Posts by doublelayer

University duo thought it would be cool to sneak bad code into Linux as an experiment. Of course, it absolutely backfired

Re: Phew, glad they caught them.

Exactly. The question is not detecting a single malicious commit, but instead identifying how bugs happen. Whether deliberate or accidental, the goal is not to have them. So look at how they came to be and see what patterns there are. Is there a type of bug that doesn't get caught often? If so, can testing or review be improved to detect it? Is there something that reviewers consistently fail to catch? What is it and can something be done to draw their attention to it? That's real effective research.

Re: This All Falls Under The Category Of...

"Isn't there now a risk of a Streisand effect, where lots of other people will try & sneak code in 'for fun", since it's been proved to be possible."

I doubt it. It's not very easy to introduce something just for fun. Submitting a basic patch allows people to say they did something and not have someone angry at them.

"Might have been better for the kernel folks to have just had a quiet word with the Uni, while improving the processes which allowed this to happen."

Oh no it wouldn't. If people were going to tamper with the code, the research paper itself made that idea public. Keeping this quiet would have left that paper as the last word. What the Linux kernel community has done now is to demonstrate that maybe you can insert useless or dangerous code into the kernel, but if you get caught, they will target you with all the power they have. They have established a deterrent to people contemplating pulling the same kind of stunt.

Re: Place your bets...

It works all the time. If you're going to penetration test someone who asked for it, you coordinate with the person who hired you that you're going to do it. You don't tell them all the details, but they need to know who you are and at least a range of time you might do the penetration. That's so that, if you fail to penetrate and end up in the security office or the police station, they know to vouch for you.

Re: Place your bets...

I think that comment is missing the point.

"Still, one should question whether the policy of "Don't probe possible vulnerabilities because it might upset us" is such a great idea in today's infosec security targeting world."

Probing vulnerabilities in the code is important, and the Linux community doesn't have a problem with people doing that. Nor is there a problem looking at the ways people operate and suggesting that such ways lead to security problems. The key is that observation of others is good and probing of your own systems running others' code is good. Probing others' systems without permission is a very different story.

Consider a parallel. Penetration testing is important to ensure that security procedures are sufficient and followed. Hiring a penetration tester is a good idea. However, being a penetration tester of someone who didn't agree to it is not. At best, you have people angry at you though fixing problems you've demonstrated. At worst, you end up in jail. If these researchers had gained the agreement of someone in authority on the team that they would run the experiment, the community would probably be reacting very differently. They didn't even try to get permission.

10 years later, Chrome OS starts to look like a proper OS with hardware diagnostics and the ability to scan documents

Re: Er, why?

Because collectors are weird. They will find something you can possess and that there aren't many of, and they will decide that it holds a ton of value. Because there are multiple people doing this, they end up looking sort of right as they exchange their useless items with each other and sometimes make money doing it. Meanwhile, I, and probably you, look at them and think their items are nearly worthless. Especially true when the items concerned have some purpose because the collectors will frequently not use them to preserve the condition.

What we should do is look through our junk and see if there's anything in there which has now become rare. For example, I have a sort of PDA thing that's about twelve years old. It was pretty rare even when it was manufactured, the company made a small batch, they went out of business in 2012, and the internet doesn't even find anything about it unless you really know what to search for. Of course the device isn't very useful now--it's got an ancient Linux kernel and no package manager. The update server is long dead, and the OpenSSL library doesn't support very much so it can't do much with the browser or email client. That's a great thing--that means most of the people who bought one have probably thrown it away by now where I just put it in the closet. So all collectors, call out offers.

UK.gov wants mobile makers to declare death dates for their new devices from launch

Re: Default Passwords

The law shouldn't ban publishing the default passwords. It should ban having a default password. Out of the box, it has no password. When someone wants to use it, they have to set the password. If they forget the password, they use the physical reset and it loads the factory firmware, allowing the user to set the password and reconfigure.

Now for things given to less technical people, this can be annoying. I know for a fact that my family does not know the passwords to their internet equipment because I set it up. However, they need to balance the risk of annoyance for people who have to set a device up from scratch versus the security nightmare of having lots of things with default passwords. If the default password is "password", "admin", or the product name, not publishing that is not going to stop people figuring it out.

Re: Force open source instead

Not really. Sometimes that's a problem, but most of the time, the stumbling block to third-party support is that the manufacturer has locked down all the things that you need. Custom versions of Android can run on phones with most kinds of SOCs. Certain ones are harder, for example because Mediatek doesn't release information about some of their chips, but the developers can get around some of that. Manufacturers have even less excuse, because they have access to documentation that we don't. They could update things but choose not to. Third-party developers can too as long as they have access.

We seem to have materialized in a universe in which Barney the Purple Dinosaur is designing iPhones for Apple

Re: Ooh, Shiny

The hardware designers certainly do attempt to construct the phones well. They want it to not bend, not overheat, and be thin and stylish. They don't spend so much time on not gaining scratches, not shattering, and being easy to hold. I have never broken a phone screen, but I know people who have. I also know that the glass on the back is easier to shatter than the glass on the screen, which makes things worse. They have also managed to reduce the phone's friction coefficient so low that they are almost ready for first-level physics class. The result is that people put them in cases so they are less likely to be dropped and more likely to survive if that does happen.

They released those a few months ago. There's not much they could do for a new range so soon. Designing the M2 will take longer.

Microsoft revokes MVP status of developer who tweeted complaint about request to promote SQL-on-Azure

Re: Cancel culture

"If big tech or media doesn't like your message - there is no debate of ideas, you just get canceled."

Not true in most cases, and not true this time either.

He was being paid (in Azure credits evidently) to post advertising about Azure. I don't know why; it doesn't seem like a good business decision in the first place. He didn't like that. I'm with him--I would only be willing to post approving comments had I actually compared two options and thought one was significantly better. While I wouldn't mind getting money from the better one for the post, I would probably not take it because it would weaken my credibility by implying I was biased toward them. He complained about the program he was in. Is it that surprising that the people running the program figured he wasn't a good person to have in it? He didn't want to do what they wanted him to do.

Re: Bloody Azure

"you could just add more internet connections."

Oh come on. The stated use case is about as clear a don't-use-cloud situation as you could imagine short of an airgapped environment. It's not cheap to run extra internet connections which you intend to be redundant. Cable connections may use common infrastructure, so you either have to pay for installation of alternate paths or hope that an issue with one won't bring down the other. Fixed wireless connections may not be available depending on the size of the factory, are prone to congestion, and may use common infrastructure as well. Satellite might be the best alternative to avoid those problems, but that also depends on the weather and available satellites. Meanwhile, from the sound of it, the server doesn't do anything for people outside the factory, so it's a lot more important that it is available to the other things in the factory than to the outside world.

There are at times advantages, sometimes significant ones, to using the cloud. However, even if the cloud providers manage to improve their uptime to 100% and reduce their prices by an order of magnitude, there will be some cases where it's still not the right decision. A situation where the users and the cloud are separated by unreliable or limited network connections is one of those.

Working from a countryside plot nestled in a not-spot? Consultation opens on new rural mobile planning laws for bigger masts, wider coverage

Re: Who Has Dark Communications Spots?

"A Baofeng UV-5r hand-held is quite adequate for free bi-directional multi-channel Satellite Communications."

Really? Because I just looked that up and it doesn't seem like it does that. It's a terrestrial radio which can transmit on two or three bands using a relatively low power limit. Assuming you have the proper license to use it, you should be able to communicate over a few kilometers to people using radios on the same frequencies. Satellites, not so much. There are a few satellites used by hobbyists which receive such signals, but they aren't permanently available--the site I found that discussed them told people to look up the availability times--and they don't relay your signal elsewhere, so no internet. I also doubt that it's easy to send your signal to such satellites with such a weak transmission. Am I wrong, or is this a completely different device with completely different use cases?

To have one floppy failure is unlucky. To have 20 implies evil magic or a very silly user

Re: if it works...

Connecting an Arduino to WiFi is a pain. It can control the light bulb or whatever other thing you want automated, but if you want to control that thing remotely, you need some communication mechanism. WiFi or Bluetooth are commonly available, but neither runs on an Arduino unless you attach something else to do it for you. That's another set of chips you have to buy, power, and maintain just so the original controller can be contacted. What's even more pathetic is that the controller for the communication is usually an order of magnitude more powerful than the controller the main task is running on. If you don't want remote access to the device, then an Arduino is probably fine. If you do, it makes sense to use the processor which does that communication to do the automation task as well. Unless you can't work out the low-power modes or you need custom control pins the comms chip doesn't have, that will be the simpler and more efficient solution.

Brit authorities could legally do an FBI and scrub malware from compromised boxen without your knowledge

Re: Works both ways

I think it might be possible to allow interventions like this, where the systems themselves aren't directly entered but the malware's control system is compromised. The major restrictions that are needed are A) they shouldn't be allowed to extract data from the system including telemetry about their removal, B) they must not push any binaries or scripts other than a removal, and C) they must publicize what they have done. If those restrictions were clear, I wouldn't mind actions to cauterize malware by invoking its self-destruct mechanisms.

If the organizations concerned intend to spy on the operators of infected servers, they already know how to do it and they won't ask permission. This is a separate issue, but just banning something like this won't fix the problem because those agencies have already made it clear they're willing to break the laws. Meanwhile, if the agencies are investigating the operators for crimes, they can get legal warrants allowing them to collect information. So what is made possible by allowing this which wasn't already possible and frequently used?

It was Russia wot did it: SolarWinds hack was done by Kremlin's APT29 crew, say UK and US

Re: I love

Really, why not? Each of those countries, though small and economically troubled, has managed to set up the resources to build nuclear weapons. That's expensive and difficult, but they wanted it badly enough that they have done it (well, giving Iran a bit more credit given we don't know how far along they are). Building a few teams of smart people capable of breaking into stuff isn't that expensive in comparison; you need some computers, some smart people, and for those people not to have great alternatives like working for a tech company. Why couldn't North Korea or Iran manage those requirements?

"(yet, my instincts tell me that there is more to this - how far down DOES that rabbit hole go?)"

Then go digging. You have the freedom to do it. Just don't complain if you find the security researchers know more about it, having researched it for months, than you can find out. I've seen nothing which suggests Russia couldn't or wouldn't have done it. Nor do I find any major flaws in what I've read so far attributing it to them. The opportunity's always there if you can prove them wrong.

Zorin OS 16 beta claims largest built-in app library 'of any open source desktop ever'

But that's not trying to mimic Windows. MATE may have similarities to Windows, but it wasn't designed to make transferring people easier. The desktop environments which were designed to look as much like Windows as possible are just getting tiny details the same while ignoring the large chunks which won't be. MATE clearly isn't Windows but uses enough of the same concepts that people can figure it out quickly.

Ever wondered what it's like working for Microsoft? Leaked survey shines a light on how those at the code coalface feel

Re: what was NOT said

"I would be VERY interested in seeing what the political spectrum of Micros~1 employees are, how many voted for Trump in 2020, how many are registered Republicans, and so on. Was THIS (or anything related to it) in the survey?"

As you can imagine, a survey about what the employees think about the corporation doesn't include extra useless questions like that. A good thing too. If my employer ever asked me something like that, they would get A) no answer to that question, B) no answers to most of the following questions because my focus is no longer on their survey, C) a cold statement that the question serves no purpose and is inappropriate if the survey contains an "anything you'd like to comment on" question, and D) reduced performance from me while I consider whether that's actually where I want to work.

Last chance to grab an iPhone Mini as savvy analyst reckons Apple will scrap it next year

Re: Cannibalism

Not just that--the second SE is half the price of the mini. If we assume that people who want small phones don't need 5G and are fine with recently-the-fastest-but-now-the-second-fastest processor, it makes a lot of sense that they wouldn't really see those improvements as deserving a doubling of the price. I hope there is a market for small phones as I am certainly in it, but my needs are small. I don't need a large screen, and I don't need a fast processor, many cameras, or 5G (though I don't mind that one). I am not interested in a small flagship phone. I'm interested in a small low-to-mid range phone.

What the FLoC? Browser makers queue up to decry Google's latest ad-targeting initiative as invasive tracking

They won't. If they ever look at it. Just like they won't like what Google currently does, just they haven't gotten around to checking what Google's doing. It's been busy. They've only had three years of GDPR to spend investigating those things.

Key Perl Core developer quits, says he was bullied for daring to suggest programming language contained 'cruft'

Re: Long Live PERL

"I also wish people would stop calling GNU\Linux background drivers daemons. That REALLY bothers me. Please stop it."

Why? Daemon is a term that's been used to describe exactly that sort of thing for a while. In fact, not only do I have no problem with daemon, I wouldn't like to call them "background drivers". I view drivers as controlling something else, especially hardware, for a separate process or the OS as a whole. Lots of daemons or whatever they are don't do that. So I'm going to prefer daemon for that type of program unless you have an argument for it.

Also, what's wrong with Python as a name for a language? Language names are pretty much all arbitrary words or letters. You don't seem to have a problem with Perl as the name of a language, and that's not even spelled right (it was going to be named Pearl, but there already was something called that, so they just chopped out the A and went with it). Why is Perl fine and Python not?

Re: Cult and control

That's fine, but not really complete. There are lots of subjective elements. What should the assumed environment be? Does the user use a single laptop screen or two large desktop screens? If there is a possibility of a mobile user, two interfaces or one interface? Should the desktop interface look like the mobile interface with additions so users who use both are familiar with it or should they be made to look like the interfaces of the devices they're running on so that actions are fast on each one? What are the key actions to be taken? Should the action be made fast or have lots of options? Should there be two choices for the same action just so one is fast? What about aesthetics?

As I've stated, I am not an expert on this and I don't want to be one. Still, there is a lot of subjective stuff when designing UIs. I subjectively think the Office ribbon is bad. I know a lot of others who also think the Office ribbon is bad. Microsoft stated at the time that it was better for feature discoverability. I'm sure they've done some tests on it. I've also heard people who don't think it's a problem. Similarly, I've seen such discussions about the window systems on Windows, Mac OS, and various desktop environments for Linux/BSD. Each group has some statistic they'll bring out for why their desktop is better. Each looks nice and numbery, and probably has some validity to it. Yet there is no agreement about which is best. Because it's subjective. That doesn't stop a bad interface from being bad for pretty much everybody, but it does eliminate the ability to find the epitome of excellence in UI design.

Re: Cult and control

The developers could be doing that, but they could also have a point. UI is very subjective. There are lots of UI changes that some people think are better. Others will hate them vociferously. Also, changing the UI is a guarantee of annoying most people. So it does to some extent depend on what change was suggested and how many people were familiar with the previous one. After all, if you maintained an office program and someone suggested you throw out all your menus for an ribbon of buttons which always seem to move when you're not looking, would you do so immediately?

In my experience, I try to minimize UI changes after the first non-beta release. Suggestions for redesigns only get through if the change is small (and I think it makes sense) or they've written a long, detailed description of why this improves the system and how users can be made familiar with the change. Improving the UI because "I know more about usability than you do and this approach is superior to yours" won't happen; both of those points may be true, but that's not enough for me to start from scratch with no support. Fortunately, I rarely have to deal with this because I don't like working on UI stuff and try to either stay to the backend or keep it simple.

Re: The concept of open source

"if your project has non-developer users and some sort of feedback mechanism then I think you should expect feature or usability requests."

You should, and you should take some of them. I do wonder if some of the negativity with which feature requests are received is due to users who ask for the impractical all the time. I'm on a couple of mailing lists for open source projects, some of which have quite a few non-developer users. I've seen plenty of normal feature requests which should get real consideration. Sadly, I've also seen people asking ridiculous things and not stopping when it's explained why that's not feasible.

One person wanted us (well, in that case I was not a core contributor, so them) to add a proprietary component because they preferred it. We pointed out that A) the software was GPL and the component wasn't, B) the component wasn't free, so in addition to changing the license we'd have to buy licenses for it, C) the software we produced was free to users so we'd just be losing our own money trying to do it, and D) nobody but this guy seemed to think this component was any good anyway. This was not the end of the bombardment with emails asking why we weren't going to do it. For another example, there was one person who wanted the project's resources translated into Slovenian. That's fine; the work had already been done to make things localizable and there are existing translations. No, that's not what the user wanted. They wanted us to find Slovenian translators and have them translate the resources even though none of us spoke it. I volunteered to simplify the process of creating the localization files so they could produce a translation. This was not the right move. This particular episode included some angry missives from the requester.

I wonder if the treatment afforded proper feature requests is due to things like this. If I as a developer think people will ignore me when I state reasons why I can't or won't implement something, I might be more likely just to ignore most people and only pick those feature requests which struck me as the most interesting. That doesn't make that the right approach, but it might go some way to explaining it.

A keyboard? How quaint: Logitech and Baidu link arms to make an AI-enabled, voice-transcribing mouse

Re: Really?

That is possible. The traditional ways to type in Chinese are drawing the character or typing a romanized equivalent and selecting the correct option from a list. Each spoken character is pretty fast. Depending on the user's speed at handwriting, speech recognition could be very helpful if it's effective.

After years of dragging its feet, FCC finally starts tackling America's robocall scourge

Re: I am not sure if this is possible ...

My suggestion for those people requiring anonymous contact is to continue to allow sending no number to caller ID. An unknown number can't be identified and can't be called back. That's better than faking someone else's real number. If scammers use the unknown value and people start ignoring it, that's their choice.

Re: I am not sure if this is possible ...

This isn't feasible and doesn't solve the problem. It's kind of like the people who block IP blocks from cloud providers or various countries--if you can do it, it only blocks them for a few days before they move but it does negatively impact others. In this case, the scammers already appear to be coming from the U.S. because they use companies which are based in the country who in turn don't tell you where they got the line from. If this was prevented, the scammers would find new ways to route onto the U.S. network and lie about it with the assistance of the same kind of companies. Meanwhile, if you ever did get contacted by a call center, likely a callback you requested from some company which outsourced it, the call would be dropped.

One thing that would make a much larger dent in their operations is a caller ID system which does not allow forged numbers. If they couldn't keep changing their number, they would be easier to block, since phone numbers aren't completely free, but they would also be easier to track. A complaint against a fake number gets automatically discarded today. A complaint against a real trackable number can identify a caller or at the very least the unethical company willing to front for them. That can lead to much faster action.

Nominet chooses civil war over compromise by rejecting ex-BBC Trust chairman

Re: Who's the fool?

It wasn't. In that article is a link to the Nominet statement on a Nominet site. You can verify that. It's all real.

Average convicted British computer criminal is young, male, not highly skilled, researcher finds

Re: State sponsorship and Organised Criminals?

This research only covers people convicted under the Computer Misuse Act. As stated, people who commit larger crimes will likely be charged and convicted under something else, like the laws against theft, because they are easier to use in court and lead to more definite sentences. It also only includes those people who operated on a large-enough scale to get the attention of the police, who didn't do enough to cover their tracks, and who didn't do so much that the really determined and skilled investigators got brought in.

For blinkenlights sake.... RTFM! Yes. Read The Front of the Machine

Re: Broke my little toe...

That doesn't make it work. If you play with a sufficiently large group, the chances are incredibly high that one of these things happens:

1. Everybody lands on properties and buys them immediately because they have the money to do so. They thereby block everybody's chances at a monopoly. People then circle the board paying low rent payments to each other and hitting the random squares from time to time. Often, there's one property unclaimed which could give someone a monopoly except nobody has landed on it all game.

2. The same thing happens but someone manages to get a monopoly. They have one and nobody else does, so they are going to win. Unless the other players concede then, there will be a long death spiral as people don't happen to land there this time around or the player with the monopoly gradually builds up the capital to build more houses.

The more rare options just result in the game ending faster, not the game being any more interesting.

Re: Broke my little toe...

"Does anyone win? I thought they just went on and on until everyone lost interest."

Or one player (you know who you are) is so relentlessly annoying and competitive that the others don't care what happens just so long as that player goes bankrupt. Queue a formation of a cartel of the other players. I'll give you the property which completes your monopoly and you give me the same. Build a bunch of houses on each one and by the way, rent is cancelled if you show up.

Wormhole encrypted file transfer app reboots Firefox Send after Mozilla fled

Re: Nice potential... but also challenges...

I think most of those features should probably be limited to their pro plan. Then again, a business can usually have a protected internal network through which files can be transferred. Still, individuals probably don't want most of those features and implementing them will take more resources. Since those are mostly for business users, it makes sense not to give them away.

The Android client requires full network access, prevent device from sleeping, and write to storage permissions. All of those make sense to me. A report using the Exodus privacy scanner for Android apps on that client can be read here.

Re: CPU usage

It's not scanning the whole internet. At most, it just has to advertise its availability to the server which can connect it to the other machine. Machines which have not contacted the server need not be scanned. Machines which don't have a connection established also need not be scanned. That cuts out nearly all of the internet, and it is only necessary to check on the computers involved in the transfer, so that's probably 2 though could be 3-8 theoretically. That doesn't explain the CPU usage.

How do we stamp out the ransomware business model? Ban insurance payouts for one, says ex-GCHQ director

Re: Its impractical of course.

We can do both of those things. The problem is that doing so takes some effort. Some people want it to be doable with a click of a button. If it is that easy, then every transaction will receive a button press and the data will be on file. On the file of the police for easy tracking of criminal activity. On the file of the police enforcing a dictatorial regime. On the file of a police officer who doesn't mind using it to stalk someone. On the file of an advertiser who thinks they can use it to sell stuff better. On the file of an abusive family member. On the file of an unethical journalist. On the file of your boss.

Sometimes, we have to concede something which makes it easier to commit crimes because it supports others' ability to live a life without oppression. If we didn't have to, we could eliminate all crime, or functionally so. 95% of crime would be impossible, 4.99% of crime would be possible but nobody would do it, and 0.01% of crime would be detected immediately. You would not want to live in that world, especially if you ever disagreed with the people who decided what crime was.

Re: Companies need to start lying (well, more than they do already)....

Wishful thinking, I'm afraid. Several ransomware attacks were known not to return decryption keys, yet received payments. Probably not as much as they would have if decryption worked, but they got sent money by people who didn't investigate them before deciding to pay up.

Re: Its impractical of course.

Please stop. There are lots of people who want to stop crime by completely eliminating privacy, but that doesn't make that right, practical, or even functional. If person A doesn't buy gift cards, but instead buys other items and sells them onto others, the problem is the same. Let me guess, we now need to present ID to buy anything that looks easy to resell?

There is already a method of doing what you want. Proceeds of a crime can be ordered seized from someone who knowingly received them, someone who didn't knowingly receive them but was contacted fast enough, or someone who has the ability to obtain them from the criminals involved.

It's an attempt to encourage caution about external resources which could host malware, request information, or try to steal SSO tokens. Clicking on the link versus pasting it doesn't really make much difference. Sure, there's a chance that someone will recognize a URL as malicious but not bother to check the URL on a link, but I don't think it's a large subset. Most users I've seen will either check where the link goes before clicking it or cheerfully copy and paste a link to iamactivelyevil.com.

Re: Stop using MS Windows is also an option

"Still scratching my head how in the world it is possible someone manages to design, produce and make truckloads of money of an Operating System that allows its kernel, device drivers and boot code to be changed by a webpage, email or a pdf."

Simple answer: they didn't. Your OS's core components can't be infected by opening those things unless they've found one massive vulnerability, and they probably haven't. In most malware attacks, the powerful application is a binary, executed on the machine. The user may be prompted to download the binary by a website, but the website didn't do it. Or the binary might get installed by modifying something they already have installed. Or a password is guessed and someone manually executes it. These are the very common things.

Yes, there are vulnerabilities allowing an attacker to do drive-by attacks without the user or someone with user-level access executing something. They are somewhat rare. They're also found in all OSes. Linux, Mac OS, Windows, Android, IOS, you name it. That's basically impossible to prevent because there is so much going on. Implying that Windows has a lot of those and they are the cause of lots of malware infections is incorrect. For many attacks, the people to blame are the users who executed it and the administrators who didn't protect the method used to attack. Some of the time, the blame is squarely on one of those. The original developers deserve blame too at times, but not as much as you may think.

Re: We have created this mess for ourselves

"What was once a perfectly safe conduit for plain text, is now a funnel for all manner of shite, because "we" yearned for increased functionality, or rather, developers thrust it upon us, in the war for market share."

I'm sorry, but in most important respects, this is just wrong. HTML email does allow a few exploits, such as embedding an image to check when somebody is opening the message, but that's not a major security risk and the privacy risk that does exist is mitigated by most modern mail clients and some mail servers. Opening an HTML email doesn't in itself give the attacker access to run code.

The exploits which have worked so well over email are all hacking the human. Open this attachment which is an executable but looks like a document because the OS doesn't show extensions. Open this document which is actually a document but contains macros. Go to this website and enter the information on it (if the user copies a URL or clicks a link, they're ending up in the same place). All of this was as possible with text-based email as it is today. A few of the risks that make it more dangerous, including the structure of the protocol meaning it's possible to impersonate anyone and a lot of servers will just trust you, are leftovers from that old text-based conduit which was never secure and still isn't today.

Back in those good old days, it wasn't that email was more secure. In fact, it was almost certainly less secure because we have found some things that could easily be fixed. The reason it felt better is that there were fewer attackers and fewer users who were biased toward more familiarity with the technology and its risks.

Apple's pending privacy clampdown drives desperate marketers to overwhelm domain database

Re: The Etsy problem

Of course they do. Yet their interests are not a reason I should have to sacrifice my privacy. If they want to track conversions, they can without having to create their own domain. If they want to know about their customers, they can send out a survey and see how many of the customers will fill it out for free, or they can have a prize to increase participation rates. If they want to track me elsewhere along with a massive company, too bad for them. I'm not going to let them do it if I can help it. Just because they're not making enough money to pay for ethical market research is not an excuse to let them violate others.

Lies

"For months, developers at Facebook and Apple have been trying to figure out a way to continue to allow advertisers to track ad conversions – to understand which ads people click on – in the web's increasingly complicated technical environment."

No, they're not. It is easy to determine which ads people are clicking on. Let's say a company is running five different ads for the same thing and they want to measure whether there is a difference in effectiveness between the presentations. Here's how you do that:

Ad 1: links to https://ispamyou.adnetwork/ad/1

Ad 2: links to https://ispamyou.adnetwork/ad/2

And so on. Or, because the short numbers will get reused:

Ad 1: links to https://ispamyou.adnetwork/ad/aei6zln2

Ad 2: links to https://ispamyou.adnetwork/ad/fl2ozvnp

If you're on something which doesn't do custom paths, you can do the same thing with query parameters. Then you just dump the request in a database to look at later and redirect the user. Facebook could build a server to collect that if there is a user who lacks the technical knowledge to do it themselves. I wouldn't be surprised to hear they already have that. The privacy protection thing doesn't make that harder.

What it does make harder and what Facebook wants to make easy again isn't figuring out what ads people are clicking on, but to figure out who the people are who click on the ads. Or do anything else online. That's what Apple's privacy measure is intended to protect. Facebook and its advertisers are angry about that and I understand why, but that's just too bad. They never asked my permission for invading my privacy. I will neither ask their permission nor care when they object to my blocking and impeding them.

Texan's alleged Amazon bombing effort fizzles: Militia man wanted to take out 'about 70 per cent of the internet'

Re: Christian Militia Terrorist

Yes, and the methods of oppression used by the so-called Islamic State which are undoubtedly terrorism were considered by them to be lawful. Just because the terrorists consider themselves to have political power and their motives and actions to be justified doesn't stop it from being terrorism. Was the action generating terror in the population? Yes. Was it done deliberately? Yes. Was it done for reasons connected to Christianity? Yes. It is possible for enforcement of a law to meet the definition of terrorism.

Re: OVH

Sadly, it also shows the number of people who don't have multizone setups and don't have the ability to recover quickly. There's a site I wanted to visit on March 25th which didn't work. Turns out it went down on March 10th and is run by a French company. It's still down today. I would expect that they would have the necessary backups to get a webserver back in operation in a month. One datacenter can be very important to small operations, though with cloud it shouldn't be.

How to ensure your tech predictions catch on in a flash? Do the mash

Re: This is so true

These are points "futurists" should really keep in mind. They always come up with technology ideas without even thinking about whether people would want them if they became feasible. Science fiction writers do the same thing, but at least they're not necessarily saying that we're going to have those technologies. A lot of futurists appear to have the kind of technology experience which comes from reading about but never actually developing things, and perhaps this explains why they think, for instance, it is easy to make a computer converse with a human on general topics.

Re: Future Gazing

True, but that's just more data. We can store the instructions to decode data and people can find it. Consider the Arctic code archive Github did last year. Included in that is the source code for a lot of things you can use to read files of various rare types. There's undoubtedly a Fortran compiler up there. Even if they can't figure out the instruction set to which the compiler will compile it, they should be able to work out the syntax and reverse-engineer your code if they care enough. The source for FFMPEG isn't on Github (or maybe someone cloned it), but that's likely stored on lots of disks. That's a really useful way of accessing video or audio data once they find it.

Archaeology is difficult. They have to figure out a lot of details that the creators of the artifacts didn't specify. It won't miraculously be fixed by our ability to create copies of stuff, because they'll still have to work out things like the languages we use and how our stuff worked. It will be made easier though because we have a lot more information for them to find and that information is harder to lose or destroy.

Re: Future Gazing

I'm not sure that's as problematic as it sounds. The pyramids are still here, but I'm sure there are various things we have built which could also remain here if we didn't do anything to it. There are artistic constructions which we aren't going to take down and won't just decompose on their own. Unless we have a war which destroys them or somebody comes along and really hates them, they will remain there. Remember that we don't have a ton of ancient Egyptian office buildings to investigate; we have the constructions which had an ornamental purpose and were preserved to retain it. We will do the same.

On data, we have a lot more power to preserve it than our ancestors did. A thousand years ago, there weren't many copies of documents, they were stored on stuff that is really easy to destroy, and copying them took a very long time. A fire or flood in a library would destroy a lot. Just to make it worse, the library was made of wood, people used fire to heat it and see, and it was next to a river so the inhabitants could get something to drink. Lots of information died then and there. Meanwhile, individual data storage devices degrade, but we have the ability to copy information without error and reproduce it on multiple continents in minutes. Also, libraries today have started to buy out Cold War bunkers to store their material. I think those are a bit more resilient.

Not only digital things. There are millions of paper copies of the same books where our ancestors wouldn't have them. Even with a global catastrophe, the chances of one of those surviving for archaeologists to find it is a lot higher. This also applies to documents which wouldn't have been kept. In centuries past, routine business documents, if they were created, were erased so as to reuse the paper. Eventually, they were just burned or trashed because they weren't needed but the space was. Nowadays, they're just archived because it's cheap to keep a year's records on a tape. Some places will eventually decide they don't need to keep that after all, but some others will keep it out of laziness alone. It's so cheap to store data that I have copies of Wikipedia and a few other encyclopedias on my own media, along with a bunch of nonfiction books and other documents that would be rather nice sources for life today if you needed that. And that's just data I intend to use myself. There are projects to archive all sorts of data with the goal of future availability firmly in mind.

Jeff Bezos supports US tax rise after not paying it for two years – and paying tiny amount in 2019

Re: Political football

If you're referring to price elasticity, there is but it doesn't change the answer. It allows more granular discussion of exactly what will [probably] happen if suppliers change the prices. Some products are inelastic, so if the price goes up the company just gets more money. Some are elastic, meaning the companies are taking a large risk by increasing the price. There are equations and theories giving more information about how to test this and use the results.

Either way, companies change the prices based on their own calculations. If the tax rate goes up by 5 percentage points but the company expects that increasing the price will cause demand to fall, they will bring out the calculators to figure out whether that's a good idea. Some companies will decide that increasing the price will cause demand to go down too much, so they'll have to absorb the tax increase. Unhappy execs and shareholders ensue. Other companies will decide that they can handle the increase and prices go up. However, if the tax rates didn't increase, the companies may have done the calculation (they do that all the time as part of routine work) and increase the price anyway. So it is true to say that tax increases may increase prices, but incorrect to state it as a certainty.

Re: Political football

And, using that argument, technically you as an individual also pay no tax, because you pass it all onto your employer. It is included in your income. Also, you pay no tax on your investments or property or anything else for which you get a tax bill and pay money if you consider it as ingrained in the cost.

It's not in the cost. It is a separate cost. How a change in taxes is handled depends on the actions of the person or company. If the tax rate goes up, companies may increase prices, decrease expenses, or report less profit. These are all options and are all used. If tax rates don't go up, companies may also increase prices and give the money to somebody else. It's a decision they and not the tax authorities make. It's not correct to assume that any increase in corporate taxes takes the form of price increases.

AWS straps Python support to its automated CodeGuru tool, slashes prices – just don't go over 100,000 lines

Python doesn't let you chain too many expressions on one line because they don't use punctuation to delimit expressions and blocks, so there's no workaround there. Java, on the other hand, does have that punctuation so I wonder what happens if all the newline characters are dropped before running the scan.