Posts by doublelayer

AT&T: We did nothing wrong in promising unlimited data that wasn't. We're just giving the FTC $60m for fun

Re: Why are you still an AT&T customer?

You assume here that the people are still customers. I'm guessing quite a few left after their contracts ended, tired of being lied to. But you also have to realize that people still need phone service. If only one provider provides useful service wherever you may be, then you are effectively locked into them. And even if you're in an area of good coverage from everyone, you still have to shop for the best plan. It might end up being that the plan from AT&T was a better value for money than the available plans from the competition, just without honesty.

One can't always keep placing companies on the never-buy-from-them-again list; sometimes their services are needed as much as people dislike them for previous decisions. Your approach works fine in a market of perfect competition, but mobile service is not in a state of perfect competition anywhere in the world, let alone the U.S.

DoHn't believe the hype! You are being lied to by data-hungry ISPs, Mozilla warns lawmakers

Re: Google complains about data hungry ISP's??? Those are some swinging balls

It's Mozilla making the argument here. And I completely agree with you about Google's willingness to collect and sell data. The solution to this, however, isn't to choose anyone and everyone who isn't Google and keep data flowing to them. Instead, technology promoting privacy should be supported, investigated, and adopted when feasible, no matter whose data collection is disrupted. If a certain endeavor doesn't do much to cut off the data pipe to Google but does to Facebook, it's still a good thing.

DoH, unfortunately, is somewhere in the middle. It really does promote privacy; it's not difficult to change the provider in a browser and it's quite easy for a DNS provider to set it up. However, it can be used by programs and devices to evade DNS blockers and user controls, including the use of hard-coded servers. Even admitting this, I believe the balance is tilted toward the positive. Programs ranging from actively malicious to locked down by vendor will probably use DoH to hide their tracks, but that can't be helped. If DoH didn't exist, they could and would use something similar. Meanwhile, DoH does really help ensure the privacy of DNS lookups until the DNS server, which can be very useful at keeping data away from ISPs, malicious network devices, etc.

Baffled by bogus charges on your Amazon account? It may be the work of a crook's phantom gadget

Re: How is the device added...?

Logically, it probably starts with account access. This could be from password reuse, poor passwords, access to an email account, theft of credentials via malware, or the like. However, as we don't have many details, it is theoretically possible that there is another vulnerability somewhere that people have found. We don't need to assume that exists at the moment, but it's not beyond the bounds of possibility.

Everyone will have some type of security incident, and quite a few of those will be account accesses. However, the real problem is recovery from an event like this. Most accounts can be recovered by taking them over again, changing access methods, and enabling multi-factor. When this course of action is not sufficient, we have a problem.

The .amazon argy-bargy is STILL going on – and Uncle Sam has had enough with ICANN

That's not a good idea. For one thing, the organization never asked for the domain. They just complained about Amazon getting the domain because they're annoyed. As pointless as it is for Amazon to want the domain so much and as warranted as Brazil's complaints against the U.S. are, this fight is producing no useful outcome for anybody, which the complainants know well. I have little sympathy for them. I don't really care whether Amazon gets their domain or not, but I can't see that people deliberately trying to be obstructionists have any legitimacy.

Top American watchdog refuses to release infamous 2012 dossier into Google’s anti-competitive behavior

Re: Meh

But a auto dealership and a hardware company aren't search engines. They are making recommendations when asked, but it is not their job to provide information. In addition, no manufacturer of cars or phones currently has an effective monopoly on that market. Google, as a search engine, does have providing information as a primary purpose, and at the time (and now), their market share does place them very close to a monopoly in many countries. If they choose to bias their search results to promote other products, it could be considered abusing their market position, which violates antitrust and pro-competition legislation. Your analogy is inadequate.

Not just adhesive, but alcohol-resistant adhesive: Well done, Apple. Airpods Pro repairability is a zero

Re: Hearing aid?

I don't want these, and they're ridiculously priced as well, but there is a simple answer to why people want earphones that block out a lot of the noise from their environment: open plan office. I'm in a mixed plan office and I still choose to use headphones because if I decide to work to music, I won't be irritating the person closest to me. In addition, having devices that have the capacity to serve as impromptu earplugs can be nice if I'm being subjected to far too much ambient noise. An airplane cabin or construction zone next to where I'm working come to mind. Another that comes to mind is if I have to work inside the server room at some point. The shriek of lots of servers is annoying and can damage my hearing, while there's very little likelihood I have to listen out for dangers (unless it's the BOFH's server room) or would be able to hear them anyway.

Re: Double the reason

I'm guessing that you treat your high-priced wired headphones rather well. That's quite a logical thing to do given how much you spent on them. My problem, however, is that I want not to treat them well. I want to use them out and about, finish up, and coil them into a pocket or bag. I don't necessarily want to spend a ton of time neatly keeping the wire in perfect condition because it's quite likely I will stop using them when I need to be doing something else. In my experience, cables don't last very long when you do that to them, especially the pretty thin ones attached to most sets of headphones. I've killed far too many sets to spend very much money on them.

That said, I do have a good set of wired headphones which are quite high quality. I keep those at home, neatly organized, and only use them when doing audio work. I don't need that kind of quality when I'm using headphones elsewhere, and I don't want to lose the money spent on them by damaging a cable which isn't always as straightforward to replace as it looks.

Re: That vendor's track record for reparability is miserable

To be fair, and I don't necessarily want to be, their record isn't all that bad when compared to many of their rivals. Nothing they make is very repairable, but many of their phones and laptops are at least more repairable than ones from other leading manufacturers. Recent reviews of Samsung and Google phones, Microsoft laptops and tablets, and the like seem to show similar levels of disregard for self-repair. I wouldn't focus on how Apple ranks compared to others. I'd focus on what the raw numbers are, and they range from not great to well it's the bottom of the scale.

The Feds are building an America-wide face surveillance system – and we're going to court to prove it, says ACLU

Re: Hypocrites

They have. At least some of the new companies placed on the American entity list were placed there because they create surveillance systems used in the Chinese province of Xinjiang for tracking and in many cases imprisoning people on ethnic grounds. Which is why they got suggested on the list, but they'll certainly be removed if the trade war goes the way the American administration wants because human rights won't matter in that case. Various other countries have been calling this massive human rights abuse by China out too. It's so obviously happening and so obviously really bad that nearly everyone at least says they're concerned about it.

Re: Hypocrites

What's the lie you speak of? The Chinese do have such a system, and it's pretty dystopian. The various branches in the U.S. haven't gotten around to writing their lies about what they have and what they'll be doing with it, and are sticking with silence for now. Assuming they have set up such a system, we're likely to see quite a bit of prevarication and/or hypocrisy, but we haven't yet found out which. There's also a chance that they've realized that the system is pointless and haven't wasted their time; they have other ways to infringe privacy rights.

Re: "the FBI has a larger database of over 640 million faces"

I'm certain that's what it is. People need pictures for driving licenses, passports, and various other things, and all that data can get put in the same database. It would make sense, leaving all decisions on morality aside, to use as many pictures of each person as they can get to have more chances of successfully identifying a person. They can deal with the increased risk of false positives once they've activated their data collection system on all the matches that came up. That's what it's for, after all. Don't look at the logs! I told you that's what it's for; you don't need to check! In fact, you don't need to be here. Get lost and stop poking into what we do with all the private data we have on you that you never gave us or anyone else permission to collect.

Radio nerd who sipped NHS pager messages then streamed them via webcam may have committed a crime

Just give the pager a very basic microprocessor capable of performing encryption and decryption. They have them all over the place, and they're quite cheap and run with little power requirements. You can still use the same frequency. Given the privacy requirements of some of this data, that would seem to be a sane precaution.

A stranger's TV went on spending spree with my Amazon account – and web giant did nothing about it for months

Re: There seems to be something wrong here

Well, let's round up a few suspects:

1. Reused password.

2. Poor password.

3. Keylogger.

4. Phishing email.

5. Someone with a passwords file (especially children).

6. Insecure IoT device (E.G. television watching Amazon's video service).

7. Malicious attack by someone who knew the person.

8. The poster was not the person whose account was accessed; they are the technical person who helped a family member or friend whose account was accessed using one of the above mechanisms.

9. Amazon's had their system accessed and Amazon doesn't know or hasn't told us.

10. Dumb luck.

So maybe one of those was used to access the account. It's still a massive problem if you can't lock them out by changing the password and deleting connected devices and changing how 2FA is working and talking to normal customer support. I fail to see your objection to this quite likely possibility.

Re: Tie in all your services

I suggest the following alteration:

One ring to rule them all,

one ring to find them,

with many ways to see them all,

and for the money, mine them.

I think it fits with the business model of most providers.

Running on Intel? If you want security, disable hyper-threading, says Linux kernel maintainer

Re: Quick question

That question is difficult to answer. The main reason is that these aren't of particular concern to single-user machines. Of course one might want access to protected memory on those, but an evil person is more likely to have a better way of gaining access to data on a less secure user machine. This type of vulnerability is more useful in penetrating the protections in place on a machine running VMs for multiple people or for multiple purposes. The other problem is that you can't easily detect this by a signature or other file characteristic. Only by observing the operation of a program can the behavior be detected, and the overhead required to do that to everything is prohibitive.

All that said, the best answer is "not very many". It's not easy to do, it's relatively slow, and it's only useful in a few circumstances. You probably shouldn't fear this vulnerability as much as many others. But that's not to say it's unimportant, as there are lots of things someone could do with it.

We can go our own Huawei! Arm says it can flog chip blueprints to Chinese giant despite US trade embargo

Re: Just a second

This is not about competition. I know, unpopular opinion, but it's not. It started from real concerns in some security circles across multiple countries that Huawei might actually spy for the Chinese government. These people recommended code checks, which revealed some worrying things but didn't reveal spying. And now the security people have mostly dropped their concerns. The only reason this is still a thing is that some American politicians realized that "security reasons" sounds better than "hostage in a trade war". But it's not about Huawei competing with other companies on comms tech, it's about wanting the trade balance to switch. That's an issue so important to the current American administration that they'll sacrifice anything to get it, and they're not above manufacturing another bargaining chip to try and add some stress.

I enjoyed reading that, but it's a little weird to imply that something of the kind would be considered today. For one thing, no matter how weird the American government gets, they wouldn't need to militarily occupy Canada to express their displeasure or for any other reason. For another, I think it might be useful to consider this section from the page: "Many of the war plans were extremely unlikely given the state of international relations in the 1920s, and were entirely in keeping with the military planning of other nation-states. Often, junior military officers were given the task of updating each plan to keep them trained and busy (especially in the case of War Plan Crimson, the invasion of Canada)." Militaries waste their time on myriad pointless researches and games, but that doesn't stop a lot of those activities being completely pointless.

Median speeds for UK 5G four times faster than 4G, but still way behind US and South Korea

Re: Mobile data is faster in the US?

There are two major reasons for the difference. Reason number one is logical; the U.S. is really, really big. They have their share of large cities that can be cabled quickly, but you have a lot of very empty spaces. It's like that saying: "The difference between an American person and a British person is that the American thinks that a hundred years is a long time, and the British thinks a hundred [insert kilometers or miles depending on whether it's an American saying this] is a long distance". Running wires to all the places people live is expensive, so there is often no desire to do it again if there's something there already, and relatively little reason for other companies to compete outside the major cities. There are various places that are remote enough that there just isn't a cable; if you want internet, you either have to get satellite or pay for the installation of a cable.

The second reason is purely economic and political. Competition is not considered an issue of major importance, and most places don't have it. The various regulations about what service levels are and what companies are allowed to do have frequently allowed service providers to lock down certain areas as captive markets. Even as regulations change, which they do from time to time, the inertia of past regulations carries on. For two examples, there was frequently a monopoly given to cable television companies who agreed to serve an area. When internet began to come along those cables, the companies with those monopolies had a great opportunity to assert their dominance in the fast-enough internet market as well. Meanwhile, companies were not required (and still aren't in most places) to share any infrastructure, increasing barriers to entry. Regulators frequently focused on geographic coverage rather than competition.

Google claims web search will be 10% better for English speakers – with the help of AI

Re: In other words

"I'd question if it is truly AI or just some glorified DSS. Probably the latter."

From what they've said, it fits the standard definition of AI, being based on a neural network rather than just a large set of rules. But that doesn't necessarily mean the large amount of different ways a sentence could be read will matter at all to the accuracy of search results. The fact that their own demonstration test case didn't hold after they release indicates that it's probably not as reliable or useful as they would like to believe.

This type of analysis, if it worked, would be very helpful. There are various things that cannot be easily phrased without using word positioning and prepositions. Quite frequently, searches I perform fall into this by being in the format "A without B", as I know I'm going to get a lot of articles about A with B, which is how I got desperate enough to try phrasing a search to get things without B in the first place. But I somehow doubt that this will solve that problem.

Re: 10%?

Not true. Bing is the default on Windows, in a Microsoft browser. If people use a different browser, then Google is almost certainly the default. Most people didn't actively choose a different search engine; they actively chose a different browser. Some people didn't actively choose anything, as Google pushed Chrome with something else and set it as the default. Try going to an average set of Windows machines and seeing what the OS internal websearch system is using. You can set that to Google, but nobody does because they don't care about that search box. If they choose to use Chrome or Google search, that's fine, but know that there is quite a lot of sticking with the status quo behind market share figures.

Not LibreOffice too? Beloved open-source suite latest to fall victim to the curse of Catalina

Re: SECURITY!!!1!!

It doesn't really matter when the warnings happen. A wall of them makes a better point in one picture, but it doesn't really change the experience if the warnings appear one by one. I'm happy to have to manually grant access to stuff. But it is Apple's responsibility to make sure that works when other programs try to use it. And there is no good reason not to tell people that they have the option to proceed with running an unsigned app; that box is pretty bad. Apple's headed in the right direction, but they're on the wrong track. They'll need to jump to a parallel one with good UX and user choice in mind, then keep going in the direction of more OS-enforced security.

Google ads from the po-po can prevent vengeful gamer nerds going full script kiddie – research

Re: Perplexed

I think they do that, but it takes a certain amount of time to take something down, especially when the person investigating it doesn't live in the same country where it's run, and others can find and use its services while it's not been shut down yet.

No one would be so scummy as to scam a charity, right? UK orgs find out the hard way

Re: Charities are a fraud

Some charities are frauds. Some are run incompetently. And some, quite a lot, are quite useful to the local area in whatever field they focus on. Trying to get an easy answer by putting them all in one box, no matter what box you pick, is certain to get it wrong for a large chunk of charities. Only by researching what a charity does and whether they're doing it honestly can you know whether it is legitimate or not.

I volunteer my time to some charities*. When I decided to do that, I checked out the charities involved to see whether they were trustworthy. This may be tricky in some ways, because a charity can do a lot of the same things a for-profit business does without having violated its trust, including paying some people quite a bit or spending a lot of money on certain things**. And there are definitely charities that exist in a middle area where they're not manifestly perfect. But, even with that admitted, it would be harmful to say that all charities are thus.

*I volunteer my time outside of work, but I work for a company that is definitely not charitable.

**For example, certain charities do spend a lot of money on lawsuits or travel expenses, which would ordinarily be red flags. If the charity is a legal advocacy thing, the law expenses make sense. If the charity does field research, then the travel makes sense. But otherwise, those remain red flags. So you have to consider all the available details; there's no easy equation for whether something is trustworthy enough.

The sound of silence is actually the sound of a malicious smart speaker app listening in on you

Re: "vishing"?

I don't think we need a new name for this, but this isn't social engineering. Social engineering is when you convince a person to trust you when they shouldn't and you leverage that trust. This is exploiting an unexpected vulnerability in a device so a user's data can be exfiltrated. It's malware, not social engineering. The easy way to determine the difference is whether a person needs to be involved. After writing this skill, a malicious person can push it out and get recordings of users without ever having to personally interact with any of them.

It's wonderful that both Amazon and Google had to specify that they've taken down the proof of concept malware skills. As if we didn't already figure that. What we want to know and what they refuse to tell us is whether they're actually taking any of the necessary steps to prevent active use of the same tactics. From their statements, Amazon seems to be saying "Yes we made a change, but don't ask for details. Trust me, it's fine" and Google appear to be saying "We already did, so we didn't have to make a change, it's fine, and we don't need you poking about now go away". I'm taking both statements with the annual salt output of Bolivia.

Pack your pyjamas, Zuck: US bill threatens execs with prison for data failures

Re: Relocate ?

There are places he could run to, but he almost certainly wouldn't. Even if you stick with English-speaking only, you've got countries on every continent meeting that criterion*, and you can find someone who speaks English well and willing to translate for you in exchange for a bunch of money anywhere you go.

But even if this law got passed, he would have a team of lawyers so massive that it would be years before anything at all happened to him, years that would be spent trying to get the law repealed or modified, a pardon issued, or a loophole found so that nothing would happen at all. And, by some leap of imagination we actually consider that he got convicted, I doubt the prison sentence would be very long or onerous. A life in exile isn't so desirable if you can pretend you've learned your lesson, go wherever you'd like, and leave with billions.

*I count at least nineteen countries with English as the primary official language and lingua franca across six continents, and at least another twenty with English as an official language spoken by a large enough community. Not that all of those are places you'd want to live on a full-time basis, but they at least exist.

You just pointed out the judge. Where do judges work? Courtrooms. What do they do? Trials. What happens when someone's broken the law? They go on trial. Who runs that? A judge. So how have you come to the conclusion that the judge is just going to sentence the person without holding a trial. It happens to be completely against the constitution, and, oh yes, nobody's ever advocated for it and they're not now. You're raising a completely pointless and wrong objection.

Fancy yourself as a bit of a Ramblin' Man or Woman? Maybe brush up on your cartography

Re: Any Idiot...

So the phone app shouldn't be used for this information? The paper map isn't necessarily any better. It could be inaccurate or out of date, and you wouldn't know until it became a real problem. While I get that the phone could run out of power or the app could get broken, lots of coulds apply to a paper map as well.

It's also probably worth keeping in mind that many of those people probably didn't use this app for areas they had a high chance of dying in. If people like going to a perfectly safe area containing nature, they're probably using the map to help identify and locate things, rather than get to safety. I am reasonably sure this applies to most users, and therefore the consequences for the app being useless were a ruined excursion rather than a brush with death. As such, your calling them idiots seems quite a bit harsher than they deserve.

Not a good look, Google: Pixel 4 mobes can be face-unlocked even if you're asleep... or dead?

Re: Erm

Most good fingerprint sensors won't work on a lifted fingerprint, so you have to pick up someone's hand and physically place the finger on the sensor. Since people move a bit in sleep and the sensor requires sustained contact, you'd also have to hold their finger there for a second or two. In addition, many sensors aren't great and require multiple scans, which means possibly having to lift and reapply the finger. Some people may sleep soundly enough that you can pick up their hand, separate one finger to avoid interference, and hold it to something else, but I doubt it's all that many people. The majority who would wake up would now know the exact person trying to access their device, have very clear proof, and be in convenient punching range (either from gaining lucidity admirably quickly or simply a strong enough startle reflex). Judging from how well my cat can wake me up, it won't work on me.

Welcome to the World Of Tomorrow, where fridges suffer certificate errors. Just like everything else

But I doubt the screen size is directly proportional to the processing, memory, and storage. They could have obtained all of those parts from their extra inventory and simply attached a larger screen to the result. Of course, since nobody will actually run all that much on this device, perhaps that's the most efficient choice for all involved.

Sudo? More like Su-doh: There's a fun bug that gives restricted sudoers root access (if your config is non-standard)

Re: @tfb - Already patched in Slackware.

"It is not you alone that decides who is to be trusted and who's not, business has also a word to say."

Methinks you misunderstood the main point. The main point was that giving unrestricted root access lets everyone with that access do anything. The business wouldn't want that. Nothing was said about the admins making all decisions; instead the admins would be better implementing a security policy limiting users' access to run stuff with root privileges.

"Also, may I remind you the not so few cases in which a trusted sysadmin locked down networks and systems and denied legitimate users access ?"

And how did they do that? By running commands as root. So if you give ten times as many people unrestricted root access, you have ten times as many people who could do something like that. And your disagreement with the original point was?

Re: I suspect that most didn't even know it was an option

However, that usually allows a user to sudo to only one user, I.E. whitelisting rather than blacklisting IDs. I haven't read the details, but it sounds as if that configuration would have prevented this attack.

Lies, damn lies, and KPIs: Let's not fix the formula until we have someone else to blame

Re: KPIs

And that's often because I know any score below a nine (or sometimes a ten) is seen as an indicator that someone has failed. Even though eight out of ten is pretty good, I know there will be a discussion about why there weren't two more points there. Maybe this will cause a lot of problems for the person concerned. Maybe they'll send me a dozen more surveys to try to extract the reason for my withholding those two points. And I succumb to laziness and just assign nines and tens if the thing was fine or above.

I'm not sure that would necessarily have been the case. The data was wrong, that's true. But the data was also untested. It could be argued or inferred that the managers were responsible for at least attempting to verify that the data was correct, and that they had failed to do that. If someone in HQ was of a suspicious type, they might assume that management had specifically engineered the script to function improperly and was trying to blame the person who caught them, or that management and the developer conspired to do it incorrectly and could both be held responsible.

Blame is a complex substance; when it's dropped from the ceiling it never just falls straight to the floor. Every time, it splatters everywhere.

Re: Building entry log

That's why a system actually used for safety purposes would need to have a remote backup. If there were multiple sites, a mirrored version between the two would help. If not, the records could be stored in any number of remote places. It's quite doable. However, it's quite unlikely ever to be considered a priority despite the required tech already having been installed and the real benefits it could provide.

Tearoff of Nottingham: University to lose chunk of IT dept to outsourcing

Re: And this means

"When the only upwards path is into management you end up with management by people who weren't recruited for managerial talent but could do the technical job"

Sometimes, but usually I find that if that's the case, the people who could do the technical job got promoted into management, and because they either weren't good at that job or just didn't like it, they left. So management is made up of some random people who actually like but aren't necessarily any good at management, while all the technical people who were good at the technical work left because they wanted to keep doing technical work. Meanwhile, anyone that gets hired and can do the technical job well will do so, but they see what's coming and they're just biding their time until a different job comes along.

From Libra to leave-ya: eBay, Visa, Stripe, PayPal, others flee Facebook's crypto-coin

Re: Good reasons for virtual currencies.

Well, the theory is that it's harder to commit fraud with a crypto wallet than it is with a credit card. With a credit card, they need a relatively short number which will authorize any transaction whatsoever. With a wallet, each transaction needs a separate signing with a private key, so you can't just steal part of the data traffic from a previous transaction and start making new ones. That's the theory.

In practice, we all know how that ended. If you have a great way of keeping the private key private and secure and not known by anyone and easy to get to but also not easy for you to lose, then you're great. Otherwise, you can still lose your money and now you don't have a way of getting it back.

Re: The cost in kW

"And how is that any different to Barclays seeing and notarising all my transactions, as at present?"

I can't believe you're really asking that, but let's do a few comparisons:

Banks/money in government-issued and controlled currency: Strict regulations on what they're allowed to do with money. Not perfect regulations, and not always obeyed.

Facebook/money Facebook makes: Almost no regulations save for data protection (data protection regulations offer valid in EU countries and U.K. only). Facebook has a terrible record obeying even that.

Banks: They are not permitted to sell personal transaction history to anyone.

Facebook: They not only are allowed and are definitely going to sell transaction data to someone, but they already know the people they're selling it to and have customers eagerly waiting for it.

Banks: In most places, value is insured against a bank collapse.

Facebook: Hahahahahahahaha.

Banks: Multiple available. Should it turn out your bank has not been sufficiently protective, you can choose a different flavor of not that great, but at least competition exists and is enforced.

Facebook: Hahahahahahahaha.

Banks: Should you want to prevent them from knowing what transactions you do, you have the option to make a large withdrawal in physical cash and then spend the cash (offer only functions on some transactions, notably smaller ones).

Facebook: If you think getting a different currency out of their system without a lot of paperwork and paying quite a lot in fees is going to happen, you might not have read their documentation.

Banks: They are owned by many different people, and those people are interested in the profit of the company. So they aren't super happy to incur massive fines or lose all their customers and will change policies to try to prevent that.

Facebook: They are controlled by one person and he is already a billionaire. He doesn't need any more money and he will do whatever he pleases.

Government-issued currency: Supported by the government of the country. As history shows us, this is no guarantee that it will definitely retain its value, but it is somewhat likely to do so if the country is run democratically and has a large-enough economy.

Facebook: They can pretty much decide at any time to reduce the value of their currency and have fun trying to stop them.

Government-issued currency: The government of your country of residence has the ability to ensure this currency can be used to pay people; sellers can increase prices but must accept payment.

Facebook: Should Facebook stab sellers in the back with high fees, sellers would be completely in their rights to stop accepting it abruptly. This makes Facebook's currency less reliable.

Nobody is saying banks are great. We can all get together later and compete to complain the loudest about banks, and we have plenty about which to complain. But that doesn't stop Facebook from being worse.

Re: But today I'm a reformed character

I don't think you have the right handle on monetary policy there. Let's take this point by point:

"The notes that are printed by the treasury cost about 7 cents or about 6 pence to make...subtract that and the "usery" that the central banks charge for essentially loaning the money to a government who issue's the paper money and you have what the treasury/government make on actual currency."

That would only be the case if the treasury simply ordered notes printed up and started spending them. But they don't do that. The supply of physical currency is strictly controlled by various instruments of the government. Not that they couldn't start doing that, but the U.S. government, the one under discussion, doesn't and hasn't. If they did, then trust would indeed be lost, inflation in dollar-denominated markets would spike, and people would start using other currencies for international trade.

"However this is less than 10% of "money" the rest is virtual and is worth more or less what people want to believe its worth.... And are alluded to as financial instruments..."

No, it's worth what people as a whole have decided it's worth. If I decide my investments are worth ten times what they are actually worth, I won't get any more money. People disagree on the actual worth of the things, but that's why we sell things we think are worth less than other people think they're worth.

"As an example there is now. More "money" in derivatives than all the currency ever made, minted, printed or bartered for what there's a record for."

That's true. But many of those securities are in some way tied to things that aren't money. For example, stock in a company technically is backed by the assets of that company, including things that aren't money, like code written by the company or the physical items owned by that company.

"The reason the dollar is "believed" to have "value" is because energy can only be bought and sold in $ as mentioned above... The problem is that this distorts the value of the $ and devalues all other currencies...."

Energy can be bought and sold in any currency you like. The prices are usually stated in dollars because that's convenient, but dollars are not universally used. In fact, there are certain parts of energy markets where the money used is euros, because the participating governments or companies find that more convenient.

"The danger is that a systemic failure of US economy will knock through other markets...

ie the last "credit crunch" which by a large factor the was because of IGI was unable to cover what they had underwritinen in toxic credit default swaps."

That's very true. But that can happen no matter what country was involved. If China's economy collapses, we'll feel it here. And although many American financial companies dramatically worsened the severity of the 2008-2009 financial crisis, companies in other countries also contributed.

"I'm not sure how you perceive value but if you use it as a measure of what you can buy in a store ie purchasing power then the value is about 52 cents as the rest will be taken up in interest, duties, tax and fluctuations in the fx markets"

Yes, we usually decide that value is ultimately purchasing power. And your number doesn't make sense. When you purchase something, the tax and tariffs are part of the price you pay, which they tell you. So although your money goes both to the store and the government, the value is still one dollar. Not to mention that, even if you do decide to determine the value of a dollar based on the amount of the dollar that goes to the seller, the value will be very different depending on where you're spending it and what you spend it on. If you spend it in the United States on an item where the state has no sales tax (E.G. food) and which hasn't been imported or has no tariff, then you pay much less than if you spend it in a country which uses another currency (you pay for the eventual exchange into the local currency), which has a higher sales tax, and which has paid a tariff on the item. This is the reason we don't decide the worth of a dollar by who gets each part of it; we decide based on the price of the item and how many dollars need to be paid to obtain the item.

Re: But today I'm a reformed character

No, but considering that pretty much everything requires at least a little trust, I don't think we should limit ourselves to financial things to put on the don't-let-facebook-be-part-of-it list.

China and Russia join to battle 'illegal internet content,' which means what you fear it does

Re: Satellite internet's a'comin

I just meant to reply to the thread, not a specific post. And while you could put a dish there, it probably won't have the ability to contact the satellite without a very permeable roof. I haven't tested this, but I doubt many houses will allow for it. Of course, the installation of equipment is just one problem that needs to be solved before satellite comms work as anti-censorship gear.

Re: Satellite internet's a'comin

You may be interested in the recent activities of Turkmenistan. The general idea is that, because of urban beauty reasons and definitely not because they wanted to censor, satellite dishes are completely illegal. And that is enforced; if you have such a dish, the police will come by and confiscate it. You will be fined or imprisoned. This applies to every dish; it's clear they're primarily trying to prevent reception of satellite television, but they'll take anything. That wasn't particularly difficult for them to do. That can happen anywhere.

If you think the skies will be free, I'm going to need to see a receiver for satellite internet that can easily be used while remaining hidden and even more easily hidden should a censor come to call. So that will require the device to work indoors, without being obvious through a window, and collapse to a small enough device that it can be hidden inside something else. All existing dishes I've seen are quite expansive devices and need a very precise position, meaning that it wouldn't be all that easy to take it down and redeploy it twice a day. Can you show me such tech? If not, I believe you are badly mistaken in your optimism. Even if you can show me such tech, we've only solved the really obvious problems. Plenty more methods of censorship remain.

Re: Damned Authoritarian Governements

Sadly, both already have. China has blocked pretty much every communication app under the sun. What remains has a direct phone home to a Chinese government-controlled set of servers, and of course no encryption. Russia has mandated the same in law, but because they have less technical capabilities, they haven't gotten it yet. However, they are actively blocking Telegram after it refused to assist the Russian government in decrypting users' messages.

I know you were going for the "look at the west; they're bad too", but the western spy agencies are still trying to get the law to give them the power to demand companies assist them. Russia and China already have. I don't say this to support the surveillance systems supported by the west, but Russia and China are not being attacked by a hypocritical west; they're the disaster we are headed to.

The safest place to save your files is somewhere nobody will ever look

Re: Editing Docs from Email

That's dangerous. The user could edit the document, click the normal save button rather than save as, and have the file saved in the temp directory. And then you have to answer the question "Why didn't it tell me it wasn't saving in my folder?" If you make sure they know to save immediately, thus changing what document is being edited, there's less of a chance they will totally mess up what you said once you've left. Still a chance, but a smaller one.

Is right! Ofcom says Scousers enjoy a natter on the phone compared to southern blerts

Re: I Hope This Isn't True...

As a relatively young person (I have no problem making and receiving calls), I think the opinion of those who don't like to make calls is concern that the person they are calling will not appreciate the call because they are busy or unavailable. I'm not saying this makes sense; we all have a vibrate mode on our phones for a reason. But that's the reasoning I've heard from some people and those people tend not to make calls very often.

Father of Unix Ken Thompson checkmated: Old eight-char password is finally cracked

Re: Not sure...

Sorry, but that calculation is not sufficient. You're getting the combinations of 64 characters that can come from a set of 94 possibles. But since characters can be repeated, there are actually 94^64 options. However, since a 63-character password is not one of the set of 64-character passwords, it becomes that series I wrote instead. Either way, it's a bunch of numbers. But just in case you have access to the biggest hard drive and processor factory ever, make sure you check all permutations and all lengths lower than your limit or your rainbow table will have gaps.

You want to store a rainbow table of up to sixty four characters? Well, among other things, that's:

94^64+94^63+94^62+...+94 = ~1.926*10^126 password options (using the 94 characters from the standard ASCII printables)

Assuming we store a compressed version of that string that takes, on average, 20 bytes and we also store only a 256-bit hash (32 bytes), that's

1.926*10^126 passwords * 52 bytes/password * 1 terabyte / 1099511627776 bytes =

9.112*10^115 terabytes of storage

Using the rough numbers of 600 grams for a 3.5-inch hard drive, which we assume stores 16 terabytes, and has a cost of $200 U.S., this would produce a set of hard drives weighing 3.417*10^114 kg and costing $1.139*10^117.

In other words, your rainbow table would weigh about 1*10^75 times the mass of the sun and would cost so much that, even if you diverted the gross world product to pay for it, you'd need to continue long past the death of that sun to pay it off.

Talk about a calculated RISC: If you think you can do a better job than Arm at designing CPUs, now's your chance

Re: "I did not know that ARM actually prohibited adding instructions"

I don't think you understand what is being said. You are telling us that, if you request and parse the CPU ID before every questionable instruction, it would add a lot of overhead. When you say this, you are right. When you say this, you are missing the point. The ID is not retrieved and parsed before every possible instruction. It is retrieved and parsed (only if applicable), at the beginning of execution. Then, things are updated to use the proper instructions. The overhead is only incurred once, and that is a negligible time cost. You ask for examples of things doing this. I would direct you to nearly every program that uses one of the instruction sets that are widely supported but not universally so. Using my example of AES, look at disk encryption programs. They will do exactly this. Other extra instructions are frequently used conditionally by programs such as VM hosts or anything where the marketing includes the phrase "hardware acceleration".

As an example on how this is done, consider this pseudo-assembly, with AES acceleration as the example:

#function that does encryption in hardware:

run_cpu_aes_instruction parameters

return

#function that does encryption in software:

bunch_of_normal_math_instructions parameters

return

#main function:

encryption_function = do_it_in_hardware

//Note: I've written this like a variable. I do know about computers, so I know this would be implemented by storing a number in a memory location or register. I wrote it like this for simplicity of reading

Retrieve CPUID

Parse CPUID

if (CPU can't perform hardware AES):

encryption_function = do_it_in_software

#rest of program

In this simple case, the only thing that's changed is the value of the pointer encryption_function. The rest of the code merely jumps to it. In the real world, there would be more complexity because they'd probably write the code to avoid the function-calling overhead too. But I hope you get what we're trying to explain.

Twitter: No, really, we're very sorry we sold your security info for a boatload of cash

Re: If something is free, YOU are the product being sold

This is far too general. In some cases, it's simply not true. Plenty of software is released for free without expecting data or anything else of value. And, in many other cases, people pay for a product and have their data stolen regardless. To some extent, you could say that "If there are ads on it, you are the product", but that's not necessarily always the case either.

I know what they mean. They mean that the phone numbers weren't simply packaged up and emailed to the advertisers, I.E. no data was "shared", deliberately on the basis of "let's share this big list of numbers". However, the data was, in fact, shared because the advertisers got matches. The matching software ran on Twitter's servers and not the advertisers', that is all. From the perspective of the users who had their numbers stolen and given to an advertiser, there's not much difference. I would cheerfully accuse Twitter of almost a lie in this occasion. They know what this means but they were deliberately deceptive to try to make it sound like less happened. Definitions of "lie" can change, but it was clearly less than honest.

Geographic coverage

We now need to find out where this applies. If it applies to European users, they may be in for quite a fine, as this is a pretty clear GDPR violation and they probably didn't disclose any of this as they were required to do. Why do I have this sinking feeling that it applies to everyone but the European users (just check, investigators, you'll clearly see that the server says "everywhere-but-europe.twitter.com" and why would we lie?) or that those with the power to hand out fines will consider it and then forget?