Posts by doublelayer

Imagine surviving WW3, rebuilding computers, opening up GitHub's underground vault just to relive JavaScript

Re: No binaries over 100KB

It's basically Gentoo everything. First, you retrieve the source for an operating system, Linux for example. This needs various libraries, so you find those too. These need to be compiled, so you retrieve a C compiler. Then you realize that you don't have anything to run on and the compiler's also written in C. Then, you write your own language and compiler for whatever computer you have found, or you use whatever programming language is on the surviving machine available. So basically it would only be useful in a very weird catastrophe. Maybe we should have someone write a book called "How to build a computer out of rocks that knows how to execute some instruction set we designed for computers built with lasers" and put that in the archive too.

Everything must go! Distributors clear shelves of ALL notebooks in Q2, even ones gathering dust over last 12 months

"How do they expect to set up a home lab, test software and generally be productive with just a consumer phone or tablet? They sound a bit like frauds to me."

Why would they be expected to do any of those things:

"set up a home lab": In normal circumstances, why would I? If I need a lab, there's probably one in the office I'm expected to use. If I have to work from home and keep using the lab's type of hardware, I will either do so from a remote terminal if possible or take the equipment that's already in that lab home with me. If the company doesn't want me to do either of those, they can pay for the lab equipment that I use for them. If I want to have my own home lab, maybe I'll have some of those devices. If I don't want one, my company shouldn't care.

"test software": Why? If I'm testing software for work use, I use work machines. That's the machine in my office, my work laptop, the machine in my office via the work laptop, or one of the servers I have access to. So all I need is the work laptop.

"generally be productive with just a consumer phone or tablet": I don't expect to do that. I expect to be generally productive with work-provided kit. If I need more kit because my job requires it, then work has to provide that. If I happen to have replacements at home, I may volunteer to use them instead of having my work buy and send me them, but otherwise, it's their problem not mine. I'm currently expected to be productive, and I use my own peripherals because I like them, but the computer they're connected to is work-issued. That's all they should expect me to use.

Companies toiling away the most on LibreOffice code complain ecosystem is 'beyond utterly broken'

Re: "Slapping a "Personal Edition" label on a product implies..."

You may have read, but you're doing quite a nice job misconstruing all the points. Let's look at your comments and what they came from:

LDS: "I read the comment. The comment implied LO has no freedom and just they want software from LO they have not to pay for."

gobaskof: "Slapping a 'Personal Edition' label on a product implies [note implies here] you can only use it for personal use, which would be against the license. It is technically legal. But it is wrong [opinion]"

So the original comment demonstrates that they understand that any organization can do as they please with the code, including providing or refusing to provide binaries. That comment disagrees with it.

"RedHat doesn't make the Fedora and CentOS builds - those are "community" projects."

From the Wikipedia article for The Fedora Project:

"The project was founded in 2003 as a result of a merger between the Red Hat Linux (RHL) and Fedora Linux projects. It is sponsored by Red Hat primarily, but its employees make up only 35% of project contributors, and most of the over 2,000 contributors are unaffiliated members of the community.[6] [...] The Fedora Project is not a separate legal entity or organization; Red Hat retains liability for its actions.[15] The Fedora Council is currently the top-level community leadership and governance body. The Council is composed of a mix of representatives from different areas of the project, named roles appointed by Red Hat, and a variable number of seats connected to medium-term project goals.[16] The previous governance structure (Fedora Board) comprised five Red Hat appointed members and five community-elected members."

There's some external community, but Red Hat controls a lot of the code and the organization that owns it. You can argue definitions if you want, but I consider this as having a significant connection to Red Hat.

Original: "But it is wrong and misleading and should not be allowed"

Reply: "Really? This is the mindset of people who think Open Source is 'hey you, work to give me the software I need for free!'"

I don't think that's really true, as the code would exist anyway. It's not that hard to compile most open source projects, so if you don't want to give back, the policy is simple. The original comment was expressing the opinion that labels like "personal edition" imply something that might put off users. Not that they actually do, but that users may believe they do. The opinion was that this belief might dissuade people from adopting it and therefore lose the developers the income from support contracts, extra features, and similar.

LDS: "Again, nobody forbids anyone to take the LO code and make all the builds they like and distribute them. But you can't think to force a company to make the builds you need for free. Otherwise, where's the freedom?"

And once again, the original comment clearly states that there is no requirement forcing anyone to make specific builds, but that if the proposed specific builds were made, they believe that decision to be a bad one. I think part of the reason that leads to this opinion is that it wouldn't be the core LibreOffice team making those decisions, but instead a commercial company, Colabora. It could be considered misleading if someone other than the LibreOffice control organization made software calling itself LibreOffice but with restrictions. It would be legal to do (and again the original comment says as much), but it could sound bad to some people, including the one you replied to.

Re: It's quite clear where the money is:

That's certainly part of it, and I mentioned the discount on Office365 in my mock discussion, but I mostly left that out because exactly the same logic would apply to many a small business. When something is free, they're a lot more forgiving of things like time requirements than if it costs a little less. Even if a completely rational economic analysis says that doesn't make sense, they will do it. Also, in various situations, it does make sense.

Re: "Slapping a "Personal Edition" label on a product implies..."

Read the comment you replied to. The comment acknowledges that it's perfectly legal. The comment acknowledges that any terms or suggestion wouldn't be legally binding. The comment argues that, despite those things, people will see them as in some way binding. The comment alleges that people will decide not to run the software because of this. The comment suggests that these are bad things and so the behavior likely to lead to them happening should be avoided. You can disagree with those allegations, but it's hard when you only argue against the thing the comment didn't say.

Re: Payment workaround?

That message seems carefully worded to be accurate and sound like they use the money for development without ever saying that:

"LibreOffice is made possible by the efforts of thousands of volunteers around the globe, and by the generosity of donors [but those two things aren't related]. Please support our efforts [whatever those may be]: your donation helps us to deliver a better product [somehow, but we won't tell you exactly]!"

I concur with your post; this would be a great avenue for further journalism. I generally thought of TDF as trustworthy, so I don't think they're pulling an ICANN and using the money they pull in for the enjoyment of the board, but if they're just putting it in a bank account, it's not helping the project very much. What do these people do?

Re: It's quite clear where the money is:

I see your argument as well as the similar one from the article:

"Free software has an unfortunate connotation of gratis, free of price," Meeks said. "The FSF (Free Software Foundation) has tried for many years to explain that it is all about freedom. LibreOffice has the word Libre in it. But there's quite a strong sense of gratis in its statutes, which is unfortunate."

However, I must disagree. If you go to anyone who doesn't know the term already, they hear "free software" as meaning £0. This if often a good thing because it can be the initial selling point. Even if they pay money for a support contract, knowing that they could entirely stop payment and still have their product is useful. I sometimes volunteer some computer support time to a charity, and I'll use them as an example. Here's a short but effective method of convincing them to switch:

Me: I notice you're using Office365 at the moment. There's another product that you might try which is free.

Charity director: Well, Office365 isn't that expensive. We get a discount on it and everything.

Me: But this product doesn't cost anything. Not everything is as easy, and we might have to replace a few things with other software, but there's a lot out there that we can use. Not only is it cheaper but it is better in various ways. It can never expire on you.

Director: And it doesn't cost anything?

Me: No. You can buy support if you need help with it, but the software is free.

Director: Can you roll it out to all the machines and we can run a test. If the users like it, we can go from there.

Consider what would happen if getting functional LibreOffice required payment, manually building, or getting from a dodgy-looking site.

Me: I notice you're using Office365 at the moment. There's another product that you might try which is free software, with free referring to your rights to do with the code as you wish.

Charity director: Interesting. So what rights do we have with that that we don't get with Microsoft.

Me: You can modify it in any way you like, share the code, contribute to the community, all that.

Director: You realize we don't have programmers, right?

Me: Yes, but it's still better because it doesn't restrict you like Microsoft's product does.

Director: What restrictions does Microsoft have that this doesn't?

Me: You have to pay a subscription per user every year and you don't have as much choice about how you store your data.

Director: So this is free?

Me: No, but it's cheaper.

Director: Office365 provides us with mail accounts. Does your suggestion?

Me: Well no, but we can use another free software product to do that too.

Director: And we get cloud storage which I've used as a basic backup system. We get that too, right?

Me: No, but

Director: So we have to pay for at least three different pieces of software. Will the prices for all these things still be lower than Office365?

Me: Probably. I know the mailserver software is free and depending on where we do the storage, that could be cheapish.

Director: And how about the hardware the mailserver and storage run on?

Me: You'd have to have that too. You have a server in the closet so we could use that.

Director: You're going to volunteer all the time it takes to switch our mail system over and guarantee us that no email will get lost, because we can't handle outages?

Me: I'd like to, but

Director: Is this really that worse than paying Microsoft, given that it sounds like we're getting a lower bill in return for having no features?

The theoretical director there doesn't understand all the specifics, but they have a point. Having two options, and for each having to pay, means the two enter a type of competition that isn't as present if one of them is free. For us, we know about the freedoms and care, we are confident in our ability to troubleshoot if things go wrong, and we often don't care about spending a bit longer getting some software exactly the way we like it. A lot of businesses don't go that way, and think only about finances and wasted time. If you can't argue a business into using the software, then you lose any money they might have paid for a support contract, and they're not going to suddenly bet on an unknown for a slightly reduced bill.

Google promises another low-end Android effort as it buys into Indian mega-carrier Jio Platforms

Re: One reason only

KaiOS is using most of the code of Firefox OS (global effort) and is continued by an American company. While I think the most effective sales effort for those devices has been in India, it's not an Indian home-grown OS. Incidentally, Google has been one of the most prominent developers of apps for that platform and has invested in the developer. I assume they're preparing for the possibility that they don't keep their chokehold on the low-end smartphone market.

It's Go edition, not Android One

"Nor is there news of how the new device will impact Android One, the slightly-simplified version of Android that Google launched in 2014 to bring low-cost smartphones to India. Android One is currently alive and well and Google promotes a decent range of handsets running the OS."

That's incorrect. You're thinking of Android Go Edition. Go Edition is designed to run in a gigabyte or less of memory with the extra surprise feature of not having compatibility with some things that you will find out at some random time after you make the purchase. Android One, on the other hand, is a guarantee to supply updates for such a long time that most likely all phones will be broken by the time it expires. Well, to supply updates for sort of a long time. Well about half the expected update lifespan of an Apple device and a third of the lifetime for a Lineage OS device.

Yes, I know about the tips and corrections address. I might send a summary there at some point, but I'm not on a machine with a mail client configured at the moment and I'm kind of lazy.

As internet governance meetings go virtual, compromise becomes harder to reach

Re: "The lack of corridor diplomacy affects participants’ ability to network"

The problem with that feature is that the main meeting is still going on. Separate small conversations work when people are between meetings. For example, if my team has a meeting, I pay attention to it, and after it ends, I find the person I wanted to talk to separately and we have a chat while we walk back from the meeting room. I'm not ignoring the others.

Existing videoconference software is perfectly capable of doing that, but it doesn't happen very often for a number of reasons. For example, I used to have conversations with the dev nearest me in the office. Some of these were pointless to productivity but I enjoyed them (I hope and think he did too). Some were useful to our project. Neither type happens very often, even though we have the ability to chat or call one another. I tend not to send messages because I'm not sure whether he's busy, something I can determine by looking at him in the office. I think it's similar here, with the added complexity that previous corridor conversations at a conference like this probably occurred between people who don't know one another very well.

Bad news: Your Cisco switch is a fake and an update borked it. Good news: It wasn't designed to spy on you

Re: Computer misuse act

The article told us what happened. The counterfeiters wrote a bootloader so it would bypass some protection code. Cisco's update had a new bootloader. Cisco's update knew how to install the bootloader and that it would work on their gear. The counterfeit device didn't think it through and installed the new bootloader, wiping out their custom one. Their custom one being required, that didn't end well.

On a legal basis, it's not Cisco's responsibility. If they knew of counterfeit goods, it would have been easier for them to just call law enforcement. But they are not under any responsibility to ensure their updates work on equipment they didn't license the software to run on. Sadly, they often aren't required to make sure their software works correctly on the devices they do build either, though you can sue them for lost productivity if that happens.

Chinese mobile giant OPPO claims new 125W fast-charging spec will fully fuel your phone in 20 minutes

I haven't found charging quickly to be that important. My battery is showing its age and sometimes needs an odd time recharge, especially if I haven't plugged it in the night before, but my solution to this is easier. I have a collection of USB batteries. Some were given to me as presents, and they are large capacity and well-built. Some were given to me as methods to show the company's logo, and those are available if I am ever concerned about losing one. Either way, I can drop one into my backpack and be assured that I can charge my phone should it need it, assuming I haven't borrowed the cable I keep alongside it. These mean the battery doesn't die, extend the time I can be away from power if I ever need that, and can also be used to power other devices in a pinch.

Mozilla unveils $4.99/month subscription-based VPN, says it won't hang onto user logs

Re: Bad timing, sigh

You can, and I have, but that only works for some of the use cases of VPNs. In my experience, people want VPNs for one or more of the following reasons:

1. To provide a secured tunnel to a known endpoint.

2. To access other machines without having them be openly available on the internet.

3. To have anonymized traffic that's difficult to track.

A VPS handles use case 1 easily. It can handle use case 2 with some work (for example, I have mine set up so I can VPN into it, then follow a previously-established tunnel to a device which is on another network). It does not handle use case 3 unless you allow others to use your VPN as well so you can hide among them. That's usually not a good idea because you will use up a bunch of bandwidth and may be responsible if someone uses yours for illegal actions.

Google: OK, OK, we pinky promise not to suck Fitbit health data into the borg. Now will you approve the sale?

We accept your conditions, just prove your honesty

Dear Google. We are happy to tell you that we have accepted your conditions, namely that you guarantee that you have not, are not, and will never use data collected or entered on Fitbit devices for advertising purposes and that it will never be visible to any system which also stores data processed for advertising. We are now happy to approve your sale, but we require one final item. In order to prove that you are complying with your own conditions, we will need to see and audit both of the following systems: A) the code run on Fitbits and any remote system with which they interact (recursively), and B) the systems and data on which you base your advertising decisions. These audits will need to be ongoing while your company continues to produce wearable products or software which interacts with wearable products. If you decide not to comply, we will be required to deny your request to acquire. Please note that providing false information in this step is a violation of laws in every EU member state and punishable by prison terms for every manager and forfeiture of all financial resources. Also please note that information provided during this process may be used by data protection authorities. Congratulations on this approval for your proposed acquisition.

Sueball locked, loaded and pointed at LinkedIn over iOS privacy naughtiness

Re: Free/Libre and Open Source advantage

"I made an Android app that reads the clipboard on startup without asking. It does it to see if the clipboard contents is a URL, in which case it pre-populates a text field with that URL"

That's your choice, but I think it's not that useful for a few reasons.

"I could have added an extra Paste button, but then I'd have to worry about issues like "would the button take up too much room on small displays" (or if it's hidden, would users be able to find it)"

This is why consistent UI decisions across apps are so useful. In most operating systems, there is a typical way to copy and paste and any app supporting those actions does it the same way. If your paste function was available and followed a convention, most users would know how to use it.

"and "would users be confused if pressing the button causes an error message because the clipboard contents is not something we can handle—would it be better to simply not offer the option in that case?"

As I see it, this is a nonissue. If the clipboard contents are not text, you just don't paste any contents into the box. If it is text, you put it in when they paste and let the user decide what to do then. After all, you already have to have some control for a user entering an invalid URL, either a typo or testing you, so if the clipboard contents are invalid, you just report them as invalid just like you would if I mistyped the URL as "https;\\".

These are subjective decisions, and everyone will probably have their own opinion on what is best. For what it's worth, mine and yours differ.

Re: I'm baffled

Well, it's not as simple as that because you may not always use the standard edit controls. In an app that implements a different edit box with different features, say for an actual word processor, you may want to be able to paste into your new area. Apple saw this need and implemented your basic clipboard where you could read at any time. Logically, they could easily have asked the user about whether the app was intended to be reading the clipboard, implemented rate limits, or various other security patches, but they didn't do that. Maybe their IOS 14 changes will include one or more of those preventative patches in addition to the retroactive warning mentioned.

Re: I know not of these matters...

I think most of your statements are wrong there. We'll start with the first one. You can violate privacy without immediately sending the contents of the clipboard off. As a basic example, if you copied it into an internal buffer and used it to perform on-device metrics, even if you never sent those metrics, it could be violating the privacy of data stored in the clipboard. Sure, it's relatively low-level and users should be careful (that is assuming this app only did this while in the foreground), but don't assume that violating privacy requires phoning home. In this case, I don't think LinkedIn was using this as a sneaky data collection feature because it would be so fragile. I think it's more likely that some coder thought it would be useful and didn't think of alternatives or the downsides.

Now on to the code part. You say that checking the clipboard content "is absolutely required if you want to implement "Paste" into anything other than text views and text fields." Not true, because you still only have to read from the clipboard when a user presses that button. The issue here is checking the content in a loop without any button. Then, you said that "you want to know what's in there so you don't have for example a "Paste" button if there is stuff that you can't paste." I disagree, because I find hiding controls that you sometimes have and sometimes don't confuses the users, but that's a subjective UX thing. You can implement format-specific paste in a number of ways, including cancelling a paste operation without changing the original content if the contents are not compatible. You can warn the user or not as you desire.

"And then there's the fact that in Windows, Linux, MacOS, Android, and iOS up to 13.0, everyone does it. For good reasons."

You are assuming the reasons are good. Frequently, I find that good programs wait for me to paste in the contents of my clipboard rather than snatching potentially incorrect data out, though I will admit I've seen some go the other way.

Unless you really need real-time monitoring of clipboard contents for some reason, you are also making your application do a lot of pointless busy looping. This isn't great for performance or power usage if you do it for long enough.

Modular edutech PC crew opens fresh Kano beans with expanded kit and accessories

Some parts not as nice as I first thought

I was interested to see exactly how flexible a device like this would be. It's always nice to introduce children to hardware and software together. Sadly, I don't think this looks like the way to do it. I had one concern after reading this article, and it was that it didn't look like the memory or storage was replaceable on this machine. I get it with memory (sort of), as the processor in this machine probably can't do all that much with more. However, in my opinion, storage absolutely should be replaceable; not only can it wear out, especially with heavy use, but it is useful for people new to hardware to understand how storage works and experiment with different systems, which can be easily accomplished by swapping out disks.

While I had these concerns, I wasn't sure from the article that they applied. Maybe these parts are replaceable and the article just didn't mention it, so I did my research. Well, I tried to do my research. It seems as if Kano doesn't publish the assembly guides for their products on their site, blog, or help center. They do indicate that a printed and illustrated version comes with the device, but I think it's also important that they publish it online for perspective purchasers or in case someone loses it. I wonder why they haven't done this; it's not as if it's valuable without the hardware.

Since I don't have any of the official documentation, I'm only going off some articles I've seen about the launch, both here and elsewhere. Unfortunately, it isn't painting a picture I like. It seems like the hardware assembly is relatively basic: put in speakers, attach battery, close the case. I'm sorry to have to be so blunt, but an assembly process that can be completed in two minutes doesn't teach people very much. If the hardware, described as teaching children, actually gives them little education and less choice, I have to wonder how good the software education experience is. I don't know, and it may be markedly superior, but my initial confidence has waned.

Meanwhile, there are educational computers and kits that I think are more useful. Unsurprisingly, most of these are based around a Raspberry Pi, which already provides a lot of the facilities of this. I have seen laptops based on the Pi which include batteries and touchscreens but also include things like built-in breadboards for hardware hacking. I also know that, even if the manufacturers of these haven't built educational resources into the product, the Pi Foundation has useful resources and so does the community. I'd have liked another provider of this type of resource for students, but I don't have confidence that Kano is one.

It's handbags at dawn: America to hit France with 25% tariffs on luxuries over digital tax on US tech titans

Re: Local sellers can't avoid much taxes

There is a good solution to the problem of large multinationals using tax havens, which is to clarify and reenforce national tax laws so it's harder to use the haven to protect taxable income in each country. There is a bad solution, which is to name the people who are avoiding, which of course these companies do, and specifically target them. Both solutions function in as much as getting some money out of the entities concerned, but the first solution means you don't have to readjust your law when a new egregious offender turns up and the second solution makes you look as if you just have some companies you don't like. I am not here to defend the tech companies; we all know very well how they juggle things around to avoid any taxation or accountability. I come here to recommend a legal solution that is more likely to be accepted and more likely to work in an objective manner.

Re: Pay tax where users reside

There is something to the very high tax rates driving away places that have a lot of money, but there's a lot more to simple greed. Consider that you can hire a lot of skilled accountants for €1 million per year. Imagine that they can reduce your effective tax rate by 10%. Well, as long as your tax bill is over €10 million, you make money by hiring them. I, and likely you, don't have the resources to do that or a tax situation that would benefit greatly. In addition, most likely both of us wouldn't really have a use for massive quantities of money anyway. A lot of rich people and companies don't think that way and will choose any course of action that means more money stays with them, no matter whether there is an ethical way to get there or if they have any use for the extra money added to their accounts.

You can fix that in one of three ways:

1. Make the tax bill hard to circumvent by simplifying it, meaning your accountants can't help you find sneaky ways out.

2. Make a law like France's which simply targets those viewed as most problematic, which lands you in this situation.

3. Try other solutions that might work, but history is not on your side.

IBM job ad calls for 12 years’ experience with Kubernetes – which is six years old

Re: Why wouldn't Tim Berners-Lee have 17 years experience designing websites?

I did not read that far down; thanks for bringing my attention to it. That said, I'm not accepting that; it sounds like at best a pedantic distinction without a difference or at worst an excuse for getting the number wrong. Designing something can happen in many ways, as long as you make decisions about how a thing will look or function. It's pretty broad. When I made students write "design documents", they neither wrote the code nor used imaging software, but they still designed their programs when they wrote up some text. You can design a site in the same way, and you can also do work on making the site look exactly how you want it to. That sounds like design to me.

Re: Mandatory Experience

I have taken to reading the careers pages of sites I'm already on (note to employer: I'm not trying to find another job. I just like to see what they'll come out with). There was a role mentioned on one of these pages that specified that the candidate would need experience with "algebra and geometry". Weird, but they're being clear that mathematical knowledge is required. Except that they specified the specific things you needed to be able to do, including "find real roots of a parabola" and "calculate the volume of a cylinder". I have ever since been confident that, if something should go horribly wrong in my career, I can at least go over to the cylinder place and do quadratic formulas all day. It won't be interesting, but things are never hopeless.

Re: Why wouldn't Tim Berners-Lee have 17 years experience designing websites?

That's part of it, and that does earn the interviewee a demerit. But the tweet contains three components if you ask me:

"We interviewed a 28yo designer in 2012 who told us he had 17 years experience designing websites.": Interviewee claimed to start designing sites at the age of 11 in 1995, which is possible but unlikely.

"I said, 'Tim Berners-Lee doesn’t have 17 years experience designing websites.'": This sounds to me as if the interviewer actually thought this was true. As it happens, it was not. If you count HTML websites on WWW, he had 21-22 years experience. If you count his previous work on CERN-specific pages that worked like websites with hypertext, it is even more.

And then the point about the interviewee not knowing who that was.

When you see PWA, Microsoft and Google want you to think Programs With Attitude: Web app release tool tweaked

Re: Am I the only one

"My thoughts were the opposite. PWA's don't have as much access to the hardware as native apps. Even when they eventually do, how is this different from native apps now?"

Let me count the ways. Um ... sorry, lost count somewhere around twenty three and I should keep working. Fine, here's the short version:

Current mobile operating systems have put a lot of work into sandboxing apps. They don't all do it right, but they mostly try. Users can generally block certain permissions and it isn't trivial for an app to circumvent a denial and get the data anyway. Similarly, it's usually difficult to have one app suddenly start reading the resources of another app. That's unlikely to be the same for a web app, if only because all the sandboxing would have to be started again. Of course there will be protection from accessing the location permission, but will the permission system be as granular? Will it be secure against circumvention attempts? Will it include any sneaky access methods because Google is building it?

In addition, a web app has a very different security profile to a native one. Web apps tend to use a lot of libraries. Those libraries come from really nobody knows where, or sometimes we do know and we might feel better if we didn't. Each of those places can get modified to introduce new code. Since these are progressive, update frequently, move fast and break things apps, our devices would be pulling this new code down and starting to execute it. At least with a native app, the library has to get tampered with, pulled down for the build, and released to the traditional channels. That might not be a reassuring shield but at least there's a shield.

Another issue is with privacy. Theoretically, analyzing network traffic from a web app isn't more complicated than with a native app. In practice, it's trickier. If you are able to intercept apps' traffic to block it, a web app can more easily disguise itself as a browser. Since the app needs to stay up to date, it must ping a server all the time, and because devs are lazy, there is a reasonable chance that it will require a server to function properly. While any app can require a server, it's more likely that a native app which cannot pull libraries from a server will function without one than one which requires a server pushing libraries for installation.

That's the short version. I should probably stop writing now.

You call Verizon. A Google bot answers. You demand a human. The human is told what to say by the bot

Re: I can hear the conversations already

The problem is that, unless they operate the nice kind of call center, you are liable to finally get an operator after an hour of the same two advertisements on a loop to have this discussion:

Client: I am trying to activate a new phone online, but it says that the eSIM requires me to call for activation.

Operator: I will help you resolve this situation. First, may I have the phone number you are using to call us so we can call you back if needed?

Client: Sure. Here it is.

[...]

Operator: So you don't need help with your SIM card then?

Client: No, I need to activate a new device.

Operator: Well, I'm in the troubleshooting call center, but fortunately I can forward you to the activation call center. It'll just take a second.

Client: Thank you.

Advertisement starts again.

System: Good morning and thank you for calling Verizon. How can I help you?

I can hear the conversations already

System: Good morning and thank you for calling Verizon customer support. How can I help you?

Client: I am trying to activate a new phone online, but it says that the eSIM requires me to call for activation.

System: I will help you resolve this situation. First, may I have the phone number you are using to call us so we can call you back if needed?

Client: Sure. Here it is.

System: And now your subscriber number?

Client: Here.

System: And your pin?

Client: Here.

System: Thank you. The SIM card slot is usually located on the side of your phone or in the battery compartment. You may notice a small hole.

Client: Wait a minute. I have an eSIM problem, not a SIM problem.

System: You can use a paper clip to eject the SIM card tray from your device, but make sure to turn it off before you do so. If there is an existing SIM card in the device,

Client: Stop. Cancel.

System: ... remove that card from the tray and insert your new Verizon SIM card.

Client: Other query. Help. Not my question.

System: There is a triangular cutout on the card which should align with the tray.

Client: If I wait it out, will it let me do something else?

System: If your SIM card is too large for the tray, you will need to break out the smaller card ...

Two minutes later:

System: Has this solved your problem?

Client: No.

System: I'm sorry to hear that. How can I help you?

Client: Activate new device.

System: I am capable of recognizing human language. Please phrase your request in full sentences.

Client: I am having trouble activating a new device.

System: I will help you resolve this situation. Is the number you are activating the same as the number you provided earlier? That number was two [long pause] four [long pause] eight [long pause]

Client: Of course not; I can't activate, so I have to call you from a working line.

System: six [long pause] zero [long pause] [...]

Client: [after number has been read] No.

System: May I have the number of the line you are trying to activate?

Client: Here.

System: Thank you. This line is not associated with any devices on your account.

Client: Right.

System: Has this solved your problem?

Client: No.

System: I'm sorry to hear that. How can I help you?

Detroit Police make second wrongful facial-recog arrest when another man is misidentified by software

Re: The real news

That's not true. It happened. It really did. It was nine months ago in a private test somewhere in Europe. And they detected this guy entirely correctly. Well, he wasn't the guy they were looking for, but he was an identical twin with that guy, almost. I mean we put this guy in a lineup, brought in some people, and asked them to look at a picture and point out which of the people in the line was that guy. Everyone pointed at him except for a few of them, but those people didn't select anybody so they don't count.

An email banning our staff from using TikTok? Haha, funny story about that, we didn't mean it – Amazon

Re: Another non-event distracting us

Exactly. That's why trust in the base app is such an important detail. The only relevance to the "pull down arbitrary code" possibility is that someone else could get the code inserted, either by forcing the company to do so, stealing the mechanism, or discovering a vulnerability. The new code would not be released as a potentially detectable update either, making it easier to hide.

I think the best example of such an issue is the vulnerability discovered in WhatsApp a little under year ago. Said vulnerability wasn't intentional (unless you are paranoid), and it allowed arbitrary code execution by crafting an invalid video file. That code would not be able to exit the sandbox of the app, but WhatsApp's sandbox is really big so it proved to be a useful exploit, weaponized by at least a couple groups. If TikTok had a similar mechanism intentionally or through a vuln, it could prove dangerous even if a user trusted the original app. Obviously, I do not know that such a thing exists, but if it did, it would be bad.

Re: Another non-event distracting us

It wouldn't need root access to be able to do things you wouldn't like. I checked out its Exodus privacy report which shows information about permissions and trackers found in its Android app. That's quite a lot of permissions. Malware given access to those would be able to do lots of things, including making and inspecting network traffic. As with far too many Android apps, this app also requests permissions that don't seem to make any sense (install new packages, for example). From inside that sandbox, you can still do a lot.

Now, just because this app requests those permissions doesn't necessarily mean that all are granted or that they work. Nor does it mean that there is something malicious using them. I wouldn't be surprised to hear that TikTok does have a mechanism allowing their developers to push arbitrary code and run it. I also wouldn't be surprised to hear that Facebook has a method to push arbitrary code and run it. I already know that Google does have several ways to push arbitrary code and run it. As with any other application, the degree of trust in its developer and usefulness of the features must be taken into account before deciding whether to use it. I wouldn't trust it, but I also have no inclination to use it and there are already hundreds of other companies' apps that I also don't trust.

A volt from the blue: Samsung reportedly ditches wall-wart from future phones

Re: 5v/12v ring

I suppose the question would then be why. Let's assume you could create secondary circuits at lower voltage. What would the benefit be of doing that? If you still provide the main circuit at normal voltage, your secondary circuit means extra installation, extra possibility for breaking, etc. without removing any of the cost associated with the main one. Meanwhile, providing the ability to use higher voltage may be useful in a limited number of circumstances. For example, most places could probably use LED bulbs at lower voltage (although how low is in question, see the other reply for details). However, some may wish to use a different type of bulb. I know some people use bulbs that release more ultraviolet light to promote vitamin D creation. I don't know if those have a higher power requirement. Most importantly, I don't know what other unusual types of bulbs people use, and I don't know if it's a good idea to make it more difficult for them to do so.

Re: 5v/12v ring

"Agreed, but wondering what the load would actually look like though"

There are quite a few devices capable of drawing high power outside the kitchen (and I'm assuming you are also counting the laundry room and garage in the rooms needing higher power). There is of course the powerful desktop computer, especially a gaming or high-processing dev machine, probably one of the first to jump to mind for us on this forum. But there are other things, some with even higher draw. Printers, for example, can get pretty spiky. Portable heaters which are designed to quickly warm up the immediate area are also power hungry. Vacuum cleaners vary a lot, but I have not yet seen a USB vacuum capable of rapidly cleaning the floor. Fans may not be very hungry, but they will draw quite a bit of current if you run them at 5V. Televisions, speaker systems, and the like run with relatively little power, but high enough that running them together at low voltage is going to push the current level too high. Even laptops with large screens can charge at around 100W, usually through 20V USB-PD, which at 12V is a potentially undesirable 8.33A.

The problem is that there are potential users of increased power elsewhere in the house, so you will want to provide it. Probably relatively few people want to run an 800W GPU stack, but those who do will be annoyed if you take their mains availability away. Since we can easily step down to voltages at the point of the device, but stepping up is going to mean dangerous current draw, it is probably more efficient to leave sufficient voltage for more power hungry devices. If those voltages are never requested, little is lost.

Re: You're funny

"las t time a friend tried charging his iphone here (last years model) he found that with his genuine lead it refused to charge from the usb chargers that we use for our samsung & honor phones, in the end the only thing we found that would charge it was an old charger for a 1st generation ipad mini."

I really don't know about this. I have had iPhones, and they have charged off anything, up to and including a Raspberry Pi. I know I charged one off this really cheap plug next to me which is, let me check, a ZTE. I don't even know how I got a ZTE USB adapter, but it works fine on everything, so it remains in service.

The reluctant log trawler: The buck stops with the back-end

Re: Late 2000s?

Why do you assume that "the 2000s" by default refers to a century? Because for all you know, it refers to a millennium. The only significant figure there is the 2, so any smaller chunk that still includes multiple years is valid, including 2000-2999, 2000-2099, 2000-2009, or for some pedants the 1-offset century and millennium as well. I choose to believe that this happened in the late 2000s, sometime around the year 2978, but the various changes in human culture since now have made it not as funny. Fortunately, they also invented time travel so someone could report it to us.

Re: Fault at both sides

I very much agree. I was expecting to read that a user had realized that, by getting a quote with a different ID, they could trick the backend into purchasing stock at a different price and that a heist by a black hat was on the way. Verify all input from users; they are not to be trusted.

TomTom bill bomb: Why am I being charged for infotainment? I sold my car last year, rages Reg reader

Re: Simpler than I expected

When you purchased your iPhone, did the manufacturer indicate that the contract for service was a component of the product? When you first got your iPhone, did you set up the contract on it as part of the process, or did you set up the contract with the mobile provider and connect the iPhone to it? Both of those things were different for this case. There was one other thing that was different, and that is that there wasn't any contract. This has been clarified by the original source several times above this in the comments: there was no contract, and the charge that TomTom sent out was not a valid charge.

Re: New one on me

Come on. "I can math" has always in my experience been a lighthearted joke in one of two situations: someone expresses surprise at your having done some calculation quickly or when they didn't expect you to do it, or you have made a stupid mistake in mental arithmetic. It's used to juxtapose someone who doesn't know how to phrase that grammatically correctly with someone who is doing mental mathematics. As for "I logicked", I have heard that but very rarely and the grammatical way of saying the same thing: "I used logical thinking to come up with a solution" sounds pretty stupid too.

There are some people who seem to enjoy verbifying nouns, but it's usually sectors like PR or consultants who need new euphemisms or new things they are an expert in that nobody else has heard of so they must be good.

Re: As I read that

"It wiped the car. It just didn't wipe Tom Tom's customer database, which is not in the car."

I get this distinction. When I first read it, I was inclined to agree with it. Having read information in other comments however, I don't think the user is at fault here. It wiped the internal parts of the car. The car was sold with the TomTom device included, meaning that device was in the car at time of purchase. The device interacted with the main car display, meaning that a user could infer, incorrectly in this case, that it was connected to the car's systems and would also be reset on the activation of the wipe. That device didn't get reset or, if it did, didn't update the account it was connected to to inform the account of the reset. And the user didn't have any repeated billing set up on that account. When the charge, wholly unexpected as it was TomTom's error, came through, it presumably indicated in some way that it was linked to that particular Mazda vehicle.

You could see why the original misconception was that Mazda could do something about this. They sold the equipment in the car, their screen controlled the equipment and was used to perform the reset, and the bill mentioned them. Now we know that that wasn't correct, and it wouldn't be fair to them to continue to blame them for much other than failing to warn of this possibility in the reset process. Still, given the limited information available at earlier points in the process, I think the concern was understandable.

Soft press keys for locked-down devs: Three new models of old school 60-key Happy Hacking 'board out next month

Re: Alternatives?

If you go to your lots-of-items-selling site of choice, you can almost guarantee that you will find various budget mechanical keyboards around and even below your price range. I have experienced good results with some of these, but with each you will have some drawbacks. There are those who will not accept any switch type other than the well-known manufacturer they have used before, for example, and budget keyboards tend to use some manufacturer you've never heard of. I tend not to care, but if you do, the budget might not satisfy. Similarly, at that price range you are unlikely to find keyboards with extra features like Bluetooth, detachable cables, or extra ports. If one does contain such a feature, it's likely the only one.

Utilitarian, long-bodied Nokia 5.3 has budget basic specs - but it does cost £150

Re: Got one of these recently

I found a couple low-priced options with removable batteries. I don't know if any are good though. Here's a search with the selected criteria being removable battery, 3.5 mm jack, 2019 or later, and at least 32 GB of internal storage to get rid of the "Go Edition" useless things.

Re: Can we get a utilitarian tablet?

So you want a tablet with few inputs, bigger than a tablet, with no battery? An odd use case, I'd say, but you can probably manage it if you're willing to fiddle around. You could, for example, get a Surface, disconnect the camera (from a teardown it looks like that's doable), and run Android X86 on it. Or you could get a tablet meant to run Linux which has killswitches for all those things and do a bit of work to make Android run well on it. And I found some large, desktop-sized all-in-ones with Android on them from several years ago. Maybe one of those product lines still exists. But if you're asking why companies haven't built that device already, it's because it isn't very useful for people. Most users use tablets and touchscreen devices for portable, not desktop, use cases. So they make them smaller and with batteries.

Asia’s internet registry APNIC finds about 50 million unused IPv4 addresses behind the sofa

Re: So, IPv4 addresses are like petroleum

Yes. In many ways they are like petroleum. There is a limited amount. Nobody is really sure when we will hit that limit but we have gotten far enough that there can be problems with the supply. Some groups control a massive amount for no good reason. Large parts of the world have next to none compared to their populations. There are replacements that might be useful if more people were to use them.

IPV6 has many problems, and making any change is difficult, but it is already chaotic to try to find and keep IPV4 addresses. This block may have reduced that pressure for a little bit, but in only one region of the world and only for so long. Given the aggressive CGNAT used in some parts of Asia, I imagine demand for these addresses will be fierce.

Microsoft sues coronavirus phishing spammers to seize their domains amid web app attacks against Office 354.5

Re: Something about motes and beams...

"Are those dates in American MM/DD/YYYY format or UK DD/MM/YYYY format?"

Yes, indeed they are.

Sorry. I thought the question deserved that answer. I'll go now.

You may be distracted by the pandemic but FYI: US Senate panel OK's backdoors-by-the-backdoor EARN IT Act

Re: States

Basically, you have a good understanding of the issue. Nothing is very clear. In general, if a state makes encryption illegal, then it is illegal for you to use encryption if you are physically in the state, to provide encryption to people in that state if you are not there, or to provide encryption to others using systems in that state. How much you care about each prohibition depends on what your state thinks about all this, your likelihood of going to the affected state, or whether you have money or other assets that state has the ability to go after. Federalism is weird sometimes.

Re: Democrats

I thought that about the surveillance bills passed in the early 2000s. Then I stopped thinking that, which was good because it's painful to be wrong and I would have experienced that pain every year or so when they blindly reauthorized those powers, even as revelation after revelation came through about what those powers were being used for. Why should I believe that any politician, other than perhaps Senator Wyden, understands or cares about privacy and security? I have seen no evidence in favor and quite a bit of it against.

Re: once the encryption is broken...

That's likely not how that would work. First, it requires tech companies, most or all of them, to choose altruism and privacy over profit and friends in government. They're already not willing to do that; why will they when it's even more painful? Most of the big companies don't really care much about encryption. They provide it some of the time, but mostly they don't bother. The primary exception among the giants is Apple, but Apple alone probably can't do much about this, especially as they don't run public online platforms anyway so they're safer than most from the effects.

Of course, if some company does decide to turn off a state for those reasons, that state will almost certainly find a way to go after them. They could, for example, sue them for violations if they can get any connection from that state to the encrypted system run outside it. States have power to arrest employees or get assets the company might have there, so if they want to force a company to comply with the law in one specific way, they have some tools they can use to try to make that happen.

From the article, which presumably you read before getting here:

"Initial drafts of the law also contained two proposals that raised serious concerns from a broad range of groups and organizations. Firstly, the creation of a new 19-person committee that would be led by the Attorney General and dominated by law enforcement which would create content rules that tech companies would have to follow to retain legal protections. Secondly, and the suggestion that has security folks up in arms, is that those rules could require tech companies to provide Feds-only access to encrypted communications."

Summarized from later in the same article:

That panel: Still in the law. Still law enforcement.

That panel empowered to require backdoors: No.

Fifty state panels empowered: Yes.

Fifty state panels restricted from requiring backdoors: No.

Some state governments expressed interest in backdoors: Yes.

So some states could make encryption illegal: Yes.

So companies would have a patchwork approach: Yes.

Which would be really tricky and open them up to lawsuits: Yes.

Which companies like to avoid: Yes.

Easy solution to that: Don't offer encryption inside U.S.

Re: We're all fucked....

"Once it affects those senators, then they'll realise the mistake they made."

I admire your optimism. I unfortunately cannot see them ever understanding what this does, even if they are directly targeted by it. Even if the person who breaks in puts a message box on their screen saying "I could do this because of the act you passed", they'll probably go on thinking that it made total sense. Now, in order to find the person who broke into my computer system, I am proposing we pass the Encryption Violations and Intelligent Law Act, which will allow law enforcement to access information during investigations without a warrant as long as a copy of that data, encrypted or not, has ever existed outside the house of the subject, on the basis that current law only requires a warrant to search the houses of subjects so data isn't included.

Trump's bright idea of kicking out foreign students unless unis resume in-person classes stuns tech, science world

Let me let you in on a little secret. The world has a thing called time zones. It means that it's not the same time everywhere on the planet. As a completely random example, imagine that you are going to take an exam which starts at noon and lasts for two hours ... at the university's default campus on the eastern coast of the U.S. Since the university doesn't want students to record the exam as it shows up on their screen and send that to others, everyone has to take it at the same time. If you live in the eastern U.S., you take the test from 12:00-14:00. If the western U.S., it is 9:00-11:00. What if you live in India? It's 22:30-00:30 (10:30 PM to half past midnight). In China, that's 01:00-03:00. In the most populated time zone in Australia, 03:00-05:00.

Since university schedules tend to include morning and evening classes, anyone outside the Americas is virtually guaranteed to have to completely mess up their sleep schedule to take their classes if there's any real-time component (including taking tests, asking questions, participating in discussions, and many other very normal things for studying). For this reason alone, students may wish to take online courses in a similar time zone to the ones they're recorded in. And that's the most obvious pain point about trying to do a virtual education from the other side of the planet. There are many others.

Re: Sometimes you just have to be there

I entirely agree. I think this applies to most of life, really. I've certainly noticed that some types of activities I did at the office are not working as efficiently now that I am at home, and my job is one of the most easily virtualized ones. Still, I know that it is not safe for me to return to the office, and if the U.S.'s trend continues, it may not be safe for students to return to universities in a month or two. Given this safety concern, there are only a few ways to deal with it.

You could just cancel classes and postpone them for a time when optimal learning conditions are available again. This would harm plenty of students who will have delayed entry into the job market and may not have the economic ability to do nothing for a semester. You could bring all the students to the campus with the ability to send them back home if something happens, but in addition to increasing the likelihood of something happening, you have also created a bunch of chaos if you do exercise the option of sending the students away. You could try a hybrid model where some students show up and some don't, which would probably be bad because those who do show up get all the benefits you listed in your comment while those who go virtual aren't the primary focus of the university's planning (as well as all the concerns about bringing everyone back just scaled down a bit).

While you raise valid points, nobody is doing this because they think it's better. They're doing it because the situation is dangerous.

UK government shakes magic money tree, finds $500m to buy a stake in struggling satellite firm OneWeb

Re: It Could Be Made to Work ???

"But nobody from government has stood up and said why they've just spent half a billion on something out of the blue."

Well, technically, several people and documents from U.K. government did say exactly why they bought it. It's just such a shame that basically none of them agree on what that reason was. This article quotes someone who says the reason is broadband. The article from a few days ago links to a report that says it's mostly navigation. Comments sections for both articles link to articles saying any number of other things.