Posts by doublelayer

Reply-All storm sparked by student smut sees school system shut down Google Classroom for up to a week

Re: Clearly run by dummies

"Why isn't a mailing list set to provide emails to each person in turn, or to a dummy address with everybody else stuck in BCC? I'd be pretty pissed off if a school was willingly sharing my email address with all of the other students..."

Almost certainly, it is set up as you suggest and they aren't giving out addresses. It's just that they forgot to change the all-important setting of who can send to that list and have it operate for them. Usually, there's an address which sends the message to all the addresses in the list without showing that list to the original sender, but if anyone on the list can be a sender you end up in the same place.

Pot, meet kettle: Google claims Australia's pay-for-news plan could see personal data put to nefarious uses

Re: Paying El Reg

They would have you log in, which we already are, and then if you had purchased a subscription they would delete the ad frames, the Facebook share button and secret pixel, the various other buttons, any other third party scripts, etc. They could do that and I would pay for it. No tracking doesn't mean they would be blocked from having a log in system, but that they would be blocked from collecting information based on it or letting someone else do so. I already trust them, so the only important bit is "letting someone else do so".

Mozilla signs fresh Google search deal worth mega-millions as 25% staff cut hits Servo, MDN, security teams

Re: Sad to see the end of Firefox

And how often do you make new accounts? How often do you completely erase Chrome, including those secret tokens it stores somewhere (or maybe it doesn't, but try proving that). Because unless the answers are "every twenty minutes" and "every five minutes", your efforts are likely not as useful as you think they are. If you create new accounts but use the same Chrome installation, then it could just link those created accounts together. Eventually, it will create not only a profile of actual information you've entered (for example, any time you made a payment it has a reasonable chance that you entered trustworthy information), but also a comprehensive list of pseudonyms and dummy accounts to which you have access.

Re: Diversified to death?

"There's no money in a browser engine?!! Come again? They're raking in $400 million (!) a YEAR."

But not for the browser engine, for the market share. The engine itself isn't making them the profit. Should Google succeed in getting Chrome to 98% market share, they wouldn't have any reason to keep paying Firefox to send users to their pages and earning them ad revenue. The engine is the thing that is most reassuring about Mozilla, because they haven't abandoned it and it continues to allow some competition, especially important as Google keeps putting things into Chromium that rely on Google-run services. Basically, the thing that makes Mozilla money is their history of having a great browser, and they are currently using at least some of that money in maintaining a good browser engine.

That doesn't help. Firefox security is critical, and it's the main security team that I care about, but Mozilla's recent product is a VPN, which is one of the ways they are planning to make money. That isn't Firefox, meaning the Firefox security team probably doesn't work on it. Who does? I probably wouldn't be that confident investing in a VPN if the main organization security team had been completely eliminated, and Mozilla is facing a market that already has established competitors while their effort is only a couple months old. I would have thought that it would be in their interest to put as much behind this project as they can to ensure customer confidence and hence customers.

In addition, they must know that firing workers without a clear indication of funding problems is going to cause concern among those of us who pay the most attention. Those people who pay a lot of attention are also the ones most likely to understand the benefits of and need for a VPN. So they are going to risk harming their image amongst what is probably the largest demographic of VPN customers. I don't understand that decision.

NHS tests COVID-19 contact-tracing app that may actually work properly – EU neighbors lent a helping hand

Re: Like to have an expert check the privacy statement & app

I believe your downvoters (for the record, I'm not one of them on either post) are concerned that the app will collect or retain data not specified in more readable statements. It is possible to do one's research by reading the published source, manually build, and attempt comparisons between that and published binaries, but it's not easy. I'm sure it will happen. If I was in the U.K., I would probably spend time doing so. Depending on your level of trust in the government, you may disagree on the need to do such research anyway.

Re: Over sensitivity

"Why is there so much of a concern that the app may be too sensitive, and is likely to over estimate the risk of infection from people 2m or more away?"

It is a lesser concern than various other potential problems, but mostly the worry is that people will become desensitized to requests to quarantine. If the app detects people at a distance, then it will probably pick up lots of them who are on the other side of walls or windows. If it produces a lot of warnings from this then people will be frequently requested to quarantine. If people quarantine without symptoms for a few times, they may think the app isn't doing anything, meaning they ignore it next time it says something. These particular ifs haven't been proven too happen yet, but it could reduce the efficacy of the app if they did. There are other concerns which are more important, including the opposite (no reports because of lacking adoption or testing leading to complacency), but it is at least worth some consideration.

Well, what are we waiting for? Three weeks later, Windows Embedded Standard 7 still didn't have the answer

Re: The old laptop killer

That's annoying. We should see if we can get all the boot encryption systems to have a timeout after which they power back down. At least one I know of does that--if I don't enter my encryption password within two minutes or so, it shuts down again.

The Surface Duo isn't such an outlandish idea, but Microsoft has to convince punters the form factor is worth having

Re: Does it run Windows?

Out of curiosity, would you want it running Windows? It's running Android, which well I'll admit I don't like it very much, but at least it's open and compatible with other mobile devices. In addition, Android has been designed for mobile devices with touchscreens as the primary or only interfaces, which is what this has. Windows has been adding that support, but I don't think the Windows tablet experiment worked very well given that I haven't seen any of the cheap tablets still around and every Surface I see has a keyboard connected. Then again, they're also working on a Windows-based thing that's shaped kind of similarly, so maybe you'll want that when they get around to releasing it.

COVID-19 has done what Microsoft and Intel couldn't – given people a reason for a PC upgrade

Re: Upgrades not replacements?

If the business bought it, it's probably a Thinkpad so it's easier to standardize and repair. I think that was probably most of it, as Lenovo is better known to businesses than to the average home user. Home users may have gone out to buy new machines to some extent, but they probably buy whatever is available at the local shop, which probably means cheaper machines from Dell, HP, or Asus. Also, home users are more likely to slow their purchases while businesses which previously used desktops had reason to buy lots of laptops at short notice, so that might also contribute to a primarily business-oriented buying spree.

Texas jury: Apple on the hook for half a billion dollars after infringing 4G LTE patents

Re: It really is time that anything included in a standard is royalty free.

Updating my comment immediately above: I wanted to provide more information on a topic more relevant to this case. My example on radio broadcasting still stands, but since it's not mobile telecoms, let's instead look at OFCOM's regulations on mobile telecoms. On the above page, there are documents describing frequency bands which can be licensed by providers for use in a wireless telecommunications network. Below this is a list of standards documents that have been regulated into use by EU directives, the U.K. government, or both. These include technologies known to us under the headings 3G and LTE. They do not include a do-anything-you-want provision. They also include a requirement to interoperate with international service providers. In my opinion, this counts as government endorsement of specific standards.

This endorsement is a good thing. This allows phones to be in use worldwide, assists the development of better communications technology, etc. I feel that this endorsement also gives governments a good reason to have more control over the standards they are using in such ways, up to and including extra powers to increase requirements for FRAND-style IP regulations. For all I know, the ones in use here are entirely fair; I'm still not knowledgable about this case. In the case that a standard is created and given assistance in a similar way, and the terms are not fair, I view the conditions to which these standards are often put means that there is adequate rationale to restrict what licensing provisions can be applied to the IP.

Re: It really is time that anything included in a standard is royalty free.

"I think you misunderstand how 3gpp works. It is not a governmental organisation and the standards developed by 3gpp are not approved by government"

I'll be the first to admit that I'm not particularly knowledgeable about the IP included in this particular case. My comments were more generic, and if they don't apply here, they still apply elsewhere. Plenty of standards in wireless communication are approved by regulatory bodies and include proprietary technology. For a basic example, digital audio radio broadcasting. It's not exactly the closest match to this situation, but I'm using it as my example because the technology is so simple. There are a few technologies in common use in different countries, but in most cases, each country has one standard which is in use while other standards are not approved outside of experimentation. The most common standards are DAB+ (Europe, Australia), DAB (U.K.), HD (Canada, U.S.). Each one contains different proprietary technology, including which audio compression engine is required, meaning license fees from all radio stations and possibly all radio receivers (some standards require it, some don't seem to). Each is supported by a government-enforced monopoly in those countries in which it is used. This is the kind of situation I am talking about. Perhaps I should have done a better job to indicate the general coverage of my original post, but in my opinion, such monopolies may warrant more expansive FRAND restrictions.

Re: It really is time that anything included in a standard is royalty free.

Original: "meaning the holders of the IP now have a license to print money at the expense of all the other manufacturers and consumers"

Response: "No, that's what FRAND is for - Fair, Reasonable And Non-Discriminatory royalties, if your invention gets adopted into the standard."

Exactly. I understand that. What I am suggesting is that possibly the FRAND standard allows too much leeway, and in some cases where standards are supported by an external party, it may need strengthening. You'll note that there seem to be many disagreements between IP holders and IP purchasers about whether terms are in fact fair and nondiscriminatory, which are rather important. Legislation may not be able to handle the fair price part, as the more leverage the IP holder has the less likely they are to agree to any price short of their original ask, but legislation might be able to produce better terms that enforce nondiscrimination. Only by investigating where the current FRAND process fails can we figure out what if anything is needed and how we can apply policy that will improve the situation.

Re: It really is time that anything included in a standard is royalty free.

That is concerning, but so is the alternative which is that a standard is made and soon adopted by a government which makes it the suggested or only approved option, meaning the holders of the IP now have a license to print money at the expense of all the other manufacturers and consumers. If some standards organization without any conflict of interest wants to make their own standard with proprietary technology, it doesn't harm people very much. If it's a standard that can be forced on people, not so good. Mobile communications standards usually require regulatory oversight, meaning that if you get a patent into a standard and get that standard approved as the only accepted way for people to use their phones countrywide, you have a lot of money on the way. And since we get a lot of benefits from using similar technologies all over the world, if you can get that standard in use somewhere powerful before other countries adopt their own standards, you have even more chance to get money. With that kind of gift being provided, I don't feel it's too much to require that standards that are part of a governmental requirement be subject to more restrictive requirements on royalty rights. We could work to ensure those restrictions don't allow a small company with a really good idea to be trampled, but if that small company is planning to trample others by charging them ridiculous prices once they get a monopoly on standard compliance, I lose my sympathy.

How is Trump's anti-Chinese rhetoric playing out? 70% of smartphones sold in the US are – surprise – made in China

Re: HTC Korean

Samsung and LG are Korean, and they manufacture a lot of their components there, but they've been known to use Chinese assembly and even sometimes Chinese components. Should they be forced to move out of the Chinese supply chain, they're better suited for it than most. HTC is based in Taiwan. I'm not sure where all of their stuff comes from. It looks like they have manufacturing capacity for assembly in Taiwan, but that might not be all of it and I don't know where they get components. So they might not have such an easy time if China's components become unavailable.

Re: One Possibility

"Between robots that actually work, much enhanced 3-D printing and the possibility of shipping much stuff to folks as "kits" that any twelve year old can assemble, the classical "factory" may largely fade away in the next few decades."

Your first two are possible, but your last one seems unlikely to me. That would be nice, but I don't think much will be made in kit form for two reasons. First, companies like their planned obsolescence, and making it easy to assemble and probably disassemble their products isn't going to appeal to that kind of place. Second, the places that do make kits for things often don't make one any twelve year old can assemble. Instead, they make one that twelve year olds who already know how to assemble things because they have all the tools and have broken enough stuff to know how to operate them can assemble into things that still look a bit fragile. With people wanting durability and convenience, I can't see many things going that way, especially things like phones with expensive components (and dangerous ones giving the high-capacity battery) which people would like sealed for water resistance.

This is node joke. Tor battles to fend off swarm of Bitcoin-stealing evil exit relays making up about 25% of outgoing capacity at its height

Re: Passwords Everywhere

That's weird. I'd have thought that you wouldn't need very much code to implement it. I would think that the following offline code should do it:

on event UserRequestsPage(string url) {

if "http:" in url {

UserReallyRequested(url.replace("http:","https:"))

}

}

It should only need access to the address bar, not the page itself. Maybe it's browser permissions looking weird. If it's doing more than that, maybe it's time for us to write a replacement.

Re: Too stupid to care?

Sadly, it's not exactly that. A server implementing HSTS has to say this and not allow normal HTTP access. However, a site can implement HSTS and still allow HTTP connections which get redirected, and a lot of them do to avoid looking broken to people who aren't familiar with it. Take my site for example. If you request any page over HTTP, the server sends a 301 saying it's been moved to the HTTPS site. So you can't retrieve something over HTTP from my server directly. However, an attacker who is replacing your traffic could intercept that HTTP request, not give it to you, fetch the real page from me using HTTPS, and present it back to you as if my server hadn't attempted to do the redirect. There are some pretty good solutions to this, but each comes with a downside:

1. I could block HTTP requests rather than redirecting them. This forces all connections to be secure and makes it harder to pull the redirect on someone. It means that people who type my domain name and whose browsers attempt HTTP will think my site is down though.

2. The user could check the address bar for the secure site icon and the domain name they're trying to access. This would take them all of three seconds.

3. The user could type the HTTPS. This would take them all of two seconds.

4. The user could install a plugin that does 3 for them. It might break and they'd have to remember what they did so they could click the button to allow the two exceptions.

5. The browser makers could modify their default policy for when a user enters just a domain name and try to send an HTTPS request first. If and only if it fails send an HTTP one.

Re: I continue to be surprised

"Now, conversely, if I were running a Bitcoin exchange, I would definitely want https to be the default setting, if for no other reason than wanting to ensure that the Dunning-Krugerrands wind up in my pocket and not someone else's when I decide to fake my death and abscond to a foreign country with the proceeds of my clients' ill-placed trust."

The problem there is that the attacker probably does use HTTPS to connect to the exchange, just with them impersonating the client. It's probably not easy to determine that it's not the user on the other end, and almost certainly such a coordinated group has different nodes making the connections so they can't be identified as exit nodes and blocked that way.

"If I were the client of such an exchange, I would definitely pay close attention to whether https is being used as well, but I'm not sure what the interface for such a thing looks like, so maybe it's not obvious."

The exit node can't easily provide a forged certificate because the client's machine will still verify it, so they're probably seeing the insecure site icon like on any other HTTP-only site. Either that or they get redirected to a secure site that is controlled by the attacker and therefore doesn't use the same domain name. It would really help the clients to make sure that is not there whenever they're accessing something sensitive, but maybe it would be better for there to be a setting to enforce that. That doesn't seem out of character for the Tor browser to warn or even block HTTP-only on the clear web and 301s pointing to different domains.

Re: I continue to be surprised

"HTTPS doesn't stop your ISP, TOR exit node, etc, from seeing what sites you go to. This is mentioned in the article."

The article mentions that connections are often made to cleartext HTTP pages first before being redirected, which gives an attacker an opening, but that's just the first page. It gives some detail about the domain, but that's it. For example, I'm not even using modern security but my ISP doesn't know what pages I visited during my session here. They would know that I'm active and reading The Register, but not which articles I read. I don't really care if they do know that, but I might care about similar information leaked from a different site. For this reason, HTTPS is useful even when you aren't sending information. In addition, more advanced security measures can keep my ISP from knowing some of the information they could get before, (although since this site uses its own IP addresses, I couldn't hide everything without VPNing through my ISP).

Can I get some service here? The new 27-inch iMac forgoes replaceable storage for soldered innards

And why do you do that? A disk failure can happen to any of your disks, so you're no safer your way than the other way. If you're concerned about software writing over the files because it's on the OS disk, you could create a separate partition on the same disk. If you have enough data to use seven external drives, more power to you. If you want duplication so you use seven drives, that's fine too. Some people either don't need that or are happy to have that on their backup system. For example, I use multiple drives to store backups, but I use a single disk in my laptop to do everyday work. It is faster to compile a bunch of code if it's read from inside the machine than if it has to be pulled off a RAIDed set and over a USB cable or the network. Worse, the original post suggested that this would be happening with cloud storage--retrieving from RAID on my local network isn't great, but retrieving from I don't even know what the hardware's like from the nearest data center is going to add plenty of problems while I'm trying to get work done. Back up there for off-site media, certainly. Read production media from there every day for performance-sensitive tasks, not a chance.

Of course the professional users will have a backup. Unless they are only professionals in their field and don't know how to, but most of them will have a backup. The backup is useful in case of drive failure, because you can replace the drive and restore the backup to it. Oh, wait a minute, I meant that the backup is useful in the case that the drive fails and the user has to either boot to the backup disk, probably over USB, or restore the backup to a new drive in something else. Neither is a good approach if you need fast throughput, because you probably didn't buy two machines to do the fast professional work on when you only need one. You could buy a spare iMac, and if your work is really important you might, but it might be easier just to buy something that can take a new disk and put a new disk in.

As for network storage, no, that's not going to work. People who need local processing usually also need local storage so their processing actually helps. If you get a processor that's twice as fast as the old one and put your data on a network connection that slows you down, there's little reason to have bought the faster computer in the first place. Sure, the data gets synced to the network eventually, but it's for a rolling backup and for easier access. When you're doing complex stuff with said data, you want it on the same machine that does the processing, and usually with the fastest access you can get, which is why there's a business for really nice SSDs and in-memory caching.

What are you gonna do? Give me detention? Illinois schools ban pyjamas in online classes

Re: Hmmm, how the hell?

"better still to have the kids cameras disabled unless absolutely necessary. Not least the privacy aspect"

I agree entirely, but I have recently heard that many schools are requiring their students to keep the cameras on to enforce the attendance policy. I'm not sure how I feel about this other than glad I don't have to experience it. If it happened to me, I might have to try the "my camera doesn't function because it got damaged" gambit. Fortunately all of my current meeting members don't care in the slightest that I don't turn my camera on because most of them don't either.

Publishers signed up to Apple's premium News may be less than 'appy to discover the iGiant snatching readers

Re: Walls

"Try getting Outlook to talk carddav and caldav, and you'll see what I mean."

I think you'll find that, if Outlook won't do it, Thunderbird might, or one of various other programs. Openness doesn't always mean that the included tools do everything, but instead that if they don't, you can replace them with something that does. On Windows, you can. On Mac OS, you can. On IOS, you can't.

"As for browsers, I have seen Brave and Firefox on iOS, and I doubt they're the only ones."

They're not. There's also Chrome and the Duck Duck Go browser and Edge mobile and they all run the same engine so it's still not open. But you knew that already, saying this:

"That iOS isn't open, well, duh. That wasn't the point."

Maybe all of us are pretty stupid then, because that's what I thought your point was. You* started by saying "One of the original reasons you'd use iOS or MacOS was because it would at least interface with Open Standards so had choices and could use a back end that was Open Standards compliant (aka nothing made by Microsoft other than by accident)." Openness seemed to be somewhat important there, at least the openness of choice, which is what all of us were talking about. If your argument isn't about that, could you explain what you are talking about and why you used the term "open" twice during that argument?

"Also, it now DOES have file management (it had it before as apps, but there's now a file manager as part of the standard build), which suggests you haven't been near iOS for a while."

It didn't before and it only sort of does now. Apps that did file manager things before were doing that within their own sandboxes. Moving files into and out of apps was painful to the extent that you basically needed Dropbox to do it as they were the only service that had good integration into most apps. What is the situation now? Well, it's much better. Why? Because Apple made iCloud Drive, which is basically Dropbox. It got integrated into more apps, but not all of them. I can't use that file browser to retrieve my document from any app, only apps that support it. Going into it now (latest IOS 13), there are several apps that store files but I can't read them; I can only get those by using the mechanism built into the app, which in some cases means iTunes file sharing and in other cases means weird web server thing. There's also one app that stores files, I can read them, and I can't find anything because the app has stored each one individually using directories with random hex string IDs (presumably the developer just connected their file system to the IOS one without giving me the database the app uses to associate files with these strings). It's also tricky to open a file in another app. Sometimes, I have to use an internal app button to do it. Sometimes, I have to use the file manager to send the file to the app. This is the difference between a file system and an open one. With an open file system, I'd be able to know exactly where the file is, and the apps would as well.

MacOS is open, at least for now. It has been since NeXT days (a little ironically), and it's one of the things that drew me to it. Despite the fact that IOS has a lot of the same code running its lower levels, the fact that I can't run or change those means IOS is not open. I'm using open here to mean openness of choice, standards, etc.

*You: Technically, there are two posts by an anonymous poster. Based on the similarity in points and that they are in the same thread, I assume them to be the same person.

Pay ransomware crooks, or restore the network? Guess which way this city chose after weighing up the costs

Re: Ah IT 'managers'

If it is considered important enough, the law can be modified to clarify that paying money to someone else knowing that they will be paying the ransom means you are equally culpable. In fact, I'm surprised that's not already what the law says for cases like that. It won't stop it entirely, but by driving it underground there will be fewer people who will pay and less reason for other people to create similar malware.

"Imagine if there was a criminal charge that would be levied against senior manager or officials of an organisation for allowing their security to be lax enough that they 1- allowed a significant and dangerous malware onto theri network and 2 - their systems were too poorly configured/maintained to allow them to recover from 1 in a timeous way."

On the surface, this sounds nice. I'm all for accountability, and the senior management is the place that most often needs and fails to be accountable. However, I think the criminal penalty would probably break things, and maybe we should be more lenient but more precise in our penalties.

If such a criminal penalty were enacted, almost certainly it would include a provision making it the fault of the technical people if they could be proven incompetent. For example, the senior managers hire people and pay for backups, but the techs don't actually do that. It makes logical sense, and it would undoubtedly get lobbied into the law. The problem here is that, in every case, the senior management will do everything it can to put the blame on somebody in IT rather than take the blame themselves. They will be backed up by the legal and financial power of their business, while the IT person will be backed up by their life savings, which will have to serve for their protection from charges of incompetence and for their legal expenses for wrongful dismissal. The answer to this would probably be things like required audits by an independent third party to confirm that IT are doing what they should be doing, which would be nice, but would also mean IT has to keep stopping normal work to complete the audits and the business has to pay for them frequently. This is easy for a large business, but it could make things hard for the small ones.

Re: Yes but no

"I hope they do not fire their IT staff."

I'd be surprised to hear they have much in the way of IT staff. I'd guess they have a couple people whose job is maintaining desktops and contracts with places to write web apps they need to provide city services, meanwhile the maintenance of infrastructure, backups, etc is handled by whoever needs it at the time. I've seen many systems run in this way because IT is a cost center, and backups even more so. Then this happens and they can't recover because they didn't make any backups or provide for a restore process.

Re: I wonder if...

"Assuming they leave their calling card and have a 'reputation' to protect"

You assume a large thing. A lot of ransomware artists don't see their job as requiring a reputation advantage. The smaller the scale of their effort, the less reason they have to write a decrypting program or actually check they're encrypting correctly instead of just corrupting every file. Even for those longstanding efforts that do have a reputation, nothing stops a competing criminal from designing their malware to look like one that is more trustworthy, if such a word can be applied to malware. It's been done to attempt to throw off attribution; it can be done to get more money.

You had one job... Just two lines of code, and now the customer's Inventory Master File has bitten the biscuit

Re: Who in there right mind would...

Usually, someone without a lot of extra space, such as someone on an old 1970s-era computer. I don't know what the disk situation was like on that, but I'm guessing it was not easy to find twice the disk space to make a backup of the database file and that, if you did, it would take quite a long time to make the copy. Now depending on the size of the file, it's possible they could have made an extra external backup onto other media, but that also might have taken a while. When faced with a situation so seemingly easy (a single SQL statement does it in modern times) with a backup requiring nontrivial effort, someone might trust their intuition for proper coding, which probably worked just fine the last hundred times. Then uh-oh.

What happens when holes perfect for spyware are found in the engine room of millions of Qualcomm-based phones? Let's find out

Re: Why do us customers bother?

It didn't, but nor is the AMD64 architecture responsible for Intel's many failings. It's not the architecture, but the design. I believe the original post here is responding to comments of the type praising the benefits of ARM when Intel security vulnerabilities are discovered. Those comments, while technically correct in the sense that ARM is not the same as Intel, are making two large mistakes. First, they make an apples-to-oranges comparison between Intel's design and ARM's architecture. Second, they ignore the possibility that an ARM manufacturer might do a similar thing. I interpreted the original post as pointing out these errors and cautioning the writers of such comments that nothing is foolproof.

Whoops, our bad, we may have 'accidentally' let Google Home devices record your every word, sound – oops

Re: Or more likely ...

Really? Amazon offers advertisements too. They want to sell things, but they don't care whose things they're selling as long as they don't make one of the items concerned. In order to get you to buy all those things, they need to advertise items to you, meaning data collection, and in order to maximize their profit, their advertising arm will be happy to sell that opportunity to the most motivated merchant. Your description of Google's usage of the data applies to Amazon in every particular. You may have underestimated their appetite for data or how they will be using it.

Android user chucks potential $10bn+ sueball at Google over 'spying', 'harvesting data'... this time to build supposed rival to TikTok called 'Shorts'

Re: Do end users have standing to sue over this?

That may be, but although we knew it was very likely, I don't think we had proof that Google had that level of spyware in their code. It would make sense that they did given their previous attitude toward our privacy, but it's also not a very useful method of violating our rights. If their code does provide them enough information to identify apps to compete with and tactics to use when doing so, it also offers the proof of what we assumed. Given that proof, it's time to use it to attack Google for their privacy problems from all fronts.

Re: Do end users have standing to sue over this?

No, they have reasons to sue over the other things and this too. You've described the data as what apps and how long (I.E. when). There are several good reasons I don't want Google to have a log of what I do with my phone, including when it was in use for each thing. And there is no good reason for them to collect said information. I as a user would feel this alone violates my privacy.

Now, if the allegations made here are correct, they have a lot more data than that. If they are analyzing how I interact with apps, it's probably not just seeing whether I use them a lot, but instead seeing how they are used (E.G. which utilities of each app I am using), how active I am during use, etc. This has all sorts of potential to contain personal information, and I can't know it's happening, let alone see what data is collected or control it. This is deeply concerning. The only potential reason not to punish Google intensely for this is if they can prove that it doesn't do what the allegations say it does. I haven't yet found a good technical analysis of this, as most of the coverage of the topic has happened in the past few weeks. If they can't release a comment that can disprove the allegations, I predict numerous complaints worldwide, and those complaints will be justified.

I got 99 problems, and all of them are your fault

"It's the attitude towards the person they have asked to fix the problem that matters."

A thousand times this. I have no objection fixing things for my friends or family, even if it's an annoying problem and it's all a result of their actions. I may get a little annoyed if it takes hours to fix it, but my grumpiness is directed at the machine, not the user. That is, I don't have a problem fixing that if they understand that my efforts are helpful and they are benefiting from my work. It's when they complain about my help when I consider saying "not my problem". For example, when I need something from them to finish my recovery and they just don't want to provide that right now because they're doing something else on their weekend, I consider informing them that I too have some ways to spend a weekend so maybe they can find someone else who doesn't mind performing IT work for free. If someone requesting help doesn't do that, they usually get dedicated assistance from me.

National Crime Agency says Brit teen accused of Twitter hack has not been arrested

Re: Victim shaming

"As for victims the way I see it (my view) is that the victims are the ones who lost money and the people who had their accounts hacked."

You are correct, they are. There are a few crimes with which this could be pursued:

Obtaining access to a computer system without permission: Victim is Twitter.

Accessing protected data without authorization: Victim is account holder.

Theft and fraud: Victim is person who submitted bitcoin.

So all of these crimes can be pursued, including by other countries. The one currently being discussed most by law enforcement is the first one, so that's why the U.S. has gotten into it. That doesn't stop other countries requesting to charge the perpetrators on the others though. Probably the reason for the first crime to receive more attention is the value of the crime; the damage to Twitter is valued highly, while individual victims who lost some money is a smaller thing. I would expect that to also get handled in the upcoming trials though.

Re: Victim shaming

Your concerns are valid and they are often taken into account during extradition hearings. In many cases, if country A does not think the event was a crime, they will refuse to extradite. If country B's punishment for the crime exceeds country A's, it is common that country A will only agree to extradite under some conditions including a limit on punishment. These considerations are often seen in such cases, and there have been cases where country B decided not to meet country A's requirements and country A refused to extradite and charged the suspect themselves.

As for your discussion on where Twitter is located, that is somewhat clear. The company is located in the United States. They may own other entities, but the entity which controls the servers which were broken into is the main company based in the United States. The crime that is mostly being discussed here is accessing those servers, meaning that the locations of the people impersonated is not at issue. The location of the people used during the attack is similarly unimportant. In this case, the U.K. and U.S. both have jurisdiction over this particular suspect, so the U.S. may request to have the suspect tried there. If they do, the U.K. will be free to refuse that request and they will consider points such as yours when they do. It is worth keeping in mind that, should the U.S. make a request, it is not only legal but very standard for cases such as these.

Re: Victim shaming

"Then again why should Mason Sheppard be tried in the US, British citizen in UK when it happened, surely subject to UK law."

Crimes can be tried either in the country where the perpetrator resides or the country where the crime took place (for digital crimes, this means the country of the victim). For this reason, it's rather normal that there would be the potential for this crime to be tried in the U.S. and extradition requested. The U.K. of course has the option to refuse extradition and try separately. The U.S. might want to extradite to the U.S. rather than wait for the U.K. to try the suspect in the hopes that information from all suspects might lead to more effective trials; for instance, if the same investigators get to question all suspects, they are more likely to get information against others involved.

Geneticists throw hands in the air, change gene naming rules to finally stop Microsoft Excel eating their data

Re: other excel woes

"Still no easy way to cycle thru sheets via keyboard (hint CTRL-TAB would be nice)"

In mine, CTRL with page up and down does that. it isn't great if you're at one edge and want to go to the other one, but otherwise it's pretty useful. Maybe that will work for your situation?

Re: I must be missing something...

"I don't know why you think scientists who are experts in their field, should be any better at office software than they are say at plumbing or arc-welding."

They should because the office software is part of their job. Now probably it shouldn't be that big a part, but if they insist on using Excel for their database, then they need to know how to use it for the database-style things they intend to do. Column typing is one of those things.

I'm a programmer. I only need to know how to write code, so I shouldn't have to know very much about infrastructure which I don't administer, right? We probably all know programmers like that. Yet that knowledge is crucial to understanding how my code will be working and therefore making my products useful. It isn't a thing specifically named in my job description, but if I don't know how to do it, I am not as good an employee.

Re: They are creating a database ...

Some people have this very strong aversion to databases. They don't necessarily provide a reason, and if they did you wouldn't understand it. I've seen lots of people do this, including several types who know about databases but still use spreadsheets. Part of it might be that they don't want to have to write the UI around the database and the only reasonably common portable database format is SQLite*, but that's not a great reason.

*For example, the MS Access database format isn't easy to open if you don't have a license for Access. Dumps from other databases might need tailoring if you're using a different server, or people just don't want to run servers. I view an SQLite file as a perfectly valid way to send a dataset, but I'm comfortable issuing SQL queries. I don't know if there are good GUIs for that which allow viewing, sorting, adding, and all of that without needing to learn SQL, but if not maybe we should write one for the biologists. Anyone want to collaborate on that open source project?

By the way, XKCD has been prescient as always.

Call of duty, modem warfare: Taiwanese Qualcomm rival MediaTek teams up with Intel for first stab at 5G laptop chipset

Cellular laptops really that useful?

I wonder whether others find cellular connectivity much of a factor when thinking about laptops? I tend not to. Although I can get some utility from having the connection available and I'm sure there are people who work outdoors more often for whom this is even more useful, I've always used my phone's connection for that instead. The primary reason for that is that, in my experience, mobile providers don't really care about people who want a connection that will stay down most of the time. They all seem to charge an amount that is required just to keep the line in service, either a fee explicitly for that or a bill for a data allowance that didn't get used. So if I need the laptop's connection only occasionally, I end up paying an extra service fee even when I don't use it. Meanwhile, my phone already has service and I don't have to pay any more to use its connection for tethering. So is it just me or is this feature one manufacturers have cared about for many years while users mostly don't?

USA decides to cleanse local networks of anything Chinese under new five-point national data security plan

Re: Human Rights

"Does China have greater surveillance of its citizens than the USA? I very much doubt that it does overall."

You may think this, but that is incorrect. China really cares about surveillance, and they have it in spades. They have software to track communications over phone or internet. Software to monitor movements using vehicles, and increasingly pervasive camera surveillance with some of the best facial recognition technology. But these only cover the cities, right? Wrong. They cover a lot of the area, and they link people based on any metrics they need. When they decided to repress a group that was annoying them, they rapidly expanded their surveillance to cover the Xinjiang province and areas near it in other provinces. But you had another point to make:

"Far more Chinese citizens live in extremely rural areas where there is no CCTV, just for starters."

Nope. Those areas are indeed poor, without many of the nice conveniences for life which also make surveillance easier. Want to know what they still have? They have cameras. There's another reason for this. China has had a long history of trying to keep tabs on their population. Going back to the 1950s, it was critical to know who was doing what. Back then, cameras weren't really an option, but a strict hierarchy of power and responsibility was. China built that. Now, they can use technology to support it, but they still have that hierarchy. Part of that is responsibility to watch people for certain activities and know things about them. It's inefficient, but it works.

Countries like ours are dangerously willing to surveil us. They have powers that we need to curtail. They have been taking advantage of anything they can think of to increase their capacity. But we can still do things that China has prevented. A lot of the reason for that is that our countries don't use their surveillance powers against us very often. China is better at it because they use it all the time, while our countries may have the capability but by leaving it unused they don't have as much ongoing data.

Our governments may be interested in ideas like a social credit score, automatic checkpoints requiring constant confirmation of a person's identity and status, or elimination of encryption, but it is China that has already successfully implemented them.

Ever wonder how a pentest turns into felony charges? Coalfire duo explain Iowa courthouse arrest debacle

Re: There's more..

But in order to make that decision, we have to ask why those professions get those privacy benefits. Lawyers make sense, since they are ostensibly the protection layer between people and their accusers. How about doctors? Why do they get that protection? According to this article on the subject, it's designed to ensure that patients tell medical professionals enough information that they are treated properly. On that basis, you can make an argument that security testing is similar to medical--they are also ensuring that the person or organization who is using their services is healthy, and you can draw coherent though tenuous connections between tasks performed by security testers and doctors. The argument isn't the easiest to make, but in my opinion the argument for medical privilege isn't particularly convincing either.

"Just because someone has been arrested and then released without charge if the case is still open do you delete everything"

In this case, charges were dropped. This basically means that the case isn't open. It's possible for someone to decide to file new charges, but unless that happens, the people concerned are not subjects of any charges and not arrested. The case is effectively closed, not open.

"do you delete everything e.g. the interview. Do you delete everything when the case is closed and say someone else is convicted. Surely you still have to keep the info just in case there has been a miscarriage of justice."

You can keep that if you need to. The point under dispute is whether you keep a public record of an arrest. You can keep the interviews and evidence in private without allowing the names of the people who were released without charges to be inextricably linked to something that is now viewed as not criminal.

"Personal information like photo/mugshot finger prints dna should be deleted."

I agree, but when they don't do so, they will use the same argument you have just made.

"Of course there is bugger all you can do if it is reported in the press."

Well, you can do some things. In Europe, this is where the right to be forgotten might be used. People will argue about that, but we can skip it for now since this is in America. Still, a newspaper story making clear what happened offers more context than a record that simply says "arrested on felony charge, no trial occurred". Someone doing a background check who reads the article and understands the context is more likely to make a reasonable decision than an automatic system that looks for felony charges in a database and counts people out on that basis.

We Kana believe it! Raspberry Pi Foundation launches Japanese keyboard

Re: Why make keyboards

If you're looking for somewhere where it's really hard to find electronics and the road is a day's walk away, Japan might not be it. Japanese is spoken elsewhere, but not so much that you'd expect to stock many Japanese keyboards for the general public there. If they want to create keyboards for languages that aren't well represented at the moment, maybe they should focus on those which haven't been well-established in computing for five decades. There are languages covering millions that fit that bill.

Google to pull plug on Play Music, its streaming service that couldn't beat Spotify, in favour of YouTube Music

Re: Disabled person

Are you willing to build the system yourself? There are a few things you can do to get that working. Various projects exist allowing a Raspberry Pi to relay audio to such a service, so you just have to replace the recognition on their servers with recognition running locally (CMU Sphinx has proven to be an effective library for me). Of course, you then have to provide your own list of commands and actions to take when commands are heard, so it's not labor-free.

There are also some open voice assistants that run using local software. I've seen types that use a Pi as the brain, which are more open and configurable but sometimes less powerful. This one is probably the most famous, but I have never used it and I don't know whether it's capable of everything you want. I've seen others that use an Android device to power them because by doing so they can use Google's dictation function (requires an additional download but then can recognize offline) instead of building that themselves. That would also work, but initial configuration or recovery should the host device shut down isn't as straightforward as with a Pi. If you want to investigate those options, try searching for voice assistants on FDroid or Github. If you set up either option with a speaker of high enough quality, this should work.

NSA warns that mobile device location services constantly compromise snoops and soldiers

"My God, if they're spooks then they ought to be about paranoid enough to only use a crappy little GSM type phone while at work."

Antiespionage report, section 12: mobile device usage among clearance candidates

Most candidates for this position are using off-the-shelf smartphones. They will be treated with normal scrutiny. Four candidates are using phones without smartphone capability. Two of these are old and are using old devices. While it will be assumed that these people dislike smartphones, these candidates will still be treated with elevated scrutiny. The remaining two are using newer devices without that functionality and will be treated with severe scrutiny. Two candidates are using atypical smartphones, namely candidate 280 is running a Linux-based mobile OS on a device from Pine64, a known provider of secure devices for technical users and candidate 393 is using Lineage OS, a variant of Android with additional privacy features. Candidate 393 will be subject to severe scrutiny. Candidate 280 will be denied clearance and will be further investigated for potential criminal tendencies.

Sometimes, if you want to blend in, you have to do things that everyone else is doing even when you don't want to or they're dangerous for your attempt.

Re: How terrifying

Well, most states have proven that they have and like that tech. There are also cases where someone was operating it, but the police never found out exactly who it was. Most of those I've seen were presumed to be state actors, but since we can't prove that, it's always possible that it was someone else. Since the hardware can be built by a nonstate person, it's not that surprising that some people have done this. It doesn't have to be a concerted effort for some new concerted effort to pick up the practice.

Re: Talyrand: they forgot nothing and learned nothing!

Your biggest problem isn't 5-7, it's just 5. Spies can always place calls from public areas without CCTV, well not very easily but we'll come back to that, but where will their recipients be? The person receiving the call won't know they need to receive a call, so they'll be wherever they were before, which is potentially exposing. They will have to keep their burner phone turned on to receive said calls, meaning it will be able to track their location if someone ever identifies that phone as a device of interest. If you were planning that the conversations are always preplanned, so both ends can go to a public place, how does spy A indicate to spy B that spy A has urgent information that spy B needs to know when they don't have a scheduled meeting for several days?

Now, a public place to make a call without surveillance cameras. I really hope no spies ever go to London or most cities really. There are cameras everywhere. If you find a place without cameras, someone could check feeds for the cameras near the place to find the person who spent the right amount of time in that place before leaving. The other problem is that, if you make a call in public, you have to say all your secret stuff in public. People can hear your conversation which either includes incriminating things or cryptic things, which might cause your listener to report you or listen in.

"does not mean that it is impossible to prevent tracking."

But in effect, it's really hard. To demonstrate this, let's see if your ideas work (not as well as we'd like).

"As the most obvious way, just prohibit people from bringing phones into the area."

This assumes we are talking about a specific secure area, but we can go with that assumption. Other comments have already explained the dangers of collection outside secure areas, so I'll limit myself to the secure ones. If you make people leave their phones outside the secure area, then a tracker can do several things. If they don't know where the secure area is, it's that place where lots of phones suddenly go offline when people put them into those isolation lockers. If no lockers, it's that place where a bunch of phones go to not move at all--if you have your phone on you, even if you're just moving around a room, the signal will change slightly. Not as much if it just sits on a table. Assuming they already know where the secure area is, they know now who goes there and when. They may not know what they do once inside, but they can track the phones as people travel to the secure area. This means you know when the area's personnel are away from their homes so you can search them, or when the area has most of its people so you can attack it for maximum destruction, or when the area is sparsely populated for some other type of activity like trying to plant bugs.

"Another way would be for the people running the secure area to set up their own base station which is made secure so that nobody can get location data from that base station."

So the area has its base station, and the data can't be intercepted. This doesn't necessarily mean that phones will switch to said station or that they won't also contact others. A lot of tower data comes from towers other than the primary one, which mostly comes from phones verifying that they're still on the best one. What happens if the station is on one side of the area while an attacker drives by the other side with a more powerful malicious station. They could easily convince several phones on that side to trust them instead. Of course, by that point, you may not have such a need for location information, but it could at least tell the attacker who works on that side of the area rather than the other side. If they have floor plans of the area, that data might be useful.