Posts by doublelayer

The rumor that just won't die: Apple to keep Intel at Arm's length in 2021 with launch of 'A14-powered laptops'

Re: enabled?

There's what the OS is capable of: nearly everything, and what the UI lets you do: much less. It has a file system. It is capable of creating directories, putting files in them, and moving or copying big sections at a time. Pretty much everything can do that. But until not that long ago, you couldn't do it manually on IOS, because they wouldn't let you at the file system. Individual apps could provide you with access to their own sandboxed sections of the file system, but to get anything in or out required going through IOS's transfer system which works on single files only. Now, they've slightly relaxed that and have a file browser on the device. It can do some things. But it can't do everything you typically do in seconds from any desktop OS, and some of the things it can do are significantly more painful.

As for the shell, it can run one. As you've pointed out, you had to jailbreak for that one. The point being that, as Apple has designed it, you can't have a shell. So you can't do certain things like writing a script to do some batch file changes, firing up python to use it as a calculator, or curl a file from the internet, which are all useful things for the more technically-minded of us. The device and OS are capable of it, but the layers above the kernel have been set up to make it hard to do so.

So, while IOS remains that way, I maintain that it is not fully featured for the uses to which desktops and laptops are put. Apple can fix this if they want, and they don't have to do much. Just add access to the filesystem (writing a good GUI file browser is optional because if the access if available, someone will), give us full access to the utilities through a terminal, give us the ability to install code directly from the device (which currently requires a tether to a mac), and we're done. They don't have to do lots of nice things, like give us root access or open the doors to unsigned code. But until they do those things, the OSes are not similar from the standpoint of a technical user. If they do those things, they've effectively just made IOS a slightly different version of Mac OS with a touch input layer.

Re: The rumor needs to die before the Macintosh does.

I also like having a standard instruction set that is generally open, but your characterization of it being multi-supplier is a little strong. Basically, the only available options are Intel and AMD, with other companies not being allowed to join the party. With ARM, there are many manufacturers and a few designers of processors implementing that instruction set. Qualcomm, Broadcom, Samsung, TI, Apple, ARM themselves, Huawei, and a couple small places that don't make many chips. ARM has many other problems, like not having a consistent method of booting firmware--I can take virtually any X86 chip and run arbitrary code on it, but not so with an ARM one, but in terms of suppliers and lock-in, ARM is probably better.

Re: enabled?

Possible? Certainly. Do I think it happened? No. If it did, we'd have it. IOS is a functional OS for mobile devices, but there are tasks it doesn't handle well. One of those tasks is manipulating lots of files, keeping them organized, etc. One of those things you do a lot when writing software. Another is spinning up a terminal session to run multiple small tools on files. IOS doesn't do that either. For nondevelopment purposes, you don't need those things and most users won't notice their absence, but devs would.

You can call nearly anything portable a laptop. As long as it has a processor in it and can be carried with you, it qualifies. There's still a major difference between a traditional laptop that runs a desktop operating system and other devices that do less. Even when it's shaped like a laptop with a keyboard and everything, most tablets are still just tablets with a keyboard.

Google says no more shady anonymous web ads – if you want your billboard up, you've got to show us some valid ID

Malicious ads

I wonder how long it will take for malicious advertisers to find a loophole in this. Google already allows loading ads containing javascript with very few limits--for example, javascript that redirects the browser to another page, which is malicious enough. Frequently, that type of ad is used for the "Your computer has a virus" scam. If they're not scanning for or preventing that, they're certainly not doing that broad a job inspecting things. So the only question for me is whether they accept random numbers without verification or whether someone has to get public documents from someone else's company and submit them.

Why should the UK pensions watchdog be able to spy on your internet activities? Same reason as the Environment Agency and many more

Re: Big Brother Watch

I think these organizations are well worth supporting, but at the risk of seeming quite cynical, I have to ask whether they have an effect. Oh, they do incredibly useful work in looking at and protesting and in some cases launching legal attacks at surveillance programs. But their efforts haven't seemed to stop any of the major abuses being passed, nor have they managed to get increased public support. The legal cases seem to keep coming out on their side without getting anything changed. I hope that, with sufficient support, they can get more public interest and action such as protests together because that seems like the only method that hasn't really been tried yet. Sadly, it seems very difficult to organize and with a tenuous hope of success as well. My major hope is for some political group to start to realize the importance of this, as I haven't seen anything above a single politician understanding the importance of privacy, so my vote is pretty much pointless on this issue.

Internet root keymasters must think they're cursed: First, a dodgy safe. Now, coronavirus upends IANA ceremony

Re: Single Point of Failure?

It's not quite as single a point of failure as it seems. There are many protocols that are not affected by this--if these keys expire, many parts of the DNS root system continue to run like clockwork.

But, let's assume that all the people who do this are killed at once by some type of internet-hating terrorist group. What would happen is that IANA would get in a locksmith and break into the safe again. They might need more time, and they might need to do a bit of trial and error if there are any passwords involved, but they can handle that.

Let's assume the terrorists also take out the facility where the safe is. IANA just moves over to Virginia where there is a second copy of the safe and breaks into that one, then probably copies the contents and reestablishes the two-locations system again.

Let's assume that both locations and all participants are destroyed. In this case, IANA are a little stuck, but that's assuming they have no backups of the system somewhere (and nobody managed to copy the keys for a laugh). Given how secure they want this to be, it's possible they don't have them, but I wouldn't be surprised if that weren't the case. But if that happened, the problem would eventually fall down to the next set of servers. For a while, cached results from the root servers would be fine and nobody would have a problem. That's why attacking the DNS root servers, even if it works, doesn't immediately bring down the internet. During this time, users continue to act as normal while IANA and other DNS operators decide what needs to be done.

Let's assume they fail to do it. They don't have the ability to create a new key and have it trusted implicitly, and nobody has an idea of a quick way out of this. What happens then is that people have to fall back to other DNS information without authentication. It has problems, but it has also worked for quite a while. We're just back to that. Many places will have to change their system configurations. We'd see a lot of annoyed users. We technical folk would get a large helping of blame we don't really deserve. But life, the internet, and everything would continue to exist. IANA might get a lot of bad consequences for that, but that's where it'd end.

Lockdown endgame? There won't be one until the West figures out its approach to contact-tracing apps

Distances are larger than they appear on globes

"One of the few coronavirus "success stories" has been Singapore. Despite its proximity to regional hot spots like South Korea and China"

They're not that close. Singapore to Seoul is over 4500 km. Even considering Hong Kong as China, it's still 2500 km to Singapore from there. Some comparisons might help. Singapore to Hong Kong is a similar distance as London to Istanbul or Vancouver to Chicago. Singapore to Seoul is a similar distance as London to Tehran or Vancouver to Guatemala City. Now it's true that people go between China, South Korea, and Singapore somewhat frequently. But they also frequently go to Australia, Japan, the U.S., India, and many other places. Some of these places have bad records and some have good ones. Proximity is not a good predictive measure of where cases will start to pop up--if it was, we wouldn't have expected Italy to have been one of those places.

Academics: We hate to ask, but could governments kindly refrain from building giant data-slurping, contact-tracing coronavirus monsters?

Re: Dedicated device

"This should be a tiny disposable wearable."

That's a bad idea pretty much whatever you think about the plan. Please consult the following list and choose the rebuttal based on what you think about the idea of tracking contact.

Tracking's great and everyone should do it: With a small disposable device, people will forget to check that it's charged. When they do charge it, it will be away from them and they might do something without it. It might break. In order to sync keys out, it will need a connection to something, probably either WiFi or Bluetooth, which makes it tricky to set up. You have to get one to everybody which is harder than digital delivery of an app.

Tracking's terrible and we should disobey en masse: With a small dedicated device, it becomes easy to verify if someone is complying with tracking. Police could ask to look at it and make it a crime not to have one on you. If the device has a connection, they will know any time you don't have it on. If it doesn't have a connection, there will be the ability to suggest random enforcement checks. With a hardware device, most likely with completely closed firmware, it won't be easy to investigate it, either to understand what it's doing or how to get around it.

Tracking is bad, but in this case a necessary evil: The small device has many downsides compared to a mobile app, see the rebuttal for "tracking's great". It also may lead to additional surveillance afterward, see the rebuttal for "tracking's terrible".

I have to live with tracking: This works in addition to any other opinions you have selected in this list. If we do need to do tracking, and it's done with a device, you need to remember to charge it. To check whether it's working. To not wear it in a place where it gets wet when you wash your hands (I'm assuming they don't make it waterproof because they want them cheap and disposable). To sync it with the key storage place or the key-retrieval-and-checking program on your computer or phone.

Contact-tracing or contact sport? Defections and accusations emerge among European COVID-chasing app efforts

Re: IPXE's CX protocol solves this

Sure, it sounds nice. However, I note a few problems. First, there aren't those apps yet, though it is stated they'd be easy to create. Second, there are no providers of dangerous seeds (which would have to be set up by health providers), so it'd be useless even if there were such apps.

The third problem concerns this quote from their documentation. This is how you find out that you've been in contact with someone:

"The healthcare provider publishes a notification list of hazardous seed values corresponding to positive diagnoses. Each participating device downloads this list and compares the hazardous contact identifiers against its own record of observed contact identifiers."

Or, in simpler terms:

1. Device creates a seed at some time.

2. Every [short amount of time], it uses that to generate a new identifier. The page doesn't say how long, so I'm going to guess twenty minutes.

3. That identifier is broadcast for that [short amount of time].

4. The user tests positive.

5. Their seed is uploaded to a database which is region or country-wide.

6. Everyone downloads a list of seeds and uses them to generate the identifiers.

7. Identifiers match, and alerts can be generated.

The problem is that generating a bunch of identifiers from random seeds when they change so frequently is intensive from a processing perspective. If a seed is generated a month ago, then to check the identifiers for that seed means my device has to generate 2160 identifiers and check 1008 of them against my list. Also, I need to know when that seed was generated. I have to do this for every person in the country who tests positive. Every day. Probably most of that would get done while I sleep and the phone charges, but it could cause battery drain and slow processing if the phone is trying to do that while I'm using it. The severity of this would depend on the extent of the outbreak and of testing. In Australia, I'd have to generate and check about 82000 identifiers per day. In Germany, it'd be about 7.79 million.

Is the system gravely flawed? No. It's been thought through with some care from the look of things. But it has some flaws, and they may be severe enough that it doesn't get adopted elsewhere. I'd be happy to add this to the list of possible ways to do this, but it won't solve any of the major problems still facing the concept, including these:

1. The concept only works with thorough adoption.

2. The concept only works with thorough testing.

3. The concept only works with comprehensive support from health authorities.

4. The concept does not have much time to start to be useful before it ends up being too late and mostly useless.

5. The concept can promote anxiety if it is too broad.

6. The concept can promote complacency if testing is insufficient or contacts are not correctly logged.

7. The concept could be modified to add additional surveillance which would undermine confidence. (Yes, this approach slightly mitigates that concern, but if seeds can be collected by some means including a government-created app implementing the rest of the protocol, it would still allow surveillance).

Grab your Bitcoin while you can because Purse.io is shutting up shop in June and you could lose the lot

Re: Respect

The only possibility is people wishing to use bitcoin like a currency but frustrated about not having many people willing to accept it. True, they could exchange the crypto for cash and use that, but that requires either a physical trip to wherever the exchange is or a bank account (and many people interested in cryptocurrencies don't like banks). So it could theoretically be used for legitimate purposes in the same way that most other tools primarily used by criminals could. I'm doubting most of their business was intense crypto-promoters though.

Re: Respect

"No one is laundering money using gift cards."

Mostly true, but a few people are. Anyone with hundreds of thousands to launder will need something much more intense, and they can hand over quite a chunk to get that. They wouldn't do anything like this. The people with small amounts, for example people who had one successful ransomware attack or payment-request phish probably don't need to worry about that--they can go to an exchange and retrieve cash, claiming they mined a small chunk if questioned. It's those people in the middle with a reasonable but still small income stream coming in bitcoin who need something more anonymous, as they can't arouse suspicion by so frequently going to a physical exchange or providing details allowing them to be identified. Amazon gift cards may not be perfect, but if it can be done anonymously, it might just be enough.

Paranoid Android reboots itself with new Android 10 builds

Re: Wot, no Sammies?

From the Lineage OS supported devices list, it doesn't seem like Samsung is terrible. Of every manufacturer on the list, Samsung has the highest number of supported devices (71 versus 33 for the next highest, LG). However, I note that Samsung's list has quite a few old devices and that some of their devices are listed many times for carrier-specific variants. I think it's a constantly-moving target in that a manufacturer can either be magnanimous with bootloader access or make mistakes that make it easy with one model and then turn around and change their tune quickly, similar to how Huawei locked its bootloaders a couple years back and have fallen of the list of good devices for replacement firmware.

The other side of that coin is that a device can have a completely open software stack and still not get much attention. Only if the phone is owned by enough people will the work get done. At one point, I had found a device where basically everything was open (even most of the hardware, strangely), but it was not found by anyone else because it didn't even have a brand name (I still don't know who made it), it was intended as a very cheap device with poor specs, and by the time the previous owner gave it to me for erasure and I figured out how open it was it was three years old.

Bad news: So much of your personal data has been hacked that lesson manuals on how to use it are the latest hot property

True, but if you publish them where the general public can read them, then you'd better hope that you and everyone else have protected against what it says. What would be useful is to create a closed group of organizations that distribute them internally when they are obtained (and if they can be obtained by theft or without completing a payment I'm all in favor) and another public site where the pathetic wrong ones get released publicly. Anyone who finds that public site won't be able to complete a fraud with the instructions, and we avoid funding the how-to-commit-fraud industry.

An alternate suggestion is that we create some guides of our own, which we submit to the reviewers on these sites until they let us on, then we send all those who purchase it a PDF of that guide but with extra malware inserted. Bonus points if the malware can be written to turn these people in.

Re: When there's a gold rush on

Very good point, but they actually do have a ratings system where accounts need to be verified in order to post reviews. It's weird how normal these sites can look if you ignore what the products are.

Apple: We respect your privacy so much we've revealed a little about what we can track when you use Maps

Perhaps I should clarify my policy. An app can ask for location permission and need it to work (E.G. navigation), and I will grant that permission. An app can ask for location for a clearly-identified feature, such as adding geotagging to photographs, and I will deny it, but if it still works, it can stay. If an app asks for location and does not have either of the previous two excuses, including where I don't know why it wants location, then I will decide the app is untrustworthy and I will discard it entirely. It doesn't matter to me if it works without the permission--if it asked for that, it might be doing other things it didn't ask about but I don't trust.

VPNs: no effect at all. Cell towers and access points happen before the VPN, so if the app can read them, it can use that data to locate you. If you want that not to be possible, you have to add lots of restrictions to what apps are allowed to do. My typical policy is that an app can ask for various permissions and be denied, but if it asks for location and I don't want to give it, that app is evicted with prejudice.

SE's baaaack: Apple flings out iPhone SE 2020, priced at £419

Re: Only took Apple 2 years...

There are a few, but they're not necessarily what you want. For example, the Unihertz Atom XL was reviewed here not that long ago and has a small screen. However, you would then be dealing with a relatively unknown manufacturer, so there are provisos if you decided to buy it. It seems the general public has decided that they don't need to fit their phone anywhere and will take massive screen real estate over compactness; I don't understand why either, but somehow the majority has decided against us.

IP76

"The budget blower is also rated IP76, therefore providing solid water- and dust-proofing."

Sorry, but that's not correct. The first digit in the IP rating number is about dust protection, and it only goes from 0 to 6. Looks like the value is IP67, or protection from immersion in water less than a meter deep for thirty minutes. Alright, pedantry completed, back to normal discussion.

Let's authenticate: Beyond Identity pitches app-wrapped certificate authority

Re: Let me see

We have that. It's a password manager (they can store keys too). This one is more than that because they want to run authentication through their infrastructure. That can sometimes be useful, but there's a reason most current players in that realm are providing secondary-factor authentication rather than primary-factor.

"But also - isn't this already solved rather nicely with biometrics? What does this add?"

No no no no no no no. Biometrics does not solve this problem at all. For one thing, there are devices out there that don't have them. But for the major thing, biometrics do not support many of the security things one usually wants to have with passwords or keys. Try revoking someone's face or fingerprints if that person still needs to log in but an outside party has found a copy. The only solution is to break your biometrics system and give the compromised person a key or password instead. Also, give me a good way of using biometrics to authorize myself to distant machines. I'm working from home at the moment, but I frequently use a key to authenticate and encrypt a connection to a machine kilometers away. To do that with biometrics, the remote machine either has to trust my machine to say that it is me at it, leaving it open to potential attacks on the verification hardware on my machine, or it has to transmit my biometric information on a potentially tappable connection. Neither is good.

So how do the coronavirus smartphone tracking apps actually work and should you download one to help?

That assumes that when they said inexplicable, they meant "the perfectly logical way everyone expects". Maybe, when they said inexplicable, they meant inexplicable in the sense of nobody really knows why the icon changed but it shouldn't have. This app got set up really fast and rolled out to a billion devices--you have to expect that there will be bugs when that happens, including incorrect reports or syncing issues or system malfunctions. It happens with things much simpler than this.

Re: What's to stop...

Should this app get used, there is only one viable solution to this. In order to start alerts, a key associated with a testing facility must be used to confirm that the device's proclamation of a positive test result is trustworthy. That would work reasonably well for this one case, but it doesn't fix any of the other major problems that exist.

Re: "their phone will release the identifiers of all the other devices"

That's a logical way to do it. That way has two problems though:

1. Downloading the full world-wide database could take a while and use too much bandwidth, whereas segmenting it into regions could be flaky.

2. If phones don't upload all the identifiers they've seen, then there won't be a reason for individual phones to frequently ping the server with their own so the server can check for them. If that doesn't happen, using the information for tracking purposes won't work, the advertisers won't pay for the intel on the users, and the NSA and its friends will have a bunch of meaningless numbers instead of a nice graph.

Re: a bit late in my book

"When we all have and use this app, people will be able to have a reasonable assumption that the people they deal with are not infected"

That's wrong, and it's also quite dangerous. This app is, as has been pointed out admirably, only a retroactive notification tool. It can let you know, at some point, whether it's possible you came into contact with an infected person. But the speed and hence the reliability of that depends on the speed and comprehensiveness of testing, and we know that those values aren't great right now.

Meanwhile, if people also assume that, we will have quite the crisis indeed. If people think this app will protect them, catching people before they have a chance to be infectious, they will be more eager to engage in social interaction because the people they are in contact with must not be infected--they haven't been quarantined by the app people. This means more spreading and more pressure on testing infrastructure, which means less comprehensive tests, which means less reliable data from the app, which means more people interacting because none of these people have been quarantined by the app people, which means more spreading and more pressure on the test infrastructure.

If people continued to follow instructions while using this, it could be a little helpful. But if there is any other person who comes to hold an opinion like the one quoted, it will be harmfully counterproductive.

Re: Good for data-less phone plans

"Would you like to"

a) "Be locked down for the next 100 years like now, for that is how long it'll take for herd immunity to arrive with the current system or"

b) "Get a budget smartphone and set it up to use the app"

Good choices, but I think I'd like to choose among these:

C) Not constrain myself to a false dichotomy.

d) Consider quarantines that neither pander to panicking people nor to people who don't care about deaths, but are based on frequently-updated statistics and careful study by epidemiologists and economists.

e) Consider using tracking solutions only in the most extreme of circumstances, rather than jumping immediately to them.

f) Plan for the long run, including how quarantine is set up, how it is shut down, what needs to be done to maintain it, and what needs to be done afterward.

g) All of the above.

h) Items C through F.

I'll choose option H, thanks.

Signal sends smoke, er, signal: If Congress cripples anonymous speech with EARN IT Act, we'll shut US ops

Franchising is weird when the service being provided isn't physical. Usually, you don't need one and you don't have one, and most exceptions only have local affiliates (usually not franchised) to provide local support. Signal doesn't have national franchises now, and for a very good reason: they'd be useless. But let's assume that they did set one up. Essentially, they provide the main system and a national franchise is created which links citizens to it. If the local franchise is connecting people to an encrypted system, they can't access the data being sent. If they were sent an order to divulge that data, they wouldn't be able to comply and could be charged. The owners of the company who authorized the franchise could also be charged on the basis that they did not intend to follow the laws when they agreed to establish a franchise. Enforcing that charge if the owners were out of the country would be difficult, and getting judges and juries to agree would also be tricky, but it is certainly possible in the law to do so.

Consider a simpler example of a franchise: an international chain restaurant. If a local franchise is formed which needs to get ingredients, and the ones they are required to buy break local health laws, the owners of that franchise can be charged for that violation. In addition, the owners of the main business can be charged with breaking the same laws by making that requirement, which is illegal. Again, this isn't a guarantee of a legal victory, but it is a case that can be made which often leads lawyers to try to avoid that risk.

Re: I think it would be rather splendid

Sadly, I expect you'd see this timeline:

1. Law: Is passed.

2. Signal: Is forced overseas.

3. U.S. enforcement body: Tries to pursue Signal legally, can't find a way, blocks them.

4. Legislators: "We want our secure communications."

5. Law: Is modified saying government can use these apps but citizens can't.

6. Signal: Decides that if citizens aren't allowed, government isn't either. Blocks them.

7. Legislators: Write law: "Somebody make us a version of Signal that works for us."

8. NSA: "We'd be happy to. The code is open source anyway. We're just going to stand up a server of our own."

9. Legislators: "Perfect. Send us a link, would you?"

10. NSA: "We have finished setting it up. Now if you could reauthorize our data collection stuff for a century or so, we think we can send you a link."

11. Legislators: "Weird. They thought we were ever going to balk at that. We've been fine with it for two decades; why do they think that's going to change? Well then..."

12. Reauthorization law: Is passed.

13. NSA: Sends link to signal.gov client.

14. Legislators: Install the app.

15. Legislators: "Hey look! It works the same as the last version! Thank you, NSA."

16. Military: "The encryption system we had just got hit with the original law. Can we use this too?"

17. NSA: "Absolutely!"

18. Military: Starts to use the app.

19. NSA: "Any congresspeople being potentially annoying today?"

20. NSA analyst: "Actually yes. There was a new one elected and they're chatting about an oversight bill over us."

21. NSA: "What do we have on them?"

22. NSA analyst: "Everything they've ever sent or received. I'm sure we can find something out of context that can be used against them."

23. NSA: "Wonderful! Do that then."

24. Newspaper: "Newly elected representative [name] who stood for election on a platform of public privacy faces ethics committee investigations."

25. NSA: Evil laughter.

If you operate with a franchise, that doesn't help. First, you are essentially handing that franchise-owner over for all punishments, which isn't very nice. Second, if your franchise does anything, then when their stuff is affected by legal matters you have much more disruption. Third, it doesn't stop you being responsible legally, and you can still get arrested if you show up there. If you can operate electronically, it works similarly except they don't have anyone they can arrest immediately. Their only choices are to try to put pressure on countries you need stuff from or try to block you.

At a very basic level, if you don't operate in the U.S. and you don't need things from the U.S., then the American government can't do anything to you from their law. They can try to encourage your country to go after you, and it has a decent chance of working for them, but they don't have legal methods. So that would be a drastic method, essentially cutting off all of the U.S. The less drastic method that also has some chance of working is to move all operations and supply chains out of the U.S. but continue to allow Americans to use the service. That is technically operating in the U.S., and the U.S. can issue legal complaints, fines, or prison terms, but if you don't live there or have stuff there they can take they may find it difficult to enforce those. That approach could work for Signal, while there are numerous other types of organizations for which that would be a non-starter.

Re: If you follow the money

Do they? The only one that comes immediately to mind is the chat app WhatsApp, which is Facebook-owned. The rest of the big players only seem to offer end-to-end on things they get paid for, and don't bother with it for other communications they work with. Apple, for example, offers relatively good encryption for many of their things, including end-to-end on some, but to use any of those, you have to already have purchased an Apple device. Anything that is clearly mined, such as email services from Google and the like, are not encrypted and there's no pretense that they are. The clearest providers of completely encrypted communication services I can think of are all smaller nonprofits, such as Signal, Tor, or Telegram.

Watch out, everyone, here come the Coronavirus Cops, enjoying their little slice of power way too much

Re: If you're not part of the solution, you are an idiot.

Original quote: ""You are strongly requested to stay in your house, and when you go out for exercise, please be courteous to others and keep 2m apart, and please don't congregate with people you're not living with", well, that's got a chance of being done."

Response: "And Neil Barnes, [original quote] has worked really well so far, hasn't it? They tried that. It did not work. What did you do when Boris said "we are advising you to stay indoors"?"

Not really connected to the rest of your comment, but you appear to have missed their point. The point was about wording, specifically "order" versus "strongly request". The opinion stated there was that "strongly request", though technically a weaker statement than "order", would have produced a smaller sense of injustice and would have been better adhered to by the public. If you knew that, then you know that "strongly request" was not tried by the U.K. authorities (it is much stronger than "advise", and the statement I found when searching for that one had some limits on it), meaning we can't know whether the stated opinion was correct or not. For the record, although I'm not in the U.K., when I received my suggestion (yes, mine was a suggestion) to stay at home, I did so. I have not come within range of others since that time.

Honor 9X Pro: Better specs can't save this smartphone from a barren app store

Re: Apps

Sideloading is easy. But it might not be enough. Google's APIs may be proprietary, sketchy, prone to crashes, and completely unauditable. However, many apps have decided to use them. If you don't have them, and this doesn't, then you may run into problems after sideloading. For example, I am running Lineage OS which I have decided not to poison with Google's APIs. I've just tried a few apps that need them. In general, they look completely fine until they've finished the first set of loading screens, then they crash repeatedly until the phone decides not to try and start them again. This is not a problem for me--I was running these as a test and I could find replacements anyway. For the general public, they might not know why it's crashing like this, and they probably won't understand how to fix it. For those who understand the former but not the latter, they might find unreliable, crash-prone or malware-laced versions of those APIs instead. Whether this is a problem for the consumer hasn't really been determined, but it's worthwhile to understand that sideloading doesn't by itself fix the problem.

Minister slams 5G coronavirus conspiracy theories as 'dangerous nonsense' after phone towers torched in UK

"What's bizarre about turning your router and mobile off at night? I don't see any point in them consuming energy when I'm asleep and therefore have no need for them."

That's not bizarre. What is bizarre is people turning them off some of the time because they think they are dangerous. It's already bonkers to think that they are dangerous after so many tests, but if someone was convinced that they were dangerous, they shouldn't have them turned on at all. It's like saying "I know that driving without a seat belt faster than the speed limit with my lights turned off is dangerous, so I'm only going to do it twice a week instead of three times.". Even the nutcases don't believe their nonsense enough to do what would be warranted if their ravings were true.

Not only is Zoom's strong end-to-end encryption not actually end-to-end, its encryption isn't even that strong

Re: People don't buy encryption

I've heard this argument before. It was stupid then, and it is now. There are three solutions to the problem of not being able to offer some features and provide end-to-end at the same time. They go like this:

1. Offer end-to-end and work on enabling the features in a more security-conscious way (store recordings on the cloud in an encrypted form that cannot be decrypted without the user-stored key, have dedicated call-in boxes with encryption built in that cannot continue to store keys and have individual trackable keys so only authorized ones can be added).

2. Offer end-to-end, and if someone tries to enable one of the features that doesn't work with it, you tell them they can only have one and prompt them to choose.

3. Don't offer end-to-end, don't lie about having it anyway, and cite those reasons when people ask (and most won't ask).

Any one of those is a legitimate way to handle it. What they did wasn't.

Re: Probably not as bad as it sounds

Oh, sure. If I get you an encrypted blob that used to be a frame and try to render it as an image, it won't work and you'll see nothing. But that's rarely the issue. The issue is what happens when I run a program on a captured stream, meaning a bunch of images of similar areas and a bunch of similar sound data. Both of those are very pattern-heavy, and therefore both would be vulnerable to a concerted attack on the crypto. Consider what would happen if I took a compressed audio file which I encrypted in a zip file with a three-character password and rendered it as raw audio. You'd only hear a bunch of noise, and it wouldn't even be the same amount of noise. Yet, given the file, you could decrypt it, decompress the archive, and play back the compressed file with ease. They used a visual example to demonstrate the flaw in a way that was evident to the human eye; they didn't say you could do exactly the same thing with the data in this case, just that a computer could.

Re: Not the end of the world

"they need to stop calling this 'end-to-end' if it isn't, although if it isn't end-to-end then I'm struggling to understand why they need to do a key exchange to give all participants the same key to decrypt the stream?"

It's encrypted as it goes to and from the server. The reason the key needs to be sent to users is that they need to decrypt it after it comes back, the reason it's a separate key is that symmetric encryption like this is faster than asymmetric encryption that was used to send the key in the first place, and the reason it's the same key for everybody is that Zoom doesn't want to use any CPU time decrypting a stream and reencrypting it with a new key for other people (and on that point they're basically correct as doing that wouldn't fix any of their problems). The important detail when considering end-to-end is who generates and sends the key and who gets it. In an end-to-end system, the organizer of the meeting generates it and sends an encrypted version to each participant, and the server moves these encrypted chunks around but doesn't have the ability to read them, while in Zoom's system the server generates a key and sends it to all participants, and maybe stores it or leaks it or actually nobody knows but given what we do know it's probably not good.

Real-time tragedy: Dumb deletion leaves librarian red-faced and fails to nix teenage kicks on the school network

Re: ah yes there were times at work they went round and audited the machines

I used an archive file format the name of which I cannot remember at one point which did work like that, at least to an extent. I think it would stop compressing further after about three runs. My guess was that the algorithm in use had some limits to ensure compression didn't take very long leading to inefficient choices being made. People liked sending files over slow connections at the time so this three-run trick got quite a bit of use.

Re: Our IT professor had us stumped for a long time

Maybe he just managed to get the command prompt to process the incorrect string and reject the original, leaving all other programs to use correct paths. If your main environment is said command prompt, it could hold people back for a while, assuming "cd .." repeatedly wasn't supported yet.* It'd be kind of like the classic prank where a hidden directory is placed in someone's home directory, it is set as the first path directory, and a binary named ls is placed there which runs a real ls and modifies the results for maximum confusion--neither prank stands up to concerted efforts, but both are confusing for quite a while.

*Sorry, I'm young enough that I didn't really use DOS. I don't know if either assumption would have functioned in that environment.

BOFH: Will the last one out switch off the printer?

I wouldn't count on that. Either someone ends up with a much better monopoly than everyone else and wins almost instantly, or you get into a stalemate where nobody owns a monopoly because they're all blocking others' monopolies but the players are too invested in their own chances to do anything about it. At one point during my childhood, I was playing with some people who were far too competitive so, when I finally achieved a monopoly, I added just enough houses to it such that, on average, people would pay me the amount of money they had earned since the last time they landed there, meaning that everyone's balance stayed static while mine climbed slowly but surely. They still didn't give up until we ran the bank out of the big bills. Ah, the freedom of youth where you can waste eight hours moving tokens and it's just an ordinary rainy summer day.

Re: I'd have gone for Risk!!

For me, it's one of a few less popular board games. All of them sound fun. Probably all of them are fun. Except that all of them are played with the same people, and I haven't played any of them before. These people can make many games much less enjoyable because they think they can teach me the game without having me read the instructions, they don't know how to structure documentation, and they really want to win the game which they are definitely going to do because I don't understand how it's played yet. Somehow, these people can suggest complicated games that take hours to learn and, when I suggest that I'm planning to go to sleep tonight, offer the alternative of monopoly, which is just one step above deterministic.

UK judge gives Google a choice: Either let SEO expert read your ranking algos or withdraw High Court evidence

Re: Compromise

That will never happen. Google doesn't want anyone to see these who isn't friendly to them. This could be for one of two reasons. If the data they've submitted is designed to hide or simply doesn't contain damning information that in fact exists, they don't want anyone to stumble on it, whereas if the data they've submitted is genuine, they want absolutely none of it to ever get out, even in summarized expert-created form. Foundem wouldn't want to agree either, because if the evidence shows that they were not targeted or unfairly treated, they don't want to have anyone admit this in court and if the data is on their side, they don't want to have an expert hedge on the denunciation. Court cases so rarely involve amicable discussions.

Huawei P40 pricing is in step with previous P-series efforts – but flagship lacks the apps punters have come to expect

Re: Wireless charging?

"It allows phones to be designed without physical connections, which in turn allows them to be made waterproof, and therefore more reliable."

Nope. There aren't any commonly-available port-free phones out there, and there are plenty of waterproof ones. Waterproof is not incompatible with ports.

"Also, it can prevent data theft or malware being installed"

Nope again. Unless the phone is so completely locked down that it can never be contacted, there is a mechanism for the manufacturer or repair staff to get to it somehow. Having no cable increases the likelihood that it is some magnetic data connector or purely wireless, which actually makes it easier to gain a connection without making it obvious. Whether it is easy enough to make that difference worthwhile depends on how that channel is set up.

Re: It's not really that hard

Yes. I may not trust Google's software, and because I don't I don't have it on my phone. But if someone came to me asking me to put those things on their phone, I'd be very careful to make sure that the only malware they ended up with at the end would be Google's. I am certain that there are many malware-laden versions out there today for Huawei owners, and it's important that anyone who wants to sideload those services don't find themselves installing those. Especially if those phones ever see any of your data, like your correspondence with the user. It's a perfectly reasonable question to ask.

But will the general public agree? Based on my efforts to inform my friends and family about what Facebook and its ilk do to their data, a lot of people are quite interested in maintaining their online profiles and would get annoyed if that were prevented.

Sadly, though I usually want my smartphones closer to Huawei's environment than Google's, Huawei has not given me what I need in a device. I don't want Google apps, so their absence is nice. But I also don't want Huawei apps. I don't want an undisableable Google framework running everything, nor do I want a Huawei-branded replacement. And sadly, Huawei has not reversed its decisions to keep me out of the bootloader, preventing me from installing a replacement OS.

For these reasons, I'm concerned that Huawei may fall in a gap between the two groups. They don't offer enough apps for the general public and don't offer enough access for those who like the freedom of custom Android distributions like Lineage OS. Only time will tell if they manage to sell their system to one or another of those groups or if there is a third one I haven't considered.

Amazon says it fired a guy for breaking pandemic rules. Same guy who organized a staff protest over a lack of coronavirus protection

Re: Bit of a non-story

I'm not going to accuse Amazon or this worker of lying about any of this, but if someone wanted to, there are some very easy lies that make a lot more sense. Instead of lying that he came in when he didn't, Amazon could lie that he was told not to. It is difficult to prove a verbal remark was made. If he wanted to come to work for whatever reason but was told not to, he could either lie that he was ever told not to or lie that someone informed him informally that he had to. The major problem remains, though. The story Amazon's using doesn't make a bunch of sense to me, whereas it has been called plausible above. Since it makes sense to somebody, I'd like to hear the theories that I've not thought to consider.

Re: Bit of a non-story

I am still confused why this is plausible. Could Amazon want to keep him at home? Absolutely. But if they did, why did he insist on coming back in? In their statement, Amazon said that he would continue to receive pay while at home, so if he came in, why? Was the work that fun? People ignore social distancing requirements all the time, but they usually have some reason. They were bored and wanted to meet with friends. They wanted to buy things that they didn't necessarily need. They wanted to go out and make extra money. But I see no reason this guy would have wanted to come to a workplace he thought was unsafe when he wouldn't get anything for doing so.

I posted a comment similar to this earlier, but the votes on that one seem to indicate that I don't know what I'm talking about. Could someone please explain why I'm wrong?

Re: Unions

Except that most do make sense.

Elections: The idea is that people vote for their desired representatives, but human nature leads to people voting without knowledge, people hijacking votes, people faking or suppressing votes, or institutions coming into play to maintain undemocratic governance though the elections exist. They are flawed, and you could attack them on this basis. It does not prove elections useless.

Credit cards: They are a good idea for a payment method and a way of taking out short-term small loans, with a high interest rate to dissuade people using them when they won't be able to pay. But human nature may take over, leading to overspending and a spiral of debt, which can lead to far-too-broad credit reports which get leaked, economic crises, and increased poverty. The idea has flaws, and you could attack it on that basis. But it doesn't prove credit cards useless.

Free beer: It would be nice for those who like beer, but when there are no limits on how much you can have, people end up drinking all the beer so there isn't any free beer for anyone who comes late, and now you have a bunch of drunk people who tend to be harder to manage. The idea has flaws, and you could attack it on that basis. But it doesn't prove it useless.

Re: One Sided Reporting

It's always possible that Amazon warned him, offered to pay him while he stayed home, etc. But does the following story really sound likely:

The man works for a company, but he is unhappy with working conditions; he feels them to be unsafe and doesn't feel the workers are paid sufficiently for the current conditions. Please note that he was willing to accept the pay earlier when he joined the company, so his reservations are about the current conditions although he could already have been displeased. He protests about this to the company. In the next two days, he somehow manages to come into contact with someone who had a confirmed case of the disease in the workplace even though someone with a confirmed case or symptoms of the disease should definitely not have been working there and violate repeated requests, which he seems to do quickly. His employer suggests to him that he should not come in to work, thus not subjecting him to the conditions he felt were unsafe, but that they will still pay him the old rate that he had accepted back when he wasn't so worried about the conditions. He chooses to violate this order despite the fact that he isn't being paid any more for going in, by going in he subjects himself to the conditions he was protesting only two days previous, and he puts his job at risk.

So tell me, if this is the situation, why is he choosing to violate the orders to stay home with pay? Has he demonstrated any incentive to want to be there? He's clearly not getting anything from Amazon for showing up, and he's already indicated he isn't happy with the situation there. The only reason I can think of is that he would want to continue organizing protests, but he could do that by contacting people outside of work. Also, how many warnings can he have gotten and violated? He protested on Monday and was allowed in then, so the warnings to definitely not come to work must have been between the protest and today. That's not a lot of days.

I don't know whether what he or Amazon says is right, but I do know that Amazon's story doesn't make a ton of sense. When you combine that with this particular person having angered Amazon, there are some clear possibilities that are worth consideration. It may be that, if this ever gets investigated, we will find out that there was a miscommunication and he in fact was fired for breaking regulations. But we may find many other things. The situation seems well worth a look.

Fitbit unfurls last new wearable before it's gobbled by Google, right on time for global pandemic lockdown

Re: All your health data are belong to us

I very much doubt that any manufacturer will balk at taking the data and using it as they see fit. However, if you're willing to accept some reduced functionality, there is an app called Gadgetbridge (look in FDroid) that can pair with some trackers and is local only. I don't know how well the supported devices work for your use cases, but for perfect privacy that's probably the only option.

Cloudflare family-friendly DNS service flubs first filtering foray: Vital LGBTQ, sex-ed sites blocked 'by mistake'

Yes, it is.

Censor: Verb

(transitive) To review in order to remove objectionable content from correspondence or public media, either by legal criteria or with discretionary powers.

(transitive) To remove objectionable content.

Their changes are a censorship technique, just a small one that's voluntary. By using their technique, you agree to their definitions of what is acceptable and what isn't. That doesn't mean they're censoring by force or they're violating someone's rights, but anyone who uses the service grants them the right to decide what they think is objectionable. This is a tricky thing to get right, and there's always some site that, if they blocked it, would annoy you. As I'm not intending to use their filter list, it doesn't much matter to me what they do, but it is worthy of discussion when a place starts to make decisions about what they think is acceptable or not in case you disagree with them and might want to modify your behavior accordingly.