Posts by doublelayer

Microsoft unveils a Universal version of Office for Apple silicon

Re: This puzzled me a bit

"64-bit is not better than 32-bit, it's just bigger. We're all chasing the word size believing that it's somehow better - while there are a few advantages, the fact is that the application sizes keep doubling, systems need more memory and higher cpu clock speeds each time."

That is not how that works. Applications do not double in anything, be that disk, RAM, or CPU. When an application is recompiled from 32-bit to 64-bit, the only things that need to get larger are pointers. Those do double in size. The instructions either stay the same, not changing in size, or are changed to new ones for more efficiency. Since they're not using any more data, they're still the same size. Some use of pointers means there'll be a slight increase in disk usage for the binary, but it will be small. More importantly, most storage used by a program is in the form of assets. Databases, media, documents, images, and those stay the same.

The programs that do see a difference are those that use a lot of pointers. Ones that use a lot of other types will have no change. The result is that an operating system compiled for 64-bit will have a significantly higher memory footprint because kernels have to store a lot of pointers so everyone else's virtual memory works. That point, I'll grant you. But it's not double even there.

Meanwhile, a 64-bit processor can do some types of things much better. AMD64 supports operations on 64-bit and 128-bit values that can be accomplished in one instruction whereas I386 requires several to do the same thing. What does this mean? It clearly means faster calculations, and that's true. But since you are focused on binary size, it means that each time a program does an operation like that, its disk usage is reduced by a few bytes as it chops out a few other instructions. This increase in efficiency invites programmers to use the faster processing to add features, so you will see larger programs, but you would (and did) see the same thing if they just made a faster 32-bit chip. Such programs get larger because they do more things, not because the architecture change did it to them.

"Does anyone think that switching to 128-bit is going to improve things in a couple of years?"

It won't happen, but absolutely. CPUs have come to the conclusion that 64-bit addressing will continue to work for a very long time, and it will. However, there are other kinds of chips including GPUs and ASICs that already do some parts of a 128-bit architecture or in some cases an even larger one. These are popular among people who want and are willing to pay for very good performance because they run faster for certain mathematical use cases. I fully expect that such chips will become more available in years to come and that they will be adopted by places wanting good performance. You don't need it in a consumer-level machine, but supercomputers will want it quite a lot. Eventually, gamers will get the same kind of chips so they can drive even higher-resolution screens at even faster framerates. While I rarely need either type of improvement, those things would definitely be improvements.

Email-spamming COVID profiteers deleted database with 'key evidence' when UK watchdog came knocking

"On the other hand, do we want the ICO to have the power to kick the doors down and seize everything whenever it wants?"

No, we don't. How about we give them the power to kick the doors down and seize everything whenever they've identified a likely criminal and obtained a warrant from a judge. Since they're an organization empowered to investigate crimes, maybe they should have similar powers to other law enforcement, including the power to keep a warrant application quiet so they can get evidence before someone destroys it.

Facebook's anti-trademark bot torpedoes .org website that just so happened to criticize Zuck's sucky ethics board

It's bad because Facebook doesn't control the string "facebook". It's worse because I think we all know the bot excuse is just to deflect blame. No actual business has to put "thereal" in their domain to prove who they are; it's clearly to express that the Facebook-named board isn't, in the opinion of the people with the site, doing any oversight.

The name of your site is not the problem. What you do on that site is the problem. If you run a phishing site for Halifax online banking, it doesn't matter if you call it genuine-halifax-online-banking-biz or iwilltakeallyourmoney.gq; what you are doing with it is illegal, so your site will be taken down for that reason. Trademark complaints are different, but that would only be relevant if the people running the site tried to create an otherwise legal enterprise under false pretenses. Not only did they not do that, but Facebook doesn't even allege that they did.

Domain Name: FACEBOOK.COM

Registrar: RegistrarSafe, LLC

Registrar IANA ID: 3237

Registrar Abuse Contact Email: [e-mail]

Registrar Abuse Contact Phone: [phone]

Not one I'd ever heard of, so I decided to just visit them:

Mailing address: RegistrarSEC, LLC / RegistrarSafe, LLC

1601 Willow Road

Menlo Park, CA 94025

Phone: [phone]

Fax: [phone]

Primary Contact: Denise Michel

Officers: David Kling – CEO, President and Secretary; Susan Taylor – Vice President and Treasurer; Michael Johnson – Assistant Secretary

Member: Facebook, Inc.

You can't even buy domains through this registrar. Why they felt the need to create a subsidiary to do this is beyond me.

Here's US Homeland Security collaring a suspected arsonist after asking Google for the IP addresses of folks who made a specific search

Re: Hmmm

"Ah yes; the entirely lacking in evidence argument that "they did it legitimately this time means they won't the next time". [...] I am old enough to remember when "innocent until proven guilty" used to be a thing."

They are guilty. The law enforcement entities have been found to have violated laws on data collection and privacy in numerous ways. They started by collecting information they didn't have a legal right to collect. Then they didn't delete information when the courts said they would have to. Then they used data for unwarranted purposes. The only reason those crimes haven't resulted in jail time is that these entities have the ability to decide that they don't want to investigate their own crimes, but they haven't had to hide the information about what they've done. Why do we have to give them the benefit of the doubt when they've already repeatedly proven that they will collect information and use it despite what the law requires of them? The example here was legal and appropriate for the situation, but the inappropriate requests have already come and succeeded.

Re: Percentage...

I'm assuming most of their cases are to divulge Gmail messages or files on Google's cloud, with the small percentage being search history. Why Google needs to keep logs of search results going back weeks is perhaps a better question, but that's why we're using DuckDuckGo, isn't it?

Re: A narrow search is good

But it is probably not going to be the most successful result. Take the evidence described in this article:

1. He searched for the address.

2. His phone was near the crime scene but he doesn't live there.

3. His truck was speeding away from the scene right after.

Maybe it's just me, but it seems logical to proceed through the evidence in the opposite order. First check security cameras and find vehicles that are speeding away right after the arson. If "speeding away from the scene" from the article really means conspicuous driving, that's not going to produce many suspects. Run each one and see if there's a reason for their vehicle to be there, and when you find a person who doesn't live or work nearby, check whether there's more evidence on that person in particular. This means checking phone location records on that particular person (if you can't establish an alibi for having the car there).

The problem with this approach is that the order of evidence is opposite to the ease of hiding that evidence. He could hide the lookup by searching for a nearby address, by browsing through a map, by driving down a day early, all these being very easy. He could only hide his phone location history by getting a burner phone or not bringing a phone at all, which is doable with a little more effort. Getting a car that isn't connected to him is by far the hardest task. In future investigations, it might make sense to start with that kind of evidence.

BOFH: Rome, I have been thy soldier 40 years... give me a staff of honour for mine age

Re: what a classic!

I think that's why he hasn't, because this is actually one of his longterm plans. Had he done something to take over the company, he wouldn't have leverage to use against his witnesses. By keeping his take restrained, he can get rid of evidence by threatening people from the blackmail file. He also doesn't have to worry about a replacement tech finding out any of his secrets.

Keep in mind that he did a similar thing with his own employment contracts, in fact at least twice. He just didn't have the audacity to try one this big.

Apple's T2 custom secure boot chip is not only insecure, it cannot be fixed without replacing the silicon

Re: Surprised?

"I don't get why people think Apple will use the transition to ARM to lock down macOS. They could have done it at any time"

You are correct, but I think it's likely. In 2006, they didn't want to lock it down. They wrote BootCamp just to prove that. They still allowed running unsigned binaries. I was very happy with them. It's not the same now. They've taken various small steps toward locking down their OS, and they've created another fork which has already seen much more thorough lockdowns. The reason I think ARM might be a good opportunity for them to lock down is that it's easier to say "We have to drop support for multibooting because our chip doesn't support the operating system images currently available" rather than "We decided we didn't want you to run Windows anymore so we're pulling Bootcamp". In the name of security, they've instituted weird and painful restrictions on disk access that don't work which look a lot more like IOS than they look like any other popular OS. They've hidden the settings needed to run software they haven't signed behind obstructive and meaningless error messages. Their repairability scores have been dropping steadily for most of their machines. These are not good signs to me.

Since it requires a cable connection and booting to recovery, it's unlikely to spread without assistance; people rarely connect one computer to another one over a USB cable. The exploit is very serious given the likelihood that someone could do this with minutes access and it could remain resident for a long time. I doubt it's hard to use the access granted here to grab the encryption password and install malware on the victim's system to phone home with the data when the computer is connected to the internet. At least we know about this; had it been someone who doesn't work on security testing with a public interest, it would already be deployed at various countries' border scans.

Teracube whips out cheap, fixable phone with removable battery and four-year warranty

Re: Alternate use...

Not at all. There were two points in the post:

1. Pine64 is being silent.

2. They deleted blog posts.

The first point is an opinion, the second one a statement of fact which I couldn't corroborate. I therefore asked for the reasons for the opinion and assistance proving me wrong.

I can't contact Pine64 about their purported silence, because I don't know what you (or a different anonymous person but I'm guessing you're the same) think they're being silent about. So I asked you. You feel they're silent, so you could easily tell me what type of information they could be providing but aren't. I could contact them and ask about their silence. Let's see how that would have gone:

Me: Good morning. I hear that you are being silent, specifically regarding the PinePhone. Why are you doing that?

Them: We're not being silent.

Me: I have a statement from an anonymous person online that says you are.

Them: What does your source say that we're being silent about?

Me: I don't know; they wouldn't tell me.

Them: What evidence was provided that we're being silent?

Me: Not sure. They claimed deleted blog posts but I couldn't find them and they wouldn't point those out either.

Them: So you're asking us about an opinion from a person who wouldn't provide any specifics, whose allegations aren't proven, and you have no reason to think they have special knowledge about this stuff?

Me: Yes, that's what I'm doing. They said you are silent, so you must be. Tell me why.

Them: We've posted blog posts regarding the PinePhone several times in the past months. One in September, two in August, two in July, one in June.

Me: I know you talk about the phone a lot, but you're being silent about some things. Why?

Them: What things?!

Me: I don't know, you tell me.

I thought you actually had something of relevance. You could have pointed me to the deleted blog post. You could have stated your opinion on information that was insufficiently explained. You could have just said "They're being silent about issue X". Want to try any of those?

I also appreciate water resistance as a feature of phones I might buy, but it's hard to properly seal a device for waterproofness and keep it this repairable. Some things can be done; waterproof isn't incompatible with SD cards or removable batteries. It does make it a little tricky to take the main board out, put in another one, and still have the result be waterproof. They might instead create a waterproof case to put the phone in, which would make the device bulkier but would mean they could obtain both their goals.

Re: Alternate use...

Could you specify the questions that aren't being answered? In an attempt to inform myself, I searched for the blog posts that were deleted, but I couldn't find them. At the time of writing, the official blog contains nineteen posts from 2020. Going to the Internet Archive, I've searched through their historical captures of the blog and I have not found any posts in those captures that don't currently appear on the blog from Pine64. I only looked at posts in 2020, so if they only deleted years-old posts, I didn't search that far. They do bring up phone-related things from time to time, so I'd be curious to hear the things about which they're silent.

Re: A suggestion for a long life

Possibly, but even when 5G does happen, it isn't going to make 4G obsolete. It took a long time for 2G and 3G to die, and that's only in some countries. Europe especially has kept these around for several more years yet. Therefore, I'm not sure it's that important to include it since it's not core to the device continuing to function; by the time 4G isn't being used anymore, the biodegradable back cover will probably no longer exist.

A suggestion for a long life

To all people developing devices like this, which are supposed to run a long time. There's just one thing you need to do to guarantee my confidence, but it will also help you a lot with extended support. Find a custom version of Android known for releasing updates, my preference would be Lineage OS, and add support for your device there. You probably don't have to worry about updating it to new versions of that either; even if it doesn't happen, people will still be on the latest security update. If your device is popular enough among the community, and being a device with manufacturer-guaranteed support will probably help, someone else will do the update work for you. Meanwhile, I will have confidence to purchase your device.

I use my phones for long periods before replacing them. One of the reasons I can do this is that I use software which continues to have available security patches and even the occasional new feature. I have succeeded thus far without causing damage to the hardware, so the warranty is not the primary concern for me. It is certainly useful, but I'm mostly planning that I won't need it often if at all. Software support is more critical.

Re: Alternate use...

You might want to look at the PinePhone. While its specs are worse than this one, it is designed to run a variety of Linux distributions and provides the resources needed to easily port things that aren't yet in the list of thirteen working distributions. It is also easy to repair (Youtube video demonstrating disassembly. If Linux is what you want, this might be a more reliable way of guaranteeing that you'll get it. One note, I don't have one of these and can't vouch for its quality.

ICANN begs Europe: Please fill in the blanks on this half-assed GDPR-compliant Whois we came up with

Re: Whois lookups used to be useful

Depending on your country, most likely all large-enough companies and all charities are already registered somewhere. That somewhere is usually the bureaucratic entity responsible for verifying filings, meaning you know that what is there is at least a little verified. It often includes a web address if the company concerned has chosen to provide one.

Using whois as a proxy for this has two primary problems. You're trying to verify details about the company or to verify that the domain belongs to them. Here's how that breaks:

Verify that the domain is theres: If I'm setting up a fake domain, I can easily put in the information for the place I'm impersonating. It's not independently verified and has never been, so nothing prevents me using that mechanism. I can include a phone number that's intentionally mistyped or, if I think my victims are likely to actually test it, I can set up a phone number for the purpose. Or I find a number for the actual organization which nobody answers and include that. But let's be honest, if I'm a scammer I'm probably planning that my victims aren't going to put that much effort in anyway so I could probably ignore those few who are suspicious enough to call a phone number in a whois record.

Find details about the owner: You're not going to find anything of use. If the company wants you to contact them, and they probably do, you'll find addresses, phone numbers, and email addresses or contact forms on their website. If they don't, you can probably find those details on a map or phone book. Meanwhile, lots of places that aren't companies may wish you not to have those details to avoid spam, disruption, or harassment.

It's in their DNA: Nobel Prize in chemistry goes to pioneers of the CRISPR gene-editing tool

Re: And electricity will be so cheap it won't be metered!

"'CRISPR doesn’t allow the insertion of new genes, just the modification of existing ones.' is mildly reassuring."

Too bad it's wrong. By removing an old gene and placing a section of DNA nearby, the new section can come to replace the old section. It relies on the cells' standard repair mechanisms working as expected, so it's a fiddly process to run right, but you can absolutely replace large chunks of DNA with custom chunks. You can call this a modification, which it technically is, but it can be a modification along the lines of "delete these three pages and rewrite them from scratch". Even when a length limit is hit, two treatments could perform rewrites right next to one another to double that limit (and so on). The current technology means doing this to humans would be dangerous, because there's always the chance that the new chunk gets read wrong or doesn't insert properly, but experimentation on flies will improve this dramatically. It's also unlikely that people would often want to completely rewrite a section rather than replace it with something known. I don't think this is a cause for fear, but we can only decide on the ethics if we're honest about the scale of changes that could be performed with the tool.

UK privacy watchdog wraps up probe into Cambridge Analytica and... it was all a little bit overblown, no?

Re: Your next lesson: How to miss the point 101

Well, there are many points to this article, and the one that got the most words was the ICO's conclusion about the lack of success to the use of the data. That's a valid point. However, since it is the ICO we're talking about, let's look at what they're supposed to do.

"Our role is to uphold information rights in the public interest. Find out more about the legislation we cover. [Data Protection Act] [Freedom of Information Act] [Privacy and Electronic Communications Regulations] [General Data Protection Regulation] [Environmental Information Regulations] [INSPIRE Regulations] [eIDAS Regulation] [Re-use of Public Sector Information Regulations] [NIS Regulations] [Investigatory Powers Act]"

Their point is data handling and privacy, not election security. They have pointed out that some of the things they talked about are really the purview of other parts of the U.K.'s bureaucracy. What is firmly part of their responsibility is data privacy legislation enforcement. In that area, it doesn't matter whether I've succeeded or even tried to do anything malicious after I got your data illegally; if I have the data and shouldn't or did something with the data I have which is not permitted, I'm equally culpable of the crimes the ICO is there to deal with. Since it's the ICO we're talking about, I think this point is quite a bit more important than several others we could talk about from this report.

Re: Nothing to see here...

"It was personal data supplied TO CA from Facebook - who were supplied by idiot users who filled in stupid quizzes...."

That's a very poor summary of the way that worked. Try this instead:

It was personal data supplied TO CA from Facebook - who were supplied by idiot users who trusted Facebook to only give data out when the user of the profile made it public and only from profiles which consented to the data release, not a recursive search through a bunch of friends who never agreed or knew anything about this.

The small number of users who agreed to the quiz agreed to a limited data release, not the release of everything (which is what happened). The people they had connections to did not agree to any of their data being released (it was), and were not told that their data had just been sold off. As much as the public should know that Facebook isn't to be trusted, it takes things like this to really demonstrate that fact.

After ten years, the Google vs Oracle API copyright mega-battle finally hit the Supreme Court – and we listened in

Re: will have to think about getting a license each time he/she overrides a library method

"No, there's no equivalence between writing your own new function with the same signature and copying 37 files of 11.5 KLOC."

When those 11K lines are a bunch of function declarations, yes there is. If I create enough functions with the same signatures, I'm copying those lines one by one. I want a library that implements archive operations with a different format so I create a class implementing all the same functions that the original .zip one handles, I've copied twenty lines in a row. Then I decide to implement a new module which does mathematical operations faster, so I retype each line in the mathematical module and implement the functions differently. While I'm speeding it up, I think I can get AES functions to take advantage of hardware acceleration, so that's another set of lines copied.

These lines have to look similar because the function name is the same, the parameter names are the same, the parameters have the same types, the parameters appear in the same order, the function returns the same type, and the function is in the same class. Certain other parts might be skippable, for example comments, but if I decide to properly write comments for my functions, they're going to say similar things. Why would I ever do this if I expected the company who wrote the original interfaces to sue me for my hundred copied names?

Google copied the names for a lot of functions and classes. They reimplemented basically all of the ones available. In other words, they did what you just said I could do, and they did it five thousand times. Why am I allowed to do it but Google isn't?

Re: almost certainly prevents me writing down the list of names myself and going from there

Except for some mistaken copying of a few lines, what Google copied was a list. A list of functions. Just like my list of functions. Oracle claims that this code, the declarations of the API they own, is theirs to control. Whether someone copies the file containing the list or writes down the list, it's still a list and contains the same items.

Oracle claims that copying that code is a violation of their copyright rights. They're not hinging it on the nine lines accidentally copied; everyone agrees that wasn't allowed and the lines were removed. They're basing it on the 11K lines that remain. Here's the problem with the argument you're making. Either those lines are copyrightable or they're not. If they are, then it doesn't matter whether I reorder them or make slight modifications, whether I copied them with a clipboard or typed them manually, I'm not allowed to copy them without permission. Oracle owns the text and I'm only allowed to use it if they approve. You are arguing that Oracle can copyright just those declarations, but that it would have been just fine had Google somehow written the list themselves. Not only is that impossible, but it is directly contradicted by copyright law; copyright law doesn't care how I duplicated work, whether I ran a book through a photocopier, got a bunch of blank paper and copied it out by hand, or had someone else play a word game to give me each word in sequence.

There are two logical ways to resolve this. The first method is to state that APIs are too basic to copyright, being lists of names. In this case, Google can keep using their file. You seem to disagree with the legality of this option. The alternative is to say that they are copyrightable, and therefore to copy the essence of them without permission is forbidden. In this case, it's not possible to take the steps you suggest to get around that. The two APIs I wrote above are the same. They're reordered a bit and I dropped some comments, that's all. But copyright doesn't care about this. If I dropped every second page from a book and randomized those pages before publishing them, I still committed copyright infringement against the author. Even if I rewrite those pages without reading them myself through some complex arrangement.

Re: but reimplementing them is what Oracle thinks they can forbid you from doing

Yes, that is exactly what they think they can do. It's simplified, since they think they can prevent you from doing it if you haven't complied with one of their licenses, either the GPL or one where you pay them, but they think they get to set the terms under which you can create functions with the same names and parameters. They think that, if you don't follow the terms, you aren't allowed to create those functions. They might end up being right according to the legal system, but all we're discussing in this thread is what that could mean later.

Reimplementing an API doesn't require copying code, but it does require writing very similar code. If the original API reads like this:

int factorial(int n); //returns -1 if n is invalid

int fibonacci(int n); //warning: negative numbers means undefined behavior

There's only so much you can do to create a reimplementation. You can change lots of things, but probably the most you can change and have it still work is this:

int fibonacci (int x);

int factorial (int x);

The person who typed that may never have seen the code specifying the previous API, but their code necessarily looks very similar. If copyright prevents me from copying a list of function names, it almost certainly prevents me writing down the list of names myself and going from there. No matter how I change the comments, spacing, or parameter names (and I probably shouldn't be doing that), it's going to end up being basically the same.

Re: Nine Laypeople

Judges don't live in isolation, but some things are sort of hard to understand if you've never learned about them. How does one operate a phone? They know that. How do you manufacture a phone? They have a fairly good idea. What is the difference between an API, a language, and a functional implementation? They have no reason to know that.

It's not that they live in isolation but instead that very few people know that kind of detail. Things we assume everyone on the comment board understands are things the general public has never heard of. I present you the following challenge: find ten random people who don't now and haven't before write code or administrate complex computer systems. Ask them the following questions, which I'm sure we could all answer in an instant. One point for understanding what the terms mean, one additional for getting the details right.

1. What does an operating system kernel do and what does it not do?

2. What is the difference between ROM, RAM, and nonvolatile storage?

3. What does compiling code do?

4. What is the difference between little endian and big endian encoding?

5. What is an API?

6. What is the difference between an IP address and a MAC address?

7. What is an ISA and which one or ones are you using?

8. Identify a piece of software you use. What language or languages was it written in?

Run this test on the nontechnical public. I'm guessing you'll see a lot of zeros, the occasional one, and maybe a two. Not a sixteen. You don't need to be isolated to not understand points core to the topic.

Re: The devel is in the details

"* OpenGL is under a pretty liberal BSD-style licence. There is a trademark licence treated separately, but that isn't involved in the Oracle vs. Google case."

This one probably holds. Worth keeping in mind that the person you're replying to specifically stated that they hadn't checked, so while this one's choice of license makes it unlikely to take advantage of a precedent, it could have fallen into it had the developer made a slight change to the license chosen.

"* Octave/Matlab; languages, not an API."

A language and an API are very similar. Both take creative effort and specify a way of running things, the implementation of which is provided later. I would not expect them to be treated differently.

"* SQL is an ISO standard and a language, not an API; anyone can buy a copy of the standard."

Anyone can read a copy of Oracle's Java APIs, but reimplementing them is what Oracle thinks they can forbid you from doing. Someone who decided to license SQL could allow you to purchase a copy and read it, but woe to those who try to reimplement it without receiving permission. This is not unusual with standards; if I try to reimplement the LTE specification from its standard without purchasing licenses to the components, they would be very grumpy. I also contest your language-not-API distinction here. I don't think it matters anyway, but I think it's also incorrect in this case. SQL may be both, but it provides a series of functions with parameters. That's effectively an API, it's a list of possible functions which exist. SQL also includes a language in which the functions are called.

Re: Status quo?

To clarify, it's the legal status quo in this case because it's what the previous judgement is. When cases go to the Supreme Court, it is to either uphold or overturn the ruling of a lower court (simplification, but close enough). The opinion of that lower court is therefore considered the current approach unless it's overturned. This is why, for example, the opinion of the lower court stays if the court has a tie vote. This is smaller than it sounds; it mostly applies to one case. As a case rises through the appellate system, what the status quo is could flip a few times before the case is finally over. Once the case is over (taken to the Supreme Court and decided there or one side concedes defeat instead of appealing), that decision could become a much larger status quo that applies to lots of other cases and people.

A decades-old lesson on not inserting Excel where it doesn't belong

Re: 65536

I'm guessing they didn't want anyone to say they'd overstated what the screens or image formats could do. Then again, it didn't seem to hurt the storage industry much when they used a definition for kilobyte, megabyte, and gigabyte which was not the same as the definition memory manufacturers came up with, or the portable tech industry when they dramatically overstate battery life.

Re: Thingies cat

You hire people based on a diligent attempt to establish their abilities and responsibility. Only if you made that effort in good faith can you start deflecting blame. It's not enough to find a person, hire them without checking, and blame them for anything that goes wrong. Similarly, if you hire someone to do a task, it becomes your responsibility to get enough information to determine whether they're doing what they were hired to do. Sometimes you may hire someone else to help you manage that task, but this just increases the size of the tree which you still have to monitor. If you didn't do enough to validate that the people you hired were capable of the job and were actually doing it, you still take the blame for things when it turns out they weren't.

DigitalOcean decides to head rivals off at the PaaS, floats App Platform to deploy, run code without juggling servers

Re: Hack attack

It's certainly smaller than a lot of other places, so you're less likely to see it if you just look at who runs the servers for everything you use. However, it's worth looking at all the other attacking IPs in your logs, because they're going to represent a lot of the internet. It's really easy to try automatic logins on your site, and people will use any cloud service, VPN, or botnet to let them do it. Unless some provider makes a point of not taking down the systems of people who are particularly malicious, they're just like any other provider. To the best of my knowledge, DigitalOcean is usually quick to respond to abuse requests and is not at all a bulletproof service provider. People use it when launching attacks because it's cheap and convenient, which is basically the same reason someone else might choose to run things there as well.

UK, French, Belgian blanket spying systems ruled illegal by Europe’s top court

Re: Nothing rhymed

I don't think that's how any of that worked. The history seems to be that some people worked out a way for laws to not conflict maybe while others did what they wanted to, in many cases ignoring even those people trying to stretch the letter of the law. Those who created the spying programs didn't care what the law said they could do, or even what their own lawyers said they could contort the text into allowing, but instead did everything they could come up with. When laws changed or courts informed them that they needed to stop, they just didn't and waited for the next case.

Take this chunk from the decision:

“in situations where a Member State is facing a serious threat to national security that proves to be genuine and present or foreseeable, that Member State may derogate from the obligation to ensure the confidentiality of data relating to electronic communications by requiring, by way of legislative measures, the general and indiscriminate retention of that data for a period that is limited in time to what is strictly necessary, but which may be extended if the threat persists.”

Here's how that chunk will get used:

"in situations where a Member State is facing a serious threat to national security that proves to be genuine and present or foreseeable,"

"foreseeable". "Foreseeable"! "FORESEEABLE"! As long as the people at the spying organizations can foresee something bad, they can do many things. I can foresee bad things with ease, and I guarantee you that they can foresee much worse things. Here they have complete authority to activate the powers granted them in the rest of the quote. But of course that section will still impose serious limits:

"that Member State may derogate from the obligation to ensure the confidentiality of data relating to electronic communications"

All good so far, they can throw away their responsibilities. Restrictions are coming, right?

"by requiring, by way of legislative measures,"

Oh no. They'll have to get the legislature's support. This is a major blow, because they'll have to inform the public about what they're doing and why. Except the laws being challenged here already support the measures, so nothing new is required.

"the general and indiscriminate retention of that data"

Well, they didn't hold back about adding sufficient adjectives to let the organizations do whatever they want, did they?

"for a period that is limited in time to what is strictly necessary,"

Ah, they're throwing us a bone. They can do whatever they want, but only for a limited time. Then they have to throw out their data and start over. At least they'll only have a year of my data at any time. Sure it'll be the most recent year, but still, it's nice that they're giving me that.

"but which may be extended if the threat persists."

Remember that the threat will persist for as long as someone can foresee it. And that nobody gets to decide that the foresight is wrong or question whether the threat persisted. I foresee that a new country will form called Evilania, and it will invade our country. As long as I continue to foresee it, I can extend the retention timeline as long as I like.

Big Tech to face its Ma Bell moment? US House Dems demand break-up of 'monopolists' Apple, Amazon, Facebook, Google

Re: Sounds like the case against Apple

"What Apple would need to do in the meantime is effectively turn iOS into a hypervisor, and make every app run inside a separate VM so it can't possibly touch another app or the OS except through defined methods."

They already did that. The primary worries about an insecure app is that it might find a vulnerability in that hypervisor, which has happened several times, or that they might find a valuable sandbox that allows access to lots of things. For example, if they get into a sandbox which already has access to contacts, the global filesystem, and the microphones, the insecure code doesn't have to escape the sandbox to do malicious things. To the extent that Apple's review is focused on real security scanning, this is the kind of thing they want to prevent.

Re: "AD requires a CAL which means its not financially viable"

Yes, you can. Manufacturers get to choose how they go about it, but some have chosen to sell some of their products with Linux instead of Windows with a corresponding reduction to the price. Dell and Lenovo have done this, but only for specific machines in their lineup. You can of course purchase from a company that specifically focuses on Linux machines, of which there are several.

Re: Give the FTC more power?

While I'm not aware of Joseph Simons having done anything to bring on ire, it's possible that the original poster was instead referring to the person who currently has the power to remove and replace commissioners should they wish to mess with something. Maybe the post was intending to call for increased oversight of a bureaucratic entity should its powers be increased. Or maybe it was just an acronym confusion. I'm not sure.

Bad boys bad boys, what you gonna do? Los Angeles Police Department found fibbing about facial recognition use

Re: Its coming

No, we do not agree. A working facial recognition system, if it's even possible, would be a nightmare. Imagine what a totalitarian country would do with something like that. Imagine what a malicious operator in a democratic country could do with something like that. It could be awful. What it does is provide a mechanism to track a person wherever they go without alerting them and by providing a smokescreen of a potentially useful purpose.

Lots of things would catch criminals faster and reduce crime rates. Some of those things should be tried. Some of those things need to be avoided, even with the extra crime, to avoid creating a terrible situation for the innocent. Systems which destroy privacy or give the police unchecked power are among those types. A working facial recognition system, for that matter even one which doesn't work, does both.

Institute of Directors survey says most bosses expect no mass return to the office if COVID-19 crisis ever ends

"Have we really become such an emotionally weak society that out up-line managers must spend time worrying about out "mental well being" that worrying about getting the job done and making the company more profitable?"

Not quite. It's always been the job of a manager to worry about such things because the workers' mental wellbeing directly affects their productivity. If workers hate you, they'll try to leave and you'll have to hire new ones. Reduced profit. If workers are constantly distracted by a poor working environment, they'll get less done. Reduced profit. If workers are in a combative environment where they have to essentially fight against one another, then they'll spend time defending themselves or planning their own attacks instead of getting stuff done. Reduced profit. If workers are subject to too much work and burn out, expect them to have other health problems, therefore taking more time off and reducing productivity. Reduced profit. It's been known for as long as there have been workers who had a choice about whether to stay working for the company; it is the managers' responsibility to ensure that workers are in a good enough condition to continue doing work, and those who fail to do it usually see productivity slump.

Depends on the state of the office. Put me in an open plan office without restrictions about noise levels, even requiring me to stay there and looking at least a bit productive for all my allotted hours, and I assure you I'll be less productive than at home, where things are quiet, even if I take breaks more than they'd like. The same can be true for lots of environmental differences, from noise to equipment to socialization.

As it happens, your comment is correct for my current home and office setup, because my office had full walls and also gave me an easier way to quickly check things with others. When my team members all return to the office, I'll be there too and I'll be cheerful about it. It could definitely go the other way for lots of people.

Big IQ play from IT outsourcer: Can't create batch files if you can't save files. Of any kind

Re: Classic techie mistake

Again, it doesn't help against anyone else. If he could do it, anyone else could do it. If he was going to do anything dangerous, he'd have done it before, or instead of, telling someone about the problem. It's missing the point and badly to think about sacking him; either you don't care enough about the stuff in the safes to go to the expense of updating the locks in which case you can ignore the problem, or you do in which case your attack landscape is anyone and everyone who could conceivably get to the safes. It sounds like they completely ignored this, and given that their project was being spied on by Soviet agents which they'd rather not have know the information, they probably should have put some thought into it.

Re: Classic techie mistake

I don't think that's the correct response. I have not read his account, although I've just put it on my reading list which is a LIFO stack so I will have soon, so I'm going with the summary outlined above, but in that case, it was a terrible response. If the comment I'm referring to is correct, the reason he could break in was that people were using a small set of combinations and the locks were shoddy enough to take several possibilities. The second problem is expensive to fix, but the first is not. Ban the default combination and require people to change it, with an explanation of how to do so randomly. That should dramatically worsen the chances of having a code which unlocks all the safes or brute forcing a small number of possibilities while distracting the safe's owner.

In addition, this was a government project with a massive budget holding state secrets; if security isn't relevant there, what is the point? Blocking one person from accessing safes protects you against that person, who already proved he was on your side by reporting this instead of stealing the information and choosing his next nation of residence. It does not protect you from anyone who read his report, heard it from him, or figured out the same thing. If they're not on your side, you won't find out until after they've exploited the problem. This is what happens to the least sympathetic of data breech victims; they know there is a problem, know why there is a problem, know how to fix the problem, don't fix the problem, and people suffer as a result. Don't do it.

Apple seeks damages from recycling firm that didn't damage its devices: 100,000 iThings 'resold' rather than broken up as expected

Re: They can't fix it, but I know a man that can..

Welcome to the world of used devices. When you go online and buy a used device, it's usually not from the manufacturer. It's from some user who may or may not have damaged the device, meaning you know you're entering the realm of possibly extensive damage. The same is true if you buy from these recyclers or if you buy from someone random who lives near you; there's always the chance that what they call "lightly used" means "only dropped on concrete three or four times". For this reason, I rarely if ever buy used devices that I think are likely to have become damaged, phones among them. When buying other used devices, I require that I get to test things before payment. Those who choose to enter this market know what they're getting into. I have no reason to believe that the phones sold this time were any worse than the average user-sold used device.

That said, it is still a breech of Apple's contract, which is a legal contract. I would prefer that the contract didn't get made, but it was. I'm not saying here that what the recycler's employees did was right or that they should get away with it without consequence.

Re: The Waste Makers

The article states that the company concerned also operated in the United States at the time, to say nothing of the possibility that phones were shipped to the Canadian recycling facility to take advantage of a good recycling rate or cheap electrical power. We really don't know how many devices were recycled by Apple at all, given that we don't know how many companies they use to recycle for them.

You are trying to prove that Apple's devices are unusually bad, which is going to require extra levels of proof. Their repairability scores aren't great, but their competitors' aren't either. If you want to ban Apple devices for sustainability problems, which they have, you should also prepare for most competitors to be banned as well. Only a few phones I know of are easy to repair, including the Fairphone, PinePhone, etc. so you might be left with only those.

"not sure: if Apple handed them to the recycling firm, then the recycling firm owned them."

Almost certainly not. Apple could have done it two ways:

1. "Here are some phones we don't want. You can buy them and obtain value from them. You have to be environmentally-focused if you get rid of parts." Results in the recycling firm owning the devices.

2. "Here are some phones we don't want. We want them recycled, you recycle, so we'll pay you to recycle them." Apple still own the devices.

I think Apple chose option 2, in which case they are paying the company to do something with the things Apple owns. Since the recycling company didn't own them, they can't cancel the contract on right-to-repair because the devices are not theirs to repair.

I would prefer that the devices get reused when possible, but it's helpful to recognize what legal rights Apple has in this situation if only to suggest ways to make it less likely to happen next time.

Re: Google has short life cycles...

Depending on the history of those drives, the total destruction contract might have been more relevant. If they previously held sensitive information, the destruction could have been to eliminate that rather than to push demand for newer disks. I would be very angry if I gave disks to someone for destruction but they didn't do it. Then again, such concerns shouldn't apply to Apple devices since the internal storage is flash and encrypted with a separate location for key storage, so an erase should be nearly impossible to recover from.

Suffering silicon: Benchmarks for Apple's A14 chip are in, but post-Intel Macs, when they arrive, will tell the real story

Re: Not any more..

This assumes that ARM is going to be critical to all OSes in the future. Given that the public doesn't know what ARM is, that's a hard point to prove. Intel's problems in speeding up their chips are well-known, but AMD has succeeded in producing X64 chips with a smaller lithography and they're starting to get into the low-power space. Meanwhile, Intel still has a bunch of cash to throw at their problems.

ARM has several benefits, but one that hasn't been seen often is performance for large use cases. Existing ARM-powered computers usually take the form either of less powerful but cheaper (things like the PineBook Pro, the long-lived battery Windows on ARM machines, or ARM Chromebooks) or lots of cores for lots of parallel operations (every ARM-based server). Apple will probably be one of the first to produce consumer-level machines that aren't one of these two, but just because they can do it doesn't mean anyone else has a need to do so to stay current; if Apple's chips manage to produce the needed speed, it won't stop AMD's ones from doing so too. Unless you expect AMD and Intel to hit limits which just don't apply to ARM, why does it matter which companies switch to it? If you do predict a limit like this, what causes that limit and why?

Re: Mobile is not laptop or desktop

Almost certainly the laptop processors will be as good or better. However, there's a reasonable argument that the phone-level processors won't really work well enough for laptop or desktop use cases. It depends what they're being asked to do, but some people use their laptops for more intensive tasks that people don't do on phones or tablets. I expect that Apple's laptop chips will be more powerful than their phone ones, but the question still remains: how will they go about it? They could just design similar cores to run under higher power to get performance improvements, which would probably be helpful, but they could also just try throwing more cores into the mix, which will only help some of the time. Depending on what they do, they could have a performance dip in laptops where they've stuck too close to the mobile chips. This probably isn't a major factor since they can quickly change their plans for the next iteration of machines, but if they make that mistake the first time, people might have less confidence.

Something to consider in case Dell freezes over: HP unfolds 2-in-1 laptop with Intel Tiger Lake brains, bigger screen

Re: a button that covers the webcam

If it can be disabled by physically covering it, then there's no way for it to get activated if I have closed it. That means someone can't spy on me through it, either by finding a sneaky way to disable a light, by there not being a light, or by my not noticing the light. Same reason some people really like physical killswitches for some components; we're paranoid people but at least with those we have complete confidence.

Re: Is this the same HP... @A.Coward

"Really? Guess who owns Thinkpads - not IBM - think Asia - think Red...."

That's the point being made. IBM doesn't make Thinkpads anymore, Lenovo does, so if IBM does something wrong, it's wrong to punish Lenovo for it. Substitute "HPE" for "IBM" and "HP" for "Lenovo" and you've got the point they were trying to get across.

If the Samsung Galaxy S20 Fan Edition doesn't make you a fan, we don't know what will

Re: When will I get what I want?

I don't think all the features you mention are incompatible with a feature phone of today. If "keyboard" means "qwerty keyboard", it could be for sending SMS messages. The 4G or 5G could be for a tether connection. Bluetooth for an audio device. Admittedly, asking for Linux or Android is a little hard to understand; if they wanted something like the Motorola StarTac they shouldn't expect an OS that lets users develop and run sophisticated applications. It doesn't really matter though because, if the feature phones using a basic OS and primarily targeting 2G networks are insufficient, the lowest-end option with 4G connectivity is going to have that functionality anyway.

It really comes down to what tasks other than placing calls and messages are important. I really appreciate having things like navigation, meaning I need a smartphone with the kind of processing and internal storage that requires. If someone only wants some basic apps, a feature phone of today may actually have similar sets of features as a PDA of a decade ago.

Complexity has broken computer security, says academic who helped spot Meltdown and Spectre flaws

Re: Hmm...

Mostly correct, but this is not always the case. The perfect example of this is a hypervisor. The program it runs is specifically another operating system, but the purpose of the hypervisor is to provide resources for the program and restrict it from affecting things that aren't in its virtual environment. Or, at a different level, operating systems for embedded devices often run one program but still restrict it from doing certain things. For example, an OS I'm using for a small device handles Bluetooth for the application running on it, and so as much as the program that is loaded may want to modify the memory reserved for Bluetooth protocol operations, the OS will not permit it to do so (at the moment, it alerts the developer on its own, kills the program, and loads another one allowing a debugger to be attached).

Re: Hmm...

They're also used for different tasks nowadays. In decades past, normal users might do most of their work by logging into that from their basic terminals or terminal programs running on relatively weak computers. They'd do standard work on that system, which was also running the important software since the mainframe was the only large system available. Now, the mainframes are still used to run the large software projects (some of the time), but users usually don't have to log into that mainframe to read their corporate email or access intranet-type services. This means that a lot of users probably don't get accounts for the mainframe, and therefore the worries that an unprivileged user will find a way to attack it or allow someone else onto it to do the same are reduced. It doesn't make it perfect, but it does make it easier.

Re: Hmm...

You are correct about that, but even the mostly secure Unix and other multi-user operating systems weren't designed for situations where one user would need very strong isolation from others. Random examples still exist of this; it's still possible, for example, to read the command line commands another user enters. This is usually not critical, but it's an example of one of the previous parts of the design where security really wasn't a factor. Other examples exist, such as when passwords were really stored everybody-readable or the ability to have a file exist with permissions inconsistent with those of its containing directory. These all are small and relatively unimportant, but compared to now when we're trying to limit processes' disk access inside a user account, they look a little anachronistic. The main reason that we don't care much about the few of these that remain is that multi-user systems are used less frequently; our personal machines usually only have one user account logged in at any time (assuming they even have more than one) and most other systems use VMs for small sets of people rather than one big system with open login for the whole institution.