Posts by doublelayer

AWS has been doing things that are 'just NOT OK since 2015,' says Elastic as firm yanks Apache 2.0 licence

What "free" means

Various companies have, in recent years, started to misunderstand what free software means. Yes, it means free as in freedom of speech, but freedoms like that are not small things. Those freedoms mean that I am free to use the software in any way I like. It may be in a way that the author doesn't like, but the author doesn't get to restrict me. That freedom gives the author various advantages, including a larger user base which will occasionally contribute to the code or donate money, but it also comes with downsides, like sometimes people use it and don't pay. The author can throw up some roadblocks, like not providing compiled builds unless people pay for them, but the entire point of the freedoms allows those who are willing to go to the effort necessary to use and distribute the code under those terms.

If someone wants to extract rent from all users of the software, they can write their own license terms. It becomes proprietary, since they are demanding extra authority to restrict usage to those who pay, but it's their code, so they have the right to do that if they want to. Doing that to code produced by others is at best an incredibly disrespectful move, and can be a license violation depending on how it's done. In short, don't give people freedoms you don't intend to honor, or they will hate you.

Loser Trump's last financial disclosure docs reveal Tim Cook gave him $5,999 Mac Pro, the 'first' made in Texas

Re: Can he keep it?

The section of the law that restricts this is the emoluments clause of the constitution, which is strict but limited:

"No Title of Nobility shall be granted by the United States: And no Person holding any Office of Profit or Trust under them, shall, without the Consent of the Congress, accept of any present, Emolument, Office, or Title, of any kind whatever, from any King, Prince, or foreign State. [...] and he shall not receive within that Period any other Emolument from the United States, or any of them."

So if a foreign government gave him something, he would not be able to keep it. If someone else gives him something, he can keep it. Gifts can be given to the government directly, and if that happens, he couldn't take it, but if it was given to him directly, he can. Of course, it doesn't end there, because there are laws about bribery (obviously this computer isn't a bribe but other gifts could be) and the lawsuits about foreign governments buying stuff from his businesses haven't been decided yet. But he can keep the computer.

Raspberry Pi Foundation moves into microcontrollers with the $4 Pi Pico using homegrown silicon

Re: Neither fish nor fowl

Excellent example to prove the point you argue against. The Model T is well-known because it was affordable due to efficient manufacturing. Not unlike the original Pi itself. It didn't necessarily do more things, but it had a serious point of competition where it provided a benefit to the consumer over previous cars. Other cars came out with different features, increased reliability, or even more affordable, and they succeeded. Usually, they needed some point of competitiveness in order to be successful cars.

The original question is just asking what this board's competitive edge is. It could be anything: "it does things the others don't do", "it does things the others do at less power", "it does the same things but it costs less", "it uses the same power but is faster", anything like that. And some of the advantages sound a little interesting, though perhaps not as differentiating as I'd hope. If it didn't have any advantages, then it'd be like many other cars you've never heard of, because everyone looked at them and decided to buy the Model T instead. It's not irrational to ask what the differentiating factors are if they're not evident.

Re: Neither fish nor fowl

I have to question this, since there are already several microcontroller-based education projects. I wonder if education is the foundation's primary goal with this board. When the original Pi came out, there was little competition in SBCs running Linux on low-cost components. Today, there are a lot of boards like it but as you said, the Raspberry Pi is still the one with all the tutorials and support. It therefore makes a lot of sense for the foundation to continue to create boards like that for the educational benefits.

In microcontrollers, however, there are a bunch of existing educational boards. From the early Arduinos to the MicroPython-focused ones to that weird thing the BBC made. I haven't yet seen what this does for education that those boards don't do. For those new to programming, most of those boards will be better since they include peripherals. An early programmer can blink an LED that's already on the board, then move on to breadboarding on some more. Or they can make a board that uses hardware which either comes on the PCB or can be attached conveniently so they get used to the peculiarities of driving hardware manually. The alternatives are usually much harder for someone new to programming, as they also have to learn to assemble the hardware and determine whether something is not working because the connection isn't stable or the code's wrong.

For this reason, I doubt this is for the same educational goals that the larger Pis are for. That doesn't have to be the foundation's only goal though, so this isn't necessarily a problem. Still, arguments that cite it as an educational board don't make much sense to me until I hear why it does the job better than the many tested alternatives in that space.

Re: What a shame they didn't go down the RiscV route...

Opening it to everyone would be the point. The original Pi didn't have to open every detail of the SOC since it was designed primarily for educating people about programming, Linux, and the like. But this is not really that kind of thing. The lack of ready-made IO makes it a different type of product than the computers they've built before, and while they undoubtedly expect some to buy them for entertainment or education, I expect they're aiming for industrial users. Especially as there are already a bunch of microcontroller-based boards which easily work for educating those new to coding; my favorites are Adafruit's more recent products.

This doesn't have to be a bad thing. The foundation may have focused on education, but they and we know a lot of Pis aren't used for that purpose. If they want to make a microcontroller that's primarily intended for industrial use, more power to them. Still, they have usually stood for openness of platform, and they designed their own chip this time. Had they used an open-source ISA, they could provide a lot of interesting details that would have served an educational purpose for those interested in the design of CPUs, while not impacting product quality. It's their decision, but I think that would have been a good one.

Signal boost: Secure chat app is wobbly at the moment. Not surprising after gaining 30m+ users in a week, though

Re: Because...

There are several mechanisms that can be used, each with dubious legality at best.

1. The mobile companies sell it to them. This is often not legal, but doesn't get investigated. Even the U.S. holds this to be illegal, but although it has been documented repeatedly, nobody with the authority did anything more than complain.

2. When a phone number and name are supplied to businesses, the businesses package up the data and sell it. "Brokers" purchase the databases, cross-reference for accuracy (or refrain from cross-referencing for size), and sell the result on. This is illegal under the GDPR, but may not be in other countries. It might get investigated in Europe if they ever decide to get moving on that, but the businesses which do it often don't advertise that and the people selling the databases are usually sketchy places which don't disclose their sources.

3. When a phone number and name are supplied to businesses, the businesses don't sell it to anyone but also don't secure it properly. Someone breaks into their system and leaks the data, and others find the leak, add the data into their database, and sell their database. As long as it's not them who did the hacking, they're on slightly better legal footing. Still, it's not exactly condoned, so they still stay low-profile.

Other methods of collection are available.

"How did a conversation talking about secure encrypted chats get derailed to talking about Android?"

Doesn't seem all that derailed to me, but the progression was like this:

1. Signal has some downsides.

2. XMPP lacks some of those downsides.

3. XMPP has multiple clients so may be harder for nontechnical people than Signal, which has one.

4. If you were going to choose one to recommend, that runs on Android, which would it be?

I don't see people talking about Android in any other sense than what software you'd run on it for secure comms. Since the conversation was already about software for secure comms, and since Signal runs on mobile devices, I don't see anything off-topic.

Re: Signal compromised?

Could it be this? A company claimed to have developed new ways to do something really easy, realized it was embarrassing, and took their own post down? The BBC repeated it incorrectly, so that might explain where you heard it. Seems to fit the admittedly few details in your recollection.

Re: It's been obvious for days

There is nothing stopping you from getting a PAYG SIM, register to Signal with that (which is when your unique identifier is generated) and then swap back in your regular SIM."

There are several things that could stop you.

"getting a PAYG SIM,": Some countries don't have a way to anonymously get mobile service. You have to supply identification when you do it. If you're hiding your identity, providing your ID on a second SIM may be an even bigger red flag for the automatic find-possible-person-of-interest database. Even if it isn't flagged, the number can be traced to you if they want to. That doesn't help you much does it?

"register to Signal with that (which is when your unique identifier is generated) and then swap back in your regular SIM.": This brings up several problems.

First, mobile companies usually collect IMEI numbers when you connect with a new SIM. You could then cross-reference those to figure out which numbers the device in question has been used with. While some of the time, a device will change SIMs because it's been sold to someone else, database entries indicating "Used number 1, started using number 2, started using number 1 again" are pretty conclusive about what you did.

Second, what happens if you have a number registered with Signal, someone else gets the same number because you've canceled the corresponding account, and tries to put that on Signal? I don't know, but I suspect something breaks. In order to prevent that, you might have to hold on to the number for quite a long time. That's inconvenient and could be expensive. I've been looking at how to keep a number reserved without using it frequently, and the companies usually want to charge me a maintenance fee or impose a "must use every three months or we cancel for you automatically" clause.

These things might not be dealbreakers. I use Signal, with my phone number, and I don't care whether people know that I do. They can't read my comms; that's good enough for me. Signal has to balance the concerns of people who don't think that with the difficulty of running a system without phone numbers as identifiers. If their decision is that they don't care, that's a viable decision.

On his way out, Trump emits exec order suggesting US cloud giants must verify ID of all foreign customers

Re: Was it Trump?

I'm afraid it doesn't sound sensible, or rather it does for the first thirty seconds, sounds pointless for the next two minutes, and then starts to sound concerning.

The first thirty seconds: people use this stuff to commit crimes, so why not identify who they are so it's easier to track them?

00:30-02:30: How is this going to help with anything? The order calls for U.S. providers to audit non-U.S. users. All an attacker has to do is to use a non-U.S. provider and they escape it. Or pretend to be a U.S. person and evade the required tracking. What happens if they use a U.S. provider's non-U.S. infrastructure? And how often do they tell the truth anyway; the really dangerous people will be able to lie through this system.

The rest: They want to require everyone purchasing IaaS services to create a government-auditable log of having done so. While the size of the group who will at some point do this is small, they want to be able to quickly get a full identity attached to any system. This sounds like a privacy nightmare, and rather like those governments who used to require licenses be purchased to own computers, phones, or televisions. While it might help with investigations, it seems more likely to increase the size of the NSA's database on everyone and to be a juicy target for people looking for valuable identifying information.

Indian government slams Facebook over WhatsApp 'privacy' update, wants its own Europe-style opt-out switch

Re: GDPR

"the government can't cherry-pick which companies can do whatever they like and which not..."

They can and they have. India recently banned several Chinese apps, either because they're creepy data collection efforts or because India is angry with China. They didn't make a new law to do that; they just listed some undesirable apps and told the companies to stop operating in India. They could always do that again. I wouldn't hold my breath though.

Scottish Environment Protection Agency refuses to pay ransomware crooks over 1.2GB of stolen data

"all malware starts by using JS to download and run the nasty,"

What? Wrong! Do you know how malware works? That isn't done often, and for a very good reason; it doesn't help with any of the tricky bits. JS from websites, where NoScript can block it, can't unilaterally run executables. It is sandboxed. If it can do something malicious inside a sandbox, it will. If it can escape the sandbox, it will try that too. Things like tracking users across sites using sneaky storage, exfiltrating stuff they type onto websites, stealing CPU time for cryptomining, redirecting them to somewhere dodgy, that style of malware. For those and only those reasons, blocking JavaScript on websites is useful.

Ransomware requires full access to the disk. Not even bad browsers give that kind of access. A JS-laden ad might redirect someone to a download link, but that could be done with an HTML ad too. And those approaches usually don't work as effectively as emailing the file or the link directly, which is probably what happened here. In fact, if you want a script system that is more often used to send malware, it would be Office macros (not JS). Every once in a while, there's a vulnerability like EternalBlue which lets one upload malware directly without any of that, but not using JS. Then, something has to be done in order to get the program running. Often, this involves getting the user to click through the OS's security features or bypassing them using a vulnerability. Since most such vulnerabilities use APIs of the operating system which aren't available to JS, JS is seldom used for such purposes.

If you think you are saved from malware by blocking JavaScript in your browser, you likely have a flawed understanding of most if not all the relevant concepts.

Re: The right attitude

"Once bitten the twice shy victim will be a harder target."

That's a possible outcome, but there are several others. For example, once bitten and it didn't cost much so they're not at all concerned about next time because they can afford to pay that ransom again. Queue the next time when the ransom is significantly larger. Even worse when insurance handles the payment because now they think of it as amortized in normal payments like all the other risks.

Or the client who pays the ransom to keep data hidden and doesn't realize that the criminals can come back any time to request a top up since there's no way to know if the criminals have destroyed all copies.

People sometimes get complacent about their ability to handle a risk if they've done it before. This is yet another problem with ransom payments.

Back to the office with you: 'Perhaps 5 days is too much family time' – Workday CEO

That's an option, but some companies like to adjust payment when people move to cheaper places, so the same amount of money would become a larger fraction of total income. Logically, the company shouldn't care as long as the people work at the same level, and the people would probably work more efficiently having gotten better sleep and more time to focus, but companies sometimes see a reason they can justify paying less and they take it.

"I tend to use the same words with my mouth-hole as I do with my tappy-hands,"

For efficiency, talking to someone can prevent you having to use all those words. If they already understand something, you can skip it rather than having them skim through text which doesn't tell them anything new. If they're confused by something you said, you can rephrase immediately. If they have specific questions that are more important, they can suggest that you restructure your address so you cover those things earlier or in more detail.

Take an email I recently sent, describing the performance of a system. I told the recipients that, in the interest of reliability of my measurements, I had tested the code repeatedly and reported average, median, and extreme values for the time it took to run. However, one of the recipients got confused based on the word "reliability", interpreting it to mean that the code itself was unreliable, either crashing or producing incorrect answers. This led to a second email where I clarified what I meant in a diplomatic fashion and provided even more numbers to confirm that the code always completed and produced the same results given the same inputs. My colleague also added an email of his own to ensure them that we had a large set of tests to confirm the stability and correctness of the code. I think that misunderstanding could have been resolved in about thirty seconds of conversation, because they could have said "What is unreliable about the code?" and I could have said "I see. The code is reliable. A better term would be sample size of time measurement. I'll use that for the rest of this conversation.".

Epic Games files competition lawsuit against Google in the UK over Fortnite's ejection from Play Store

Re: They want a free ride

Yes. The license for Google Play Services. Google charges manufacturers for these, and also requires that they refrain from installing any other variant of Android. It benefits Google in two ways: they get money off Samsung for the code and they prevent competitors from building around AOSP. Both give them plenty of cash. That's quite a healthy revenue stream.

Physical stores are not comparable. Some of the reasons are explained in the first reply to your post, but one other reason is simple: the people selling products to the stores can decide not to sell there and sell somewhere else. On IOS, that's not an option. On Android, it's not a realistic option. That is one reason this discussion is happening, because there is a lot of competition for physical stores, but next to none for Google Play and none at all for Apple's store.

Re: They want a free ride

When did I say that. I pointed out that they have a revenue stream for that stuff. It's from users. Who buy devices. Google and Apple get large chunks of profit every time someone does that. Google also gets revenue chunks when companies design new phones and licenses Google Play Services. The APIs you're talking about are earning Google money, and they only do that because app developers make them necessary. Without developers, the APIs in question would not earn Google money. As for Apple, they also charge every developer an annual fee for things like this.

You are saying that, regardless of any other revenue stream, any money that is collected must be necessary for development. The large profit margins demonstrate clearly that they could lose revenue without having to cut spending on development. Given that, the discussion then needs to consider fairness, which is what we could get to if you would stop telling me that anything and everything they do must automatically be justified because I, or rather mobile app devs which I'm not really, owe them so much.

Re: They want a free ride

"so Google and Apple make $0 for the billions in investment creating the platform"

Wrong. They get money from hardware sales and software licensing. You know, from the people using all the stuff in the platform? The people who write apps aren't using very much of that platform; it's the users who are. People who write apps don't much care whether the built-in email client works or not. I do. The money for the upkeep of that app and all the other ones comes from the money paid for those things, which is embedded in the sale price of any phone using Googled Android or IOS. In addition, app developers are the main reason the platform has value. Without third-party apps, these platforms aren't so useful. The ones that had nice design but few or no app devs, well most of them aren't around anymore.

"and developing the distribution infrastructure."

Oh, yeah. The thing that has to respond to three requests: search, information page, download app? Extra feature of payment management, which if the developer uses it cuts the store in? Which gives the manufacturers a ton of power over what people download? I can see why they need to be rewarded for that. It's not like someone else might have implemented that independently using basically no resources.

Security fears, but not the ones you meant

"Epic also wants "an order requiring Google to remove or amend the technical restrictions to ensure that [...] those apps/app stores are able to operate in the same way as the Google Play Store with respect to app installation, app updates, and access to operating system features," something likely to ring alarm bells among Android security watchers."

Yes, it does ring alarm bells. The alarm is because Google has, to enhance its own store, poked holes in Android's security model for it to use. There's the anticompetitive aspect of that, which I'd expect to appear in investigations in the near future, but also the risk that someone could find a way to abuse those holes by impersonating Google Play. Unlike other ways to download apps, Google's doesn't have to negotiate to get the required permissions or prompt the user before making changes. Those prompts aren't just security theater or notices so users stay alert, they're also the best opportunity to spot something nefarious and prevent it getting started. A good solution to this is to lock down Android so that any method of installing apps has to go through rather than around the security model. This would apply to FDroid, Google, the manufacturer, the carrier, and everybody else.

Apple reportedly planning to revive the MagSafe charging standard with the next lot of MacBook Pros

I suppose we must live in different worlds regarding phones and laptops; I see phones charging, but usually from short cables which aren't stretched across rooms. The long easily-tripped-over cables I see are almost universally attached to laptops. Maybe it's just the buildings I spend time in. My other points for the why not on phones issue remain, though.

"And 'endemic' obviously means something different!"

I'm not sure what you mean by this. I didn't use the word endemic; you did. I just quoted you. I interpreted it to mean something along the lines of "prevalent" or "common". Did you mean it differently? My response was written for that meaning, and having reread your comment, it still seems to be the most logical meaning in context to me. You said the issue wasn't endemic, I counter that it is quite common.

What worries me is after the original handshake. If the magnetic connector doesn't support the 65W my work laptop expects, it might specify that and refuse to work, which would be acceptable, or it might not have that functionality and try to pass the voltage through until something burns out, which wouldn't. I don't know for sure what would happen, which is why I have to test it, but I'm afraid given the many manufacturers that there will be some unreliable ones out there which could cause a safety or destroyed equipment issue.

"Think about it, though: if the problem was as endemic as is implied,"

It is, and most of your questions have obvious answers.

"why don't other vendors come up with alternatives?"

They do. Microsoft's Surfaces use a magnetic charger for the same reasons. They're not the only ones who have done so. The primary reasons that companies choose not to do it are backward compatibility (E.G. most Dell business laptops used the same size barrel adapter before they adopted USB-C) or patent fears (Apple's sued people before for similar connectors and everyone was expecting them to do the same to Microsoft but it didn't happen).

"Why hasn't Apple put it on their phones?"

Two reasons. First, phones aren't usually as likely to have the problem. The reason is that phones have batteries which generally last longer, so people are rarely seen at a table, working on the phone, with the phone plugged in. Laptops do have that more often, so they need the protection more. Second, phones are already expected to fall more often, which is why people often put their phones in cases. Because they're small, easily dropped, etc. they've been designed for abrupt falls more than laptops have. It's usually less of a problem if a phone falls to the floor than if a laptop does so.

"(I previously mentioned my LG phone with a magnetic USB adapter)."

Which is useful, as is wireless charging, because they reduce wear on the charging port. Magnetic USB-C cables do exist, and I need to buy one to see if it can withstand long-term high-voltage charging. I'm afraid that they're not designed for that and will fail in a laptop where they wouldn't in a phone.

"Why don't the business laptop vendors (Dell, Lenovo, HPE, etc) address the issue you describe by making the power socket easily replaceable?"

Why don't they make the hard drives easily replaceable? Or memory? Or WiFi cards? The usual answers are that they can save themselves money, produce a thinner machine, and so on. Also, few of their customers are planning to resolder a power port anyway, so they probably figure they don't have to worry about the issue costing them customers. If it leads to a faster replacement cycle for the laptops, I doubt they'll complain.

The cables that look the same but are not is a really important issue. Have an upvote.

I don't buy new equipment all that frequently, so I've still got a lot of stuff not on USB-C. Those things I do have though... I have a laptop from work with a USB-C socket for charging. It comes with a power adapter for it. I have a portable device which also charges via USB-C. Its charger can't charge the laptop because it doesn't produce enough voltage. Fine, no surprise there. However, the cable which connects to that weak charger doesn't appear to be able to charge the laptop when a proper power supply is placed at the other end. I don't know why. Also, this is one of the few cables I have with USB-C on both ends, but I don't know whether it carries data at all. Also, there are cables which work with Thunderbolt and ones which don't. The Thunderbolt ones are supposed to have a logo on them somewhere. So perhaps one can determine which kind they have if they have a magnifying glass on them, but in reality, the cable that fits the port gets used and people generally won't find out that it's causing the system to run slow until they've experienced a lot of pain.

If USB-C is to be our one standard, I suggest we force one standard on all the people using it. It goes something like this:

1. All cables carry data. No cable will ever be produced lacking data pins. If we find a cable you've manufactured which lacks the data lines or in any other way has data intentionally disabled, you will lose your license to produce USB cables and we tie all the power-only cables at ankle height around your office before killing the lights. If you wish to produce cables which don't carry data for security reasons, you probably don't need to, but we'll accept cables with a switch on them which cuts them.

2. All cables with USB-C on one or both ends will be able to carry power at 5 V and 3 A. They should be able to do more, but nothing less than that.

3. Any wall adapter with a USB-C socket must be able to provide power at 5 V and 3 A. This holds whether the device they're shipped with uses that or not. If the device only uses 1 A at 5 V, the adapter still has to be able to produce 3 A if called upon to do so.

4. If a device uses USB-C to power itself, all the USB-C sockets on it will work to charge it.

5. All devices with at least one USB-C socket have to state in their documentation if not written on the device itself whether the sockets are data-only, power only, or data and power.

6. All devices using USB-C to power themselves must state in their documentation if not on the device itself the voltage and current required to charge them.

I'm sure there are more necessary rules. Without them, we have the situation we had before, with cables that only work on some machines and you might have to get an unusual one if yours breaks, but now they don't even look different to make this clear.

Facebook tells Portuguese court that a biz called Oink And Stuff makes profile-harvesting browser extensions

And using a subsidiary based in Ireland. I mean, we have to list all the countries that have nothing to do with Portugal so we can get the full effect of the "Why?" feeling. Maybe they've got servers there or something? Facebook's going to have to provide a good reason when the courts start to read their complaint.

Xiaomi hit by US sanctions: Can't list on stock exchanges and investors can't invest

Doesn't really make sense

The targeting of Xiaomi doesn't make as much sense as other companies do. I don't agree with the banning of Huawei because each time public information gets released, it paints Huawei as a place which writes crappy code but not a place which backdoors the equipment it sells. Still, I can conceive of a justification for its ban. The hardware it makes does go into the backbone of a critical resource, and if someone could disrupt, intercept, or disable that resource, there would be big problems. If someone knows that Huawei has capacity to do those things but doesn't want to tell us, it could make sense that you'd have to ban it. I'd like to see the evidence, though.

Xiaomi doesn't have that justification. They don't make infrastructure; they make consumer electronics. Sure, their electronics might come with malware on them, but so could any other company's. If there is a risk of malware-laden Chinese electronics coming into a country, that country would likely have to ban all the companies' imports, not their shares. There appears to be little or no justified security concern, which makes previous bans dubious as well. If it's a trade war they want, they should just do it the normal way, with broad tariffs. Doing a trade war by picking victims and turning the cannons on them alone is not only strange and erodes trust, but it probably isn't going to do all that much about the problems people have with the trade relationship either.

Dratted 'housekeeping', eh? 150k+ records deleted off UK’s Police National Computer database

Re: Backups

They were deleting after three years*. That's not GDPR. That's other regulations. Specifically, it appears to be from the Protection of Freedoms Act 2012. At least the biometric information is covered there. That is what the article talked about, but there's other information the police get, such as full images of computers and phones which they like to extort out of victims for reasons I don't understand. I'm not sure where that's stored or which laws the police use to set the data retention policy for that.

*Well, they claim to delete after three years.

Re: Backup system destroyed by Fire

"If the backup system has been replaced and is operational, what's the point of mentioning the fire in the story?"

Some options:

1. It demonstrates the age of the system I.E. "it was around in 2005 to have this happen".

2. It demonstrates that the operators are likely to have backups I.E. "we know they had backups in 2005, so they probably have them now even if they don't give us the details".

3. It demonstrates that there has always been a problem with maintenance of this system I.E. "as far back as 2005, it's been known that recovery will be difficult".

4. It is intended to suggest that the police should have learned by now I.E. "they should have learned in 2005 that massive data loss events will happen and built a faster recovery system accordingly".

5. It is intended to suggest incompetence I.E. "at one point, they built their backup system near a place that can explode. Who knows if they've done something as risky now".

6. It's an interesting event that happened, and they think the story might intrigue the readers.

More options are available.

Re: Backups

The article says that they're recovering. Distributed or not, it sounds like they have backups. Maybe it will take some time to restore them, but I doubt any data has really been lost. Just a bunch of headaches getting it back into the database.

Watchdog urges Tesla to recall 158,000 Model S, X cars to fix knackered NAND flash that borks safety features

Re: plugs Great

Not really true. Depending on the location of the phone or camera, it probably has more padding insulating it from shock, whether that be a protective case for the camera or your leg if your phone spends its time in your pocket. SD is a bad idea for a number of other reasons though, which I've just posted about. The short version: not good for lots of rights, can't predict failure, not easy to confirm reliability, and NEVER make it feasible to remove something safety-critical while the system is running. Reservations about SD as an option aside, the storage should certainly be replaceable.

Re: Great

"I'll bet they wish they had built a microSD card slot into the bezel of the infotainment system."

The storage should definitely be swappible, but never like that. It shouldn't be easy to accidentally take the storage out, and it really shouldn't be feasible to take it out while driving. Similarly, consumer-grade EMMC inside the dashboard isn't great for reliability, but if you wanted to see what significantly worse looks like, trusting SD would be a good way to get there.

I would instead suggest a container for a storage device which is modular but installed beneath the screen panel. Users who are knowledgeable enough can get to it by disassembling the car, but nobody will accidentally take a card out of the display thinking they must have put it in a while ago. That also makes it possible to insulate the storage device from shock, temperature, and other possible damage. While specifying this storage system, the manufacturer should ensure they use storage which supports a SMART-style health check so they can warn the drivers to get it replaced. If they want to be extra careful, they could have the module include two mirrored disks so not even a relatively rare unpredicted failure can crash it. Even requiring all of this instead of a basic EMMC module wouldn't change the price all that much, and the service center could probably charge the driver for the replacement part instead of being forced to replace it at their expense when it causes a safety issue.

"So what's the deal? Have I just been lucky, or has Tesla cheaped out on the components in its cars?"

A little bit of both. The storage was consumer-grade EMMC, which isn't the greatest out there for really anything from speed to reliability. That doesn't help. But another aspect is that you don't write to your flash like the car does. That's often a critical factor, since writing to flash is more intensive than reading from it (mostly unlike spinning disks). I'm guessing that many of the flash-based devices you have don't write a lot. Some may be powered off, some may not store much data and primarily use the flash to store the firmware, and some may not get used as often so they don't need to change so much data. The car's system will write to the storage automatically, including updates and entertainment data. When used consistently for eight years, that's a lot more writes than you'd normally find in other devices. Simultaneously, only 8 GB of flash is provided. While there's some more to handle hardware problems, that's a relatively small chunk to be constantly rewriting. I don't know the size of files that get written to that routinely, but given that the infotainment system which runs on that screen seems to have many features, it gets updates somewhat frequently to support them, and at least one of the features appears to be a navigation system with offline storage of some map data, I'm guessing it gets written a lot. If they also do things like storing logs there, that could be even stronger. I'm pretty sure they don't use it as a cache for autopilot images because EMMC is too slow for most of that.

Re: Your no-socket Powerbook might get replaced after 5 years

That's a bit optimistic. Now I'm biased, because I already had to replace one failing SSD in my primary laptop and now another one is failing, but still. There's a lot of writing that can't easily be controlled, and that will wear out storage. The more writing takes place and the less control one has, the more likely this is to become a problem. Depending on what people do with their computers, they can do some write-heavy things. Browsing, for example, often includes a lot of caching stuff to nonvolatile storage. Editing image or sound data also usually has a largish disk usage, depending on the editor in use, to support things like autosave with undo. And that's without including things that the operating system might do, like downloading an update, failing to fully get it, deleting the failed download, and going again. Then updating all the OS files from that update.

Disks wear. Whether it's an old mechanical drive whose moving parts have worn down or an SSD which is nearing its write limit, they can be expected to fail with more frequency than other components. For any sufficiently important system, there should be a plan for replacing them when that eventually happens.

The Novell NetWare box keeps rebooting over and over again yet no one has touched it? We're going on a stakeout

Re: Not a high bar.

I'm sure Dan knows that. Haven't all of us at some time worked for someone who isn't known for their IT prowess, doing IT? I have (note to employer, I'm not doing so now). All we can do in that situation is try not to make the reputation of the IT prowess worse; dreaming of improving it is often a wasted effort. Still, it doesn't necessarily mean that it's our fault. Put the wrong person in charge, have them ignore the people below, and you can take skilled techs and still make a mess.

Backers of Planet Computers' Astro Slide 5G phone furious after shock specs downgrade

Re: "Anyone wanna buy this bridge?"

To some extent, it comes from a desire for a product that nobody else makes and trust in a company that has successfully accomplished a product release before. In this case, for example, I would have had little doubt that Planet could make the product because they've already made two products which still exist. Not that I'd have necessarily liked the product if they'd made it, or that it would be identical in every detail, but I wouldn't fear losing my money in a scam. With a different company though, that would be a stronger worry.

You might as well ask though why anyone would invest in a risky venture. If you have money, why put it into a business which might fail, or invest it in a stock or bond which won't help much if the company goes bankrupt. In each case, someone is willing to risk that their investment may decrease in value for the chance that they'll get something better than their investment after waiting, whether that be a larger amount of money or a product they want.

Re: Peak Planet

They don't have to release new Android versions, but if the 2018 figure means security updates, that doesn't take so much effort. They can use a lot of the same code that gets made available because it doesn't do anything to their keyboard or custom hardware. After all, custom ROMs seem to be able to do that without much difficulty, and they usually don't get paid to do so. A manufacturer which doesn't do that gets sent down my list of trustable ones. One who advertises to tech-literate people and still doesn't do it gets themselves a nice hypocrisy debit as well.

Re: My friend backed this

I disagree entirely, though I didn't back this phone. The reason is that this was supposed to eventually also have Linux on it. A processor can be quite important if it's running a desktop OS and potentially intensive software on it. Unfortunately, Android can also be CPU-hungry, especially if they don't have Lineage OS or a similarly trimmed version.

Meanwhile, 6 GB of memory is, in my experience, fine for a lot of phone tasks since it doesn't need to multitask as much as other machines. Opinions will vary, but many have devices with 3-4 GB and rarely use that much. Also, backers knew they would have 6 and presumably were fine with that since they chose to back at that level. Other improvements, such as a better camera, are meaningless to me; if it has a camera, it's probably fine for the few times I will use it in its lifetime.

I would be unhappy with this change in specifications if I had backed it.

Re: They need to clarify...

But the question is why a U.S. tariff and mainland Chinese retaliation should change the negotiations between a Taiwanese company and a British one. If China put a tariff on Mediatek to punish Taiwan for having companies which got restricted by the U.S., it wouldn't really make much sense because a lot of Chinese phone manufacturers use Mediatek SOCs heavily. Also, I think we'd have heard of the tariff. But even if they did that, the restriction would likely be on Chinese purchase of the chips. Or, if Mediatek agreed to make things harder for American manufacturers so China wouldn't do that, there'd be problems between Mediatek and American clients. Planet is British. Why would either Mediatek or China want to do anything to the British to retaliate against American tariffs? If they did want to, they'd be able to make it happen, but it doesn't make sense given the current state of relations between Taiwan and the UK.

We didn't collude with Twitter to throw Parler off our servers, says AWS in court filing

Re: What about places that hinders me to enter if I don't abide to their rules?

"So if Facebook, for example, decided to only one side of any story/news item so as to direct the narrative you're ok with that? Can't have it both ways."

I think I can. I view that as their right to do, as it's the right of any terribly biased media source to do. I am not happy about it though. I'll complain. If I have the ability, I'll try to convince them to change their policy. Then again, I'm already unhappy about their data collection, and I've complained, and I've refused to set up an account, and that's not had any effect on their policy. Still, I'd try.

Re: What about places that hinders me to enter if I don't abide to their rules?

Leaving the rest of your comment aside. I only want to respond to this chunk:

"Surely you agree that all competitors in the social media market should follow the same rules on free speech?"

No, I don't. Social media companies, like other companies, are private entities. They should have the ability, should they choose to use it, to decide how they want their system used. If that means no discussions or pictures of cats because that's so last decade, then they can make it the no-feline-content zone. If that annoys the users, then that's a commercial failure; they probably won't be mourned. In terms of monopolistic behavior, I want to limit social media's influence in such a way that they can't prevent the creation of alternatives. So if Twitter started to buy the internet so I had to abide by their rules everywhere, I'd have a problem. If the only place I have to abide by Twitter's rules is Twitter, I view that as their right. If I don't want to abide by Twitter's rules, I find or create an alternative and go with it.

The same rights apply to any other company which makes something that I use but doesn't sell that thing to me, only allowing me to use it under a contract. A rental property may tell me that I'm not allowed to make loud noises at night. A rented car may come with a contract telling me that I must not drive it too far away from the place I'm going to return it to. A cloud server company may specify that I'm not allowed to mine cryptocurrency on a shared CPU. None of those things are required because they're against the law. They're required because the company owns the resource and I don't and they have specific conditions under which they're willing to let me use their thing.

Under that pile of spare keys and obsolete cables is an IoT device: Samsung pushes useful retirement project for older phones

Re: An option to turn them into security cameras would make this really popular

There are already ways to make a phone relay its camera to something else, so you could already configure that. It would involve some work on the system which takes the video from the phone and makes it useful, but that's the same problem you get with any other camera. The problem with a phone used for this purpose is that they're usually not so designed to be taped up outdoors. Even the ones sealed for water resistance aren't expecting long-term exposure. Anything on the outside of the building is likely to be exposed to sunlight, solar heating, cold not often seen indoors, and precipitation. The hardware may not enjoy those conditions, and at least two of them have been known to create battery problems.

How I found a bug in YouTube that let me watch private videos I wasn't allowed to, says compsci student

The black market may add that premium, but it's a lot easier to sell something to the black or gray markets than it is to sell a knife to a murderer, and if you're prone to rationalizing, there are people who might use an exploit purchased on the black market for purposes you don't consider evil. For example, there are people who will pay a lot for IOS exploits. Some of these are creepy companies or governments who want to break into citizens' equipment, but another category is people who want to jailbreak. So Apple probably has to offer quite a bit of money to compete not only with malicious people willing to spend a lot of money, but also people who aren't as unsympathetic. Another reason it's different is that selling an exploit isn't illegal unless you know or have a strong enough suspicion that it will be used for illegal purposes. Using the same example, it's not illegal to jailbreak a phone, so it's not illegal to sell an exploit to people who will use it to jailbreak a phone. A lot of ethical researchers will never consider selling exploits, but there are many researchers who might not mind so much. Companies who don't want to see others with the exploits would be well-advised to consider price competitiveness.

Linux developers get ready to wield the secateurs against elderly microprocessors

Re: People still make these older CPUs last I checked...

"doing 32 bit stuff is always faster then doing 64 bit stuff on the same computer, simply because you are moving half the data."

Er ... no. Not at all. Everything's the same size, so you don't move any more data. Only for pointers do you need to move more data, and it's a load using a single register, so it's not really any different there either. Crucially, your strings, byte arrays, integers, and floats are the same size. And, as I pointed out, some of those things can be processed by a single 64-bit operation when they couldn't be processed by a single 32-bit one. Fewer instructions to do the same thing speeds you up unless someone's been fiddling with the microcode.

Re: People still make these older CPUs last I checked...

The 286 was discontinued in 1991, and even if "early 90's" means 1995, that's only a four-year gap. I can buy a processor that's four years old and do much better than a 486. A lot are ARM-based, but I could use MIPS boards, Intel Atoms, even some newer RISC-V options. Or I might canibalize someone's old computer they asked me to recycle for them. I'm not even sure where I'd get a 486 today, and no clue why I would want something with that performance-to-power level.

SpaceX wins UK regulator Ofcom's approval for its Starlink mobile broadband base stations

Re: Optional

The "for free" is because people keep assuming it's going to be used to connect very much underdeveloped areas. And no, that doesn't include the United States, even in a disaster. It includes places where people have little access to electricity, let alone communications. No wires to carry the signal, so satellite would be the fastest way to get connection there. That's what people always say is the main reason I should accept this system; it's a humanitarian dream, connecting all the world together to lift everyone from ignorance, bringing education to those who can't afford what I have, yada yada. That dream is great. If they did it, I'd be very happy and I'd give them all sorts of licenses so they could get it done. I might even buy the more expensive service to make it easier for them to give the hardware to people who can't afford it.

They aren't doing that. They haven't even started to talk about any of the gnarly issues involved in doing that. Some nice chunks of speeches have mentioned it, and bunches of people online parrot back the arguments. I would like those who do so to realize that I don't believe they're going to actually realize any of those dreams, and I'll need proof. Until I get it, I can't give them any credit for humanitarianism and consider it only as a commercial product. As a commercial product, it has negative externalities that make it harder to swallow. The balancing positives need to be proven to me and likely to others before we would stop our objections.

Apologies for the wait, we're overwhelmed. Yes, this is the hospital. You need to what?! Do a software licence audit?

Re: Really??

Nobody says they should get the software without payment. They say the audit to make sure they didn't steal it should be postponed. Keep in mind that the hospitals are already paying for a bunch of licenses, so the companies are already getting quite a bit of money. I trust hospitals enough to pay any additional license fees, and I also trust them to have already done so in most cases. The audits are the difficult bit, and now is a really bad time to make people do that when those people are also saving lives.

As I see it, the companies have a couple of likely options. They could voluntarily relax their auditing requirements now and get a nice press release about it. Or they can not do that, get a bunch of stories like this printed in papers with a higher readership, and take the risk that people hate them. Or keep doing it after that and take the risk that a law is passed forcing them to relax their audit requirements, but no nice press release. Only one final option works out better for them, which is to hope that nobody else cares enough to write about the problem. Doesn't strike me as likely, but people ignore a lot of problems, so it might work.

Somehow, I think the hospitals will probably be trustworthy enough to state the number of licenses they used later. That's always assuming the license system allows them to increase their usage without asking for payment anyway, and if the licensing model says they have to pay per computer, the software will likely enforce that. More importantly, the audit itself is going to cause a lot of problems for the hospital, while the theoretical delay in payment will probably be a drop in a bucket for a big software company who already gets paid for existing licenses. If they want to fight in the court of public opinion, it will end badly for them.

Re: In the peak of an epidemic

I was assuming that the people doing the audit were doing so remotely by sending lots of communications to the staff and demanding information about the network and machines running the software. If they did show up, there are all sorts of unpleasant things that could befall someone willing to endanger others when it's not necessary. I'd especially enjoy mistaking them for a cleaner and sending them to the least pleasant section, having previously informed all the staff in that area to be very busy if they have the miracle of not already being so and never acknowledge the questions of the new cleaner except to prevent them from leaving and occasionally reprimand them for not cleaning. Maybe it's a good thing I don't work for a hospital.

Parler games: Social network for internet rejects sues Amazon Web Services for pulling plug on hosting

Do the anti-shutdown-Parler contingent not know what free speech is?

Here's a hint. It means the government doesn't get to prevent you from talking (limits apply). It doesn't mean that I have to give or sell you any resources to use while making your speech. So long as the government doesn't name you and say you can't speak, or name you and ban me from selling stuff to help you speak if I want to do so, the government hasn't breached free speech laws. If I independently decide that I'd rather you not speak, and I'm going to refuse to help you speak, that's my right as well.

So, given this definition, let's review who did anything against Parler's speech. It's Amazon, Apple, and Google. These are not the government. They're not doing it because the government said so. There's a reason the lawsuit is trying to make an antitrust claim; free speech doesn't apply to cloud services vendors. You want to make a point about that, go ahead. Rabbiting on about free speech when the government hasn't restricted speech only proves that you're missing the point.

Better battery, LTE and a removable SSD in Microsoft's Surface Pro 7+

Re: Swappable SSD, but standard?

I thought the same thing when reading it, possibly because I'm currently considering whether to buy the custom SSD to repair an Apple laptop or just put it aside for later. I really hope they haven't done that, and I've misread things like this before, but hopefully there will be extra details about it somewhere. I looked around for someone who bothered to ask this question when they got the press release, but all the news articles I find just say "replaceable" with no more detail.