Posts by doublelayer

Handcranked HTML and JPEG japes. What could possibly go wrong?

Re: Hmmm..

I think you've gotten things the wrong way. Fiona didn't claim that she was not responsible, simply that others could also be held responsible and she didn't let that happen. The person who decided to put that file on a production server, which was not Fiona (the article makes that clear) should perhaps not have done a straight copy-paste from development to production. That's not new. Anything sufficiently large has stuff in the development folder that isn't to be released in production, and usually a script or two to try to manage that. I'd argue that these others weren't very responsible, and thus that turning them in would have been a pretty nasty thing to do, but I'd also argue that Fiona did little or nothing wrong and was unfairly attacked for a thing that did no damage and was clearly not intended.

Apple programs Siri to not bother its pretty little head with questions about feminism

I see your point. I like civility, and I would like to see everyone, from kids to those a couple generations older than me (who aren't all that much better at it), to start being more polite in conversation. I'm afraid, however, that making an electronic device ask for them will turn it into the worst parody of those over-obsessed people. You know the ones: the people who have actually said the phrase "You didn't say the magic word" without irony to someone over the age of three. It also happens that many of the requests a device like this answers aren't typically said with "please", including most of the ones in my original post. The please essentially becomes another required wakeword for the device, and loses the meaning we* were trying to get across. As such, this has the potential to be counterproductive, and I think it will be pretty silly or irritating, depending on your viewpoint.

*We: In the sense of parents, people programming the devices, and people setting up the devices. As I'm a member of neither group, perhaps "they" would have been the better pronoun.

Echo Dot Kids Edition "will not respond to commands unless they are attended with verbal civilities

Well, now I have to know what that means. "Alexa: Could you please tell me what the weather will be tomorrow?", "Alexa: If it's not too much trouble, would you mind enlightening me to the current time?", "Alexa: If you could set a timer for ten minutes, I'd be very grateful."? Sure, it might get children being polite, right up until they start shouting "Alexa: I don't have a clue what polite thing I'm supposed to say for you to set a reminder, because it's evidently such an onerous task for you. If you could be so kind, order a normal computer or smartphone that does things when I press the button. And I'd like you to confirm that purchase for me, but only when you've got the time." There are lots of advantages to not anthropomorphizing things when you don't have to. If it's not sentient, you don't need to.

Finally! A solution to 42 – the Answer to the Ultimate Question of Life, The Universe, and Everything

Let's really think about this. I don't mind if people want to donate cycles to finding this answer. But why do we care about it? I really like lots of abstract math problems, but they didn't find and execute a new algorithm that can solve these things; they brute forced a bunch of options and found one. If we should need to solve this problem for some reason in the future, and I'm willing to assume we've found one even though I haven't a clue what that would be, does this program give us a new, faster, or organized way of solving for it? From what I've seen, it does not, and we'd have to put more resources into a brute force search. So let's not give it the kind of credit that you've implied. The examples you provide gave us new algorithms, and they turned out to be useful later on. All we got from this are three big numbers.

Computing resources can be quite cheap in cases like these. If that's the way people choose to use them, then that's fine. But let's not give this more credit than it deserves.

OK, let's try that again: Vulture rakes a talon on Samsung's fresh attempt at the Galaxy Fold 5G

Re: It's the way Android takes control of the OS away from the user

I think it's mostly correct. The device will continue to perform some functions. That is true. But as the time between last security update and today increases, it's more likely that malware, anything from a malicious app in the Play Store to a malicious web ad, can get at something I don't want it to. As such, I wouldn't be comfortable using a device without recent security patches for sensitive things like banking or sensitive email. And after a certain point, I wouldn't be all that comfortable using it for slightly sensitive things like most email or having my contacts on it unless I also had a certain degree of protection such as rarely using the web browser so I'd avoid exposure to potentially unsafe code. And while I have some degree of confidence in my ability to detect dodgy things and stay away from them, I don't have that confidence for most of the general public and security is frequently a group activity. I don't expect that I'll have the security update hours after it comes out, but if I'm over a year out of date, I'm a little worried, and if I'm over three years, I'm quite worried. When it's someone nontechnical instead of me, those times are reduced.

Re: I Like The Idea

Removing that screen doesn't give much space; it's a pretty flat piece. Most of the volume of that area is already taken up with a battery and the chips for the phone. The battery would only be a little bit bigger. Meanwhile, losing the smaller screen means using it with one hand just became completely impossible. Also, I'd rather not hold the unfolded device to my face to make a phone call, though you could theoretically let a user place a call with the device unfolded and then fold it in while talking. Then again, the whole folding and larger screen component already means it's not for me, so I'm probably not the right person to assess your suggestion.

Business PC sales up as suits flee looming end of support for Windows 7

Re: Not only am I going to continue using Windows 7 on my main PC...

This is where the easy answers stop. Of course Windows updates are annoying, and they can really mess things up. But it's also true that some of them have useful security patches in them. You've mentioned that the last update applied was in May of 2017; I'm guessing it was the EternalBlue patch, released in March of that year but pushed out with extreme force in May because it was being actively and very successfully exploited by malware. And although I'm sure you're competent enough to prevent most attacks from getting into your systems or damaging things if they managed it, there are other places out there who lack that. For them, the advice to always install security updates is well-founded, because they will at least be able to prevent certain types of malware which could impact their processes or cause data loss.

It's useful to think how easily malware can be installed. If one person using one of your machines is tricked into launching a binary, whether that's by social engineering, a redirection of a download, or something else, security patches are designed to prevent that binary from getting to all the things it's probably after. They're not guaranteed to have discovered the vulnerability the malware is using, but they do patch several each month. If you have enough confidence in your security that you'll catch the binary without needing that, you may be right. Unfortunately, many have had that idea and found out that they were wrong only after seeing the damage wrought by a successful infection.

Acer and Asus unveil some of the world's heaviest laptops ... and some of its lightest

Re: Does not fry the users lap?

Maybe I'm one of those few who do use a laptop on my lap. Then again, mine has side vents and I'm not running all the cores at max power, so no burning here. There are many times when I want to use a computer and there's no convenient surface around, such as in a train/car, auditorium without the folding tables, or house with extended family present so all furniture is being monopolized. I figured lots of people did that. Maybe it's not as common as I thought.

Uber, Lyft and DoorDash put $30m apiece into ballot battle fund to kill gig-economy employee benefits

Re: Taxi Drivers Unite

I'd recommend you consult with a legal or financial advisor before trying to put that into effect. While business expenses incurred by the business concerned are tax deductible, that doesn't apply to many end users who would be taking the ride outside of work. You can't usually deduct your taxi or rideshare bill from your taxes, even if you need it to make money. For the same reason, consumer purchases of automobile fuel aren't tax deductible even if you really need that to get to work. I assumed you had planned for another reason for the payments to be tax deductible, which is where the charity/nonprofit (different term for different countries) discussion came from.

Re: Taxi Drivers Unite

"I think it's time for some market disruption by the drivers,"

I would really like to see that. In many cases, the companies run at least in large part by employees have some major benefits. There are a few cases where they can fall into error, but that's by no means guaranteed.

"they should stump up a little cash each and commission a generic ride booking app that has a simple flat monthly (tax deductable) subscription charge"

That, however, won't work at all. Neither part of that is going to be feasible. Tax deduction only works if the place is a registered charity or nonprofit. There are lots of ways to file as one, but there are usually requirements about working for some specific charitable goal. By most definitions, giving that group more control over what they earn is unlikely to be accepted under the current rules. However, let's assume that either I'm wrong and it is accepted or the law is edited to allow it. The fee still wouldn't be deductible because it'd be considered a purchase, not a donation. Only donations are considered deductible for the purchaser.

As for the subscription, that will fail for pretty much everyone. For many people who don't frequently use the transportation, it won't be worth the average subscription price for the four rides they take a year. Meanwhile, others may get a ride every day, and be profoundly underpaying for that. Worse still, if I have paid for the subscription, nothing keeps me from getting a ride to absolutely everywhere I go, because I've already paid so it's now free. So many more people will be calling rides that there wouldn't be enough drivers to handle the load, yet their revenue wouldn't increase at all. Meanwhile, potential customers would see that it always takes forever to get a ride because all the current customers are using the service five times a day, and they won't sign up. If I have to pay every time I want a ride, I'll probably not take as many, which means there are more available drivers as well as keeping environmental costs down.

Raspberry Pi head honcho Eben Upton talks thermals, stores and who's buying the kit

Re: re: PiTop

The complaint was about the people who make a laptop enclosure for the pi, not the foundation themselves. It's a reasonable complaint, as if you are buying in a currency, they often will at least tell you the cost in that currency. The places that sell the pi give the purchase price in the local currency, after all. As for this company, they have a .com address rather than a .co.uk one, but they have a London address. I'd expect them to have a currency selector on their store, but evidently not.

Re: Wattage limit

They want to maintain the ability to run in power-restricted environments. Maybe it's also a principle thing as well. But imagine trying to run a raspberry pi powered robot off a USBPD cable rather than a mobile phone power bank. While not that many people use their pi for that, you'll see lots of plans and pictures in raspberry pi media, and it wouldn't be so impressive if it were handicapped by a wall connection. I would also say that a raspberry pi's utility to me has often been its ability to run with relatively little power; if I'm running something nonstop or off something with limited power availability, the pi is my go to solution.

It's not exactly easy to make a completely compatible board. The major problem is the SOC. While it's as open as such parts tend to be (now, that took a while to come to pass), you can't exactly go out and buy one. You could probably go out and get a couple million, but that carries a few financial problems. The rest of the parts are very standard. While you could probably make a board with exactly the same shape but a different processor, there's no guarantee that it will work well with existing raspberry pi disk images. Unfortunately, ARM chips can be like that. Furthermore, when other companies try to copy the pi, they want to distinguish themselves from the pi to get customers. Since the pi already has a pretty narrow profit margin, it's hard to compete with it on price. People can, however, compete on specs. For a while, lots of people complained that the pi didn't have gigabit ethernet. Plenty still complain that it doesn't have a SATA connector on the board. Still others had a massive problem with the single gigabyte of memory on previous iterations. In each case, some place tried to make money by making a similar product with those features, usually at a price point at about 1.5 times that of the raspberry pi. I don't know how successful they were, but plenty of those boards are out there.

"TBH I'm amazed there aren't knock-off Pi-es out there. Is there anything proprietary or custom to them?"

There are plenty of similar products. Many of them are so obviously meant to be like the raspberry pi that they've called themselves "[insert other name of fruit] pi". Some actually have better specs than the raspberry pi. However, they are less popular for many reasons. One reason is that they don't have as much community support, sometimes supporting fewer operating systems or working in an incompatible way. Another reason is that, while they often support similar hardware modifications, they aren't directly compatible with the ones designed for the raspberry pi. A third reason is that these usually don't have a guarantee of continued manufacture or software support, something all pi models have received since they first came out. But if you're looking for other versions, you'll find them thick on the ground.

"They are verging on being usable low-end computers now."

They passed this point for many users quite a while ago. It depends what you're doing on them, but for traditional office tasks, the version 3 was quite capable of the load. If you need a lot of memory, nothing before the pi 4 gave you more than a gigabyte, but plenty of use cases didn't need that. It won't replace the full desktop for the people who need that amount of performance, but it could probably replace many an old one.

"Perhaps an official PiBook (in the vein of the OLPC XO netbooks) might be in the offing?"

The PiTop people did make one of these. I'm hoping some other people will also do so, as I found their one somewhat overpriced and underwhelming. Unfortunately, for the price of their enclosure, you can get a comparable laptop with better battery life, builtin storage, and a slightly faster processor. I'm hoping that people will start to realize the potential of using the pi as the computer for various form factors.

Everyone remembers their first time: ESA satellite dodges 'mega constellation'

Re: Isn't satellite broadband pretty much one-way ?

Short answer: no.

Long answer: Satellite phones. Satellite media uplink stations. Current satellite internet. None are new, none require powerful transmitters on the surface. They don't really require all that powerful transmitters on the satellite either when you compare them to lots of other things.

Re: Telecom Companies Rule

You are banking on the speed of light to necessarily generate faster comms. It doesn't. We've had lots of things that used waves traveling at the speed of light to send data back and forth, including nearly every type of radio comms system you could build at the time, and plenty of them were rather slow. The waves move faster through air than through a cable, but what mostly matters is how fast they can be encoded and decoded at the ends. If, for example, the frequencies in use are prone to collisions, that introduces a bunch of latency that wouldn't be there otherwise. Cables don't really have this problem. That's not the only issue either. To illustrate this, consider that modern satellite internet uses the same geostationary orbits that the original ones used, and while latency isn't much improved, bandwidth has been rising rapidly. The electronics have improved; the physics is the same. So just because there are some numbers that look like they make a point, it doesn't necessarily mean they're correct.

In addition, consider how the satellites actually send data. You have to uplink to a satellite. If that satellite isn't in range of the target, it has to send a signal to another one. That might have to happen a number of times before you reach a satellite in the right geographic position, which then downlinks to a ground facility, which uses cable to connect to the host, which then contacts the ground facility with the data, which sends that to the satellite, which has to send the result back to your satellite, and then it arrives at your house. All these factors could introduce latency problems, and some could introduce bandwidth problems. If there isn't a conveniently-located ground facility for your destination, you might end up experiencing most of the cable delay anyway. If you're after a server in a place like Singapore, with a lot of servers and little room for satellite downlink space, you might find that the relatively few satellites there are heavily burdened. A lot of this is difficult to calculate without access to the full documentation that the company has and guessing at part of it. At least, not until it actually goes into service and we can experience it for ourselves. Until then, you might want to think twice before declaring it's definite success with such vigor.

Trade union club calls on UK.gov to extend flexible working to all staff from day one

Re: So because you don't want it, no one else should be allowed.

I think the comment meant that it shouldn't be encouraged, or at least "it is not the case that we must encourage it". I'm not sure I agree with that, but I believe the intended point was weaker than you've described. There are many advantages in working remotely, and there are also disadvantages. Enforcing either could be harmful, but encouraging one over the other might not be. Fortunately, I don't think I'll have to decide on that policy at any point in my career.

Huawei new smartphone won't be Mate-y with Google apps as trade sanctions kick in

Re: And if Huawei allowed unlocked bootloaders

No, I can't see those at all. I can see a pointless ban by the American government as part of a trade war, nothing else. I don't support that, but just because some people somewhere chose to paint the company as a security risk when they're not, that doesn't make every other possibility true. You've claimed that people are out there bricking devices with intentionally damaged firmware and then claiming refunds, but you can't point to who is doing it or when it's happened. In addition, it's completely illogical.

It'd be similar to saying "There are people out there who go into stores, steal the batteries from phones that have replaceable batteries, and replace them with lookalikes that also contain a tracking function and can be primed to explode if the people who built the replacements want to turn the phones into explosives. Therefore, we should not allow replaceable batteries." That statement and yours are similar in that A) nobody is doing that, B) if someone did do that, it'd be completely pointless, and C) if people did do that for whatever reason, the suggested course of actions would not stop them.

Re: And if Huawei allowed unlocked bootloaders

I was responding to "As long as there are companies and secret services that work with mafia methods, you can't afford such liberties. They would be their downfall if they did." Clearly, I misinterpreted it. I misinterpreted it because what you've clarified sounds a bit crazy. Do you have evidence of someone who actually did that? Because other than overworking the company tech support as they reflash their devices, the criminals doing that wouldn't gain anything at all. You only get to claim a refund if the device is manufactured with defects, not if you've deliberately destroyed it.

You don't see, for example, people throwing phones on the ground then shipping the destroyed remnants back and asking for money, because that wouldn't work. And a locked bootloader doesn't really protect against that in any case, because if you really want to render a device unusable, intentionally uploading a corrupted ROM is a relatively time-intensive and very reversible method, I.E. one of the worst options for available frauds. Furthermore, unless you can point to a place that did this, it's a weird argument to make.

I'm sorry that I gave you credit for an argument you didn't make. I thought you were talking about accessing data or preparing a device for resale, because that's the major undesirable thing that criminals do to phones. I apologize for assuming you also considered this aspect, but I believe we are now on the same page. What book this page is in is another question, but one that can wait.

Re: And if Huawei allowed unlocked bootloaders

I don't understand your comment. Are you alleging that locked bootloaders are there to protect us from criminals and surveillance systems? If you are, that's pretty laughable. People steal phones all the time. Most of the time, they don't care about the data and are perfectly happy to reflash the device and sell it on. Even if they could replace the firmware with something else, the phone's serial numbers, IMEI, etc would still be present so the phone would be just as easy to identify as stolen. They don't need to care about the bootloader, only whatever antitheft mechanism the manufacturer has. A good antitheft mechanism doesn't have to be incompatible with an unlocked bootloader; a solution as easy as "Please enter phone's encryption unlock code before the bootloader starts" would serve perfectly.

As for surveillance states, they really care about the data on the phone. Not the hardware itself, just the data. There are only really two ways they go about getting data from a device:

Method 1: They have a phone, and they want to extract all its data but the data is encrypted. In that case, they don't need to replace the firmware, because doing that would wipe out data they need (either all the user data or at least the key used to extract it). They might try to copy the old firmware so they can retry encryption codes, but the antitheft system I described above would hamper them from doing so.

Method 2: They have a phone briefly, and they want to install malware on it to track a user who will use the device in the future. In this case, the last thing they'll do is to replace the firmware. If anything looks different, they'll be caught and the person they're tracking will dump the device. They'll use the tracking software they can install above the firmware level, which can be deployed much more quickly. In either case, a properly encrypted device will prevent them.

Re: Surely Huawei can just facilitate the user adding these?

This proves my point. You have a phone with the required APIs, and all the apps work. Huawei's phone won't have those. Almost all of the apps from FDroid will work perfectly. Many of the apps on the play store will also work perfectly when sideloaded or retrieved from the store by one of the apps you mentioned. However, if an app uses Play Services or another one of Google's proprietary APIs, and many do, the app won't work when installed. It will install properly, but when you try to launch it, it will reach a point where it crashes or doesn't work properly. In order to fix that, a user has to install the required APIs. These exist, but they're not listed on FDroid or in the Play Store itself as Google thinks they've been shipped as part of the default firmware. So the user will have to look for the APKs online, find the versions that run on their hardware, and install them in the correct order. I have no doubt that, when this phone is released, someone will create those APKs and publish them in a matter of days. Users will just have to find an uninfected copy of those and install them correctly. As I said, it's doable, but not without effort.

Re: Surely Huawei can just facilitate the user adding these?

What you need to consider is that none of the proprietary Google APIs are present, meaning most apps in the play store, along with the play store itself, won't work. You'd have to sideload those APIs first, which is doable, but you have to find versions of them somewhere (they're not on FDroid), then load them in the proper order and with some special requirements. Doable, but not without some technical knowledge and having to trust a source of the packages.

Re: So an android phone without the built in google spyware?

They also cannot preinstall the Facebook app, so you get your wish there. Unfortunately, we have no guarantee that they haven't just replaced the Google and Facebook spyware with spyware from anyone else, whether Huawei or someone else they got money from. Though it's probably at least a little bit more private than what Huawei used to ship, I'm still going to recommend an open source variant like Lineage OS for real, verifiable privacy.

Re: This is more of a problem for Google than for Huawei

It's not a stupid question. Huawei makes a lot of phones for the Chinese market and is making money hand over fist in that market. We all know that. But this Google services cut doesn't really hurt that at all, since China has blocked almost all of Google's services anyway for a decade or more. I'd be concerned that they'd lose market share in China if they dropped AOSP for their own custom and untested OS, but if they stick with effectively the same code as they used before, that's clearly not going to happen.

So the major question is how much it will hurt Huawei's ability to sell their phones overseas, and establishing their current market share in various places is a necessary first step to accurately calculating that. And for some countries, their market share is very low, such that it wouldn't be easy to tell if they've lost many customers. For the record, from statistics I found online, and I'm going to have to trust that the internet has correct data on this, Huawei's market share by country is basically this:

Italy: 24.4%

Russia: 14.1%

France: 13.2%

Mexico: 12%

U.K.: 8.1%

Australia: 7.1%

Japan: 4.3%

Canada: 3.8%

India: ~2%, noted to be falling quickly

U.S.: very low, doesn't show on graph

Brazil: very low, doesn't show on graph

Based on these figures, we can see that it's quite logical to ask about the current market share of Huawei by country. If they lose lots of business in Italy due to the services cut, it's much worse for them than if they lose business in Brazil. Americans probably don't see many Huawei devices when out and about, while Russians probably do. And in addition to the mathematical benefits, it gives us a concept of where Huawei does business and where it has yet to take over. I think the question's well worth the asking.

Re: One question.

Should a technically aware person want to sideload the play store, they can probably do so with relative ease. However, that probably won't be as straightforward for the average user, who would have to install the various Google APIs before the store could work. Although it's pretty simple, finding the required files that will run on the hardware involved and installing them properly is just over that line where many won't bother. I can't say whether that will be a problem for Huawei, because we don't quite know how many people will fall into both the categories "don't want to worry about sideloading APKs" and "need apps from the play store". I can say with conviction, however, that should anyone in my family purchase this device and want to use the play store, they'll be asking me to find and install the packages rather than doing it themselves.

Re: Things that weren't mentioned by most news about this

They can definitely access the web apps. It wouldn't be feasible or desirable to block them, and if Google tried (or the U.S. government tried to make Google do it), they'd be facing a lot of legal complaints they couldn't easily counter. So that deals with gmail and youtube easily. This AOSP device should also ship with the default android mail client, which can also connect to gmail easily. It would be able to show the web interface for Google Maps, but that probably won't be so popular given that people use it for in-vehicle navigation, which the web version doesn't really do. However, there are many alternatives for that, including some open source ones from FDroid that work pretty well.

No access to the play store might be harder to get around, as most users aren't attracted to a phone where they can't as easily install any app they want. It's no trouble for us, because many, including me, don't have any play store apps installed and don't find the prospect of having to sideload something worrying. But for those who want to be able to quickly type the name of their mobile game of choice, they might find that feature removal irritating.

Coin-mining malware jumps from Arm IoT gear to Intel servers

Re: IoT malware targets Intel machines running Linux

It's stated that the access method is SSH, so some options include:

1. SSHing with poor or default credentials to root because not all Linux users are, in your words, self-respecting.

2. SSHing with poor or default credentials to something that isn't root, then elevating to root if the user has sudo privs.

3. SSHing with poor or default credentials to something that isn't root, and therefore installing as a user process. It's not as effective, but it'll mine sometimes and that can't hurt the criminals because why should they care?

I have a public-facing server with SSH enabled. Root can't log in, and anything that can log in has an undisclosed username* and either a seriously difficult password or keys only. Lots of automated login attempts occur, but not all of them are people fruitlessly trying to log in as root. Many are trying things like "admin", "system", "user", or the machine's domain name. The people trying this must be doing it because it sometimes works.

*Undisclosed username: This is not a security measure; I know that security by obscurity doesn't work. What it does let me do is set up a monitor for the SSH logs that can inform me if someone is trying to log into an actual account, thus filtering noise from the pointless attempts. If someone does get a real username, I will know about it and I can figure out where that information came from and where this at least a bit more sophisticated attack is coming from. Unless that filter activates, I don't have to worry about the automatic SSH bots. And while we're on the subject, *checks logs*, nobody's guessed any real usernames since the server was set up two years ago.

Re: So..

In many cases, it already does. If you ever try mining on Windows, you'll probably have to whitelist the directory where you put your miner. In fact, Windows Defender even treats the Monero binaries as malware, even though you can't use them to mine, only to transact. But there are fewer traditional antivirus products for Linux, and they're less common, so I don't know if they also treat mining as suspicious.

Zapped from the Play store: Another developer gets no sense from Google, appeals to the public

Google almost certainly spent a few of their billions on a team of attorneys to draw up a contract that lets them do anything they want, as long as it doesn't break the law, but also some things that do break the law because who's going to check, and insulate themselves from any developer action. Meanwhile, they also have the resources to make sure a challenge in court will last long enough for the other party to run out of money, and if someone smallish challenges them on this contract, I fully expect to see that tactic used.

Re: 'Tis a pity he is Canadian

I doubt that would be strong enough for Google to take notice. They'd just let him spiral toward becoming bankrupt trying to have a good enough legal team, than shake their corporate head and continue on without noticing the attempt.

Hong Kong ISPs beg Chinese govt not to impose Great Firewall on them

Yes, it is such an argument. If Hong Kong's internet is cut off, all the data centers will become less popular. Nobody will set up new ones, and people wishing to have servers in a place that can be accessed in China but aren't controlled by China will leave for other locations, probably South Korea for the main Eastern connections and eastern India for overflow. The investment in Hong Kong's data lines will have been wasted, and access to approved data inside China will be made slower because fewer lines will have to take the traffic. That's without considering the loss in business when all the people who used to use those datacenters look at all the datacenters in Singapore and figure that those will work just fine.

Today's Resident Evil: Ransomware crooks think local, not global, prey on schools, towns, libraries, courts, cities...

Yes, we think backups are the solution. Backups isn't just the big box of tapes with all the data from last weekend on them; it includes everything that allows data recovery when data is lost. Whether that be snapshots, extra copies, or the big box of tapes.

You're right that having to restore from backup at the level of off-site external media is costly in time and money, but there are some things to keep in mind:

1. We only suggest doing that if you have to, I.E. the backups that are online and easy to restore from don't work. Frequently, more persistent ransomware will have found those and screwed them up. Yes, you can configure them not to be vulnerable to the typical attacks, and that will protect you from the majority of lazy ransomware. If it does, that's great. If it doesn't, fall back to offline media.

2. Restoring media may be an expensive DR option, but that's to be expected. This is disaster recovery; you only do it when there's been a disaster. There are lots of other disasters where you'd have to do the same thing, but having to rebuild from scratch would cost much more. If the cost is too high for the business, it might be worth constructing a cheaper backup system or one that restores more easily.

3. Paying the ransom is a terrible idea. It guarantees that you have the same problem that let the ransomware get in. They might also stay resident in order to hit you again in a few months or maybe just to add your machines to a botnet.

4. Paying the ransom is immoral. It funds criminals when there is another option, and increases the probability that an attack like this will happen again. If you pay the ransom, you are making someone else pay the real cost for you. That's bad.

They could do that, but they could pretty easily keep an offline backup, whether there or offsite, with relatively similar amounts of effort. If they're not going to do that, they aren't going to do a cloud backup either. If they don't have staff competent enough to keep proper backups, this is going to keep happening.

Apple says sorry for Siri slurping voice commands of unsuspecting users

Re: Random identifier

If they're doing what they say they're doing, the random identifier is just that, a random string assigned when the request comes. In that case, it wouldn't be attached to any other data, not by hash or anything else. Then, after six months, the key with the random string is deleted so anyone looking at the data couldn't be connected with other recordings from the same source. And if they did that, things would probably be fine subject to some extra considerations like the aforementioned backups storing strings for longer, which wouldn't identify users but would allow collating recordings for a device.

But we have no way of knowing whether they are keeping to that. And they have to have known previous to this that having people listen to recordings is dubious at best, but they didn't stop doing it until right now. If they do what they say they're going to do, then I'm quite a bit happier with them. And so far, they haven't lied about not doing something they are really doing, but haven't been particularly proactive in determining when something they admit they're doing is problematic. We'll have to watch them; if they decide to do something like this again, we have to nip it in the bud.

Microsoft's only gone and published the exFAT spec, now supports popping it in the Linux kernel

Re: My uninformed comment

UDF is the solution? I've had a read through the wikipedia article about UDF, and I have my doubts. We'll start with the problem that it's designed for optical media. As in media that can be written a couple of times at most, not one that might have an operating system boot off it or store frequently changed files. There is a version not specifically designed for limited-writes media, but there are others designed specifically for that purpose. This brings us to the next point.

There are a bunch of revisions of the UDF spec. And we all know what that means: lots of poor implementations that support only some of them. And it's not just different release versions, but multiple types of filesystem inside UDF. The wikipedia page includes many statements about what versions different implementations support. Actually, they don't say that. They instead tell us what different implementations "claim to support". Sometimes, such a statement is followed by a statement that only certain subversions are correctly supported, and much of this is for reading only.

My third point can best be made with this quote: "The UDF specifications[7] allow only one Character Set OSTA CS0". When this is a key point in the summary of a spec, and they follow it with a discussion of when this doesn't play well with other encodings, I know it's not fun to deal too much with this filesystem.

Re: Bring compatibility problems to Window, not the other way around

I'm completely fine with you implementing EXT4 support for Windows. But unless it gets installed by default, it's useless for most cases. The average user isn't going to understand that they have to open the partition they see, install the driver, then remove and reinsert the media, probably after restarting, and then it'll work. That will just annoy them. And most people who have EXT4-formatted removable media aren't going to bother partitioning it to include the drivers for Windows, and for that matter Mac OS as well.

For removable media, I want the guarantee that I can plug my disk into anything, and the files will be there without needing to deal with drivers, request extra access to install them, or require reconfiguration. We already have a thing that does that, and it's FAT. The only tiny problem with FAT is that it contains a couple very irritating defects, the most obvious of which is the limit on file size that can quite easily be exceeded. But because we don't have anything else that pretty much every operating system understands, I still use it for most of my removable media. Getting a better version that doesn't have those defects and having that run on everything new would be wonderful. I don't really care which particular filesystem it is; if everyone adopts EXT4 I'd be equally content. But it's got to be built in.

A quick check that might be incorrect suggests that they were granted a central patent in 2009 source, and then the patent would expire in 2026. I'm wondering why the patent was granted in 2009 when the filesystem was released in 2006, so there are some other options. But no, it seems they could keep charging for the patent for a few more years, and if they release it under acceptable terms, they're not going to do so.

Re: What if ...

While they don't necessarily have to use exFAT for that, it is probably the logical choice. ExFAT is a filesystem that plays very well with external media and most operating systems, Linux included if the package is installed. Most other filesystems don't meet one or both of those requirements. If they're also using Linux, you have many other options including the basic EXTs, but that will be more trouble for them than it's worth if they use Windows or Mac OS. Of course, the code installed to let Linux deal with exFAT at the moment won't be all that fast, which a kernel implementation would fix. I am therefore quite hopeful that this does get implemented soon.

Samsung Note10+ torn apart to expose three 5G antennas: One has to pick up something

Re: Ban nontreplaceable batteries

It could easily just be heavier use. If you do more things with your phone, you'll have used up the battery faster (I.E. it doesn't last as long even when new) and put it through more cycles because it kept getting discharged. It could also be that your phone is less power efficient than the one mentioned.

While I'm entirely in favor of phones having more user-replaceable parts, I don't particularly care about anything other than the battery, and I don't care all that much about that either. I know people can replace other parts of phones, but all the devices I've seen this on have been somewhat unstable (E.G. replaced screen panels that don't really feel like staying firmly on the phone). For the battery, I'm really hoping that, after four years or so of use when I'd like a new battery, I can find someone who is making compatible batteries today, rather than shipping compatible ones they've had on the shelf since the release of the phone or releasing batteries that look like they'll probably work, and once they get shipped here individually, I can plug them into my phone I don't want to replace just yet and see if they really do.

In purchasing a phone, I expect that, at some point, it will develop a serious mechanical problem. I could try to fix it or get someone more skilled with a soldering iron to help me, but I know that's likely to make the device function worse. That's why I try to go for cheapness. Modern cheapish Android phones are quite well-built, and I don't feel like I've lost much if it turns out that this one doesn't stay together as long as I hoped and I'll have to replace it after three years instead of six. I can't guarantee any reasonable lifetime of a device, but I can make it so that when the inevitable happens, I'm out much less than I might have been.

Re: Typical Corporate Greed

You don't need a headphone jack. I don't need one either. Probably few of the people posting here need one. But plenty of people posting here really want one, and base their purchasing decisions around that desire. I don't see why you have a problem with them when they complain about a lack of a feature they want. In my situation, the jack is sort of handy, but I don't really use it all that often. When my phone breaks and I need to replace it, I won't make a headphone socket a required feature. But why do you seem to have so much hatred for the connector or people who use it?

Biz forked out $115k to tout 'Time AI' crypto at Black Hat. Now it sues organizers because hackers heckled it

Re: Junk "science"

"Technically you are correct. But if you compare good arxiv "preprints" with published versions you'll find that many have only very minor changes."

In general, Wikipedia provides a useful, comprehensive, well-researched, and balanced summary of pretty much every topic. It's a great start for gaining some basic knowledge about something. And if I want to, I can go in and mess it all up. So can a lot of other people, so there's always some chance that the page you see there has been recently vandalized to contain incorrect information. Similarly, Arxiv is a great resource, given it allows members of the public to access papers without having to pay a journal that isn't actually doing the important part, and for that I'm quite grateful. Still, Arxiv can be polluted by useless documents, too. I haven't read the "paper" produced by these people, and I don't intend to, but just because they've posted it on a mostly reputable site doesn't mean that its contents are of any use to anyone.

Wait a minute, we're supposed to haggle! ISPs want folk to bargain over broadband

Re: Penalising loyal customers - helps competition?

This applies to pretty much every network provider I've seen in any country.

"Get our new UNLIMITED DATA plan just 29.99/month"

"How many lines do you want? 29.99/month/line above four, 43.99 for three and four, 59.99 for the second, and 85.99 for first."

"How much data at usable speeds do you want? 29.99 for 2 GB, 39.99 for 3 GB, etc."

"Do you want to be able to make voice calls with that plan? Add 4.99/month/line above four, 6.99/month for three and four, ..."

"Choose your free phone to go with this plan. Your choices are the latest iPhone at only 54.99/month for the rest of eternity, the Samsung flagship for the same price, a weirdly chosen midrange Android for 34.99/month and wondering why that's the one chosen, the Huawei for 44.99/month, [scrolling, scrolling] [option to choose no device not found in list]"

"Enter discount codes. [These codes may exist, but the most you'll get is a 15% discount on the first month]"

The companies might have a better plan, but I'm too busy hating them to be able to call and ask about it.

Pokemon Go becomes Pokemon No as games biz Niantic agrees to curb trespassing addicts

Ethics

I haven't been affected by people doing this, but in the hypothetical situation, how ethical or unethical do you think it would be for me to set up a device that catches requests for WiFi and establishes connections that don't work to mess up the many phones set to prefer known WiFi networks over cellular, then put it so it covers my yard but doesn't have enough power to extend outside of it. Is that too untargeted?

I couldn't possibly tell you the computer's ID over the phone, I've been on A Course™

Re: I wish my users protected data like this efficient PA

I take the point about asset lists not always being up to date, and I don't think that's the necessary solution to the problem. Yet it's still not the fault of the user concerned. They were, perhaps annoyingly, sticking stubbornly to their security training. In other words, they were doing exactly what we'd want them to do in the case of an attempt at social engineering. Repeatedly shouting at the user to give you information doesn't help prove the point. Asking the user to call back with a trustworthy number does do that. There are other ways to authenticate as internal and/or trustworthy, but none were mentioned. Worse, the user who acted in compliance with their training and was actually able to provide the required information without leaking potentially secure information was penalized in a frankly pretty irresponsible manner.

Contacts-slurping Android malware sneaked onto Google Play store – twice

Re: How it looks to me

It doesn't hurt all that much if other people get slices of the data. Many of them are showing Google ads anyway, and most of the other data collection isn't for ad competition but for spyware purposes. Why should Google care about that?

Also, implementing real checks that catch copied malware code that hasn't been hidden in any way would take, like, a month for a few Google Play engineers. They could be working on something else. Something more useful like ... Android security updates and getting those running on more devices? No, not those. These are cloud engineers after all. How about ... malicious extension detection for Chrome? No, not that either. They're not focused on that type of code. Another idea ... thinking ... thinking ... got it! They could work on preventing ad blockers from working. Sound good to everyone? Well, we've identified the best use of developer time. Go back and get that implemented guys.

Buying a Chromebook? Don't forget to check that best-before date

Re: Keep calm and just install something else

It is a tech site. That's why we know about the potential problems with no security updates, and why we aren't happy to see this being sold to unsuspecting purchasers, both technical and nontechnical. And maybe we can install something, but there are lots of points to consider about that:

1. Some may be locked down or lack driver support for anything other than Chrome OS. So in that case, we can't.

2. Some may lack the specifications to run anything else (E.G. really tiny storage). The purchaser probably doesn't care because they just wanted to run Chrome OS, but it would prevent a useful installation of something else. If this specification limit was the reason for dropping support, I'd drop my objection, but it's clearly not.

3. Maybe the thing to replace Chrome OS doesn't work as well for the intended purpose. For people like us, a full Linux installation would probably be much more useful. For someone else, the lack of any complexity in Chrome OS might have been a selling point. They chose to buy the device because of (or in my mind in spite of) the OS, so it stands to reason that they probably want to keep it. This especially applies to schools; they need laptops that can run a browser and are cheap enough that they can be replaced. Of course they could do that with a Linux distro running on that or similar hardware, but that requires a Linux admin who they'd have to pay. The selling point of these that got them adopted in so many schools was that you didn't need to spend as much time on administration. It turns out you have to spend that in money for new hardware that doesn't provide you any benefits.

4. There is no good technical reason for dropping support like this. If they released a new version of the OS and said "Sorry to any chromebook users still stuck with 16 GB of storage, but we'll need some more for this version. We'll give you security updates for this version for a bit longer, but you will probably want to buy a new one or expand the storage if possible eventually", I wouldn't complain. If they released new versions that need more processing so they run slowly on old hardware, I'd complain about poor coding practices but they would have no policy complaints from me. But they're not doing that; they're setting a death date for the devices and then cutting them off at that point for no good reason.

My MacBook Woe: I got up close and personal with city's snatch'n'dash crooks (aka some bastard stole my laptop)

Re: A note of CA license plates...

Maybe, but with that description of how the plates work, it doesn't sound all that hard to fake. It wouldn't stop someone who was looking at the stolen car, but works just fine when you're worried about someone taking down the number while the car is in motion, which is exactly the situation in this case.

Re: Or

"Floor tiles that aren't glued down, so that if anyone runs then their feet slip and they don't actually move."

Good suggestions except for that one. I don't think health and safety legislation will like that one, and I wouldn't either when an emergency happened.

Re: So here's the advantage to soldering down the SSD

Machines can be locked down to that extent, but many noncorporate ones aren't. Thus, the criminals may be surprised to find one with those precautions implemented because their previous ones have not been so encumbered. It doesn't help the victim very much, unless Apple makes that level of security the default. Of course, if they do that, it won't help people who really want to erase a machine they have a right to erase; if a user has forgotten their encryption code, the IT department will much rather have to reimage the machine rather than throw it away.

Re: "should risk their necks to protect your shiny tech toy "

I might not have intervened, probably because it'd take long enough for me to understand what was happening that I couldn't do anything. But afterwards, when the victim is asking people to witness, I'd definitely step up, no risk involved. Even if all I can say is "I didn't see much, but I can corroborate that I saw a guy running through here with a laptop, and you were chasing him so it was probably yours", I'll do that. Doing nothing while the crime happened is understandable, as it probably took about twenty seconds. Keeping silent afterwards is not very nice, because you could just say "I'm afraid I was facing the other way and didn't see anything" if that's the case.