Posts by doublelayer

PC printer problems and enraged execs: When the answer to 'Hand over that floppy disk' is 'No'

Re: Ah IT 'managers'

"A manager's role is not to hire and fire, but instead to lead and inspire."

I've seen that go wrong too. They feel the need to lead, by which they mean tell everyone what to do and how to do it at all times. After all, if the people did things based on their expertise and their own evaluation of what was needed or most important, the manager isn't leading, are they? Inspiring the team members is less likely to outright anger them, but it can waste time. Most of the time, the team members already know what they're doing and why, so they don't need inspiration. Inspiration is needed when the team members have been cut off from information about why what they're doing is important or when they've been mistreated. However, it's not really inspiration that is going on there, but some degree of protection from external attacks and solidarity with the team when the protection isn't sufficient. That's what a good manager does, in addition to successfully coordinating the work of the team.

I was originally going to try to extend the line to state my point and maybe include a fourth rhyming term, but then I couldn't think of a good rhyme for that and started writing other couplets. I ended up with this, which seems a little silly but now I've written it, I might as well post it:

A manager shouldn't just hire or fire, nor should they try always to lead and inspire,

They must keep the team healthy--know who has done well, and when needed the team members' merits they sell,

To diffuse conflicts, keep the work on a good path, and insulate others from excessive requests or wrath,

to remember always what they can and can't do, and to know when to delegate something to you,

To strive for work well done, not focus on just power, and know not to nitpick about every last hour,

but when needed they may have to bring someone to anger if that guy has become a team-dragging anchor,

and if they can manage that, both below and above, they will earn the workers' considered love,

but if they fall short, it will become clear, and the workers will flee in less than a year.

Microsoft emits a colourful Windows Terminal preview

Re: Open Cmd Here?

You can add a program to that menu. It's a little tricky, and usually the program will add the shortcuts for you, but if you enable it to launch a program with the selected folder or file name, it can do that. It looks like the shell included with Git for Windows will open in a directory if it's provided, so I'm guessing Cygwin will too.

A memo from the distant future... June 2022: The boss decides working from home isn't the new normal after all

Re: Socialize? With nerds?

"The social aspect of work is a myth, or better more akin to Stockholm Syndrome than actual camaraderie."

I beg to differ in two ways. First, one can make friends at work. I am an introvert, and I don't see people all the time. I don't expect that, when I leave my current job, I will be friends with everyone I know. However, there are two people I'll probably stay in contact with because we've talked for long periods, have similar interests, live in the same area, and are similar in age. I have met people at previous jobs that I stay in contact with as well. As a proportion of the people I know well from those jobs, it's very small, but those are two or three people that I can talk to from time to time and make life slightly more fun.

However, my main point of disagreement is with your limit on what "social" means. It can mean making long-lasting friendships, but usually, it doesn't. What it means for me is the productivity of a community of likeminded people and organic conversations. Consider two examples, which happen to be the people who work closest to me in the office:

There's one guy who works on my team. He writes a program and I write a set of libraries that are used by that program. I don't write that program, and my libraries are available for use by other programs, but the primary user is his group. For that reason, we often coordinate features in my libraries based on what he is going to use them for and I test new functionality at times by using his program. If I have a question about how to work it, I can walk over to him and ask. Similarly, he can ask me about details of the libraries or report possible bugs in a few seconds. Now, we can still do that, but we don't. Our company uses Teams, and we do have a consistent chat going on. Still, it's a slower process. I have a question for him, and go to our chat. His status is set to "do not disturb". I don't know if he really means that, if he forgot to turn it off, or if he turned it on by accident. Do I send him a message now or wait? In the office, I can decide this by walking over and see if he looks busy. On chat, it's hard. Similarly, if one of us sends a message but the other one doesn't see it for a while, we can spend time waiting for a response that will be delayed. In a conversation, one of us can inform the other that we're busy or we don't know, and they can go find the answer in documentation without waiting for a response that won't be helpful.

Now, consider the person who works on the other side of me. We don't work on the same team. We don't even work on similar things. We joined the company around the same time though, so we've talked from time to time. Every once in a while, one of us will stop by the other and see how the weekend was. In the month before we started WFH, she was trying to find an efficient way of performing a specific type of calculation, which I helped her do. I was trying to set up a complicated build system, and she helped me with that. While our conversations are primarily not work-related, that's two lots of productivity that we got by being near to each other and talking. Now that we're at home, we may send a "How are things going" type message from time to time (actually not that often; I should do that now), but we're certainly not asking each other about work issues because we don't work on the same team.

In neither of these cases will I be likely to have a lasting out-of-work friendship with these people. Occasional conversation with them can be pleasant, and it can make our work more productive. That's what social discussion in the workplace can be. If you've never experienced it, fair enough. If you prefer WFH in all cases, I'm happy for you to do it. In fact, I wasn't all that sad about the change of scenery at the beginning, though it's gotten boring. But just because you haven't seen it, that doesn't make it a myth.

Re: Serendipitous

If you're willing to take American analysis of their situation, check out this podcast from the University of Chicago. They analyze how much of the economy can work from home, what that part is, and how it varies geographically within the U.S.

In terms of a decision on what is good, it's very tricky to calculate. A GDP approach which counts basically how much money is spent is widely regarded as insufficient, even by the people who came up with GDP all those decades ago. However, since it's easy to calculate, it has become the de facto measurement to watch. Some countries, including New Zealand and Bhutan, have created government departments to come up with a way of evaluating other things that aren't as easily calculated and then calculate them to create a value for the country's activity, but it's not done by very many countries and each one is virtually guaranteed to do it in a different and incompatible way. Simply driving consumption is clearly a shallow and partially ineffective method of improving people's lives. Not valuing jobs, on the other hand, will also be ineffective.

By emptying offices, coronavirus has hastened the paperless office

Re: Print volume that would fill the area of seven football fields every minute in 2020.

"We need a new intermediate unit between the football pitch and the Wales."

If you change the time unit, the number works pretty well. It's about 1.26 Wales per year or 24 milliWales per week.

Hey is trying a new take on email – but maker complains of 'outrageous' demands after Apple rejects iOS app

Re: Forced?

"If you ever watch Dragon's Den, consider the markups that get discussed there - it's not unusually something costing £5 to make, to be sold to retailers for £20 and then £40 to the consumer."

There is something to that calculation that often gets ignored. The £5 is just the manufacturing price. It doesn't include payments to staff, investment in reducing manufacturing prices, rent on physical company presence, or R&D into new products. For quite a good reason, as those prices change a lot and are tricky to calculate anyway. For people who start a company, they probably aren't drawing a salary in the first place and can take risks, but if they have to hire phone support, they will still have to pay wages for it. However, seeing £5->£20->£40 and assuming this means £15 profit for the manufacturer and £20 profit for the retailer isn't correct.

Re: reply later

"Personally I'd like to see clients not only providing this but also not allowing a message to stay in the inbox after it's been read."

I take it your choices would be to move it to a folder or immediately delete it? That will certainly annoy the users.

"Provide at least some form of filing even if it's only 'All emails from year yyyy'."

Don't we have that with the advanced search feature? Mine lets me set date ranges, filters on from and to and CC and BCC fields, and lots of other options including regexes. Also, this is going to seem weird with the next suggestion:

"And delete all messages from Trash after a few days."

Which will lead to people never deleting any message. A lot of people use their email as a record they can comb through later. They may not always know they'll need a message a month from now, so they keep a bunch of archived messages to search through. Not efficient, no, but they want it. Removing that feature or designing features specifically to thwart them will just lead to annoyance on their part.

I wouldn't expect many others to use your client if you write it.

Re: @Stuart Castle - Email already passé?

You can, but doing it automatically means you don't have to. If you need to, want to, or have any inclination to whatsoever, the automatic feature is nicer. Taking it away rather than just not turning it on will probably annoy people who want signatures. While it doesn't affect me because I don't have a signature, others won't be so fine with it.

Features of Hey

"Hey describes itself as a "full email service provider" with a few key features.": Let's look at them.

"You have to approve senders, who until then are listed in a "first-time senders" section. If rejected, subsequent emails go directly into a spam box.": So I have two sections. Emails from people I know and other ones. And, just like most other clients, there's a button to block the sender. Good to know.

"You can enable a sender to bypass the quarantine by giving them a code; these can be regenerated to prevent leaked codes causing trouble.": So if I understand this correctly, I'll be talking to someone else who wants to email me. I'll give them my email address, but then I'll also have to say "Wait a minute. My email is paranoid and will block you so I'm going to generate a number on my phone. Please put that number into your email in some place, I'm not really sure, and you'll bypass my system's filters". This is somehow more difficult than just going to see them in the first-time senders box?

"The inbox is renamed the "Imbox" on the basis that anything that makes it is Important.": Maybe it's just me, but that sounds childish.

"File attachments that you send are not included with the email, but sent as links to files stored on Basecamp's servers.": So it triggers spam filters that see a link to an unfamiliar server, huh? And it probably tracks people who access my attachments, exactly when or how many times, etc. The attachments don't get autostored on my recipients system like they usually do, so they might try to access it later only to find the server's deleted it. If I want to send them a link, I'll upload my own file somewhere I control, thank you very much.

"You can rename or merge email threads;": Sounds handy. I assume this is retroactive, not just what I can do during a reply. Maybe a useful feature.

"and email trackers, which tell the sender when you opened the message, are mostly blocked. "We bulk strip everything that even smells like a spy pixel,": Good job. How does this compare to the don't-load-remote-content feature on mail clients?

"In addition, all images are routed through the Hey servers so that the recipient's IP address is never revealed.": This is a nice privacy feature. I already have it by not loading the content, plus there are other mailservers which already do that.

"No automated signatures or footers are allowed." ... "The email already says it's from you. If someone needs your phone number, they can ask,": I'm restricted in what I can put into my own emails? Not that you strip the signatures from incoming emails when I wouldn't want them, but you strip them out of my own emails? Do you understand what user choice is? If I want to have a signature that gives someone alternate methods of contacting me in an emergency, or other people who might be better able to handle their question, I certainly will and getting in my way is ill-advised.

"The system does not show numbers of unread messages as this is an unnecessary distraction.": Or it's a method of finding out if you have new emails without the notification sound turned on. If you leave any messages unread, a flag will be up, and if you get some new ones, the number is higher. I can see it at a glance.

"Notifications are off, though you can enable notifications for specific senders or threads.": This is nice. I don't know many mail clients that allow me to tailor my notifications by specific message characteristics. I'd also like it if I could set different sounds or vibrations for that as well. That's a feature worth having.

"Attachments are filed automatically in an attachment library.": I'm not sure exactly what this means, but if it's just a window to see all attachments, why not.

"A "Reply later" folder lets you store emails for attention at another time – better than the common technique of marking an email unread, according to Basecamp.": Create any extra folders you want. I can do that too.

"Another feature is the ability to expand all unread emails in a single action so you can scroll through without opening each one individually.": I don't need that, but I can see why someone might.

"There is also a technique for managing frequent senders: you can bundle all their messages together so "they'll only take up a single row in your Imbox.": Possibly useful feature.

This looks like four useful features, five detrimental features, and three neutral features that are already possible. I have a suggestion for you guys. Ditch the server part. That's where most of your detrimental features are. Just implement a mail client program with the features you like, which includes all of the useful ones, and we can look at getting it later. No annual fee, perhaps, but maybe people will agree to buy it. I'd try to be less heavy-handed with your preferences, though.

Not exactly. If you use in-app purchasing, they do, and that's common knowledge. However, there are lots of apps that do not do that and yet get money. You sign up for an account, add a payment method in that account, and use the app to access the account. There are lots of those out there, and they don't get evicted. I'm guessing they don't get evicted because Apple doesn't want grumpy users of what are primarily apps created by big businesses. The fact remains, however, that many apps are out there which receive money from inside the app or require a subscription where none of the revenue goes directly to Apple. As much as I don't care about this app, there is a reason to complain if they tried the same model and got removed without consistency. Since Apple won't talk about exactly what they used to make the decision and this app will always try to present their actions in the best light, I cannot know if what I presume is true.

Re: reply later

In most mail clients, file -> new folder -> enter "Reply later" in name field. If your IMAP server is not tightly controlled, they can even sync it for you. Setting that up might require a desktop client but a mobile client should be able to add the mailbox if you sync it. Admittedly, having that built in rather than having to create it might be easier for some people, but otherwise it's not that big a feature.

Huawei's EMUI 10.1 update shows Chinese mobile giant hunkering down for the long haul without Google wares

Re: So...

There are two approaches Huawei could take related to their licensing. First, they could do what you suggest, and use their non-Googled services framework to market their devices. This probably won't work very well--if anything in their framework breaks compatibility with Google's, people will notice and associate it negatively with their marketing. People who dislike Google may be attracted, but many won't want to have Huawei collect the data they worry about Google collecting. Meanwhile, a lot of the public won't know what the services framework is and will ignore the advertising.

The second approach is to market the services framework to other manufacturers. These manufacturers are already competing with Huawei using Google services, and some of them (Xiaomi, Oppo, and Realme, for instance) are doing rather well at it. If some of these companies used Huawei's code instead, Huawei would have more control over competitors, would be able to license the code for a fee, might force Google to maintain compatibility with it, etc. This would be relatively invisible to most users, but Huawei could gain market power if they succeeded in convincing other companies to adopt it. I think that would be somewhat difficult, but more likely to produce benefits to Huawei than keeping it exclusive.

Re: So...

Google already didn't have China. Pretty much every Google service is blocked in China, meaning a lot of the code Huawei is rolling out is based on code they've already written for China, one of the reasons they've managed the release so fast. Whether this builds into a competitor for Google will probably depend a lot on whether other manufacturers get the ability to use the software--Huawei on its own isn't an Apple, and probably wouldn't manage to carve a massive chunk of the market on its own hardware and software. By licensing HMS to other manufacturers though, there's a chance.

HTC breaks with tradition to push out 2 phones someone might actually want to buy

Re: I'll take the "small" one

No, you get downvoted for misstating someone's point. It was "I want more smaller phone options". You said it was "Large phones shouldn't exist". Now you're misstating others' points. You're claiming they said "Flagships should be small". They're actually saying two different things: "There aren't really any modern phones small enough for my preferences" and "The sort of smallish devices that do exist are hobbled by low specs".

Independently, there was a discussion about manufacturers dropping headphone jacks. Someone claimed Samsung was particularly bad about this. Someone else responded that, actually, Samsung was better because their mid-range ones tend to include them while others' mid-range devices don't. True to form, you misstated that point too.

Re: I'll take the "small" one

I believe you're wrong there. There are a few smaller devices, but not many. Apple has one now that measures 138 x 67 mm. That is certainly small compared to modern large devices, but compared to what many proponents of small phones are used to, that is already quite big. Consider the phone I'm still using, which is only 58 mm wide. If someone likes that size, there are not many options left to them. There's that mutant one from Palm which is marketed as the £300 extra phone and the even weirder miniature phones from Unihertz with 2.5-inch screens, but other than that, you have to get at least 10 mm wider to get to the smallest range of modern smartphones.

I think the complaint is less "big phones shouldn't exist" and more "why can't a few manufacturers make a small product line", and it has a point. If manufacturers choose not to manufacture, it's their right not to, but similarly people can lament the lack of a product they want to obtain.

Smartwatches win the consumer tech sector for Q1 2020 as locked-down folk take up fight against corona-carbs

I came here to say the same thing. Since you have already done so, I thought about the other company named there. I didn't know that Garmin made Wear OS watches. From a little searching, it seems they don't either. I found an article (warning for many ads on that page) comparing their model to Google's OS back in 2018, and they were running a custom OS of their own design. I found several of their more modern watches online, and none mention Wear OS in the slightest. If they use it anywhere, they're keeping the secret well enough that several searches failed to turn it up.

Not so nice, we investigated them twice: EU opens double whammy of inquiries into Apple's biz practices

It's unfortunately a popular restriction. I was recently writing an Amazon review and wanted to mention that a certain product is nice because they have open source firmware builds that are easily modifiable, and I linked to the manufacturer's site to show people where to find them. Amazon was not pleased. Stupid really because this manufacturer doesn't have their own store and all the purchase links on their site go to Amazon. I am allowed however to include Amazon links to completely different products; Amazon is not about to protect their sellers but they certainly will protect themselves.

Re: 30% is outrageous, but not for books

I am not very knowledgeable about this, but I think the reason is that a book has a lot more work in its production than just the author's contributions. Manufacturing of the book (paper, printing, binding, artwork, etc.) is expensive. Illustrators may need to be paid as well, or editors. And there's shelf space in physical stores if they still do that. The real question would probably be how much the publishing company gets merely for marketing and profit and whether they are useful in that capacity. I'd imagine exact statistics on both are jealously guarded by publishers.

Singapore already planning version 2.0 contact-tracing wearable

Re: Workarounds if device made compulsory?

Metallic shielding might work, but might be obvious. A modified device with a power switch would be tricky to build but relatively easy to use. If a dictatorial country got annoyed enough though, they'd just check that history was working at any checkpoint. For example, when checking you into a building, they would verify that your device was picked up by some readers on your path. If it wasn't, you can be detained while they investigate your device for tampering or defect and possibly replace it for you.

Tens of millions of Internet-of-Things, network-connected gizmos at risk of remote hijacking? Computer, engage shocked mode

Re: How many of these things actually have a mechanism for firmware updates?

Usually, they go with one of the following models:

1. There is a firmware update mechanism that operates online, either directly if the device has network connectivity or through a phone app if not. You never get told what update you're installing, what it does, what it fixes, or even when such an update is occurring. Either the code just changes randomly, or you get an update button with no additional context.

2. Any firmware updates are published on the manufacturer's website. Sometimes, your product is a rebadged thing, so you have to look for a model number that's not your model number. If you finally navigate that maze, there's a 90% chance that the last firmware file is one you already have. If it's not, you can download a blob which can be uploaded to your device in some way that is not clearly explained. This will have a higher version number or sometimes a completely mutilated one, but no information on what it does. Check whether your device has a card slot, USB port, or a firmware update page on the internal HTTP server. When you provide this blob to your device, it will go unresponsive for thirty seconds while it looks at it. If it doesn't like it, it will brick itself. Then the file will be verified several times to make it hard to put your own firmware in. Then the device will restart. Then the device will see a firmware update file on your USB disk and start the update procedure again...

Re: How many of these things actually have a mechanism for firmware updates?

>> your Samsung TV probably has a facility for firmware updates, and Samsung probably have servers to do the pushing

> But do they have the intention to update anything but their latest kit?...

I can say from experience that they do update older devices. Just a couple weeks ago, a family member asked for my help to update the firmware on a six year old TV from Samsung, and I found firmware for it that is only two weeks old. Of course, this firmware has exactly the same problem that caused them to want to update it, and appears functionally the same in every respect including most of the version number. There is no change log or anything, so it's possible that the server just picks a random date and slaps it on. This seems to be a frequent model for making and releasing firmware updates. Nobody seems to know what it does differently from the last version, but the number's higher so it must do something.

From the crew behind the Sony Pictures hack comes Operation Interception: An aerospace cyber-attack thriller

How easy was that attack

I'm wondering how easy someone in, for example, sales would find it to extract a password-protected .rar archive. It's not supported by Windows natively, so they'd likely have to get another archive program. At the point where you have to convince someone to download a file, decrypt it, decompress it, run a shortcut, and download a file, you have to ask if your scheme is too suspicious to work. At least, if I were evil I'd be concerned that the complicated process might confuse my victims or cause them to report me. Evidently I still have too much confidence in the social engineering resilience of the average user.

NY Attorney General warns Apple, Google to police COVID-19 tracing apps in their souks – or she will herself

"Or, given public health and epidemeology typically relies on identifying and tracking outbreaks, having some view of what's happening seems like a sensible idea. Cluster of red dots growing in Slough? Maybe just quarantine that*, not the whole country."

You aren't paying attention, are you? The app doesn't detect cases. It alerts people who may have cases. You know, after someone they came into contact with is determined to have a case. That's done by testing. Testing is done by the NHS. The NHS can report the test and where it happened and can ask the person for an address, which they can use to put a red dot on a map. The app could not put those dots on the map because the app doesn't know whether you have a case.

Only true boffins will be able to grasp Blighty's new legal definitions of the humble metre and kilogram

Re: Self-referential

No, it's not. The law defines a constant value H. H is defined as having a unit which includes the kilogram. The other units present are clearly defined, meaning that you can calculate the kilogram in terms of them and the constant value. The kilogram is the one variable there, and therefore can be calculated.

Admittedly, as this is written, the kilogram is basically just an arbitrary number based on a constant they pasted in. If they wanted to go very extreme, they could include methods for arriving at Planck's constant in the law too in order to prove why that value was used. It's not worth that effort though.

Re: £sd

Well, as a young person and never lived in the U.K., I was always very confused about old British money. There are still coins I'm not exactly sure how much they were, which often leaves me disoriented if I'm reading old British literature. It's similar to how I felt when Jules Verne reported all the measurements in his book in leagues, sometimes clarified as French leagues and times such as two o'clock in the evening, which I still don't understand. Standardization is very nice.

Whose side you on, Nominet? Registry floods .co.uk owners with begging emails to renew unwanted .uk domains

Re: Pointless limitations

As in both a .com and a .co.uk were in existence at the beginning of the internet. Most other TLDs were not. If you want to get pedantic, .com predates .uk. The point still stands: these TLDs had an organizational purpose when they were created. Creating a bunch of new ones would destroy it for little benefit.

Re: Pointless limitations

Here's why. Several reasons, actually:

1. You shouldn't have the rights to a TLD, and few people do. If you register one, then you get to resell it. If I buy, for example, .canada, I would be selling domains in it despite the fact that there's no reason I should have more rights over this likely Canadian-centric domain than any other person. You would end up funding people who get in their requests first. ICANN basically did this anyway, but they gave the preference to people capable of coughing up several hundred thousand dollars per TLD. It was bad when they did that.

2. You end up destroying the organizational systems that TLDs originally provided. If we never had domains and everyone just registered a unique name, that might work. However, that's not what happened. We started with a .com and people used that. It would be very irritating if established domains suddenly split into about twenty possible versions. Does a business based in London put their site at .uk or .england or .london, or for that matter .en, .eng, .lon, .gb, .britain, or whatever other domain someone's come up with? In that case, what's the point of having TLDs at all?

3. With an infinite series of domains, you end up with massive squatting problems. I'm a scammer who wants to impersonate Microsoft? Well they've got microsoft.com nailed down. Have they got microsoft.c0m? Maybe, because if you let people reserve domains, someone is bound to create .c0m. But you can just generate something else. Maybe they never thought to go in and snag .microsoft and you can do that. Since MS has a U.K. presence, why not use one of the eight U.K.-related domain names I listed above and specialize in scamming British people? Keep in mind that those eight only focused on England and London, not any other part of the country, so there'd likely be tens or hundreds more. There's no way they can reserve all the potentially misleading domains.

4. You are handing out a license to print money for anyone who can find an untaken TLD and extort people with threats of squatting. Microsoft may be able to afford buying a couple thousand domains. I for sure cannot.

5. Because you are making it very easy to get TLDs, you are dramatically increasing the supply of domain names that are short and memorable. This would send the price very low for most of the unpopular TLDs, which would likely attract many unscrupulous people who need a domain for scam or malware purposes. While a free domain is always nice, what would actually happen is blacklisting of TLDs as a whole by overeager people who write firewall rules. This would cause problems for users of that TLD, legitimate and malicious alike, and cause people to migrate away from that one and to others. New firewall rules. New domains. Broader firewall rules. New domains. Rules that only allow a certain subset of domains. The system as we know it today. Your system would eat itself.

Other than that, no problems.

After IBM axed its face-recog tech, the rest of the dominoes fell like a house of cards: Amazon and now Microsoft. Checkmate

Re: What about face recognition for ROBOTS?

"I think you missed the point"

I think you missed several. Let's take some of the parts of your comment here.

"the tech itself being useful OUTSIDE of "big brother" surveillance..."

Worry not; we will get to that.

"and AGAIN, just because some might ABuse it [such as a "big brother" gummint], you don't abandon the ENTIRE tech because of it [and, of course, because of any kind of activism]."

So, if something is prone to massive abuses, we shouldn't abandon it for that reason? We abandon lots of things for that reason. We restrict lots of things for that reason. If something has a bunch of dangers, we tend to try to prevent it from being used in a dangerous way. If we can't develop a safe way to use the thing, we prevent its use. We did this with dangerous chemicals of many types. We did it with weapons which we deem too extreme for individuals to operate. We do it all the time.

"And, keep in mind, "those places" ALREADY do 'abuses', and nothing WE do is stopping them..."

Yes. As I said, I can't do much about that. However, that someone else does so isn't a good argument for us doing so as well. So few people are paying attention to that at all, and some other people see a repressive government and think that's the right way

"So yeah, I want to see face recog for robots, so they can recognize YOU, your friends, and those you don't want inside your house [as an example]."

Terrible example. We're talking about completely different tech:

Your example: Recognize a face from a small list of prelearned faces, from an individual person who can stay in one place during the scan, from a camera that can move to get a more accurate image, without very much background noise.

The tech under discussion: Recognize a face from a massive set of faces (from several thousand to millions) from people in a crowded area, where the person does not move to show you most of their face, where the camera cannot move to capture a more accurate picture because it would thereby miss people it turned away from, massive amounts of background noise.

One is very different than another. The first has a few uses, and we actually have that tech already to a great extent. The latter, not that many uses that don't prove oppressive.

Re: What about face recognition for ROBOTS?

The "if we don't build it, they will" argument is usually stupid, and wouldn't you know it's stupid here too.

In the case of a new type of weapon, it can make some sense. If we don't build the big bomb, they will and they will be free to use it on us because we don't have some to convince them not to. It leads to an arms race, lots of fear, and usually a bunch of time and money wasted on weapons that nobody wants to use, but at least the logic makes sense.

In terms of cryptography, there's relatively little logic. If we don't make cryptography, then they will and they will have privacy and we don't. There's a good reason there to invent our own, but it's not because we fear the ones who have it; it's because if we don't, we won't have the advantages that the tech provides. Having our own cryptography doesn't prevent them from having it too. Privacy for everyone.

For facial recognition, there's basically no logic. If we don't build a system to surveil our population, they will build one and surveil theirs. Er ... yeah. Many things that countries we don't like do are things we don't want done. I don't want to be surveilled. I also don't want the Chinese population to be surveilled. I can't do much about China, but just because China has decided to commit human rights abuses, that's no reason that we should start doing so too. Similarly, I bet you can find various countries that have much better torture equipment than most democracies. I don't want to compete on that either. When some country decides to invest in something harmful, the right solution is not "anything you can abuse we can abuse better" but instead to work against the places committing those abuses.

Re: Headline

If only it was true, though. Three companies have pulled back, leaving various others to take up the task. Amazon backed off for a time period. Microsoft wants someone to pass a law approving of them, probably for liability reasons. IBM may have actually done something, but as the article notes, they still leave some options open. This isn't check mate. Maybe a bishop's been taken, but you can still lose under those conditions.

Whatsapp blamed own users for failure to keep phone number repo off Google searches

Re: It's an unknown

Here's a reason that might work. I currently live somewhere and I have a number there. I'm considering spending a longish time in a different country, and that country doesn't have the same telephone service providers. If I ask people in that country to use my number from this country, they may incur international charges. If I ask people from this country to use the number I get from that country, they will incur international charges. If I keep a roaming account in use on my phone, I will incur roaming charges. If I find the cheapest possible plan and use it to keep my number from this country, then people can still reach me through Signal on that number. While Signal works for most of my friends, WhatsApp, Telegram, and pretty much every other chat app works on the same basis. So, for anyone who wants to contact me, they can do so for free without worrying what country I'm in. For anyone I want to talk to, I can do so for free no matter which country I'm in. In order to keep this, I only have to pay a very basic phone bill rather than a bunch of high roaming bills. That's simpler and cheaper for everybody. I don't like WhatsApp very much and don't use it myself, but if I do move out of the country, I may have to get it for friends who don't like Signal.

As Uncle Sam flies spy drones over protest-packed cities, Homeland Security asks the public if that's a good idea

Re: I don't even see an option to make a comment.

I'm guessing the pilots were at that base as well, but no guarantees. It appears the distance between these places is 438 km, (272 miles), but the distance can be much greater.

Purpose of survey questions

""The survey will ask respondents to report":

"their demographic characteristics": Either to be used to argue against someone's opinion on a demographic characteristic or to completely ignore some subset. Lots of options to make fallacious arguments on that basis, and also a worthless question.

"their knowledge of unmanned aircraft systems (UAS)": In order to dismiss arguments as "that person doesn't know anything".

"their knowledge of the use of UAS by first responders": To bias them in favor of a favorable opinion and for further "they know nothing" potential.

"their overall trust in the use of new technologies by the government and first responders": To dismiss all points raised against it as being made by paranoid lunatics.

"their general attitudes about such use": To dismiss all arguments against it as hating law enforcement.

"and their opinions about the use of drones by first responders for specific applications like search-and-rescue.": Further to bias people to a favorable opinion.

You know what I don't see in that list? How about a question about people's opinions of drone use for purposes like policing? Not search and rescue? The reasons they've been used recently. How are you supposed to figure out what people think if you don't ask about the thing you're going to talk about? If you don't care what people think, why do you bother to ask them?

Huawei's latest smartphone for the UK market costs £1,299. And yes, that's without Google apps

I'll grant that. Compared to Huawei's Googleless lineup, however, it's a lot more devices. If you restrict yourself to subsets with certain features, you'll soon run into limits. Sadly, the software landscape on phones seems to do that to us. Xiaomi and OnePlus will probably be better manufacturers to check for modern devices, but no guarantees about feature availability.

Re: A google free telephone?

If you don't like Google, and I'm with you there, I don't understand your happiness about Huawei's current lineup. Avoiding Google can be done for much cheaper. Lineage OS provides a nongoogled interface with a long history of security and feature updates, and it supports a lot of devices. If your view is as described in your comment and you don't even care about Android app compatibility, there are even more options. There are existing extremely-private devices made for Ubuntu touch as well as other concept browser-only devices.

Furthermore, while paying a massive amount for this device, you only avoid the Google-particular data collection. Instead, you enroll yourself in Huawei's. While I may trust Huawei to have fewer nefarious uses for my data, I wouldn't be that eager to replace Google with them. Especially considering that the alternatives I list above remove me from Google's collection without adding me to anyone else's. So unless you hate Google just because they irritate you but not for privacy or security reasons, this seems like a faulty method of escaping it.

Count how many times the Feds checked Chinese telcos in America weren't spying. Only one hand needed

Re: "The vid-conferencing biz said it was following Beijing's laws"

"Does Zoom retain a recording of everything said in meetings on their servers ?"

Yes. They think it's a feature. For some reason, people have been ignoring all the massive warning signs going up around Zoom in the past few months. I'm sure they'll all ignore this too.

AWS won't sell facial-recog tool to police for a year – other law enforcement agencies are in the clear

I think I know how this will work

From the Facial Recognition Injustice Elimination and National Defense Act (FRIEND Act), October 2020:

"It shall be illegal for any institution of this government or of the governments of the states to use facial recognition software for the recognition of the public. It shall also be illegal to retain records of facial data collected by public safety organizations for a period exceeding fourteen days. These requirements do not apply in the case of matters of national security, terrorism, human trafficking, or crimes against children. Furthermore, a fund is authorized to assist in the research and development of more accurate facial recognition models to prevent this technology from resulting in unintended discrimination on the basis of race, gender, or any other protected characteristic. These funds are to be distributed to organizations doing development in the United States and using information of U.S. residents only in order to foster domestic development of artificial intelligence software."

From the records of the Improving Facial Recognition Software Accuracy Agency, December 2020:

"Grants have been authorized in the following amounts: To Amazon.com, of the state of Washington, $258 million. To Clearview AI, of the state of New York, $223 million. To Public Safety Facial Research Systems Inc, of the state of Delaware, $198 million, ..."

From the records of ________, company name redacted, March 2021:

"We have obtained a dataset containing the images of all U.S. residents from government databases opened up by the FRIEND Act. Our accuracy rating seems to be improving nicely, and we believe will be able to make the targets requested by our clients in Saudi Arabia and China."

From the records of various police departments: May-July 2021:

"Recent protests in our city concerning [insert something you could protest here] have caused damage to property and chaos in the area. These tactics are being considered terrorism. For this reason, we will be investing in facial recognition software and longterm storage systems. We request additional funding for this purpose."

Remind us again, why work for AWS? Petty Amazon sues marketing veep after he defects to Google Cloud

Re: How very trusting of him

I really wouldn't count on that. I think employers will throw in any length they want to if they can get away with not paying while it runs out. Given that there are places where that is accepted in contracts, I'd expect employers in those areas to put in a year or longer even for basic people. It doesn't cost them anything to decide they don't care in this case and they'll let that employee go, and if they decide they do want to retain them, they have ammunition stored and ready. The only reason they'd limit it is if there were some restrictions forcing them to pay for part of the period, making them liable if the employee couldn't get an acceptable position, or forbidding it entirely. Without those restrictions, it would make a lot of sense for the company to be as predatory as possible.

It could be 'five to ten years' before the world finally drags itself away from IPv4

Re: Doomed to eternal limbo

I grant that NAT breaks many protocols. The problem is that many of those protocols from before NAT was taken into account aren't very useful anymore as they were. Take your chat protocols. They would still work, but few people will use them. Why? Well, most of us now use devices which might move around, from laptops to phones. We probably want chat messages to come to us wherever we may be, without having to have dynamic DNS attached to our personal machines. Our address will keep changing, so merely identifying an address is a little painful. For that reason, a lot of old chat systems used a central server that associated names with addresses. Yes, a central server, so it wasn't purely P2P. And that just fixes the discovery problem. What about storing messages if the device is offline? For the chat purpose, using a central server is usually not a problem.

There are other protocols that could benefit from a direct connection, but there are also ways of creating that with NAT in place. Some of them pipe all the data through a central server, but many others use that server only to identify a pathway between devices which is then used without the server's involvement.

NAT isn't good everywhere. I like it on my own network, but I don't like it on my ISP. Since we don't have sufficient IPV4 addresses for all the individual users and machines we want to be addressable, IPV6 is likely our best path to not having that problem. That doesn't diminish the benefits of NAT. To the adoption of both.

Re: Doomed to eternal limbo

Yes. That is the firewall point from above. I acknowledged it and I acknowledge that I still think NAT has a benefit there. What about the tracking aspect? Because those addresses also look different to the external server, which I don't want them to do. I assume you don't mind that, but for people like me who do, do you have a suggestion other than NAT?

Re: Doomed to eternal limbo

I think there may be a disconnect here. My comment does not make any points against IPV6. In fact, I don't mention IPV6 itself, either positively or negatively. I meant my comments to be limited to a SLAAC versus NAT discussion only. In fact, while my home network currently uses a private IPV4 address space, I have others using NAT on IPV6, and I'm perfectly fine with that. I'm primarily a proponent of IPV6 adoption.

Re: Doomed to eternal limbo

"Oh and why would a router need to dole out IPv6 addresses using DHCP? All my routers had that disabled by default and everything uses SLAAC."

Well, that's a choice, but not one I'd make. For those who are not aware, SLAAC is basically the globally-unique address which gets attached to the router's address range automatically, meaning you neither have to attach static IPs nor run a DHCP server. And it means that every device becomes publicly addressable.

I do not want random devices to be publicly addressable, and therefore I use DHCP to local address ranges. Yes, I know what a firewall is. I have one configured. But I find that NAT is a good method of not letting a device receive commands from nobody knows where. If someone connects to my home network and I don't set the firewall rules properly, they either become a potential target for attacks or cannot be found by bots. I prefer the latter. For the same reason, my home network doesn't support UPNP. If I do want to have a device accessed from the open internet, I have to take manual steps to enable that. For my small network, I think this is preferable configuration.

In addition, unique addresses per device make it easier to track traffic coming from them. Using one address to route all my outbound traffic, a potential tracker cannot easily tell my phone from my laptop from a guest's laptop purely from the packet headers. Fingerprinting can still occur, but only by the sites I connect to. The ISP would not be able to track individual devices as easily. If I used individual addresses, not only would they be easier to track, but a tracker would also know extra information. The default SLAAC implementation includes MAC address data in the created unique address. This allows them to know the manufacturer of the device or network chipset and to identify that device if it is moved to another network without changing the SLAAC settings or MAC address. I view those things as negatives, and blocking direct addressing is one of my ways of combatting it.

OK Windows 10, we get it: You really do not want us to install this unsigned application. But 7 steps borders on ridiculous

Re: Colin Wilson 2 - Apple have got this right!

"Funnily enough it always seems that 'Security' are the worst offenders. They give themselves permission to install some essential tool, and its still there years later - even after they're long gone and their laptop's being used by someone else."

Then the company needs to learn that when someone leaves and their computer gets reassigned, you erase and reimage it. That's basic security. It's been known for decades. It prevents software being left on the machine. It prevents random files that are not needed taking up disk space, or a broken OS update sticking around for years. Reimage when ownership changes, whether a personal or business machine.

Re: Apple have got this right!

"At least for Macs, Apple have got this right. For £79 you can join their developer program - which, apart from everything else, gives you a Developer signing certificate you can sign as many of your applications as you want with."

Nope, that's just Apple doing the same thing. It's slightly cheaper for the certificate. That's all. Microsoft is also happy to let your stuff run if you pay a chunk of cash for the privilege. In fact, they're slightly better because they're not necessarily getting any of that cash, whereas Apple definitely is. The problem is that it requires developers to pay money annually in order to distribute software for free. Sure, it's not particularly expensive, but a lot of these developers, including the one mentioned in this article, are not making any profit off this. They may get some from donations, but it's not particularly fair that they need to pay Apple and cert providers to give away the fruits of their efforts. And of course, if they switch cert providers, previous downloads break immediately. If they stop paying, all downloads break immediately.

This might be excusable if doing this actually prevented malware, but because so many certs are issued, malware frequently signs itself because their authors are actually planning on making a profit so can fork out for a cert. As it is, developers are forced to subject themselves to a process that takes healthy chunks of money and still fails to do what it's supposed to.

How could this be done correctly? I suggest a very strict and scary warning message. How does this look?

WARNING. This program may be insecure and could put you at risk.

We don't know where this program came from. If you are not absolutely sure that it came from a reliable source, it's possible that it contains malware that could steal your information or cause problems to your computer. We suggest you do not run this program and delete the file. Please double-check the file and the location from which you received it to make sure they are trustworthy.

[Big button, set as default: Don't run and delete] [Medium-sized button: don't run] [small button over in the corner: Run anyway]

I'm good with that window. It can be helpful. But without that button in the window, including with that button technically there but purposefully hidden, they are preventing me from using the computer I purchased in order to get some extra money from developers.

Re: does filter out friend&family support calls

Don't count on it. Apple did a similar thing a while ago, where if you attempted to run an app that wasn't signed, they'd claim there was a problem and refuse to open it. It was very deceptive, and no "more info" present. However, if you went to system preferences, security, and clicked an open button in there, it would still work. I cannot count the number of people I had to tell that to when that particular feature got rolled out. Everyone with applications that didn't come from the app store was on the phone to me asking why the apps were broken and how they could fix it. I'd expect you will start to get those with Windows users too.

Re: I thought containers were a thing now

There are a few problems with this concept, and we can see it on platforms that do have that functionality. I'm thinking of basically all smartphones here. Here are a few of those problems.

First, it reduces functionality. I may get a couple files containing data from a website and save them to disk. Then, I open one or more of them in a text editor and type into them. Then I open them again in a different program which reads it and summarizes the data for me in graphical form. I save the image file of that graph, open a presentation program, and add that file to a presentation. I copy that presentation file into another directory, this one on a network-connected drive so I can pull it up elsewhere. When I have to fight every app to store that file in a location that every app can read from, it's quite the hassle. This is why IOS doesn't work so well for all use cases. It can function fine if you do all your stuff in one app. It can function with difficulty if you use multiple apps but they all support Apple's files system and store their files in those generally-available directories. If only one of your apps stores all its data in app-only storage, you end up fighting the system to move the data around so you can use multiple apps.

Second, it doesn't really fix the security problem. Reading data off disk is bad, and it can at times be worrying. Some other things are much worse. Reading the contents of memory, modifying the contents of memory, activating cameras and microphones, using the radio hardware to fingerprint the device, etc. Limiting disk access doesn't fix this, and if it leads to less effort on general security, that can be bad.

This isn't to say that disk sandboxing is a problem, because it isn't. But we already do disk sandboxing. Usually, it's done between user accounts, and the disks internal to user accounts are considered open to all user processes. I wouldn't mind if we moved that one level down, so users could indicate they wish to sandbox certain programs and not to sandbox others, and I wouldn't mind if we turn that on by default. Eliminating the open disk, however, will break a lot of functionality. Even if many users didn't notice it, many others would. The workarounds created by some operating systems are often frustrating, inefficient, and counterproductive.

Repair store faces hefty legal bill after losing David and Goliath fight with Apple over replacement iPhone screens

Re: Change Apple to Boeing or Airbus

Apple has the right to complain about the use of their logo on screens they didn't make. They are correct to complain about that. Except they're complaining about the use of any screens during repairs, which they don't have the right to do, and they also complain about the logo being present on screens refurbished by someone else, where Apple put the logo on. The first thing makes sense. The next two do not.

Re: It all depends on how the repairs were sold!

Those comparisons are not valid.

"If you buy a stolen item then you may well find that the goods are taken off you with total loss even if you didn't *know* they were stolen."

Yes, but you would not find yourself charged with theft, and even if you were, the charges would be dropped when they realized that you were also a victim. If you bought stolen goods without knowing they were stolen, you have not committed any crime. You would lose the item, and that would be the end of it.

"If you were to buy illegal drugs and have them shipped form Columbia then you may find yourself prosecuted even though it was also the seller who was breaking the law in sending them to you."

Because there are laws forbidding possession of those drugs. It doesn't matter where they came from; you would be equally culpable if you bought them locally.

The point being that either the screens were actually refurbished or they were not. If they were refurbished then they aren't counterfeit, Apple has no case since they put the Apple logos on, and as long as they're not claimed to be new this repair tech should be fine to continue. If they were not refurbished, then they are counterfeit, and either the importer knew that or not. If they knew that, then they need to be charged with knowingly importing illegal goods, which they haven't been. If they didn't know it, then they should not be held responsible for a crime in which they are also the victim. Those are the three available options.

Have I Been Pwned breach report email pwned entire firm's helldesk ticket system

Re: Also an age-old observation:

HTML email isn't seemingly responsible in this case. While it might let you more easily hide some text, it won't make an SQL injection happen if it wouldn't already do so. If you can embed the string somewhere in text, something printing that string from a database is just as vulnerable to a dev mistake. That wouldn't be hard to do; just include it in something that doesn't get read: "For more information, consult our privacy policy at https://www.ourcompany.com/q/znof/meozv9enao30z0daf0wq8t8f'; select * from data; 'ambkz94p010av8zpfp8g4372j9". Since HTML isn't allowed, this link would have to be a text URL, so it would be a common sight by users.

HTML in email can have some downsides, but most of the most worrying ones are already prevented--you can't send a script in one and expect it to be executed, for example. Most mail clients don't load remote content from messages, while some mailservers instead immediately fetch it when the message is received and then rewrite the message to refer to the local and untracked cache. A lot of HTML can also just be annoying by enabling massive messages that we don't really need or providing a method for the annoying mail designers to play with weird formatting, but those are not security risks.

I have little attachment to HTML in email, but let's be honest about what we can really fix by dropping it.

IBM to power down Power-powered virtual private cloud, GPU-accelerated options

Re: Why moving to the cloud is one the riskiest things your organisation can do...

Not exactly. The cloud isn't new technology--it's a new packaging of existing technology that is a lot like the really old packaging of similar technology. However, I don't think this story is really good evidence not to use the cloud. What it is is really good evidence to avoid lock in, but cloud doesn't necessarily mean lock in if done correctly and you can get lock in in other ways. For example, if you base too much of your systems on something the manufacturers can cut support for, you can find yourself unable to replace broken parts and looking at high costs for new equipment. Just like a cloud vendor dropping support for something, this can really mess up your day.

Cloud may not necessarily involve this. My cloud usage has almost always been running my own VMs without using provider-specific software, and I can move these VMs between providers if and when I want with time the primary cost. On the other hand, cloud has lots of options for getting locked in or becoming too reliant on something you don't control. For that reason, any good IT system will consider these risks and have backup plans. In many cases, the backup plan will be to not use those features and, if they're useful, implement them themselves. That is not a bad backup plan for most places.