could you explain what you are talking about and why you used the term "open" twice during that argument?

"Also, it now DOES have file management (it had it before as apps, but there's now a file manager as part of the standard build), which suggests you haven't been near iOS for a while."

It didn't before and it only sort of does now. Apps that did file manager things before were doing that within their own sandboxes. Moving files into and out of apps was painful to the extent that you basically needed Dropbox to do it as they were the only service that had good integration into most apps. What is the situation now? Well, it's much better. Why? Because Apple made iCloud Drive, which is basically Dropbox. It got integrated into more apps, but not all of them. I can't use that file browser to retrieve my document from any app, only apps that support it. Going into it now (latest IOS 13), there are several apps that store files but I can't read them; I can only get those by using the mechanism built into the app, which in some cases means iTunes file sharing and in other cases means weird web server thing. There's also one app that stores files, I can read them, and I can't find anything because the app has stored each one individually using directories with random hex string IDs (presumably the developer just connected their file system to the IOS one without giving me the database the app uses to associate files with these strings). It's also tricky to open a file in another app. Sometimes, I have to use an internal app button to do it. Sometimes, I have to use the file manager to send the file to the app. This is the difference between a file system and an open one. With an open file system, I'd be able to know exactly where the file is, and the apps would as well.

MacOS is open, at least for now. It has been since NeXT days (a little ironically), and it's one of the things that drew me to it. Despite the fact that IOS has a lot of the same code running its lower levels, the fact that I can't run or change those means IOS is not open. I'm using open here to mean openness of choice, standards, etc.

*You: Technically, there are two posts by an anonymous poster. Based on the similarity in points and that they are in the same thread, I assume them to be the same person.

Pay ransomware crooks, or restore the network? Guess which way this city chose after weighing up the costs

Re: Ah IT 'managers'

If it is considered important enough, the law can be modified to clarify that paying money to someone else knowing that they will be paying the ransom means you are equally culpable. In fact, I'm surprised that's not already what the law says for cases like that. It won't stop it entirely, but by driving it underground there will be fewer people who will pay and less reason for other people to create similar malware.

"Imagine if there was a criminal charge that would be levied against senior manager or officials of an organisation for allowing their security to be lax enough that they 1- allowed a significant and dangerous malware onto theri network and 2 - their systems were too poorly configured/maintained to allow them to recover from 1 in a timeous way."

On the surface, this sounds nice. I'm all for accountability, and the senior management is the place that most often needs and fails to be accountable. However, I think the criminal penalty would probably break things, and maybe we should be more lenient but more precise in our penalties.

If such a criminal penalty were enacted, almost certainly it would include a provision making it the fault of the technical people if they could be proven incompetent. For example, the senior managers hire people and pay for backups, but the techs don't actually do that. It makes logical sense, and it would undoubtedly get lobbied into the law. The problem here is that, in every case, the senior management will do everything it can to put the blame on somebody in IT rather than take the blame themselves. They will be backed up by the legal and financial power of their business, while the IT person will be backed up by their life savings, which will have to serve for their protection from charges of incompetence and for their legal expenses for wrongful dismissal. The answer to this would probably be things like required audits by an independent third party to confirm that IT are doing what they should be doing, which would be nice, but would also mean IT has to keep stopping normal work to complete the audits and the business has to pay for them frequently. This is easy for a large business, but it could make things hard for the small ones.

Re: Yes but no

"I hope they do not fire their IT staff."

I'd be surprised to hear they have much in the way of IT staff. I'd guess they have a couple people whose job is maintaining desktops and contracts with places to write web apps they need to provide city services, meanwhile the maintenance of infrastructure, backups, etc is handled by whoever needs it at the time. I've seen many systems run in this way because IT is a cost center, and backups even more so. Then this happens and they can't recover because they didn't make any backups or provide for a restore process.

Re: I wonder if...

"Assuming they leave their calling card and have a 'reputation' to protect"

You assume a large thing. A lot of ransomware artists don't see their job as requiring a reputation advantage. The smaller the scale of their effort, the less reason they have to write a decrypting program or actually check they're encrypting correctly instead of just corrupting every file. Even for those longstanding efforts that do have a reputation, nothing stops a competing criminal from designing their malware to look like one that is more trustworthy, if such a word can be applied to malware. It's been done to attempt to throw off attribution; it can be done to get more money.

You had one job... Just two lines of code, and now the customer's Inventory Master File has bitten the biscuit

Re: Who in there right mind would...

Usually, someone without a lot of extra space, such as someone on an old 1970s-era computer. I don't know what the disk situation was like on that, but I'm guessing it was not easy to find twice the disk space to make a backup of the database file and that, if you did, it would take quite a long time to make the copy. Now depending on the size of the file, it's possible they could have made an extra external backup onto other media, but that also might have taken a while. When faced with a situation so seemingly easy (a single SQL statement does it in modern times) with a backup requiring nontrivial effort, someone might trust their intuition for proper coding, which probably worked just fine the last hundred times. Then uh-oh.

What happens when holes perfect for spyware are found in the engine room of millions of Qualcomm-based phones? Let's find out

Re: Why do us customers bother?

It didn't, but nor is the AMD64 architecture responsible for Intel's many failings. It's not the architecture, but the design. I believe the original post here is responding to comments of the type praising the benefits of ARM when Intel security vulnerabilities are discovered. Those comments, while technically correct in the sense that ARM is not the same as Intel, are making two large mistakes. First, they make an apples-to-oranges comparison between Intel's design and ARM's architecture. Second, they ignore the possibility that an ARM manufacturer might do a similar thing. I interpreted the original post as pointing out these errors and cautioning the writers of such comments that nothing is foolproof.

Whoops, our bad, we may have 'accidentally' let Google Home devices record your every word, sound – oops

Re: Or more likely ...

Really? Amazon offers advertisements too. They want to sell things, but they don't care whose things they're selling as long as they don't make one of the items concerned. In order to get you to buy all those things, they need to advertise items to you, meaning data collection, and in order to maximize their profit, their advertising arm will be happy to sell that opportunity to the most motivated merchant. Your description of Google's usage of the data applies to Amazon in every particular. You may have underestimated their appetite for data or how they will be using it.

Android user chucks potential $10bn+ sueball at Google over 'spying', 'harvesting data'... this time to build supposed rival to TikTok called 'Shorts'

Re: Do end users have standing to sue over this?

That may be, but although we knew it was very likely, I don't think we had proof that Google had that level of spyware in their code. It would make sense that they did given their previous attitude toward our privacy, but it's also not a very useful method of violating our rights. If their code does provide them enough information to identify apps to compete with and tactics to use when doing so, it also offers the proof of what we assumed. Given that proof, it's time to use it to attack Google for their privacy problems from all fronts.

Re: Do end users have standing to sue over this?

No, they have reasons to sue over the other things and this too. You've described the data as what apps and how long (I.E. when). There are several good reasons I don't want Google to have a log of what I do with my phone, including when it was in use for each thing. And there is no good reason for them to collect said information. I as a user would feel this alone violates my privacy.

Now, if the allegations made here are correct, they have a lot more data than that. If they are analyzing how I interact with apps, it's probably not just seeing whether I use them a lot, but instead seeing how they are used (E.G. which utilities of each app I am using), how active I am during use, etc. This has all sorts of potential to contain personal information, and I can't know it's happening, let alone see what data is collected or control it. This is deeply concerning. The only potential reason not to punish Google intensely for this is if they can prove that it doesn't do what the allegations say it does. I haven't yet found a good technical analysis of this, as most of the coverage of the topic has happened in the past few weeks. If they can't release a comment that can disprove the allegations, I predict numerous complaints worldwide, and those complaints will be justified.

I got 99 problems, and all of them are your fault

"It's the attitude towards the person they have asked to fix the problem that matters."

A thousand times this. I have no objection fixing things for my friends or family, even if it's an annoying problem and it's all a result of their actions. I may get a little annoyed if it takes hours to fix it, but my grumpiness is directed at the machine, not the user. That is, I don't have a problem fixing that if they understand that my efforts are helpful and they are benefiting from my work. It's when they complain about my help when I consider saying "not my problem". For example, when I need something from them to finish my recovery and they just don't want to provide that right now because they're doing something else on their weekend, I consider informing them that I too have some ways to spend a weekend so maybe they can find someone else who doesn't mind performing IT work for free. If someone requesting help doesn't do that, they usually get dedicated assistance from me.

National Crime Agency says Brit teen accused of Twitter hack has not been arrested

Re: Victim shaming

"As for victims the way I see it (my view) is that the victims are the ones who lost money and the people who had their accounts hacked."

You are correct, they are. There are a few crimes with which this could be pursued:

Obtaining access to a computer system without permission: Victim is Twitter.

Accessing protected data without authorization: Victim is account holder.

Theft and fraud: Victim is person who submitted bitcoin.

So all of these crimes can be pursued, including by other countries. The one currently being discussed most by law enforcement is the first one, so that's why the U.S. has gotten into it. That doesn't stop other countries requesting to charge the perpetrators on the others though. Probably the reason for the first crime to receive more attention is the value of the crime; the damage to Twitter is valued highly, while individual victims who lost some money is a smaller thing. I would expect that to also get handled in the upcoming trials though.

Geneticists throw hands in the air, change gene naming rules to finally stop Microsoft Excel eating their data

Re: other excel woes

"Still no easy way to cycle thru sheets via keyboard (hint CTRL-TAB would be nice)"

In mine, CTRL with page up and down does that. it isn't great if you're at one edge and want to go to the other one, but otherwise it's pretty useful. Maybe that will work for your situation?

Re: I must be missing something...

"I don't know why you think scientists who are experts in their field, should be any better at office software than they are say at plumbing or arc-welding."

They should because the office software is part of their job. Now probably it shouldn't be that big a part, but if they insist on using Excel for their database, then they need to know how to use it for the database-style things they intend to do. Column typing is one of those things.

I'm a programmer. I only need to know how to write code, so I shouldn't have to know very much about infrastructure which I don't administer, right? We probably all know programmers like that. Yet that knowledge is crucial to understanding how my code will be working and therefore making my products useful. It isn't a thing specifically named in my job description, but if I don't know how to do it, I am not as good an employee.

Re: They are creating a database ...

Some people have this very strong aversion to databases. They don't necessarily provide a reason, and if they did you wouldn't understand it. I've seen lots of people do this, including several types who know about databases but still use spreadsheets. Part of it might be that they don't want to have to write the UI around the database and the only reasonably common portable database format is SQLite*, but that's not a great reason.

*For example, the MS Access database format isn't easy to open if you don't have a license for Access. Dumps from other databases might need tailoring if you're using a different server, or people just don't want to run servers. I view an SQLite file as a perfectly valid way to send a dataset, but I'm comfortable issuing SQL queries. I don't know if there are good GUIs for that which allow viewing, sorting, adding, and all of that without needing to learn SQL, but if not maybe we should write one for the biologists. Anyone want to collaborate on that open source project?

By the way, XKCD has been prescient as always.