Posts by doublelayer

Must 'completely free' mean 'hard to install'? Newbie gripe sparks some soul-searching among Debian community

Re: I love the way developers...

"As the world changes around them they seem intent to carry on fighting a battle that was won years ago. Some of them seem blind to the fact that real battles now and in the near future will be fought in hardware and the casualties triaged and treated in firmware."

That's the battle they're fighting, at least as far as wanting open firmware is concerned. If your concerns are that an OS on a chip will come along to lock us in, Debian's battles are helping you twice over. First, if they have any success at convincing companies to make more firmware open, then we won't be able to be locked in because we can edit the firmware as we do with software. Second, even if they don't have that effect (and they probably don't if we're realistic), their focus on open means we'd still have an alternative which could be run on something else.

Some people don't care about the interest in having access and rights to edit all the running code. I get that; it's a tricky and complicated thing that involves a lot of minutiae. If you just didn't care and wanted an OS that didn't make anything not work just because the licenses don't line up, I'd understand and I'd tell you to look elsewhere. Instead, you seem to argue a point directly in line with Debian's viewpoint, then turn right around and lambast them for their view.

Re: I love the way developers...

"Any software that is not both easily usable and open sourced by this point in time is either an evolutionary dead end or a niche product."

A perfect quote to sum up why I don't understand your point. Factually, it's wrong. Lots of things lack one or the other of those yet are commonly used and are highly developed. The original problem, firmware for peripherals, is often closed-source. Sometimes, it's not convenient or good for usability (and by now I have no clue what you think that means) either. Yet GPUs, often a substantial perpetrator of that, are used all the time by all sorts of people and don't appear to be dying out.

Furthermore, I don't understand why you denounce software that isn't open source while simultaneously decrying Debian's usability problem, which comes from only using open source code. Surely, if anything not open is an evolutionary dead end, then the open-only Debian should be just fine from that standpoint, and anything usability-related would be the fault of Debian-written code, rather than a failure to include dying binaries from others. If your point is just "I don't like Debian", you could have gotten there a lot faster. If you have a different point, I don't know what it is but it likely doesn't make sense.

Re: Two ways of looking at things.

Why is it so unreasonable for software developers to develop their software to have the features they value? When they're giving the software away for free and you don't have to use it? It's as if you expect them to change their plans because you don't like them, when they don't work for you or sell stuff to you.

Several years ago, I wrote a basic audio editor because I wanted one that could run on a device with very restrictive specs. I then published the code, which was basic but a few people at least looked at it. Had they come back and informed me that it crashed if they used some of the features, I would have fixed it. Had they suggested a different feature that would make editing audio easier, I'd have considered adding it, but no guarantees. And had they told me to make it a video editor instead, I'd have ignored them. Why? Because I needed an audio editor and I have no reason to write a video editor from scratch just because someone wants one. A video editor would have been better than an audio editor from the number-of-features standpoint. However, it would have been tricky to write given the limits I put on the system, it would have required a bunch of visual interface elements that would take a while to add to the software, and perhaps most importantly, it wouldn't do anything for me because I didn't have any video to edit. So I didn't write one.

The same applies to the Debian developers. They want an operating system for their use case, and they want it to include only code they can legally edit themselves. They made this, and it turns out there are people who want that and people who want something else. Because there are people who want something else, somehow it's now Debian's responsibility to make that too? Or perhaps to discard their original desired product and only make the thing that others want but they don't? Again, why?

Re: I love the way developers...

I didn't counter that it allows you to use a computer, because that's sort of the definition of software. I countered that convenience is not the "entire point". Or rather, there may be points that are considered by the developers or the core set of users to be more important than convenience. It's common for software to remove some convenience elements in favor of security, or extra functionality, or extra modularity, or execution speed, or in this case openness of code. It is your choice whether you care about these things. By incorrectly saying that convenience is the entire point and alleging, again incorrectly, that inconvenience is being "shove[d] down your throat", you are misunderstanding why Debian exists, who sets the goals (hint, not you), why people care about openness of code, and many other aspects of the discussion. Your rebuttal does seem to acknowledge these to some extent, but I can only wonder why you missed them so much in the original post.

Re: Yes. Hit meet nail head

"Use the Mrs Miggins test. Get the office cleaner and the tea lady to have a go at installing and using. If they can't do it, you've got nothing more than a nerds special product and NOT a serious, polished operating system"

Not a bad test, but try getting someone to install Windows from scratch and you'll find it's harder than you thought. Not for us, but for the general public, when the installer asks whether it should automatically partition and format the disk, with the warning about erasure, they usually come to the technical person and say "Please finish this installation and bring it back". Also, it depends what tasks you expect the nontechnical to be able to do once the computer's up and running. Click on the word processor and type in a document? They will be able to do that on Linux or Windows. Connect to a network folder? Sorry, but you'll find a bunch of nontechnical people don't know how to do that on Windows either. Configure a printer? You're now rolling the dice on whether the printer is a standard kind which will just work on everything or whether you'll end up in driver limbo, and that happens on both OSes albeit with different sets of working printers. Comparing a personal Linux machine to a work-administered Windows machine may make it seem like users know how to make Windows do lots of complex stuff, but usually it's IT which did that and they only know how to use, not enable and configure, that stuff.

Re: My personal rant about all Linux variants

Nor do you have to. For a lot of users, there is a Linux variant that includes the stuff they want and is easy to use. That just isn't the same distro as Debian. If you want to use a system that has a lot of stuff included, there are options. That's not saying everything will be easy on that, because if you want to do more technical things,, you'll sometimes have to learn some technical details, but most of the software you talk about will run without fiddling. Expecting every distribution of Linux to do that though is just not going to happen.

Re: I love the way developers...

"the entire point of any software is to allow you to use your computer."

No, the entire point is what is intended by its creators, be that the devs themselves, the management who told the devs what to do, or a set of users who specified to the devs what they wanted. In Debian's case, it's a group of devs, and they decided they didn't want any binary blobs in the default distribution. If they forced you to use it, you'd have a point. They don't force you to use it. They don't even really try to persuade you to use it. They make it available, and you decide whether you're going to use it or not.

I am currently developing a device which has what you could call an operating system. It does not make it easy to use the device. In fact, it's completely impossible for a user to use the device with just that operating system on it. The OS concerned has no user interfaces, including a command line. The reason: the OS is designed so that an application runs on top of it and provides the user interface. The OS's only goals are a bit of protection from misusing the hardware and recovery from an application crash. And that's exactly what I wanted, because I want my application to do the interface part.

Re: Free means somebody is not getting paid

There's a reason most of those things cost money and have warranties. It is because support isn't free. If I gave you those things for free, you would probably be in a similar situation. If I forced you to use Debian, you could easily expect quick support, but basically everyone using Debian chose to use it knowing that they can't just expect the Debian developers to turn into the support team.

If you choose to use something which doesn't have a support team, you have a few options. You could find people willing to offer support for free, knowing that they might not always be the fastest or most reliable. You could find a company willing to offer you a paid support contract, and you would find one. Or you could go without support and figure it out yourself. If these options sound bad, then perhaps a no-support operating system isn't for your use case. There are companies willing to provide you an OS with their own support built in, but those have costs as well.

Re: Two ways of looking at things.

"My view of the system was not the same as theirs. For me it was a job. For them it was a tool."

This isn't a bad philosophy, but I disagree with how you extended it. For people who don't work on the system, they do want a tool that works best rather than the realization of some ideal, and that's a good thing for the users to be thinking about. However, you said this:

"So for devs to say that the way you can use the system has to be the one they favour is, in my opinion, short-sighted."

I don't think so. It would be if the devs were responsible for building the best tool for your users, but they're not. They chose to create the project because they wanted a realization of their ideals which also works as a tool. Whether it's the best tool for other people may not be their primary consideration. The reason is that it's designed so that others can change functionality when it doesn't do what they want. If your users need a proprietary application on the server, Debian lets you put it there. It's not Debian's responsibility to know your users will need that and put it there for them. For that reason, I take exception to your contention that "devs say that the way you can use the system has to be the one they favour" because they've designed it so that you can use the system any way you like, but you need to change it if it's not the way they set originally.

Google's Alphabet sticks a pin in its Loon internet broadband service

Re: Starlink

Good point, as the signal still has to come down to Earth somewhere. If the downlink facility isn't as close to the markets, then it's likely that just being closer to the market than the downlink is will be faster. Given that a lot of high-frequency trading equipment is already right next to the market servers, does Starlink plan on buying rooftop space in the same building? That cannot be cheap.

Nothing new since the microwave: Let's get those home tech inventors cooking

Re: Oh dear!

That would make a lot of sense, but can't be guaranteed. A friend of mine had a key's battery die, which made the car stop recognizing it. They had a backup but requested my assistance to change the battery as I was already there and there was no battery compartment on the key. After prying open the key to get at the battery and replacing it, the key was now recognized by the car as existing, but not as being a valid key. The car's owner was told to see if the internet or manufacturer could help with it. I'm betting that key is still sitting in a cupboard in an unusable state. I don't want to think about what's going to happen when the backup's battery dies.

BOFH: Are you a druid? Legally, you have to tell me if you're a druid

Re: Plagiarism

If we're being technical, that line was "I threw a 5 and a 2.", with no "which meant" on the end. In fact, I had to just rewatch that scene for accuracy's sake of course, and none of the rolls previously mentioned were a 3 and a 4. I'm sure this information was very useful to you. I haven't wasted my time, right?

And just like that, Amazon Web Services forked Elasticsearch, Kibana. Was that part of the plan, Elastic?

Re: You can't put the genie back in the bottle

"Should Amazon do the right thing and pay back into a project they're benefiting so much from? Yes"

And have they? Yes. It hasn't been by paying Elastic a bunch of cash, which I'm sure Elastic would have preferred, but AWS upstreams a bunch of code to the Elastic project. Mostly because they're lazy, just like most of us; if you have to maintain your own version or release your changes as the canonical version, the latter is easier. Still, AWS fixed some things and gave us the code, which we now get to use for free if we want to. If I start to use Elastic, I'll profit from Amazon's changes and I can guarantee you I won't be paying Amazon for that. That's one of the primary benefits of the open source and free software philosophies: the advances made by one user get made available to everyone else without someone chasing the users for extra payments or license audits.

Raspberry Pi Foundation moves into microcontrollers with the $4 Pi Pico using homegrown silicon

Re: Neither fish nor fowl

"I can see it falling in an area where ESP32 doesn't have enough programming/processing capability but running a full blown OS (Linux) is too fat."

That's not where it is. This has two M0 cores at 133 MHz. The ESP32 has one or two cores running at 160 or 240 MHz with extra acceleration for some tasks, especially cryptographic ones. It also has double the memory. This has to fall into a place where an ESP32 is too much or doesn't have the needed features.

Re: Neither fish nor fowl

Excellent example to prove the point you argue against. The Model T is well-known because it was affordable due to efficient manufacturing. Not unlike the original Pi itself. It didn't necessarily do more things, but it had a serious point of competition where it provided a benefit to the consumer over previous cars. Other cars came out with different features, increased reliability, or even more affordable, and they succeeded. Usually, they needed some point of competitiveness in order to be successful cars.

The original question is just asking what this board's competitive edge is. It could be anything: "it does things the others don't do", "it does things the others do at less power", "it does the same things but it costs less", "it uses the same power but is faster", anything like that. And some of the advantages sound a little interesting, though perhaps not as differentiating as I'd hope. If it didn't have any advantages, then it'd be like many other cars you've never heard of, because everyone looked at them and decided to buy the Model T instead. It's not irrational to ask what the differentiating factors are if they're not evident.

Re: Neither fish nor fowl

I have to question this, since there are already several microcontroller-based education projects. I wonder if education is the foundation's primary goal with this board. When the original Pi came out, there was little competition in SBCs running Linux on low-cost components. Today, there are a lot of boards like it but as you said, the Raspberry Pi is still the one with all the tutorials and support. It therefore makes a lot of sense for the foundation to continue to create boards like that for the educational benefits.

In microcontrollers, however, there are a bunch of existing educational boards. From the early Arduinos to the MicroPython-focused ones to that weird thing the BBC made. I haven't yet seen what this does for education that those boards don't do. For those new to programming, most of those boards will be better since they include peripherals. An early programmer can blink an LED that's already on the board, then move on to breadboarding on some more. Or they can make a board that uses hardware which either comes on the PCB or can be attached conveniently so they get used to the peculiarities of driving hardware manually. The alternatives are usually much harder for someone new to programming, as they also have to learn to assemble the hardware and determine whether something is not working because the connection isn't stable or the code's wrong.

For this reason, I doubt this is for the same educational goals that the larger Pis are for. That doesn't have to be the foundation's only goal though, so this isn't necessarily a problem. Still, arguments that cite it as an educational board don't make much sense to me until I hear why it does the job better than the many tested alternatives in that space.

Re: What a shame they didn't go down the RiscV route...

Opening it to everyone would be the point. The original Pi didn't have to open every detail of the SOC since it was designed primarily for educating people about programming, Linux, and the like. But this is not really that kind of thing. The lack of ready-made IO makes it a different type of product than the computers they've built before, and while they undoubtedly expect some to buy them for entertainment or education, I expect they're aiming for industrial users. Especially as there are already a bunch of microcontroller-based boards which easily work for educating those new to coding; my favorites are Adafruit's more recent products.

This doesn't have to be a bad thing. The foundation may have focused on education, but they and we know a lot of Pis aren't used for that purpose. If they want to make a microcontroller that's primarily intended for industrial use, more power to them. Still, they have usually stood for openness of platform, and they designed their own chip this time. Had they used an open-source ISA, they could provide a lot of interesting details that would have served an educational purpose for those interested in the design of CPUs, while not impacting product quality. It's their decision, but I think that would have been a good one.

With depressing predictability, FCC boss leaves office with a list of his deeds... and a giant middle finger to America

"Imho it also shows we've become overly dependent on that network and do way to much ONLY via the Internet"

Does it? What are the things for which we depend on it which we shouldn't, and what should we use instead? A lot of the things we now do on the internet were things we used to do by going to a place in person, but now we don't for everyone's safety. That does make us dependent, but the alternative has some thorny problems. And there are things that rely on the internet which used to rely on a phone call to a person, but that's not really different because most internet lines are in the same place as the phone lines if they're not just the same wire. So what things, in your opinion, should be removed from the internet so we can be more independent of it?

AWS has been doing things that are 'just NOT OK since 2015,' says Elastic as firm yanks Apache 2.0 licence

What "free" means

Various companies have, in recent years, started to misunderstand what free software means. Yes, it means free as in freedom of speech, but freedoms like that are not small things. Those freedoms mean that I am free to use the software in any way I like. It may be in a way that the author doesn't like, but the author doesn't get to restrict me. That freedom gives the author various advantages, including a larger user base which will occasionally contribute to the code or donate money, but it also comes with downsides, like sometimes people use it and don't pay. The author can throw up some roadblocks, like not providing compiled builds unless people pay for them, but the entire point of the freedoms allows those who are willing to go to the effort necessary to use and distribute the code under those terms.

If someone wants to extract rent from all users of the software, they can write their own license terms. It becomes proprietary, since they are demanding extra authority to restrict usage to those who pay, but it's their code, so they have the right to do that if they want to. Doing that to code produced by others is at best an incredibly disrespectful move, and can be a license violation depending on how it's done. In short, don't give people freedoms you don't intend to honor, or they will hate you.

Loser Trump's last financial disclosure docs reveal Tim Cook gave him $5,999 Mac Pro, the 'first' made in Texas

Re: Can he keep it?

The section of the law that restricts this is the emoluments clause of the constitution, which is strict but limited:

"No Title of Nobility shall be granted by the United States: And no Person holding any Office of Profit or Trust under them, shall, without the Consent of the Congress, accept of any present, Emolument, Office, or Title, of any kind whatever, from any King, Prince, or foreign State. [...] and he shall not receive within that Period any other Emolument from the United States, or any of them."

So if a foreign government gave him something, he would not be able to keep it. If someone else gives him something, he can keep it. Gifts can be given to the government directly, and if that happens, he couldn't take it, but if it was given to him directly, he can. Of course, it doesn't end there, because there are laws about bribery (obviously this computer isn't a bribe but other gifts could be) and the lawsuits about foreign governments buying stuff from his businesses haven't been decided yet. But he can keep the computer.

Signal boost: Secure chat app is wobbly at the moment. Not surprising after gaining 30m+ users in a week, though

Re: Because...

There are several mechanisms that can be used, each with dubious legality at best.

1. The mobile companies sell it to them. This is often not legal, but doesn't get investigated. Even the U.S. holds this to be illegal, but although it has been documented repeatedly, nobody with the authority did anything more than complain.

2. When a phone number and name are supplied to businesses, the businesses package up the data and sell it. "Brokers" purchase the databases, cross-reference for accuracy (or refrain from cross-referencing for size), and sell the result on. This is illegal under the GDPR, but may not be in other countries. It might get investigated in Europe if they ever decide to get moving on that, but the businesses which do it often don't advertise that and the people selling the databases are usually sketchy places which don't disclose their sources.

3. When a phone number and name are supplied to businesses, the businesses don't sell it to anyone but also don't secure it properly. Someone breaks into their system and leaks the data, and others find the leak, add the data into their database, and sell their database. As long as it's not them who did the hacking, they're on slightly better legal footing. Still, it's not exactly condoned, so they still stay low-profile.

Other methods of collection are available.

"How did a conversation talking about secure encrypted chats get derailed to talking about Android?"

Doesn't seem all that derailed to me, but the progression was like this:

1. Signal has some downsides.

2. XMPP lacks some of those downsides.

3. XMPP has multiple clients so may be harder for nontechnical people than Signal, which has one.

4. If you were going to choose one to recommend, that runs on Android, which would it be?

I don't see people talking about Android in any other sense than what software you'd run on it for secure comms. Since the conversation was already about software for secure comms, and since Signal runs on mobile devices, I don't see anything off-topic.

Re: Signal compromised?

Could it be this? A company claimed to have developed new ways to do something really easy, realized it was embarrassing, and took their own post down? The BBC repeated it incorrectly, so that might explain where you heard it. Seems to fit the admittedly few details in your recollection.

Re: It's been obvious for days

There is nothing stopping you from getting a PAYG SIM, register to Signal with that (which is when your unique identifier is generated) and then swap back in your regular SIM."

There are several things that could stop you.

"getting a PAYG SIM,": Some countries don't have a way to anonymously get mobile service. You have to supply identification when you do it. If you're hiding your identity, providing your ID on a second SIM may be an even bigger red flag for the automatic find-possible-person-of-interest database. Even if it isn't flagged, the number can be traced to you if they want to. That doesn't help you much does it?

"register to Signal with that (which is when your unique identifier is generated) and then swap back in your regular SIM.": This brings up several problems.

First, mobile companies usually collect IMEI numbers when you connect with a new SIM. You could then cross-reference those to figure out which numbers the device in question has been used with. While some of the time, a device will change SIMs because it's been sold to someone else, database entries indicating "Used number 1, started using number 2, started using number 1 again" are pretty conclusive about what you did.

Second, what happens if you have a number registered with Signal, someone else gets the same number because you've canceled the corresponding account, and tries to put that on Signal? I don't know, but I suspect something breaks. In order to prevent that, you might have to hold on to the number for quite a long time. That's inconvenient and could be expensive. I've been looking at how to keep a number reserved without using it frequently, and the companies usually want to charge me a maintenance fee or impose a "must use every three months or we cancel for you automatically" clause.

These things might not be dealbreakers. I use Signal, with my phone number, and I don't care whether people know that I do. They can't read my comms; that's good enough for me. Signal has to balance the concerns of people who don't think that with the difficulty of running a system without phone numbers as identifiers. If their decision is that they don't care, that's a viable decision.

On his way out, Trump emits exec order suggesting US cloud giants must verify ID of all foreign customers

Re: Was it Trump?

I'm afraid it doesn't sound sensible, or rather it does for the first thirty seconds, sounds pointless for the next two minutes, and then starts to sound concerning.

The first thirty seconds: people use this stuff to commit crimes, so why not identify who they are so it's easier to track them?

00:30-02:30: How is this going to help with anything? The order calls for U.S. providers to audit non-U.S. users. All an attacker has to do is to use a non-U.S. provider and they escape it. Or pretend to be a U.S. person and evade the required tracking. What happens if they use a U.S. provider's non-U.S. infrastructure? And how often do they tell the truth anyway; the really dangerous people will be able to lie through this system.

The rest: They want to require everyone purchasing IaaS services to create a government-auditable log of having done so. While the size of the group who will at some point do this is small, they want to be able to quickly get a full identity attached to any system. This sounds like a privacy nightmare, and rather like those governments who used to require licenses be purchased to own computers, phones, or televisions. While it might help with investigations, it seems more likely to increase the size of the NSA's database on everyone and to be a juicy target for people looking for valuable identifying information.

Indian government slams Facebook over WhatsApp 'privacy' update, wants its own Europe-style opt-out switch

Re: GDPR

"the government can't cherry-pick which companies can do whatever they like and which not..."

They can and they have. India recently banned several Chinese apps, either because they're creepy data collection efforts or because India is angry with China. They didn't make a new law to do that; they just listed some undesirable apps and told the companies to stop operating in India. They could always do that again. I wouldn't hold my breath though.

Scottish Environment Protection Agency refuses to pay ransomware crooks over 1.2GB of stolen data

"all malware starts by using JS to download and run the nasty,"

What? Wrong! Do you know how malware works? That isn't done often, and for a very good reason; it doesn't help with any of the tricky bits. JS from websites, where NoScript can block it, can't unilaterally run executables. It is sandboxed. If it can do something malicious inside a sandbox, it will. If it can escape the sandbox, it will try that too. Things like tracking users across sites using sneaky storage, exfiltrating stuff they type onto websites, stealing CPU time for cryptomining, redirecting them to somewhere dodgy, that style of malware. For those and only those reasons, blocking JavaScript on websites is useful.

Ransomware requires full access to the disk. Not even bad browsers give that kind of access. A JS-laden ad might redirect someone to a download link, but that could be done with an HTML ad too. And those approaches usually don't work as effectively as emailing the file or the link directly, which is probably what happened here. In fact, if you want a script system that is more often used to send malware, it would be Office macros (not JS). Every once in a while, there's a vulnerability like EternalBlue which lets one upload malware directly without any of that, but not using JS. Then, something has to be done in order to get the program running. Often, this involves getting the user to click through the OS's security features or bypassing them using a vulnerability. Since most such vulnerabilities use APIs of the operating system which aren't available to JS, JS is seldom used for such purposes.

If you think you are saved from malware by blocking JavaScript in your browser, you likely have a flawed understanding of most if not all the relevant concepts.

Re: The right attitude

"Once bitten the twice shy victim will be a harder target."

That's a possible outcome, but there are several others. For example, once bitten and it didn't cost much so they're not at all concerned about next time because they can afford to pay that ransom again. Queue the next time when the ransom is significantly larger. Even worse when insurance handles the payment because now they think of it as amortized in normal payments like all the other risks.

Or the client who pays the ransom to keep data hidden and doesn't realize that the criminals can come back any time to request a top up since there's no way to know if the criminals have destroyed all copies.

People sometimes get complacent about their ability to handle a risk if they've done it before. This is yet another problem with ransom payments.

Back to the office with you: 'Perhaps 5 days is too much family time' – Workday CEO

That's an option, but some companies like to adjust payment when people move to cheaper places, so the same amount of money would become a larger fraction of total income. Logically, the company shouldn't care as long as the people work at the same level, and the people would probably work more efficiently having gotten better sleep and more time to focus, but companies sometimes see a reason they can justify paying less and they take it.

"I tend to use the same words with my mouth-hole as I do with my tappy-hands,"

For efficiency, talking to someone can prevent you having to use all those words. If they already understand something, you can skip it rather than having them skim through text which doesn't tell them anything new. If they're confused by something you said, you can rephrase immediately. If they have specific questions that are more important, they can suggest that you restructure your address so you cover those things earlier or in more detail.

Take an email I recently sent, describing the performance of a system. I told the recipients that, in the interest of reliability of my measurements, I had tested the code repeatedly and reported average, median, and extreme values for the time it took to run. However, one of the recipients got confused based on the word "reliability", interpreting it to mean that the code itself was unreliable, either crashing or producing incorrect answers. This led to a second email where I clarified what I meant in a diplomatic fashion and provided even more numbers to confirm that the code always completed and produced the same results given the same inputs. My colleague also added an email of his own to ensure them that we had a large set of tests to confirm the stability and correctness of the code. I think that misunderstanding could have been resolved in about thirty seconds of conversation, because they could have said "What is unreliable about the code?" and I could have said "I see. The code is reliable. A better term would be sample size of time measurement. I'll use that for the rest of this conversation.".

Epic Games files competition lawsuit against Google in the UK over Fortnite's ejection from Play Store

Re: They want a free ride

Yes. The license for Google Play Services. Google charges manufacturers for these, and also requires that they refrain from installing any other variant of Android. It benefits Google in two ways: they get money off Samsung for the code and they prevent competitors from building around AOSP. Both give them plenty of cash. That's quite a healthy revenue stream.

Physical stores are not comparable. Some of the reasons are explained in the first reply to your post, but one other reason is simple: the people selling products to the stores can decide not to sell there and sell somewhere else. On IOS, that's not an option. On Android, it's not a realistic option. That is one reason this discussion is happening, because there is a lot of competition for physical stores, but next to none for Google Play and none at all for Apple's store.

Re: They want a free ride

When did I say that. I pointed out that they have a revenue stream for that stuff. It's from users. Who buy devices. Google and Apple get large chunks of profit every time someone does that. Google also gets revenue chunks when companies design new phones and licenses Google Play Services. The APIs you're talking about are earning Google money, and they only do that because app developers make them necessary. Without developers, the APIs in question would not earn Google money. As for Apple, they also charge every developer an annual fee for things like this.

You are saying that, regardless of any other revenue stream, any money that is collected must be necessary for development. The large profit margins demonstrate clearly that they could lose revenue without having to cut spending on development. Given that, the discussion then needs to consider fairness, which is what we could get to if you would stop telling me that anything and everything they do must automatically be justified because I, or rather mobile app devs which I'm not really, owe them so much.

Re: They want a free ride

"so Google and Apple make $0 for the billions in investment creating the platform"

Wrong. They get money from hardware sales and software licensing. You know, from the people using all the stuff in the platform? The people who write apps aren't using very much of that platform; it's the users who are. People who write apps don't much care whether the built-in email client works or not. I do. The money for the upkeep of that app and all the other ones comes from the money paid for those things, which is embedded in the sale price of any phone using Googled Android or IOS. In addition, app developers are the main reason the platform has value. Without third-party apps, these platforms aren't so useful. The ones that had nice design but few or no app devs, well most of them aren't around anymore.

"and developing the distribution infrastructure."

Oh, yeah. The thing that has to respond to three requests: search, information page, download app? Extra feature of payment management, which if the developer uses it cuts the store in? Which gives the manufacturers a ton of power over what people download? I can see why they need to be rewarded for that. It's not like someone else might have implemented that independently using basically no resources.

Security fears, but not the ones you meant

"Epic also wants "an order requiring Google to remove or amend the technical restrictions to ensure that [...] those apps/app stores are able to operate in the same way as the Google Play Store with respect to app installation, app updates, and access to operating system features," something likely to ring alarm bells among Android security watchers."

Yes, it does ring alarm bells. The alarm is because Google has, to enhance its own store, poked holes in Android's security model for it to use. There's the anticompetitive aspect of that, which I'd expect to appear in investigations in the near future, but also the risk that someone could find a way to abuse those holes by impersonating Google Play. Unlike other ways to download apps, Google's doesn't have to negotiate to get the required permissions or prompt the user before making changes. Those prompts aren't just security theater or notices so users stay alert, they're also the best opportunity to spot something nefarious and prevent it getting started. A good solution to this is to lock down Android so that any method of installing apps has to go through rather than around the security model. This would apply to FDroid, Google, the manufacturer, the carrier, and everybody else.

Apple reportedly planning to revive the MagSafe charging standard with the next lot of MacBook Pros

I suppose we must live in different worlds regarding phones and laptops; I see phones charging, but usually from short cables which aren't stretched across rooms. The long easily-tripped-over cables I see are almost universally attached to laptops. Maybe it's just the buildings I spend time in. My other points for the why not on phones issue remain, though.

"And 'endemic' obviously means something different!"

I'm not sure what you mean by this. I didn't use the word endemic; you did. I just quoted you. I interpreted it to mean something along the lines of "prevalent" or "common". Did you mean it differently? My response was written for that meaning, and having reread your comment, it still seems to be the most logical meaning in context to me. You said the issue wasn't endemic, I counter that it is quite common.

What worries me is after the original handshake. If the magnetic connector doesn't support the 65W my work laptop expects, it might specify that and refuse to work, which would be acceptable, or it might not have that functionality and try to pass the voltage through until something burns out, which wouldn't. I don't know for sure what would happen, which is why I have to test it, but I'm afraid given the many manufacturers that there will be some unreliable ones out there which could cause a safety or destroyed equipment issue.

"Think about it, though: if the problem was as endemic as is implied,"

It is, and most of your questions have obvious answers.

"why don't other vendors come up with alternatives?"

They do. Microsoft's Surfaces use a magnetic charger for the same reasons. They're not the only ones who have done so. The primary reasons that companies choose not to do it are backward compatibility (E.G. most Dell business laptops used the same size barrel adapter before they adopted USB-C) or patent fears (Apple's sued people before for similar connectors and everyone was expecting them to do the same to Microsoft but it didn't happen).

"Why hasn't Apple put it on their phones?"

Two reasons. First, phones aren't usually as likely to have the problem. The reason is that phones have batteries which generally last longer, so people are rarely seen at a table, working on the phone, with the phone plugged in. Laptops do have that more often, so they need the protection more. Second, phones are already expected to fall more often, which is why people often put their phones in cases. Because they're small, easily dropped, etc. they've been designed for abrupt falls more than laptops have. It's usually less of a problem if a phone falls to the floor than if a laptop does so.

"(I previously mentioned my LG phone with a magnetic USB adapter)."

Which is useful, as is wireless charging, because they reduce wear on the charging port. Magnetic USB-C cables do exist, and I need to buy one to see if it can withstand long-term high-voltage charging. I'm afraid that they're not designed for that and will fail in a laptop where they wouldn't in a phone.

"Why don't the business laptop vendors (Dell, Lenovo, HPE, etc) address the issue you describe by making the power socket easily replaceable?"

Why don't they make the hard drives easily replaceable? Or memory? Or WiFi cards? The usual answers are that they can save themselves money, produce a thinner machine, and so on. Also, few of their customers are planning to resolder a power port anyway, so they probably figure they don't have to worry about the issue costing them customers. If it leads to a faster replacement cycle for the laptops, I doubt they'll complain.

The cables that look the same but are not is a really important issue. Have an upvote.

I don't buy new equipment all that frequently, so I've still got a lot of stuff not on USB-C. Those things I do have though... I have a laptop from work with a USB-C socket for charging. It comes with a power adapter for it. I have a portable device which also charges via USB-C. Its charger can't charge the laptop because it doesn't produce enough voltage. Fine, no surprise there. However, the cable which connects to that weak charger doesn't appear to be able to charge the laptop when a proper power supply is placed at the other end. I don't know why. Also, this is one of the few cables I have with USB-C on both ends, but I don't know whether it carries data at all. Also, there are cables which work with Thunderbolt and ones which don't. The Thunderbolt ones are supposed to have a logo on them somewhere. So perhaps one can determine which kind they have if they have a magnifying glass on them, but in reality, the cable that fits the port gets used and people generally won't find out that it's causing the system to run slow until they've experienced a lot of pain.

If USB-C is to be our one standard, I suggest we force one standard on all the people using it. It goes something like this:

1. All cables carry data. No cable will ever be produced lacking data pins. If we find a cable you've manufactured which lacks the data lines or in any other way has data intentionally disabled, you will lose your license to produce USB cables and we tie all the power-only cables at ankle height around your office before killing the lights. If you wish to produce cables which don't carry data for security reasons, you probably don't need to, but we'll accept cables with a switch on them which cuts them.

2. All cables with USB-C on one or both ends will be able to carry power at 5 V and 3 A. They should be able to do more, but nothing less than that.

3. Any wall adapter with a USB-C socket must be able to provide power at 5 V and 3 A. This holds whether the device they're shipped with uses that or not. If the device only uses 1 A at 5 V, the adapter still has to be able to produce 3 A if called upon to do so.

4. If a device uses USB-C to power itself, all the USB-C sockets on it will work to charge it.

5. All devices with at least one USB-C socket have to state in their documentation if not written on the device itself whether the sockets are data-only, power only, or data and power.

6. All devices using USB-C to power themselves must state in their documentation if not on the device itself the voltage and current required to charge them.

I'm sure there are more necessary rules. Without them, we have the situation we had before, with cables that only work on some machines and you might have to get an unusual one if yours breaks, but now they don't even look different to make this clear.

Facebook tells Portuguese court that a biz called Oink And Stuff makes profile-harvesting browser extensions

And using a subsidiary based in Ireland. I mean, we have to list all the countries that have nothing to do with Portugal so we can get the full effect of the "Why?" feeling. Maybe they've got servers there or something? Facebook's going to have to provide a good reason when the courts start to read their complaint.

Xiaomi hit by US sanctions: Can't list on stock exchanges and investors can't invest

Doesn't really make sense

The targeting of Xiaomi doesn't make as much sense as other companies do. I don't agree with the banning of Huawei because each time public information gets released, it paints Huawei as a place which writes crappy code but not a place which backdoors the equipment it sells. Still, I can conceive of a justification for its ban. The hardware it makes does go into the backbone of a critical resource, and if someone could disrupt, intercept, or disable that resource, there would be big problems. If someone knows that Huawei has capacity to do those things but doesn't want to tell us, it could make sense that you'd have to ban it. I'd like to see the evidence, though.

Xiaomi doesn't have that justification. They don't make infrastructure; they make consumer electronics. Sure, their electronics might come with malware on them, but so could any other company's. If there is a risk of malware-laden Chinese electronics coming into a country, that country would likely have to ban all the companies' imports, not their shares. There appears to be little or no justified security concern, which makes previous bans dubious as well. If it's a trade war they want, they should just do it the normal way, with broad tariffs. Doing a trade war by picking victims and turning the cannons on them alone is not only strange and erodes trust, but it probably isn't going to do all that much about the problems people have with the trade relationship either.

Dratted 'housekeeping', eh? 150k+ records deleted off UK’s Police National Computer database

Re: Backups

They were deleting after three years*. That's not GDPR. That's other regulations. Specifically, it appears to be from the Protection of Freedoms Act 2012. At least the biometric information is covered there. That is what the article talked about, but there's other information the police get, such as full images of computers and phones which they like to extort out of victims for reasons I don't understand. I'm not sure where that's stored or which laws the police use to set the data retention policy for that.

*Well, they claim to delete after three years.

Re: Backup system destroyed by Fire

"If the backup system has been replaced and is operational, what's the point of mentioning the fire in the story?"

Some options:

1. It demonstrates the age of the system I.E. "it was around in 2005 to have this happen".

2. It demonstrates that the operators are likely to have backups I.E. "we know they had backups in 2005, so they probably have them now even if they don't give us the details".

3. It demonstrates that there has always been a problem with maintenance of this system I.E. "as far back as 2005, it's been known that recovery will be difficult".

4. It is intended to suggest that the police should have learned by now I.E. "they should have learned in 2005 that massive data loss events will happen and built a faster recovery system accordingly".

5. It is intended to suggest incompetence I.E. "at one point, they built their backup system near a place that can explode. Who knows if they've done something as risky now".

6. It's an interesting event that happened, and they think the story might intrigue the readers.

More options are available.

Re: Backups

The article says that they're recovering. Distributed or not, it sounds like they have backups. Maybe it will take some time to restore them, but I doubt any data has really been lost. Just a bunch of headaches getting it back into the database.

Watchdog urges Tesla to recall 158,000 Model S, X cars to fix knackered NAND flash that borks safety features

Re: plugs Great

Not really true. Depending on the location of the phone or camera, it probably has more padding insulating it from shock, whether that be a protective case for the camera or your leg if your phone spends its time in your pocket. SD is a bad idea for a number of other reasons though, which I've just posted about. The short version: not good for lots of rights, can't predict failure, not easy to confirm reliability, and NEVER make it feasible to remove something safety-critical while the system is running. Reservations about SD as an option aside, the storage should certainly be replaceable.

Re: Great

"I'll bet they wish they had built a microSD card slot into the bezel of the infotainment system."

The storage should definitely be swappible, but never like that. It shouldn't be easy to accidentally take the storage out, and it really shouldn't be feasible to take it out while driving. Similarly, consumer-grade EMMC inside the dashboard isn't great for reliability, but if you wanted to see what significantly worse looks like, trusting SD would be a good way to get there.

I would instead suggest a container for a storage device which is modular but installed beneath the screen panel. Users who are knowledgeable enough can get to it by disassembling the car, but nobody will accidentally take a card out of the display thinking they must have put it in a while ago. That also makes it possible to insulate the storage device from shock, temperature, and other possible damage. While specifying this storage system, the manufacturer should ensure they use storage which supports a SMART-style health check so they can warn the drivers to get it replaced. If they want to be extra careful, they could have the module include two mirrored disks so not even a relatively rare unpredicted failure can crash it. Even requiring all of this instead of a basic EMMC module wouldn't change the price all that much, and the service center could probably charge the driver for the replacement part instead of being forced to replace it at their expense when it causes a safety issue.

"So what's the deal? Have I just been lucky, or has Tesla cheaped out on the components in its cars?"

A little bit of both. The storage was consumer-grade EMMC, which isn't the greatest out there for really anything from speed to reliability. That doesn't help. But another aspect is that you don't write to your flash like the car does. That's often a critical factor, since writing to flash is more intensive than reading from it (mostly unlike spinning disks). I'm guessing that many of the flash-based devices you have don't write a lot. Some may be powered off, some may not store much data and primarily use the flash to store the firmware, and some may not get used as often so they don't need to change so much data. The car's system will write to the storage automatically, including updates and entertainment data. When used consistently for eight years, that's a lot more writes than you'd normally find in other devices. Simultaneously, only 8 GB of flash is provided. While there's some more to handle hardware problems, that's a relatively small chunk to be constantly rewriting. I don't know the size of files that get written to that routinely, but given that the infotainment system which runs on that screen seems to have many features, it gets updates somewhat frequently to support them, and at least one of the features appears to be a navigation system with offline storage of some map data, I'm guessing it gets written a lot. If they also do things like storing logs there, that could be even stronger. I'm pretty sure they don't use it as a cache for autopilot images because EMMC is too slow for most of that.

Re: Your no-socket Powerbook might get replaced after 5 years

That's a bit optimistic. Now I'm biased, because I already had to replace one failing SSD in my primary laptop and now another one is failing, but still. There's a lot of writing that can't easily be controlled, and that will wear out storage. The more writing takes place and the less control one has, the more likely this is to become a problem. Depending on what people do with their computers, they can do some write-heavy things. Browsing, for example, often includes a lot of caching stuff to nonvolatile storage. Editing image or sound data also usually has a largish disk usage, depending on the editor in use, to support things like autosave with undo. And that's without including things that the operating system might do, like downloading an update, failing to fully get it, deleting the failed download, and going again. Then updating all the OS files from that update.

Disks wear. Whether it's an old mechanical drive whose moving parts have worn down or an SSD which is nearing its write limit, they can be expected to fail with more frequency than other components. For any sufficiently important system, there should be a plan for replacing them when that eventually happens.

The Novell NetWare box keeps rebooting over and over again yet no one has touched it? We're going on a stakeout

Re: Not a high bar.

I'm sure Dan knows that. Haven't all of us at some time worked for someone who isn't known for their IT prowess, doing IT? I have (note to employer, I'm not doing so now). All we can do in that situation is try not to make the reputation of the IT prowess worse; dreaming of improving it is often a wasted effort. Still, it doesn't necessarily mean that it's our fault. Put the wrong person in charge, have them ignore the people below, and you can take skilled techs and still make a mess.

Backers of Planet Computers' Astro Slide 5G phone furious after shock specs downgrade

Re: "Anyone wanna buy this bridge?"

To some extent, it comes from a desire for a product that nobody else makes and trust in a company that has successfully accomplished a product release before. In this case, for example, I would have had little doubt that Planet could make the product because they've already made two products which still exist. Not that I'd have necessarily liked the product if they'd made it, or that it would be identical in every detail, but I wouldn't fear losing my money in a scam. With a different company though, that would be a stronger worry.

You might as well ask though why anyone would invest in a risky venture. If you have money, why put it into a business which might fail, or invest it in a stock or bond which won't help much if the company goes bankrupt. In each case, someone is willing to risk that their investment may decrease in value for the chance that they'll get something better than their investment after waiting, whether that be a larger amount of money or a product they want.