Posts by doublelayer

US backs down from slapping import taxes on French goods over Macron's web giant tax

Re: Unfair?

"So paying taxes on the money you make is unfair now?"

The American argument is essentially that it's legal for other countries to set tax laws that apply to everybody, including adjusting them to charge more for large companies, but that France's law is targeted specifically at them. The argument would therefore be that France should change its general tax legislation to remove the loopholes that result in a lower tax payment from the companies concerned, rather than creating a new type of tax which has limits placed on it such that only a specific set of companies have to pay it. I'm not saying this argument is a good one, but it is what they're using, and the current trade rules appear to at least somewhat support them; basically every company which qualifies for the digital services tax are American, and it can be argued it's effectively an anti-American tariff.

The suggestion to implement taxes of this type by simplifying tax law so it's harder to avoid is a persuasive one, though politicians rarely want to go to that effort. In my opinion, such modification is better than a tech-tax whether you subscribe to the U.S. argument or not. The reason is that a sector-specific tax doesn't fix the problem for any other company which is avoiding paying its tax in a method the citizens dislike, so if the avoidance problem can be resolved by making it harder to avoid, it is likely to increase tax payments across the board without needing frequent patches to target particular offenders.

Pizza and beer night out the window, hours trying to sort issue, then a fresh pair of eyes says 'See, the problem is...'

Re: Doubtless with the assistance of a baseball bat peppered with rusty nails.

True, as offenses go, this is relatively minor and doesn't deserve that much punishment. That said, "major changes to config file, don't check it for viability, send directly to production, go home" is a bad enough mistake to require some unpleasant talks about how that's never going to happen again.

OpenAI touts a new flavour of GPT-3 that can automatically create made-up images to go along with any text description

"I'm just thinking about the kind of work that I could do if the a database of all of human knowledge was directly interfaced with my brain as though it was part of me. Imagine having intuitive access to that."

I'm imagining you with a phone embedded in your head. All you have to do is to think of something and you'll quickly get a search of all the stuff written on it. Most of which tells you information you don't need, a lot of which is wrong, a lot of which is designed to convince you rather than inform you, some of which includes what you want to know but is written in a way that you don't find it, and some of which includes what you want to know but you can't understand it.

Also, how is this getting us anywhere closer to the singularity, for that's basically what you're asking for? All this does is cut up some images and put them together to attempt to correspond to a label. The model doesn't understand what any of these objects is; it only understands what they look like, and that's being generous. I can give you that too, and I'd not be using AI either. If I just tag a bunch of sections of pictures "this is a chair", "this is a piano", "this is a dog", I can get a program to read your sentence and paste them on top of a background "this is a living room", "this is a street", "this is a lake". What this program does is cut out my labeling process by taking a bunch of chair pictures and determining automatically that they're mostly chairs, but it needed someone to write that label to figure that out. It shows effort on the part of the programmers, people who write image captions, and the willingness to spend a lot of computing time building a model, but doesn't really help in the creation of an intelligent computer.

United States Congress stormed by violent followers of defeated president, Biden win confirmation halted

Re: Unfortunately ...

"our Constitution only provides for that charge in times of War."

I don't think that's entirely true, and because I'm in need of distraction, I'm going to overanalyze why I think that. You can probably skip this when you get bored.

The relevant part of the American constitution reads as follows:

"Treason against the United States, shall consist only in levying War against them, or in adhering to their Enemies, giving them Aid and Comfort. No Person shall be convicted of Treason unless on the Testimony of two Witnesses to the same overt Act, or on Confession in open Court. The Congress shall have Power to declare the Punishment of Treason, but no Attainder of Treason shall work Corruption of Blood, or Forfeiture except during the Life of the Person attainted."

So it appears that treason has two definitions, neither of which includes anything like "in time of war". I'd argue that one of them at least implies war: "adhering to their Enemies, giving them Aid and Comfort", but you can have enemies without having war with them, or you can have enemies with whom you can't be at war in the international law sense because the enemies aren't states. But fine, I'll restrict this to define enemies as countries the U.S. declared war on. Somehow, I think people would define it differently if someone was being charged after working with a non-state organization which wished to destroy the U.S., but we'll leave that alone.

The reason I can do that is that there is another option listed there: "levying War against them". Once again, we have a word without a clear definition. War could mean a state of war declared by a recognized country, but I don't really think that's an honest description of how it's used. Let's try a dictionary. While it includes "Organized, large-scale, armed conflict between countries or between national, ethnic, or other sizeable groups, usually involving the engagement of military forces.", it also includes "Any conflict, or anything resembling a conflict.". It appears the dictionary isn't going to help much in getting a firm definition of what is and isn't war.

Let's instead try history. What have generally been called wars? The traditional country-fights-country things, of course, but several smaller things too. Civil wars, which don't involve a declaration of war since each side considers the opposition government at least illegitimate and often beneath consideration. Wars which didn't have a formal declaration (Korean War, Iraq War). Campaigns involving smaller wars (war on terror). Not to mention that it's also frequently used by people who aren't governments (I.E. "we are at war with [something they don't like]". If these are wars, then perhaps "levying War against them" is easier than it seems. Maybe even saying that you intend to be at war with the U.S. is enough. Maybe an act similar to one taken in a war is enough. On that basis, a violent attack on a government institution might be sufficient, as that's certainly enough to start a war if a country did it and has certainly started an armed conflict when a group of people did it.

I'm done now. I think the original interpretation is incorrect. I need to sleep.

Welcome to the splinternet – where freedom of expression is suppressed and repressed, and Big Brother is watching

Because it takes a lot of time, and they don't need to. They just need to have the ability to do it if they want to.

China doesn't need to cut their people off the internet if they have the ability to block things they don't like. In an emergency situation, they can do so without affecting the rest of it. Meanwhile, they get the benefits of being on the internet, such as the international markets, access to stuff produced elsewhere which isn't political, etc. China doesn't need that access to survive, but while it's harmless, they'll take it. If it should ever become harmful, they'll block it. Even if at some point they decided the entire non-China internet is harmful, they now have the ability to cut it within an hour.

Re: "It controls the military completely"

Pronoun, antecedent identified incorrectly. -1 points.

"In China, the Communist Party runs the show. That makes tight control of the internet not only possible, but advantageous. 'It controls the military completely. It controls information networks. It controls political perception. It controls the media. It controls the economic design of the country,' Ghosh points out."

"It" does not refer to the state. "It" refers to the political party. A state's military should be part of the state, not of its ruling political party. Be careful with pronouns; they can lead you to incorrect conclusions.

Re: Explains why P2P networks are getting so popular

A network that only has a small number of participants on it because it's really difficult to get on it self-selects the population who is interested in anonymity and capable of using complex tech. All a dictatorship needs to do is identify the small set of people joining that network to have a wonderful list of dangerous elements who need some reeducation. Only if there is some way of hiding in the crowd can that be avoided. Your network which has high barriers to entry is harming you, to say nothing of how it makes any plans you have weaker. If a hundred cryptography experts agree that a protest is needed, it will mean a hundred dead cryptography experts. If a hundred thousand people, most of whom are not cryptography experts, agree because they're all able to coordinate, there's much more chance that something less deadly happens.

Unless you live very close to people, the hardware we have doesn't make it easy to participate in a mesh network. An ad hoc one in a crowd, sure. A long-term one which can be used to organize or find things, no. Worse, in a mesh network, you have lots of ways to interfere with it, either by disruption, impersonation, or surveillance. We should create a good standard mesh network protocol which has clients for existing hardware and has security and anonymity as primary goals, but it will still be of most use for short-term networks.

Re: Explains why P2P networks are getting so popular

How many of your immediate family members know what those things are? How many of your nontechnical friends? There are plenty of systems that exist to protect privacy, but you can't exactly claim victory unless those have been tested. For example, how easy would it be for a dictatorship to detect and block each of your suggested P2P systems? How easy to intercept and read them? And, perhaps most importantly, how hard would it be for a new user to join one without a helpful close friend giving them all the necessary things? If a repressive regime censors the software you need and you can't easily obtain it otherwise, you can have a very anonymous network and still not get anywhere.

Re: what if the net stopped being one big, connected thing?

And, as accurate as the sentences said were, they're not universally so. New laws and regulations restrict the freedom of big tech companies in democracies. In dictatorships, the only regulations are new "thou shalt do what we tell you to when we tell you to" ones. I want more privacy, but I have the freedom to evade corporations here and, depending on where I live, the freedom to sue them for privacy violations and win. I don't have that power in China, where the social credit score is not optional and your options for redress from the government primarily include paying a bunch of money to gain citizenship in a different country.

Techies start growing an Alphabet-wide labor union: 200-plus sign up, only tens of thousands more to go

That has to be considered, and don't worry, the company will consider it for you. The problem is that the alternative is no different. If the company signs the contract and enough of their staff leave based on the arguments made in the post I replied to, the company might well go bust anyway because they lack the staff to fulfill their requirements and are spending all their time trying to hire new ones. At least if the employees concerned attempt to convince the company that it's a bad idea, the company knows that's going to happen and can decide whether it's worth the risk. There's little downside telling the company "I don't like this idea, and if you do it, I will quit".

That's a good start, but you can also try to convince your current employer not to do things you don't want to do. If your current employer isn't someone you have an objection to, but they have started to consider doing business with someone you have an objection to, you have two options. You could quit immediately so you don't do something you object to, or you could go to your employer and suggest that they might want to consider changing their mind. If they do change their mind, you keep a job, they keep you employed by them, and everyone's avoided a negative. If a lot of your colleagues also object to the considered project, you in combination are more likely to convince the company not to do the objectionable thing.

This benefits you, obviously, since you don't have to look for a new job if your employer doesn't do what you want, but it also helps your employer. If everyone only operated on the "never work for people you object to but also never complain" principle, the company would likely sign the contract to work for the objectionable place, lose a bunch of employees, end up in a crisis, and have trouble. If they just don't sign the contract, the company is as fine as it was before and can find a less objectionable contract. No guarantee that they'll change their mind, but if you try to suggest that they do, it's possible it ends better. It can't really end worse, as even if they do nothing it's no different from your original plan.

Singapore changes the rules and will now use COVID-19 contact-tracing app data in criminal cases

What worried people all along

I have tried to be willing to acknowledge the usefulness of contact tracing applications, but this is exactly what people feared when they were launched. This is the underhanded action that can kill trust in a government, and for governments already lacking it due to pervasive privacy violations, also kill the benefits of contact tracing. When we're faced with a crisis where public participation is required to avoid causing a great deal of preventable harm, eroding the public's trust in government is among the worst things that can be done. At this point, I think the operators of app stores should remove the Trace Together application as malware; only a decentralized tracing app can ever be permitted, and even those must be subject to review.

Explained: The thinking behind the 32GB Windows Format limit on FAT32

Re: MS, how about recognising EXT,HFS+ formats so it doesn't result in the format dialog box

For HFS+, you can get a driver for it which gives Windows read-only support for it from Apple's Boot Camp drivers collection. I haven't used it in a while, but I wouldn't be surprised to hear that it supports APFS now as well.

Julian Assange will NOT be extradited to the US over WikiLeaks hacking and spy charges, rules British judge

Re: This confused me

The OSA is a law. You have to obey it if you're in the UK. Sometimes, you may be asked to sign a document acknowledging that you know this, but if you've never signed it, it doesn't change. For the same reason, you don't have to sign a document saying "I acknowledge that there's a law saying I can't kill people when I want to". If you do kill people, it's illegal whether you've acknowledged it's illegal or not. It's how laws work.

Re: This confused me

"I never saw a clause in the (admittedly short) forms where secret information from another state was necessarily a UK secret."

That doesn't matter. The question that the judge needs to answer in this case is rather simple. Basically, if all this happened in or to the UK, would it be a crime. In full detail, if a guy broke into Ministry of Defense systems or published UK classified documents, would the UK consider it a crime? In that hypothetical case, the OSA would indicate that it was a crime. Since the action would have been criminal had the UK been the victim, the crime is worthy of extradition on the basis of dual criminality. It's not the only test that needs to pass before extradition succeeds, but it virtually always has to pass in order to do so. Just because it did pass doesn't mean that the real person could be charged under the OSA; only the hypothetical person who acted against a UK victim needs to be culpable for the test to pass.

The reason a hypothetical criminality test is used is that one country could pass a law making something illegal which another country hasn't done. Extradition in that scenario is usually refused. For example, consider the U.S.'s slavery legislation in the 1800s. The laws of the U.S. stated that it was legal to enslave people and it was illegal for a person who was enslaved to run away. Canada's laws said that it was not legal to enslave people. A person who managed to escape to Canada could therefore live in freedom because an extradition request would be denied; the act of leaving a position of slavery was not considered criminal in Canada, so they wouldn't be sent. Meanwhile, someone who escaped to Canada after murdering people would be extradited, because murder was considered a crime in both countries. Even if Canada couldn't charge the murderer because the victim was American, Canada would still consider the murder to have been a crime and sent the perpetrator to the location where the trial was allowed.

Re: pft

The OSA is not necessarily considered to cover secrets of other countries, though it could. The point is that it is a crime in the UK to release information of that nature, and thus that extradition is permitted on that basis. In most cases, to extradite a person, the crime of which they're accused must be a crime in the country they're physically in. If country A thinks something I did was illegal but country B does not, country B is unlikely to extradite me. If country B also thinks that's illegal, then I'm more likely to be extradited. That works whether or not country B could charge me for the crime.

Here's a simple example. Let's say that I go to the UK, rob a bank there, then flee to Germany. The robbery charge should happen in the UK. The Germans probably wouldn't charge me there for it, because the victim was located in the UK and I wasn't in Germany when I robbed it. Technically, my crime wasn't a thing for Germany. However, robbery is still a crime in Germany, so the extradition request would go through quickly, even though the victim wasn't German. In the same sense, the crimes that the U.S. allege are crimes in the UK, so the UK doesn't have to deny extradition for that reason.

And now for something completely different: A lightweight, fast browser that won't slurp your data

Re: RE DrXym :)

"what?? FF 78 executable is 567K.."

But the full installation is a couple hundred megabytes. Even the compressed installer packages are 50-70 MB. I assumed that the quoted 34 MB was all of the files used by their browser, but even if they chose to bundle most of their libraries into one executable instead of loading them dynamically like Firefox does, their storage usage is much smaller. That said, Firefox supports basically every site and their thing doesn't yet, so expect their thing to increase in size.

I cannot reproduce that. Running the latest stable 84.0.1 here and about:config loads just fine after a warning page which I can suppress if I want to.

Re: Not Free

Private browsing and Tor are not defenses against JS. Only blocking JS is a defense against it. Depending on the level of worry, it isn't necessary to always do so, but let's quickly review what each of the defenses does and why they're not doing anything about the risk of dodgy JS.

A private window isolates the loaded page from certain data the browser holds. It prevents the server from getting cookies or other browsing data, and it prevents the loaded page from persistently storing that stuff. It doesn't do anything else. Cookies are a server-side tracking thing, not a JS tracking thing. Most fingerprinting techniques implemented with client-side scripts access information which isn't stored in the browser. For example, fingerprinting a device based on system state or capabilities. Blocking it from cookies won't do anything to prevent that.

Tor is even less a defense against client-side scripts, although if you're using it, you probably want to avoid JS too. Tor is a way to redirect traffic through a network of relays such that the place you contact doesn't know what you're looking at, the final site doesn't know who you are, and most observers don't know what you're doing. It protects data in transit, but it will protect that data equally well no matter what it is. Crucially, it does not protect data on a computer. If a script is part of a site, Tor will not prevent it being sent. If that script collects information from the system, Tor will not detect or prevent that collection. If the script contacts a remote server to upload the collected information, Tor will happily pass it through. Tor is a network-protection system, not an endpoint-protection system. If you want privacy enough, go ahead and use Tor and also disable scripting when possible; the former does not do the latter for you.

Re: Not Free

I agree with you about most autorefreshing pages. They're quite annoying when they don't need to refresh. Sometimes, however, it is important that they do so. If any application is written with dynamic information, it probably needs to update or at least warn people about the fact that it hasn't.

Consider a simple system I wrote for someone. There is a form for user requests which includes various details including the time when the request must be completed. The backend lists all known requests, sorted by time, color-coded for urgency, with a field for time remaining, and buttons to mark the request as in progress or resolved. This needs to update itself so that new requests are seen, urgency is updated, and multiple users can mark requests as resolved and have all the participants know about it. If it didn't stay updated, people might duplicate requests, ignore one which has become urgent but wasn't when the system originally loaded, etc. Now it doesn't have to be a website, but something this simple might be done that way just to make things easier.

Re: Folded content in raw HTML

Yes, this is a thing now. This makes it easier to do that particular example. What's worth keeping in mind is that this set of tags is rather new, and for many years, it wasn't available in plain HTML. For a similar reason, HTML5 can embed video really easily, but it still took a while for competing video embedding to die because HTML was so late to the party. JS used to fold or unfold sections will probably die eventually too, but it was necessary so long that it has taken over other things.

Re: Not Free

Sort of, but not really. With CSS scripting, it's possible to get a browser to collapse a section for you. However, it takes many lines of CSS and many sections for each collapsable area. Do it wrong and browsers will get lost. For example, one way I've seen it done will trip up anything automatic reading a page. That includes bots, which you might not care about, but also includes accessibility software. Don't care about that either? Depending on how it's done, it can also find its way into things if your user copies and pastes from the page or converts it to a PDF. Meanwhile, JS code that can collapse areas is really simple. Three lines of source at the top makes it available, and a single link or button can be dropped in to do the job.

Re: Not Free

JavaScript is really useful in some cases. Without it, pages can't do some things that users expect. Then, since the developers already learned JS so they could do those useful things, they try to write everything else in it too and create a monstrosity. That's the short version, but if you're interested, the slightly longer version is below.

Without JS, HTML is basic and static unless the user fills out a static form and submits it for a new page. A lot of the internet can work like that. News sites like this one, for example, really don't need much else. However, there are some things that aren't very complicated to implement but can't be done without scripting. A basic example is dynamically showing or hiding content. Having a button which allows a user to collapse or expand a region means that the page can have lots of things on it without requiring the user to scroll past irrelevant things, but HTML itself doesn't do that. JS can also provide basic data checking for forms, so it prevents users from submitting invalid forms all the time. And if you've ever used a table which can be sorted by clicking the column headers, that's JS doing the sorting*. Initial site developers wanted to do things like that, so JS took off. Later on, JS could also be used to keep a page updated even when data changed at the remote server without making the user refresh the page all the time. As you might imagine, users were pretty happy that they could have tabs open and see updates without having to remember to refresh them manually.

These uses for JavaScript are not necessary, but without them, some sites would be less organized and inconvenient to use. Users would prefer a control panel which is on a single page which can unfold sections when desired and updates dynamic information automatically over one which uses fifty subpages so the interface can fit on a screen and requires the user to refresh every five minutes. However, devs who knew how to do that started trying to do everything else in JS too. Why do the work of writing the HTML so that it at least renders when the JS doesn't run? They instead used someone else's library to do the rendering. The library, trying to be generic, was written in JS and writes most of the HTML when initialized. Without it, a framework page is all that's left. Or they realized that a JS page allows them to collect more information about how people view the page than a static one, so they include tracking scripts as well. It also allows them to embed things from other places by dumping in a convenient script; the other places are usually happy to do so because that gives them the ability to add in their own tracking. In a few quick years, JS had changed from something allowing a page to move around content to better serve the user to something slowing down every page and making it impossible to know or trust what was being done on the computer.

*Table sorting: Making the server reload an entire page just to sort a table is possible but rarely done.

Yes, Microsoft Access was a recalcitrant beast, but the first step is to turn the computer on

Re: I'd be shocked if ...

Yes. That's true. Having a separate machine for client and server in a time where machines were expensive would have cost money. Given that the client and server could apparently run fine in shared resources, all that needed to change was that people needed to remember not to turn off the box. The original comment complained about a single point of failure, which this wasn't really. The source of the problem was an operational decision, not an architectural one.

The problem with the original complaint is that it is a textbook solution which doesn't look at any of the specifics. A single point of failure is a negative in a system design, but so is limited time, limited money, limited disk, etc. These things are only preventable if more resources are thrown at the project. Singling out SPOF as the thing which must never be allowed makes it seem as if the person who created the database made an obvious mistake, but the compromise was undoubtedly chosen because the available resources required one. Single points of failure are sometimes necessary, and treating them as anathema is only possible if you're willing to always spend ten times as much to eliminate as many as I can point out, and I can point out a lot.

Re: I'd be shocked if ...

And what would that have been? No matter what database server you use, the machine running it has to be turned on. There are two good solutions to this: a server in a place where you can't easily turn it off and a redundant server which can withstand one being turned off. Either approach costs money and causes extra complication. A standard small business has tons of single points of failure. The network connection to the office might get severed. Power to the office might fail. A water leak could force an evacuation. Someone might forget the key to unlock it while the person with the other key is off on holiday. Each and every one of these will borke the workflow more than a database going down, but somehow the database needs to be more resilient anyway?

As Uncle Sam continues to clamp down on Big Tech, Apple pelted with more and more complaints from third-party App Store devs

Re: Another reason why

Not all of that is correct:

"You should check out the Libren brand of smartphones"

Brand is Librem, not Libren. Also, they have only one model of phone.

"by Purism of India"

Purism is based in the U.S. San Francisco, to be exact. Manufacturing for the phone is done in China (or optionally in the U.S. if you're paranoid, have a ton of money, and haven't actually considered whether built in the U.S. fixes your paranoia problem).

"that have a physical kill switch to turn off the phones GPS chip, cell chips and camera chips when those functions are not in use."

Actually, the killswitches work on the mobile chip, WiFi and Bluetooth, and cameras and microphone respectively. GPS is disabled by a separate software-controlled circuit when all three switches are disabled.

Re: These developers seem to forget what some users want

I like Apple's software (some of the time), but let's be honest about it. The comment here is not honest.

"I kinda like how I have a device where I’m able to block third party ad servers comprehensively by default across all apps without having to sacrifice security or vendor support (for example)."

Implying that Apple makes this easier? They don't. I can do that on anything. On device or not. Android has firewall apps. Any desktop OS gives me a lot more control than either popular mobile OS. Apple doesn't even write that software, so why are you giving them credit for letting you run software that runs everywhere?

"I also like how I don’t have to give my card details out to every Tom, Dick and Harry and how I can see every subscription in one central list with the ability to cancel without losing immediate access for the rest of the period."

It's so terrible having to give payment details to people when you want to buy their thing with money. There are one-time credit card numbers you can use to ensure they can't charge you unexpectedly or lose data in a hack. I'm sure it's nice having everything in one place, but just because it's convenient for you probably doesn't justify to others paying Apple for the minor convenience when the heavy lifting is done by the developers.

"Do these greedy developers ever think that as a user, I might want centralised controls?"

Let me ask you a question. Why are the developers greedy? Because they don't want to pay Apple a big chunk of their revenues? When it's the developers who make the apps which make Apple phones valuable (some competing phone OSes received good reviews for OS design but failed to sell because apps weren't there)? The app developer writes the code, makes the content that makes the code useful, maintains the infrastructure that the app uses, all of that. Apple provides a place to download the app package. That's all. No, Apple can't claim that they're charging developers for all the work on IOS, because the users are paying for that when they buy IOS devices. The users get those advantages, not the devs; a new IOS feature doesn't help an app developer as much as it helps a user.

"Besides, people can say what they will about App Store practices, but their approach does have some serious advantages as a result of Apple pushing developers to use consistent development methodologies."

They don't really do that all that much. There are so many different frameworks in use to create IOS apps. Most of them are popular because they allow a GUI to be created once and run on IOS or Android. Apple doesn't prevent anyone from using those, nor has it done anything to improve them. An app can look nice or not as its developer likes, and it will get through review equally well.

The rest of your comment, talking about security, is pretty good. I think that's a fair area to give Apple credit. In almost all cases though, none of those security benefits come from restrictions on developers. IOS can get security updates equally well whether they let in an app that accepts payments or not. Mac OS can sandbox data on disk just fine if the apps get downloaded from the internet. I give credit for those admirable accomplishments to those who accomplished them: the OS developers. Not the App Store review team.

Re: Its about the money

However, that's not how breakups work. They don't say "You're a big company and you abused something, so we're going to bring in some wedges and break it into chunks along existing boundaries". Instead, they find the places where abuse occurred and break along those boundaries. Separating AWS from Amazon shopping would happen if, for instance, Amazon didn't agree to sell a product if it used a different cloud provider for its support system, but that's not how that went. The abuses that are most often used as ammunition are that Amazon's shopping system gives Amazon a bunch of data about other sellers which Amazon then uses to compete against those sellers. The boundary where the break would happen should a case on that basis succeed is the boundary between the Amazon store system and the part which makes products, including Amazon basics and a few other lines.

The same general rule applies with other breakups too. If Apple gets broken up, they're not going to make iPhone Inc and MacBook Inc. They'd make Apple the hardware and OS people and a separate App Store runner. Or maybe they'd leave Apple as it is, with App Store intact, but demand that others can also run stores. Or maybe they'd accept Apple's arguments about the single App Store being a feature but make them change rules and tactics that were abused before. If Facebook were broken up, it wouldn't be small social networks with subsets of the previous members. It would be into Facebook, Instagram, and WhatsApp as separate entities. It all depends on the argument being used to prove an anti-competitive abuse of market power; if the courts agree, the action taken is designed to stop and prevent the abuse in the argument.

Re: Idiot dev

"This is why Apple do not allow it. This is why they make it clear in the license."

I'm sorry, but they don't forbid a trial period. Here is a section of the article:

"The creator was told he had to roll out a payment system to make users input their credit card details before signing up for the trial period. There must also be a specific time limit to the pro version of the app, and once that period was over it must charge its customers money. To get out of it, users would have to explicitly cancel their subscription or else it would keep billing them."

This section outlines what Apple accepts. As you can see, it includes a trial period. Trials are not what they object to. What they appear to object to is that the user would have several chances at a trial. Perhaps instead it's that the app isn't using a subscription model which would earn them revenue. Either way, Apple doesn't seem to have a problem with the trial model as long as it only happens once and customers are enrolled into a subscription beforehand. The second part of that could easily be seen as self-serving.

You might not like trials in software which expire. If Apple forbade them, you might have a leg to stand on. They don't. In my opinion, there is no good excuse to forbid that anyway, but we don't have to have that hypothetical discussion, because that's not what happened.

The curse of knowing a bit about IT: 'Could you just...?' and 'No I haven't changed anything'

Re: Firewall vs router

At the office, the network admin is someone who was hired specifically to do that, the computer I'm using isn't mine, the information I'm processing on the computer is information the company already has, and there's a way to deal with a malicious admin by firing them. An ISP has none of those conditions, so their stuff gets a data stream from a single downstream device which does everything else. Also, any ISP which lets me bring my own equipment without anything from them gets a leg up if I have a real choice to make.

Re: Sorting other people's stuff

Good advice. I can definitely recycle them if needed, and if it's old enough, I do so. The problem for me is the ones that are new enough that they'll run modern software (very well if it's Linux, but Windows 10 will work well enough until too many other programs are added) but old enough that the specs don't sound modern. I don't like to recycle something in such good working order until I've failed to find anyone to reuse them.

Re: Sorting other people's stuff

This is a very good thing to do when people want to get rid of things. Although it helps to have plans for how to deal with the machines afterward. I've recycled machines so often that the charity I used to donate them to has had to tell me that no, they don't want any more computers. It probably doesn't hurt that I've been maintaining the ones they have too so they're also lasting a lot longer. I need to find a new place that wants them. I've tried selling computers on occasion, which sometimes works, but the older ones don't always go as fast as I'd like.

Everybody's time is precious, pal: Sometimes it isn't only the terminals that are dumb

Again, seems unlikely. It's possible that this had happened, but there are several good reasons in my mind to think that it did not. First, the modem has to be near the terminal anyway, so there's a limited amount that can be done. Turning it around helped in this case, but if that wasn't helpful, there's not really another good option available. Second, the content of the call does not lead to that kind of solution. The caller complained that the network had failed. Not that it repeatedly failed requiring a long-term solution, that it had failed this particular time. If I have to solve a "this broke" problem, my solution is "fix it now". If I have to solve a "this keeps breaking" problem, my solution is more likely to be what your idealized client would want.

In any story like this, where the user is always stupid and the IT person always figures it out, it's always possible that people are lying. Maybe the user figured out the turn-around procedure and IT is taking credit. Or maybe the call never happened and someone made it up to tell the story. These things don't sound likely to me though, because we've all experienced people who act like these characters. I've seen people who didn't understand seemingly basic things, or who got irrationally angry at someone solving their problem. I've also seen IT people break a system through incompetence and blame the client. Both happen. The general story therefore doesn't sound implausible to me, so I'm likely to consider it genuine. If I assume that the information we have is truthful, I must conclude that the client is entirely at fault and could easily have stated the problem differently and politely if they knew it (which I doubt they did).

"I'm not going to put the blame completely on the user for this one. Particularly if the user hadn't been allowed by management to move the modem, and by having IT show up and move it he actually got the problem resolved in a more durable fashion."

This strikes me as very unlikely. Sure, IT can be annoying about telling people not to do things ("No, you may not come into the server room and move the wires around even if you think you know that it will help", "No, you may not open the network cabinet and force a power cycle by pulling the power cable just because something sort of network-related isn't working and that works at home"), but I don't really think anyone in management would have a regulation about turning a box on your desk around. They might suggest you not do it in case it made things less organized, but it's not hard to do it anyway and claim an IT person did it. Also, I don't think anyone would notice or care.

Meanwhile, the call described in the article is a very stupid way to handle a hypothetical situation as you propose. If you want IT to confirm that the box can be turned around, it would be much more helpful to remember this and ask them when they're already there. Ranting at the IT person who is suggesting how to fix the problem just makes the caller look like a jerk. If I had been called out like that, I certainly would not have turned the box around; I'd have flipped the switch and left. Problem resolved for now. No reason for me to make things easier for someone who won't do what they've been told (correctly) will fix their problem, shown me profound disrespect, and didn't even think about the inconvenience of making someone come in a rainstorm to do something unnecessary.

My website has raised its anchor and set sail into the internet oceans without me

Re: Nether web

Of course it's not. It's a basic bot that only collects pages in a certain order if it can find accesses to them, sometimes forgetting something or following a zombie link and filling the database with garbage. But you find me anyone else who does anything remotely as good. Google might have it, but I can't exactly use it for my purposes. Similarly, I have some pretty intensive crawls of a couple sites which were important to something I was doing at some point, covering about 0.0000003% of the internet (only static files). Only the Internet Archive really has anything like it available to the public and offering general coverage.

And you thought that $999 Mac stand was dear: Steve Wozniak's Apple II doodles fetch $630,272 at auction

I can't say I have. Among other things, I can see a diagram of a proto-submarine on a monitor with equal clarity to the paper. I can't do that with a painting or tapestry, which is why I consider them different. Also, that is a diagram which the general public can easily grasp. The papers in this article are very different, and include such details as "five pages of circuit schematics and notes on sheets of graphing paper; six photocopied pages headed 'Bus Sources,' 'System Timing,' 'Display,' 'Sync Timing & Adr. Gen,' and 'Timing,' featuring several annotations; and a 12-page handwritten programming instruction guide consisting of 28 detailed steps." Those things, to me, don't sound special enough that the original is any more special than a copy, especially as a quarter of it is already copied. That's just my opinion, but if I were setting up a museum, I wouldn't be at all concerned with getting the originals and I might not put all of that on display at all, instead opting for the suggested exhibit in my previous comment with a web address available for interested people to read them at their leisure.

I see the point, but I don't know if that matters all that much. A museum holding an original painting can at least show something beautiful to its patrons. A museum holding an original circuit board doesn't look very different from a museum holding a reproduction of the circuit board, which shouldn't be that hard to make. Better yet, a museum holding a reproduction of the circuit board in a glass case and an emulator of the running system next to it, perhaps running software from the time. That would probably be more interesting and educational to patrons.

It's even less necessary when the item is a bunch of papers that had engineering documentation on them. Most patrons won't want to read all of that anyway, and even if they did, are you going to post them all on the wall? I'm guessing we already have pretty good scans of those which can be published online (or if you insist next to the reproduction and emulator).

Elon Musk says he tried to sell Tesla to Apple, which didn’t bite and wouldn't even meet

Re: Offered to sell the company for 1/10 current market value

Sort of true, but limited. Apple's cash did bail out the commercial failure that NeXT was going to be, but Apple also did that because they needed something that basically only NeXT could and was willing to provide. Their OS was too limited and, in their mind, in need of replacement. Writing a new one from scratch would have taken too long to finish, so they shopped around for companies which already had a new OS they would view as an improvement. NeXT's eventually won out for various reasons including its Unix compatibility. So Apple was looking for what NeXT could provide at the same time as NeXT was looking for a bunch of needed cash. In Tesla's case, they were the only one looking around; either Apple wasn't really building a car in which case they didn't need Tesla, or they're already working on their own so they didn't need Tesla. Either way, this one is a lot more one-sided.

Search history can calculate better credit ratings than pay slips, says International Monetary Fund

Well spotted. I wasn't very familiar with SNI's details and got that wrong. Thanks for the correction.

A few other methods of identifying a site I didn't think about last time include checking for differences in transfer sizes that might be connected to cookie usage, tracking frequency of requests to identify how much active content is on the page being accessed, checking packet latency and overall transfer speed to get information about the server and whether it's under load or not (this may make it easier to identify), or cross-referencing with other users' traffic which may be less secured.

For now, they know:

1. The DNS queries for the specific domain and all the domains it pulls in. Until DoT or DoH, they'll keep having that.

2. The SNI requests which contain the domain name and the first page URL you request. If you type in a domain name, they get it and "/". If you click a link from a search engine, they get the whole thing. Until ESNI or one of the other suggestions takes effect, that will be available to them.

3. The destination IP. This may be a CDN, but not always. Plenty of people use a server dedicated to network requests which makes it obvious who runs it. Others will run multiple sites on a single server but not on all the other servers, meaning that only that server needs to be interrogated to figure out what the possibilities are.

4. The size and timing of requests. They probably don't go this far, but if they have a server to test, they can try certain likely pages until they identify the one requiring the right number of assets from the right locations. Sites that bring in images and scripts can fingerprint themselves in that way.

Trump administration says Russia behind SolarWinds hack. Trump himself begs to differ

Re: "Or do all Russia-based hackers sit in the pocket of Kremlin?"

"'Fingerprints' is very vague and hand-wavery. An example or two would go a long way..."

Examples of how attribution is done include things like these:

1. Does the code look like stuff you've seen before? At a basic level, is there an exploit that someone has used before but few others know about? If so, it's more likely to be them. At a more detailed level, drill down into the assembly and look at modules. Stuff gets reused or updated. Even a pattern of names may be illustrative. There is usually not a need to go to sufficient effort to change your entire coding style to frame someone else. If you've developed a great file spider that can quickly identify stuff of interest for exfiltration, you might decide to put it into multiple malware distributions rather than rewriting it from scratch; if your obfuscation isn't good enough, that may link them both. Attribute one to you, and the other connects too.

2. How did the code get onto the victim's systems? Was an exploit used? How about a botnet? Who do we know who has done that before? If we have a location of the source, what do we know about it? Who purchased the server? Do we have any information from historical network scans? Sometimes people are careless and information they didn't think about ends up coming back to name them. For example, people who set up fake servers sometimes forget that, even though they change the information later, the provider has the ability to recall the information they put in originally. The original silk road Tor drugs market was partially taken down due to its founder putting his real name in a related account.

3. Once it was there, how was it controlled? Do we have logs showing a human acting? Maybe it crashed and restarted from a manual command. What do we know about the location of control? For example, some government-backed APT groups operate on local business hours. While it's not impossible for someone else to only work 9:00-17:00 Moscow time and take off Russian holidays, there's little reason for them to disrupt their schedule. When you notice that it happens, chances are you've at least located the attacker's time zone and that it might be an organization doing it.

4. Who has used the malware for benefit? Not necessarily always available, but have they extracted data and used it somewhere we know about? for example, if you were attributing an attack on a website to a group, finding the database's contents for sale at least gives you two targets to investigate, the attacker and the seller. They might be the same, but even if they're not, they probably know each other.

5. The old-fashioned return the favor--someone knows what APT29 is up to, and I'm sure the NSA would like to hear about it. We don't know how hard the NSA has tried to gain access to various places where such information is available, but they must have tried and probably have access to some of it. This isn't available to everybody, but in a government hack, there will be a lot of government investigation of what happened.

Re: "Fingerprints" is very vague and hand-wavery.

Of course false flags are possible. They're tried all the time. They can be fiendishly difficult when it comes to an attack on computer systems because you are dealing with lots of variables and you don't know what others know about you. It's been done before, but it usually gets figured out fast enough. For example, when the 2018 Olympic games were attacked, it was first believed that a North Korea-based group had done it. A few days later, it was actually discovered that the first clues pointing to North Korea were shallow and didn't stand the weight of investigation, and most likely Russia had done it and attempted to frame the North Koreans. Further investigation substantiated those theories to the extent possible without anyone taking credit.

Attribution is tricky, but there are people who put a lot of time into getting it right. They can recognize little techniques or snippets, trace through records of systems used, and make a pretty good hypothesis. When one person releases a preliminary report calling out someone, they could easily be wrong. When several places all agree on who it was, they likely know quite a bit and have done their homework. While they could be wrong and eventually they will be about something, they're often right.

This product is terrible. Can you deliver it in 20 years’ time when it becomes popular?

Re: Infra-red

But again, in that situation, it's the box on the television, not the remote, that's of concern. Whether the remote you use uses IR, Bluetooth, a custom RF protocol, or loud beeps for a microphone doesn't matter; only the Android TV box has the connection needed to snoop on them. The risk and therefore any remediation steps need to happen on the receiver end and the remote's implementation is meaningless.

Re: Infra-red

"The best thing about line-of-sight remote controls is that they don't upload your button presses to a server in California."

That's what you think. Unless you have a WiFi remote control, the thing that you have to worry about is the device receiving the commands from it. Nothing prevents a television relaying your IR remote commands any more than it's not prevented from sending commands sent over an RF protocol.

GitHub will no longer present a cookie notification banner – because it's scrapping non-essential cookies

Re: All websites don't really need third party trackers and services

"You can maintain state across a session using post or get variables."

But if you do, it gets painful. Whatever variables you use will end up clogging everything, from the user's history to your databases to all the HTML you send to them.

If you use get variables, the users' history, bookmarks, or shared links will contain a bunch of expired URIs which contain old session data which a) doesn't work anymore unless your server filters it out and redirects them to somewhere new which still works and is at least sort of like where they were at that point in history and b) may contain information that a user shouldn't be storing in their history. The second point can be thought of as the user's responsibility, but part of system design should be keeping data private even when it's not yours. If you instead use post variables, the user who returns to one won't have the issue of persistent storage of data but would likely get a warning from their browser that a post action will be repeated with possible consequences. This also doesn't fix the issue of having to handle links with inaccurate or missing parameters.

Meanwhile, you also have to have your system modify every element on every page to send the required data onto the next one. Turning every link into one which consumes parameters and passes them on and including hidden inputs which ensure all your parameters are in every form can be a large task which consumes resources, complicates the page, and makes your backend CMS a mess. If you don't do it, then a user who clicks on a static page which doesn't need the parameters but continues on from that page will find their session data has been lost.

Stony-faced Google drags Android Things behind the cowshed. Two shots ring out

Re: A thought

"Is there any point to Android other than on OLED/LCD touch screen phones and tablets?"

Yes. The reasons differ depending on what you're building, but there are a couple good ones. One is app portability if people other than you are going to write apps for the thing. This could be library services or ebook stores which write an Android app that runs on an ereader and supports their format or can download from their service. If all the ereaders use the same interface, they only have to write the app once. The ereaders likely don't, which is why there aren't that many apps like that, but it's a similar model with streaming video on smart TVs.

For TVs, a general smart TV platform is more likely to get support than a specific one. For example, one of my family members has been asking for my assistance because they've lost access to a television channel on their old satellite system and they want it back. They have a smart TV running some probably awful proprietary system and they also have another proprietary streamer stick which they can use. Neither of these does apps, so I've been attempting to look up whether either has a manufacturer-supplied app for something carrying the channel concerned. With something running a generalized platform like Android TV which can receive apps from people other than the manufacturer, the likelihood that there is something of use is higher. Certainly not guaranteed, but nobody's waiting on the Samsung television feature department to fix a smart TV eight years old.

Another benefit (this one for the manufacturer, not for you) is that Android has a bunch of developers and existing libraries. Linux does too, but for devices using a single screen and basic user interface, the Android developers are already familiar using Android's tools to write apps with that type of interface.

These don't make Android a requirement. A general Linux-based open TV or ereader platform would work well too. But we don't have those. Well, I think Kodi is kind of like an open smart TV platform but as I recall it has trouble with a lot of streaming services because of DRM problems. Nothing is perfect, and in this landscape often nothing is very good, but some things are less bad than others and Android can sometimes get things to the less bad point.

How to leak data via Wi-Fi when there's no Wi-Fi chip: Boffin turns memory bus into covert data transmitter

Re: Better computer cases?

That sounds nearly untenable. For one thing, a smartwatch that can be used for the attack needs to be thoroughly reprogrammed. The controlling firmware needs to control the wireless receiver, Bluetooth or WiFi, with sufficiently granular control to make it use a completely different protocol. That's much easier to do with a watch you control rather than someone else's. It's also not easy to replace firmware on a device you can't compromise yourself; firmware updates for nearly every brand of smartwatch are signed binaries uploaded through an encrypted BLE connection. While not inconceivable, actually finding someone, identifying their device, writing firmware which can use the hardware and leave the device functional enough to fool its user, and uploading it without controlling the device itself or the phone talking to it are rather difficult tasks.

The real problem though is that, if you succeeded in doing this, it might not help very much. Watches are really small, so their antennas are short and their batteries can't withstand much use. This means that the range to receive or transmit from a watch is quite low. Also, frequent use is going to kill that battery. An attacker who knows that the watch is supposed to listen to a machine can place it close to the machine and remember to charge it frequently. Someone who doesn't know that is likely to be out of range a lot of the time and become very annoyed when their fitness tracker's battery life suddenly drops (it would be very noticeable). Even if they do succeed in receiving the data, the attacker needs to get it back from the watch. Their only hope is to keep meeting the person with the compromised watch so they can get a daily download, but because of the range limitation, they will have to be physically close to the person with the watch quite frequently. That makes getting the data out hard if there's any information to get after the user unexpectedly went out of range for most of the day.

Re: Better computer cases?

That would work rather well as a listener. Even low-end devices can have enough storage to cache data sent to them over a workday. The open-source PineTime watch has 4.5 MB of flash, and the proof of concept can only transmit at 12.5 bytes/sec. That allows for four straight days of collection on a watch which can easily sync back as the attacker goes home. If you wanted to execute a plan like that, your idea is a good one.

However, it doesn't change the requirements. If you consistently work in the secure building and were able to install malware on the target computer, you can probably also go to the secure computer and make it do things. Especially so as you need to be very close to it for the transmission to be received by your sneaky watch. If you do have access, it might be easier just to make the computer disclose information a faster way, whether that's copying to media, converting to QR codes displayed on screen, or just bringing it up for you to peruse.

Google Mail outage: Did you see that error message last night? Why the 'account does not exist' response is a worry

I fail to see the confusion. The message speaks of accounts, the article of users, users have accounts, on Google users are identified entirely by their account as there is no independent username available to them, hence if an account doesn't exist, the user doesn't exist either. Therefore, the message which was sent should only be sent if a user has not set up an account with the specified name or the user's account has been closed. That wasn't the case, so we have a problem.