Posts by doublelayer

Richard Stallman says he has returned to the Free Software Foundation board of directors and won't be resigning again

It does take a lot of resources to actually create the software. Writing code which functions takes time. Making that code not crash takes time. Creating the resources which most nontrivial code uses takes time. And not only time, but also a lot of specialized resources like programmer knowledge, equipment, attention to detail, etc. Copying may be cheap, but that does not make the rest of it free. It is not. I'll grant that the car analogy is not perfect, but then little is. I'd try a book analogy, but some people also think those should be entirely free whether the author wants to do that or not, so it isn't as illustrative.

There are people out there who hate GPL with a passion. They have often taken the argument that licensing code under the GPL is violating their rights because it doesn't let them use it in proprietary software. I am very annoyed with those people. However, there are people who make similar arguments about anything not licensed under the GPL, including proprietary and permissive. They are wrong too. It is an issue of choice. What they have to realize is that copyleft is based on copyright, just like proprietary is. The reason GPL has the freedoms of GPL is that copyright law makes it happen.

Re: It's FLOSS btw

This argument is nice, but it doesn't always work. If you write code and make it copyleft, I'm happy because yay, free code. If you build a car and give that away too, yay, free car. This is not a moral imperative though. It's just a nice thing to do. I write code and release it for free (variety of licenses, but I have written GPL3 stuff because I want the license terms to apply). When I do, I understand that I'm not going to get money for the work unless I'm very lucky. It is also my right to create software which I don't release so freely as long as I don't use others' GPLed code to do it.

If someone writes some code, not using any copyleft components, and doesn't give that code to everyone but instead sells it, that's not an immoral act. Acting like it is is weird and is exactly the kind of thing that makes the original poster not want to take you into a meeting. Not having access to the code may be a sufficient reason not to use it. That's your choice, not an ethical certainty. Sadly, we don't always live in a world where code written from pure altruism is available or superior to proprietary code written for profit, which means that people who either don't care about or don't understand the license wars may choose the proprietary option.

I read the comment as giving Stallman credit for the Linux kernel. Now that I'm reading it again, it could be that or they could be correctly setting it apart and giving Stallman credit for the rest. I'm not sure which it is. If it's the latter, then my original critique is incorrect.

If it is the latter, it's unfair to lots of people who are not the FSF. This is the problem I have with those who are intent on calling Linux GNU/Linux. Yes, GNU deserves credit for lots of nice code they've written, but by including them in the name as some demand, it does two things that I see as harmful. The first is that it implies that GNU code is required for a Linux system that respects user freedoms. This is not true. Almost all the most popular and required GNU programs have non-GNU alternatives. There are alternatives for libc, GCC, the core utils, and quite a few other things.

The second problem is that plenty of other projects deserve some credit and don't get it when GNU and Linux are listed as if they're the most important. Most running Linux installations, desktop or server, have lots of software written by people who are neither the Linux foundation nor GNU. If the name of the system has to list all the important players, then it will be a very long name. KDE/Mozilla/Python/TDF/ApacheFoundation/Apple*/GNU/RedHat/Linux describes a basic desktop distro before the user installs anything, and there are undoubtedly plenty of others who deserve membership in the list but I stopped listing them. Not that it diminishes the real contributions made by the GNU project and the FSF, but such statements are often a lot more limited than they should be for honesty.

*Apple, in the Linux company list? Yes. Several important components rely on Apple-maintained components. They include CUPS for printing, OpenCL, LLVM and Clang, etc. One could list each project by its independent name, but so the name fits in this comment box, I'm recommending we don't just glob together all the installed package names.

"I think Stallman ought to be recognised for his tremendous contribution to FOSS (as Linux is much more than just a kernel),"

Sorry in advance for the pedantry, but this is the wrong way round. Stallman didn't write Linux at all, and the people who did are not associated with the FSF or GNU. What those projects created are a lot of the utilities that go around the kernel. This has led to arguments between the two projects, for example Linux sticking with GPL version 2 only while the FSF is intent that version 3 is much better. Also, insert the Linux versus GNU/Linux argument here.

Chairman, CEO of Nominet ousted as member rebellion drives .uk registry back to non-commercial roots

Re: Looking for a new registrar

If you want a registrar that supported it for a while, the publicbenefit.uk homepage lists the supporters. The largest ones who supported for a while are Gandi, 20I, Coherent, Crystal, and ANY-Web. Two even larger ones, TUCOWS and Namecheap, also voted in support but made up their minds later. There are about 480 other supporting members available. I have only listed those managing over 30K .uk domains. There is plenty of competition available while allowing you to stick with companies supporting the motion.

John Cleese ‘has a bridge to sell you’, suggests $69,346,250.50 price to top Beeple's virtual art record

Re: We have lots of non-fungible tokens

No, they can't. If you buy an NFT, you get a copy with a digital signature which is signed by a couple of keys including one you have. So you can authorize a transfer if you want to and you can prove that you have the key and others don't have it. But you can also just chop off the digital signature and send the part of the file you can look at out to anyone you like and they can't tell who sent it or who received it.

What could be worse than killing a golden goose? Killing someone else's golden goose

Re: "Things were purposefully not documented"

It's pretty clear those things don't apply. Nothing went "contrary to internal procedures". The other person wasn't annoyed because it should have gone through a meeting. They were annoyed because they deliberately created the mistake. In literally every scenario, your objections do not apply. Here are some likely options:

The change didn't go through procedures and the creator didn't do anything deliberately: Have it reversed then go through procedures. That didn't happen. This scenario isn't right.

The change didn't go through procedures and the creator was trying to hide their mistake: Don't complain about the change and nobody finds out who made the mistake. That didn't happen.

The change didn't go through procedures and the creator was annoyed enough about someone not following procedure that they wanted to fire that person: Discipline them for not following procedures. That didn't happen.

No, this was clearly malpractice and there's no reason for it. The senior developer should have been fired for it following the procedure to figure out who knew about the code and why they didn't do something about it.

Encrypted phones biz Sky Global shuts up shop after CEO indictment, police raids on users in Europe

Re: "paint encrypted mobile phone services as something used exclusively by criminals"

You have now proven my point. The indictment linked is entirely about complicity with criminal clients. What did I say about that option? I called it "plausibly true".

My complaints are about application of export law which doesn't apply outside the U.S. Is that in the indictment? No, it's not. Is it in the Dutch or Belgian reports? No, it's not. Why not? Because it does not apply. The lawyers and I agree on what charges are valid. We also agree on what's plausible. To prove it true instead of just plausible, they'll need more proof than I've seen. They probably have it. That's their job.

They are likely correct. You ... are not. They are focusing on a crime which they will have to prove. You're attacking cryptography on fallacious arguments and incorrect application of limited legislation.

Re: "paint encrypted mobile phone services as something used exclusively by criminals"

You are wrong several times. Let's start with the obvious one:

"The culpability in this case is two-fold: (a) he sold strong encryption to drug dealers for the purpose of evading detection while committing a crime and (b) in the process of committing (a) he violated ITAR and US Export Control regulations."

A is covered in my original comment, short version is "more proof than that needed". For B, no, he did not violate U.S. export controls. He and his company are Canadian. The exports happened from Canada. U.S. export controls only apply to people exporting stuff from the U.S. Same with ITAR. It's a U.S. law and applies only to the U.S. Other countries have similar legislation, at times structured to be compatible, but it's not ITAR. Canada has export control legislation. Calling it ITAR and alleging that U.S. export regulations apply to Canadians makes it clear you do not understand how those laws work.

Now let's consider Canada's legislation. Actually, it's best we don't, because Canada hasn't charged anybody with breaking its export legislation, and they are the ones who would have to. But let's consider it anyway. In the list of controlled items, it originally seems somewhat damning since symmetric cryptography which works is prohibited (limit of 56 bit keys). However, there are long lists of exceptions. One of them looks like this:

"e. Portable or mobile radiotelephones and similar client wireless devices for civil use, that implement only published or commercial cryptographic standards (except for anti piracy functions, which may be non-published) and also meet the provisions of paragraphs a.2. to a.4. of the Cryptography Note (Note 3 in Category 5 - Part 2), that have been customised for a specific civil industry application with features that do not affect the cryptographic functionality of these original non-customised devices;"

Well, the phones themselves are mass-market with hardware modifications unrelated to the cryptography. So as long as they use public algorithms, they count under this exception. Public algorithms include AES and RSA. So now, if Canada wants to charge him, they will have to identify the encryption in use. I'm guessing it's likely to be a public one, in which case they have already allowed it.

Also see this FAQ about cryptography exports. It's useful in determining what is allowed and what is not.

By the way, you'll find that no charges for breaking export controls, whether Canadian or U.S., have been filed. That's because the lawyers understand what is illegal and what isn't. They are hinging their entire case on point A, and point A is quite plausibly true. Still, it needs more proof than you have.

Re: "paint encrypted mobile phone services as something used exclusively by criminals"

Well, they can both be used to commit a crime. A car lets a criminal get to or away from a crime scene a lot faster or you can kill someone with it. For the same reason, encryption can be used to hide information about your crime. Both can be put to nefarious use. They are also similar because both are heavily used by others for entirely legitimate purposes.

The important detail is whether the operators of the encrypted communication company knew their products were being sold to criminals. The wording there is important. It's not enough that the equipment was being used by criminals; car companies know that criminals will use cars and ISPs know that people will send malicious packets. The business has to know that they're interacting with a criminal for them to share culpability. Again, the wording is important. If they went to strange steps not to know their customers because they knew they would be criminals, then they knew and the circling around doesn't help them. If they actually thought the products were being used by normal businesses which would have a reason to want secure communications, they aren't culpable. This is the reason the trials of these companies have to be based on specific evidence from each company. There have been many companies deliberately aiding criminals and this might be one of them, but that has to be proven and just saying "they provide useful stuff that criminals used" isn't enough.

Staff and students at Victoria University of Wellington learn the most important lesson of all: Keep your files backed up

Re: No....not 3.....but 4......

You have to test and check. Verify that, when it says everything, it's actually everything. That catches you if you misconfigured it once or it didn't back up a file because it wasn't unavailable. Verify that, when you restore, it actually restores. That catches you against a corrupted file that broke something. Verify that, when you want to restore and you don't have stuff, you can. That catches you in the case that the software needed for restoring is unavailable or doesn't work, for example it requires a network connection, license key, or dependency which you didn't have before but now will. This is part of using proper software in a proper way.

What could possibly go wrong? Sublet your home broadband to strangers who totally won't commit crimes

Re: Sounds “interesting”

I didn't have that because I was using my own equipment and not about to change it. Also, that's limited to customers of that ISP, which I didn't want to do. Basically, I anticipated that my neighbors could use it if their connection broke but mine didn't. Or someone else who was in the area and needed to connect. I also doubt there'd be that much risk of abuse since it would only be available relatively close to the access point, but I decided that if things did go wrong, they would go horribly wrong and I didn't like that idea. I mentioned to a neighbor that they could have the password if ever it became useful and gave up on the rest of the idea.

Re: Sounds “interesting”

"I once knew someone who left their wifi completely open (was a few years ago) so anyone could access it. Know I don’t know why unless he planned on hacking everyone who connected...."

I once considered doing that basically as a service. I already had a guest network set up which couldn't see my normal network, had bandwidth limits, and could support automatic cutoffs if I wanted them. I was thinking that I had a reasonable connection rate, never got near a bandwidth where they'd reduce my speeds, and therefore wouldn't mind letting others in WiFi range use it if they needed to move some data. Then I considered what would happen if the police showed up for information on a user, which I wouldn't have, and decided that my technical knowledge meant the lack of logs proved I was erasing them. So I didn't. Still, my idea to do it was basically altruistic.

Trail of Bits security peeps emit tool to weaponize Python's insecure pickle files to hopefully now get everyone's attention

Re: A fly in an ice cube in a microwave.

It usually comes down to laziness. There's probably harmless laziness, like using pickle to automatically serialize something because you don't want to write the thing which converts it to XML or JSON or something. Then there's harmful laziness, where people pickle code just because that makes it easier to import without giving people the actual code.

What people receiving such models should keep in mind is that they're getting binaries, and those binaries should be treated with the same mistrust as a more typical one. If you wouldn't run an executable from these people, maybe don't run their different-format executable just because it takes a few more steps to execute.

Re: pwned by default

Not exactly. Just unpickling one can't run code. It can produce an object that is runnable. It should be treated like anything that can be executed, but not like something which automatically executes. It's one level below a document which can run data just by opening it.

I'm not seeing it in the article. It runs in a sandbox, perhaps though I'm guessing, but the problem with malicious code is that it's run in the first place. It's not hard to put untrusted pickles in a sandbox, but if you don't or they can do whatever they want to do from in there, it hasn't fixed anything. The best way to handle this is to create a restricted language which can be serialized and runs only in an interpreter which has no OS access. It only does math and has no hooks elsewhere. That would work, but nobody would end up using it because people who so far don't have any problem unpickling random things and running them aren't going to go to extra effort for provable security, especially if it means not using one of the libraries they're used to.

Re: pwned by default

This is correct. Pickles are just serialized objects. And that means basically any object. If you pickle a function, then it unpickles into runnable code. If you're not careful what you do with it, you could run it. For ML models, this can end up being the intent; you just load your preprocessor, run it, then run the model. If the attacker submits a preprocessor function which does other things, you don't know what it's going to do and should protect yourself or not run it at all. The same issue occurs everywhere where you can serialize something which can execute. Unless you're careful about using it later, you could end up executing something malicious.

What happens when your massive text-generating neural net starts spitting out people's phone numbers? If you're OpenAI, you create a filter

Re: So much for "AI"

The problem is that a random number generator can produce valid or invalid numbers and, even if it produced a valid number, it has no idea what it is for. This has collected a bunch of real numbers and starts handing them out. Admittedly, it's not malicious about doing it, because it just hands out real numbers whenever they're tangentially connected, but it's not just random strings of digits which happen to be callable. If I run a random number generator to produce a number that looks like a credit card number, the chances are incredibly high that it will not work. If I collect real credit card numbers, the chances that at least one of them will work is significant. That is the important difference.

Re: A little idea

I did read that. I didn't care. It needs to read real phone numbers to learn what a phone number's like? Two solutions. First, replace all phone numbers with a tag indicating it's a phone number, but without the content. If you're afraid that your code is so bad that it will read a single [phone_number] over and over and weight it too heavily, append a random number so it will see them as different. Second option: don't bother. Why does the AI need to know about phone numbers? It shouldn't be printing them. Phone numbers should only be printed if they go to people who are supposed to be contacted, which means they should be provided manually. Otherwise, it's actually doing a worse job at its task because it is including not just information which is irrelevant, but information which is actively wrong. I think those are reasonable options for handling the phone number problem.

A little idea

In case OpenAI is listening, I have had a brainwave that might be a little handy. Your engineers are busy writing some software to scan output for phone numbers? Then the software will remove that output so people don't see it? I think it might work pretty well if you reversed this process and applied that filter to, you know, the input. So the big blob doesn't have phone numbers in it. That way, it would only generate numbers by randomly adding digits, which is much less likely to be a valid number and wouldn't be able to associate it with other information. In fact, while we're having brainwaves, maybe it's not so useful to give it the option to randomly spit out digits; we already have random number generators thank you, and they only give us numbers when asked.

Any chance OpenAI is looking for a chief sanity officer? I'd apply as long as they don't prevent me from working another job simultaneously. I think I might need a backup job when the data protection authorities come along.

Apple accused of unfairly banishing Watch keyboard app for the visually impaired from its software souk

Re: Apple aren't one for banishing people only to pick them up later at a discount

Some of your points are characteristic of Apple, but others, while logical, aren't necessarily used.

"I'd guess that most countries have at least some legal impediments around driving the value of a potential acquisition into the ground; if nothing else, there's a definite overlap with the kind of predatory behaviour which anti-monopoly laws are meant to address."

It is not clear. Using a monopoly decision to do that is illegal. But there are many other methods which are not illegal. There is a certain amount of activity which gets dismissed as "bargaining well for a better price" and therefore accepted. In this particular case, the app team have a reasonably good case because Apple abused its monopoly position, but that would work as well if Apple didn't want to acquire them. I.E. it's only Apple's App Store monopoly which makes that happen rather than another law.

"The first is that if the acquisition has value to you, then it presumably has value to other people/companies. So if you do drive the price down, the odds are good that someone else will step in and buy it at a higher price."

Good point, although it doesn't apply much for this example. The app in question works on phones and watches, but there are lots of keyboards for phones. The IP in question is for their watch app, as their phone app is still permitted on the App Store. There are only three smartwatch platforms with enough functionality to make use of a keyboard with the multitouch and processing requirement of this keyboard. Apple is by far the largest. Samsung's platform is believed to be dying. So the only other purchaser is Google, whose platform is also not in great health. Given that Apple has the most users and that the app doesn't run on Android at this stage, they're by far the most likely to buy it.

"Another point is that by driving the value down, there's a risk that you'll lose the things which made the acquisition valuable. E.g. the target may sell off some of their assets to stay solvent, or lay off people with the domain knowledge needed to make the acquisition valuable."

Again, not a bad point but it doesn't apply in this case. The tech is a single application, although some of its functionality is open source released by another developer. The staff is two people. Not all that much they can do except try or give up.

"And if it becomes known that you're responsible for driving down the value, then people may choose to leave the target of their own accord rather than working for you."

I doubt that's a factor for most acquisitions. Apple can hire new developers to understand and develop a codebase. What they need most is the code that already works and the rights to any patents involved. It's a bigger problem when there are lots of people and the acquirer wants to keep that running, but for something IP-based like this, not as much.

Your final point about PR problems is good and applies.

'Business folk often don't understand what developers do...' Twilio boss on the chasm that holds companies back

Re: Bottom line.

It's not humanities which are at the root of the problem, and I see no comments which suggest it is. Check most people who manage without understanding. They're often not humanities people. Nor is management necessarily a problem. They have a role to play which is important, and without them, there is more chaos. What is the problem is that management is more often able to exceed their role and cause issues because they have more power.

I posted on this topic a while ago. I noted there that it's not just engineering that needs this consultation. The discussion here has mostly been about engineering since A) most of us are engineering people (software included, please let's skip the linguistic discussion this time) and B) the article was about engineering. The general sentiment applies to any work where there is someone making the product and someone managing them. That product may be a technical one requiring hard science, or a legal one requiring lawyers (a lot of whom are humanities people), or an artistic one, or literally anything. The problems and suggestions apply equally well to them all.

Re: Bottom line.

In general, developers know what is possible better than do the marketing and management sides. Not always, but when the product is technical, yes. For the same reason, if your product was carpentry, you might want to include the people who know whether something's feasible or easy to build when deciding what products to advertise or which contracts to use. If your product had legal consequences, you might want to have the lawyers review what you were planning before you publicize it. The expertise in actually building the thing needs to be consulted before making management decisions, with the management responsible for coordinating actions afterward.

Take a program someone suggested I write a while ago. They had seen that passwords were a problem, both simple-to-guess ones and reused ones. They thought it would be a great idea to write a program which could go through a network, check the passwords in use for strength, verify that they weren't reused on other services, etc. They thought this was a relatively easy thing to do and they could sell it to lots of places if we could just write it up quickly. Since I was interested in security and could write code, how would I like to be the lead [only] developer on the project? Fortunately, they hadn't already marketed this, because they found it a little disheartening when I described how salting and hashing meant it was basically impossible to do the first thing on any proper system, that salting and hashing were more important fixes than verification on any improper system, and that checking against other services would be at best a profound breach of privacy. If they had tried to promise things before, they would have been stuck with a promise to produce an impossible project.

UBports community delivers 'second-largest release of Ubuntu Touch ever'

Re: Why not fork Android + make it a shell

Primarily, because they want a more controllable thing. If they fork Android, they can do a port without changing much, like the various semipopular custom distributions, which wouldn't make you happy since the Android UI hasn't been changed. That is the option which keeps most app compatibility, but you have to live with Android's UI.

Or they could do what you ask, keep some of Android, but do a bunch of work to make the UI different. Result: some Android apps wouldn't work because the UI's too different, so now they have to do extra work to emulate the old structure so things aren't broken. In the meantime, they have to work with other problems in Android which they might want to fix. For example, Android's handling of external storage devices which isn't the clearest or easiest to manage. People who are used to the old Android interface may not recognize this one either, meaning more complaints about how they don't like the UI choices made. Meanwhile, Google keeps developing new Android things and, if this fork is to stay up to date, the devs have to keep backporting the Google updates which are important. That's a full-time job for several developers even when few changes have been made; doing it with a very different fork is intensive.

For people willing to do some of this work, they're probably not that happy with half-measures. If you're going to change a lot of things in Android, why not give a full Linux-style interface a go? If you want to solve Android's storage thing, you could do a bunch of work on Android itself or just run more typical Linux userland software which already knows how to manage that. This also lets you develop things without having to worry about Google changing Android in such a way that it's hard to integrate again.

Alibaba Cloud quietly tests desktops-as-a-service

Re: Two whole gigabytes?

The point is that, to use these, you already have to pay the electricity for most of the parts. All the peripherals including the displays, but also something capable of doing the computing work of establishing the connection and driving the peripherals. That's likely to be a full computer capable of working locally. If it is, it probably has specs superior to the lower tier of possible VMs just on its own. So you could pay for the electricity to run it yourself or you could pay for the electricity to run it and also for a remote VM which is no more powerful than it.

Google fails to neutralize lawsuit that complains Chrome's incognito mode isn't very private at all

Re: when the win finally comes.....

Probably not. They'll likely try to buy off the people bringing the suit. If they succeed, that moves anything down a year at least. Let's assume either this one or another one wins against them. What will happen then is they will update the terms of service to include a bit of new legalese and continue as normal. Like what happened with GDPR. They're clearly collecting stuff and they're not in compliance, but the various data protection authorities aren't doing anything. Unless somebody actually brings out a big fine, they won't do anything. The fines from small or class-action lawsuits are not sufficient for the purpose because the lawsuits are always run by lawyers who want a payoff rather than to see change.

US govt indicted me because I make privacy tools, says crypto-chat app CEO accused of helping drug smugglers

Re: So tomorrow Signal, Telegram?

"Does WhatsApp use strong encryption? By strong encryption I mean the US Government's definition of strong encryption. Not yours."

Yes.

"Is WhatsApp purposely designed with intent of evading detection of criminal activity by a US Law Enforcement Agency?"

No. Is Signal? No. Was this? Hard to tell, but they'd need to prove it, you know. You can't just say "Criminals use it, therefore it was designed for them." You actually have to prove a statement like that.

'No' does not mean 'yes'... unless you are a scriptwriter for software user interfaces

Re: Modals

Of course, but that's just failing to do the UI work. If they left out the save button, I'd have a similar problem. Bugs will break stuff until they're fixed. Meanwhile, it's not hard to test modals to make sure that's not been missed.

Re: Yes/No/Cancel

"Better still would be to ban modal dialogs outright, and force designers to come up with a UI that doesn’t need them to interrupt you to ask stupid questions in the first place…"

Please no. What you get when you do that too much is a bunch of important questions or information hidden away. Modals are really useful in the case of warnings. I was using a new program recently and ran the export function. Fortunately, I got a modal informing me that, unless the program was mistaken, I was about to export a project file which contained several subregions that hadn't been attached anywhere, so basically I'd get a mostly blank result. Did I really want that? If modals were forbidden, where would that information show up? Probably a tiny button on the toolbar next to all the other tiny buttons saying something about warnings. Given that the export phase of this could take an hour and that testing the result is long and I might skip it, I'm quite glad it warned me before I exported. You might point out that, now I know about this, I won't do it again and I don't need the warning, but I kept it turned on because I might do that again by mistake and it always helps to get told about it.

Re: when to use the word "fewer" instead of the word "less"

Greater, probably, if they're using something abstract. Of course, if we analyze this too much we'll find out that "more" works just fine for both situations where the number increases and that "less" could serve for both where it decreases if we surpressed our doesn't-look-right instinct for a month or two.

Asahi's plan for Linux on Apple's new silicon shows Cupertino has gone back to basics with iOS booting

Re: There one law for Apple and ...

I disagree on most points.

"Well the very first response was questioning the sanity of anyone wanting to run anything other than MacOS."

No, it was questioning the sanity of buying a Mac to run Linux on. You can choose to view that as "only run Mac OS", a clear Apple fan, or "don't bother buying Macs", a clear detractor. Given that the comment also advocates ignoring Apple and building your own machine to run Linux, doesn't seem that one-sided to me.

"Then someone chipped in Apple is so big they're their own standard."

I'm not reading that as an Apple fan either. They're saying that Apple doesn't have to adhere to standards for business reasons, so it's unlikely they'll opt to do something in an open and standard way because they have market power.

"It doesn't really matter about numbers for or against. It's just that if any other company did this sort of thing there would be an almighty outcry."

Disagree. Basically every Android OEM has done this already. There was some annoyance and people circumventing it, but we don't think it's a conspiracy. We just don't like it. To some extent, it might be more muted with Apple just because we've come to expect it. They've always been less than thrilled with people messing with their products. They've locked down their mobile devices, soldered in everything on their computers, and have the only modern OS you can't run on something else (well, legally at least and it's hard). We're perhaps not surprised when they do something and it's not completely open.

Re: There one law for Apple and ...

I would agree with this sentiment if it actually held true. The problem is that there are relatively few Apple apologists here. The comments I'm seeing mostly either fall into the categories "Apple should have opened this more" or "Apple isn't going to open this more". How are either of those supportive of Apple's move? The "Apple won't open it more" people haven't said they're keeping things closed for our benefit, which is the most obvious Apple apology you could come up with. In fact, the most supportive comment I've seen so far basically says Apple won't bother because it won't add many customers, which seems only slightly supportive of their move.

Re: Serious questions

"1. Why would anyone spend the kind of money necessary to buy one of the M1 Macs and then nuke the warranty by erasing the drive and installing a Linux?"

They might like Mac OS for some things, need native Linux for others, and want to have the ability to use one machine to do them both. If it turns out to be impossible, they'll deal with it then. Might as well try first before giving up.

"2. Related to above... given the limited disk [...] is there a way to create a separate Linux partition and install a bootloader of some type so that users could dual-boot Linux and macOS?"

Probably. If they can get Linux booting, they can also port a different boot system which can present a menu and launch each OS. More work certainly, but not more difficult work unless Mac OS has been written to break it deliberately.

"3. Wouldn't it be better to run a Linux in a VM?"

I wonder how well the VM hosts will work. If they're emulating X64 Linux, it will slow down quite a lot (Rosetta 2 isn't going to convert the entire VM to ARM-native) and stop working when Apple pulls Rosetta. Given they are already pulling it for unspecified reasons, it likely doesn't have a long life. If the VM hosts are now going to run ARM builds, that's nicer but most of them were not able to run them at all previously so expect bugs for a long time. Also, there are cases where native performance or access to hardware is necessary, and some may prefer to avoid a VM for that reason.

"4. What will they do when Apple changes the (undocumented) boot system, which I'm absolutely certain they will?"

Shout in annoyance. Then some of them will start reverse-engineering the new one and the others will curse Apple and run Linux on something else. Eventually, if Apple does it enough, there will be relatively few people willing to put up with it anymore and the prospect of actually running Linux on an ARM Mac might die. It mostly depends how often Apple does that.

Why yes, I'll take that commendation for fixing the thing I broke

Re: Change control is good - when it is properly controlled

"If the client software can't handle a disconnection, then it's not enterprise grade anyway (My reasoning on this: once you start using resiliant/distributed databases, server switches will cause client drops anyway."

I think this reasoning is flawed. If your database gets transferred to a different node in a distributed database, you'll lose connection very briefly because your new node is already available even if the previous one isn't. A simple DB down, retry, connect, and the system recovers. At worst, the client has to store a log of the stuff the previous node might or might not have done to check, not as bad if the operations are idempotent.

When the database isn't distributed, that doesn't happen. The DB down happens, but the retry doesn't immediately turn up an alternative. What should the client do? This could be the database went down. Or the network went down. Or the network cable came loose from the computer and the connection isn't going to get fixed until the user puts it back. The client can easily cache the operation the user wanted to perform and have it ready to resume when the database comes back, but depending on what happened, that might not be a good option. If it was a problem at the user's end and nothing happened for an hour while it got fixed, repeating an hour-old operation might be a problem if other data has changed in the meantime. The client has to do something, and it's unlikely it can guess at the users' intent all of the time. Best in those cases to just tell them the database can't be reached, invite to troubleshoot, and not to start doing things automatically when it comes back. As long as it doesn't crash, I don't think it's fragile.

We can't avoid it any longer. Here's a story about the NFT mania... aka someone bought a JPEG for $69m in Ether

Re: What is this

It doesn't have to. You want to see it, you can go to the website where it's published and look all you like. You want to keep a copy? Just save image. No need to pirate it when it's already free.

Well, on the bright side, we basically just did. Some rich person was willing to buy something worthless for a bunch of cash. The sale would incur taxes. Then the auction house paid the artist a chunk of that. That is his income, so it too gets taxed. The auction house took another chunk as revenue, which increases their profit. So they'll be taxed on that profit soon. And, if the rich person decides to sell again, that's a capital gain and gets taxed as well. I mean it's still really pointless that anyone wanted it, but we did get tax revenue from it.

Re: It just goes to show ...

"Except the seller will have to pay taxes on it, and the transaction is a matter of public record, which kind of defeats two of the main purposes of money laundering."

What? Those are the exact purposes of money laundering. The problem faced by criminals wishing to launder money is that they have some, but they don't have an explanation of how they came by it. If they make a purchase with it, the tax authorities will become curious how they managed that and why none of the money came to the government. The criminal therefore can't buy the expensive stuff they want.

Laundering that money means it is now known to the legal system and can be used without triggering alarms. In order to do that, they do have to pay taxes on it, but they also have to have an explanation for the tax man. If they claimed they just got paid millions by a friend, the tax authorities are going to be suspicious and investigate it. So in order to launder money correctly, a criminal wants a transaction that looks completely legitimate and passes a tax audit. Taxes and public record are required features of the system.

Re: What is this

But you don't own the copyright. What you own is a number which identifies you as an owner of a right to a file which others have a right to, but your right has a serial number and you can sell it. It does not mean you have the ability to deny access to others. Most resources with an NFT attached are already available publicly by design.

Re: I Have This Rock

Here's what you do:

1. Keep doing the same thing you were going to do with the rock. People don't want old-fashioned physical things they might do something with. You're going for digital.

2. After taking the photos, keep them. These are what you will sell.

3. Download SQLite. Your computer can handle that.

4. Run the following query: "CREATE TABLE ROCKCHAIN (photoname text, owner text);".

5. Get your photos auctioned. Publish them first so that everyone can see or copy them for free.

6. When each photo sells, update your database table.

7. When all photos have sold, hash the database and publish the hash.

8. Yes, that's not a blockchain, but nobody cares really. As a bonus, you can also publish a blob of text that says something about a blockchain and people will give up and assume you did it right.

9. Enjoy the cash.

Re: Say what you will...

Nothing's wrong with the art. He may be quite a good artist. He's also a smart artist; he realized that if he put existing art in a grid, someone would pay him millions for that. All credit goes to him. The person I don't understand is the one who chose to buy it.

Re: Outrageous!

I don't see anyone getting really angry here. I mostly see people laughing, saying the buyers are wasting their money, etc. You can do lots of things I think are stupid without incurring my outrage, and it looks like most comments here agree.

Re: Dumber than a rock?

I'm not sure about this one, but in most of the other NFTs sold recently, they don't own the copyright, they may not be the only owner of a token for it (the number is public though), and the image they "own" is also available for free. But they're one of the few people with a signature saying it's theirs, and that is what counts. It reminds me of the people who take money in order to name a celestial object or even assert ownership over it, but all that actually happens is that the new name or ownership claim is entered into a database unrecognized by anyone else. The only smart thing to do in this environment is to find some junk and see if someone will be convinced that, since there's only one of it, it must be a valuable investment and they're more than happy to hand you a pile of cash for it.

Re: What is this

A relatively good point, but the original Mona Lisa is valuable both for its artistic value and for the fact that museums get people to come look at it and pay for the privilege. Since an exact copy of this image and most of the other NFT-backed data is available for free, there's no value as an exhibit. The owners of the tokens have to hope that others will continue to care about the ownership rights to something they can get for free. But then again, I would never want to purchase the original Mona Lisa, even if I had infinite money available, so I'm the wrong person to argue for this.

License to thrill: Ahead of v13.0, the FreeBSD team talks about Linux and the completed toolchain project that changes everything

Re: @bombastic bob - Says it all

As I've said in previous comments, this is not a reason we have to care about. I'm merely illustrating that there can be a reason for a company to avoid GPLed code that is not purely profit-seeking anti-user stuff. This is not my problem, nor should it be yours. Companies can make whatever decisions they want to just as we who write the source can. I just think it's worth it to keep in mind the actual results of a license decision like this one so that decisions can be made with real-world effects in mind.

I said: "If you use a GPL3 library somewhere, they have to be able to replace it somehow"

You said: "Err, where does it say that ?"

From section 6 of the GPL version 3:

"If you convey an object code work under this section in, or with, or specifically for use in, a User Product [...] the Corresponding Source conveyed under this section must be accompanied by the Installation Information."

And above that is the definition of that:

"'Installation Information' for a User Product means any methods, procedures, authorization keys, or other information required to install and execute modified versions of a covered work in that User Product from a modified version of its Corresponding Source. The information must suffice to ensure that the continued functioning of the modified object code is in no case prevented or interfered with solely because modification has been made."

Which means that, if the software can be modified, the user must have the ability to modify it. Which, except for a few rare cases, is all products. There is an exception for a product where it's impossible, like ROM, but pretty much every product uses software which theoretically can be updated and in that case, they have to make it possible for a user to update it themselves. Again, I like this because I quite enjoy hacking my stuff, but companies have reasons not to want to give that access out other than wanting to lock out the users.

Re: @bombastic bob - Says it all

I'm not following your disagreement. If you use a GPL3 library somewhere, they have to be able to replace it somehow. If you make the system such that, if they put a file in that is not identical, it breaks, then you have not complied with that requirement. Therefore, you must accept a version of the library which does not break the system. If they supply a modified version which crashes itself, that's not your problem, but if the one they provide runs, then you must accept it.

Which means that the library could be replaced by one giving the user effective access to the system with the privileges of the original library. This is one reason I'm all in favor of people using GPL3 libraries, because I can write a replacement and use it to gain relatively unrestricted access to the underlying system. I like doing that. I got a library to open a network port and run a telnet server to a root shell, for example. The manufacturer I described above is not as keen on my doing that for reasons I've explained.

Now theoretically, the manufacturer could take steps to prevent a replaced library doing anything by isolating it in an environment without privileges. So if a company really wanted to, they could do that. However, that takes a lot of work and slows down the program as it sends data in and out of a sandbox for the GPL3 stuff. That's why few companies ever do it. They either just don't use the GPL3 libraries at all or they use them without giving access and thumb their nose at those of us who know they're violating the license.

Huawei CFO's legal eagles take HSBC to court in Hong Kong to obtain evidence against US extradition

Re: Sanctions are messy, politics is worse.

You are broadly correct, but the courts in Canada have also had to resolve claims by her lawyers that the crimes were invalid under Canadian law. These disputes have at times involved discussions of what fraud is, whether sanctions apply in multiple countries, and the like. Some of these discussions have indeed handled questions of culpability if she is found guilty, and thus the intent I described. When such claims were made, Canadian courts have decided that it is a crime to make fraudulent claims about sanction compliance, which is why she is still hinging her defense on procedural issues. Your description about what those are is quite good.

Re: Sanctions are messy, politics is worse.

Some of your facts are not exactly correct.

"a) a "Crime" that is only such because America has unilaterally decided it is, followed after some delay by its Allies."

In a way, but this is not unusual. It is not a crime for you to do business with Iran if you're outside the U.S., but if you are in the U.S., then it is. This is acceptable because the U.S.'s laws are set by politicians, and voters can replace those politicians if they disagree. You could therefore make it not a crime anymore by voting in others. Huawei is involved because they were selling their plan to a bank which operates in the U.S. and therefore chooses to follow U.S. laws.

"b) a Person being held directly responsible for that "crime" rather than the Corporate Entity itself."

This isn't the case. The reason Meng (and it's Meng, not Meg) is being charged is that there was a person making the claims to the bank which the U.S. claims are fraudulent, and it was her. The company may have directed her to do it, but she actually stood up and said the things which would be a crime if proven.

"There seems to be very little requirement to prove intent or harm by Meg herself"

The courts in Canada and the U.S. have been trying to do that. They have already had to deal with questions of intent, and her lawyers have tried to prove that she didn't have ill intent. They have so far failed to do that and are therefore more likely to get the request denied by pointing to procedural problems.

"and very little to be gained by holding her responsible for the actions of her company, which has already had its business model crushed by Sanctions itself."

The former part has already been contested above, and the latter part is unrelated. The sanctions against Huawei in particular are related to a different allegation, and one which in my opinion is much weaker. The point of the fraud case is to prevent fraud. The point of the sanction on Huawei is either to protect Americans from dangerous Huawei equipment (if you believe the drafters) or to gain an advantage in a trade war (what I think). Therefore, the fraud case can be legitimate while the sanctions could be unwarranted.

ZIPX files that aren't: Keep a weather eye out for disguised malware in email attachments

Re: Any word on the vulnerable version of 7Zip?

It doesn't sound like 7zip has a problem. It saw an archive and extracted files from it. It doesn't sound like it ran them. The same feature that lets you run it on an arbitrary file and it will try to find any archives inside it allowed an incorrectly-named archive file to be extracted anyway.

Huge if true: If you show people articles saying that Firefox is faster than Chrome, they'll believe it

"With Palemoon I can at least choose DuckDuckGo or whatever as the search engine it sends it to. So far I haven't succeeded with FF although I haven't tried hard because I can mostly avoid it."

And

"it's admittedly not as easy to change those settings as one might like."

Really? Here's how you do it. Tools -> Options -> Search category -> Default search engine. And right next to it, the settings about the address bar. A total of five clicks. How is that hard? Some settings are buried. These are really easy to find.

Re: Speed means nothing

"Is browser speed significant when all you are trying to do is click on all the squares with a mosquito in them?"

Of course. You see, if you run the captcha system and slow it down or even break it from time to time when it runs on the browsers you don't make, then you either drive people to your browser where you can collect all their data or at least you get more captchas done which means more free training for the AI department. Just be careful not to break it too much so you remain the primary captcha provider for lots of sites which have an email address field you can scrape.