Posts by doublelayer

Good luck deleting someone's private info from a trained neural network – it's likely to bork the whole thing

It really depends how our notional algorithm was trained. The model stores information it thinks is useful, and the developer cannot tell it to retain information or block it from storing information that is provided to it. So if address was an included field, and the algorithm was trained in such a way that it came to the conclusion, correct or not, that address was a useful feature, it would probably store relationships of that nature. Somewhat crazily, in that case, it would think it could guess at every address, including ones it's never seen before (though a good system would lower the reported confidence rate). It's not guaranteed to contain that information, but it easily could.

The major reason this could happen, outside my example of the evil programmer above, is where there are actually a bunch of patterns. Suppose that the 1200-1300 block on 2nd St. is primarily occupied by vegetarians (we're sticking with the grocers' model in this example). If the model was given this information, it could easily notice that people there are more likely to be ordering lots of vegetables and much less likely to order meat. This might convince it to keep more address information, because it was useful in that scenario. Now imagine that there is a large group of people, say a large extended family, who share the same surname and have specific recipes in common. Now the model sees a pattern where customer name is usefully connected to buying habits, and more of that data is retained. And now we have a model that stores two types of data that are next to useless, because they don't scale to the public at large, but would allow access to potentially private data. Removing that data would require retraining the model to exclude it. That's why we have to not put that data in in the first place.

The problem being that a ML model may contain a lot more than a summary of the data. It might say that a new customer with no identifying information has a 70% chance of being a white male who would like to buy apples at a confidence rate of 62%, bread at a level of 73%, and lettuce at 52%. It might also say that a customer whose address is 1234 2nd St. is 99.5% likely to be a white female aged 42 who will want to purchase potatoes at 97% confidence, oranges at 88%, and bread at 99.83%. The problem with models is that you can keep asking them questions, and while they're not always correct, they'll take any information you give them and try to answer questions based on that info. In this scenario, address would not be a necessary thing, and a good developer wouldn't provide it. A bad developer might not notice, and an evil developer might provide it so you have a black box that's hard to audit but allows access to this data. This is why GDPR has to apply to all the source data they're about to use. If it's discovered that they violated privacy rules in obtaining the data to give to their model creation process, the models that resulted might contain parts of the data.

Re: Why use personal data to train AI?

But if you use actuarial tables, you don't get to say in your adverts that you're a modern 21st-century company using AI, and you probably have to pay some actuaries to update the tables for you, rather than taking your database and throwing it at a model building AI program built over one summer by a temporary dev. And you might get more precision with the neural nets because it could be more complex, but mostly that first one.

Re: By the time it's ingrained and encoded into a deep learning net...

Black box algorithms do something with their data. Some of it, they keep. The question is whether it's possible to retrieve any of it. If, for example, patient name was used in the training set and given to the program, there is a good chance it has done something with that data. Maybe it identifies that people named Bob are more likely to have certain health conditions than other names. If you provided it with more information about Bob, it might be able to predict more information. Of course, a good AI developer wouldn't include patient name, as that's an invitation to pollute the data and has historically proven problematic*. But people do do it sometimes and it could therefore be a privacy risk.

*For example, an algorithm trained on medical data to determine the likelihood of a patient having cancer was given the name of the hospital where the patient was receiving treatment. The algorithm was able to determine that patients staying at hospitals with "cancer center" in them were more likely to have or develop cancer. This made the algorithm next to useless, but it also increased the accuracy rate and if we know one thing about AI companies, they like good accuracy rates.

Facebook's Libra is a terrorist's best friend, thunders US Treasury: Crypto-coins dubbed 'national security risk'

Re: I quickly read the Libra White Paper

It's not new for the credit card people to be tracking purchases, but they haven't had the kind of history Facebook has with massive privacy violations. I wouldn't mind having extra choices for credit card provider either, for privacy reasons as well, but there's no comparison between Facebook and the established companies for privacy.

It's always nice to have an independent third party, but in order to establish its independence, I'll need to verify some things. It was started by Facebook, and they're the ones I'm afraid will hold too much influence. So I'll have to ask some questions. Are Facebook employees in this organization? Do Facebook have any control mechanisms over this organization? Is Facebook running the technical parts of the system? Let's check ... the answers are yes, yes, and yes. Let's ask a few more questions. Is there a method of throwing out Facebook? Is there some type of channel whereby the other people in this organization can override Facebook's decisions, including technical ones? Is there a method for end users to control the actions of this group? I'll check on those too ... no, no, and no.

Re: Oh, please

It's pretty ridiculous to blame one cryptocurrency for a money laundering risk. Crypto can be used for that, but money laundering has been pretty easy for a number of criminals. Terrorists rarely need crypto because they can run bank accounts and get donations from various supporters as long as they make a token effort to hide who it is. Theoretically, everything with value, from gold to cash to securities to those pointless online game accounts, can be used for money laundering. The solution isn't banning whatever we've decided is being used, but either making that thing harder to launder or finding the people laundering with it and dealing with them using the tools of the criminal justice system.

This idea of Facebook's is terrifying because Facebook has proven themselves to have a trustworthiness score somewhere below -100%, but it's almost certainly not going to be problematic because terrorists or someone else will use it to hide. It will be problematic because Facebook will attempt to monitor and control users' and nonusers' financial activity. Hate it for the right reason.

AI solves Rubik's Cube in 1.2 seconds (that's three times slower than a non-AI algorithm)

Impressive

So, they've trained a machine learning system, using a lot of different possibilities and probably a ton of training time, and gotten a system that doesn't exceed actual human programming. In addition, the human programming is not a black box, so can be patched if it malfunctions, but this model would have to be retrained. There are many cases where machine learning is useful or even necessary for a good result, but this never struck me as one of them, and the results don't impress me much.

Galileo, Galileo, Galileo, where to go? Navigation satellite signals flip from degraded to full TITSUP* over span of four days

Re: We live in a society

It was always this way. At nearly every point in history, the vast majority of humans would not be able to sustain the loss of the technology they used. In the 1950s, only a small subset of people could get electricity running again if power plants stopped existing. They'd have to build generators, obtain fuel from somewhere, and find some method of cleaning up the power so their electrical devices would be able to run on it. Even as we move back in history and technology becomes simpler, this continues to be the case. Do you think a medieval farmer, though undoubtedly skilled in agriculture in a way we modern humans are not, could get a plow together at that point? Of course they could, if they already had the necessary technology. Could they if they first had to manufacture an axe to get the lumber and the metalworking tools the blacksmith had using only things found in the natural world? I wouldn't count on it.

Fewer people study silicon design, but that doesn't matter much. If we ended up in a disaster scenario, even if we had all the silicon designers available, we'd also have to have the people who build the machines that manufacture chips, and the people who power those machines, and the people who get the raw materials out of the ground, and the people who purify the materials after they got out of the ground, and the people who build the machines for that, and the people to ensure all the aforementioned people don't die due to starvation, disease, or environmental factors (temperature, something toxic, etc).

Similarly, I was taught C and C++. I consider myself somewhat skilled at writing in them. I've written things at the operating system level. I've been employed writing in those languages. Could I, alone, develop an OS? Not a chance. I'd need to read a lot about how the real OS developers have done things so I could copy their ideas. And could I do that if I had to start from scratch? Even less of a chance. I haven't written a C compiler, and I haven't ever really connected to one.

Most disasters don't destroy everything. Even if a small area was preserved while the rest of the world was obliterated, there would be technology from before the disaster in that area if there were humans there. They would have to rebuild a lot of stuff, but they would do it on the back of the tech that existed before. And there's a reason turns of phrase like "blasted back to the stone age" exist, because they'd have to reinvent several wheels. But this was always the case. There was never some miraculous time when the majority knew what they were doing technologically that we've thrown away.

X-ray specs: Signal whizz JMA Wireless claims to have solved indoor 5G, everyone

Re: How will this compare to WiFi

That's true. However, the difference between countries is the maximum power allowed and some channels from the full set may be forbidden, not a completely different frequency and method to use that frequency. Almost all WiFi devices can be configured for other countries by editing a configuration file (the ones you have don't seem to be constructed well), but changing a 5G transmitter or receiver requires different chips and antennas.

How will this compare to WiFi

I think I can field that one:

Indoor 5G (hereafter I5G): functions with 5G enabled phones assuming channels match up

WiFi: functions with pretty much any device released since 2009

I5G: Access points must be developed on a country-specific basis to ensure they properly connect to wider cell networks (they will be carrying telecoms traffic from phones, after all) and avoid interference with local cell companies.

WiFi: One standard, used worldwide.

I5G: Almost a hundred possible bands, requires phones to match specific bands to work at all. No phones actually support all or even most bands, and there is no common band they'll all do.

WiFi: Two frequency bands. All WiFi devices support 2.4GHZ, and most also support 5GHZ.

I5G: Massive lock-in.

WiFi: No massive lock-in.

I5G: Inconsistent range depending on exactly what bandwidth is in use, requiring site-specific surveys to determine why there are still a bunch of dead spots.

WiFi: Established norms that mostly apply and can be used to estimate how the network needs to be set up.

I5G: Data may go through the cable of the building or the outside mobile network. Both need to be enabled. There may be security risks to this.

WiFi: The building admins can control how that works, avoiding security issues.

I5G: Choices include low frequency (low speed, better coverage) or high frequency (high speed, terrible coverage).

WiFi: Established frequencies, generally deemed acceptable for range and throughput.

I5G: Given lifetime of 3G and 4G, may become abandoned in rush for 6G in five years.

WiFi: Will still work if slowly in fifteen years.

Brilliant Boston boffins blow big borehole in Bluetooth's ballyhooed barricades: MAC addy randomization broken

Re: Isn't the real flaw...

I've long thought devices should stop sending packets asking for the networks they know--they could instead listen for broadcast SSIDs which get announced anyway. This would at least solve the problem of devices that always respond yes no matter what SSID was requested and the other problem where devices can be fingerprinted based on the SSIDs they ask about. I'm not quite sure why WiFi decided to go the other way.

Re: I still think...

MACs are supposed to be unique, yes, because networks can't deal with (some exceptions apply) duplicate MACs. That's how they're designed. However, why does my MAC have to be globally unique instead of just unique on my network? And why does it have to be the same unique value when it's on my network and when I've connected to your network?

Some things need to be globally unique, so people can find or at least recognize that specific thing when it appears. Others don't. Given that a MAC is essentially a random number, telling you only what manufacturer built the device (which you don't need to know because it doesn't tell you anything you need), there is no major benefit obtained from keeping that MAC or using a random one, unless you somehow connect to a network with another device that has simultaneously decided to use the same randomized number.

Oracle told to warp 9 out of court: Judge photon-torpedoes Big Red's Pentagon JEDI dream

Re: Not Surprised

The single point of failure has validity, but so does the complex threat landscape. When there's just the one system, without interaction to others, the single point of failure argument is the more important, as everyone who wants to attack it knows what they're going to target. However, if the DoD used two cloud services and linked them together (I.E. one system running on AWS is used to control another system they've decided to run on Azure), an attacker could target either AWS or Azure in order to tamper with that system. If everything runs on only one of the cloud services, there are fewer available vulnerabilities. In addition, the costs for ensuring proper administration are reduced because the techs only have to be drilled in proper administration and security of one cloud service, rather than potentially following a policy appropriate to one and not the other or having different teams familiar primarily with different providers. So there's an argument for multiple providers or just one.

I don't have to save my work, it's in The Cloud. But Microsoft really must fix this files issue

Re: I can see where you went wrong, step 1

You don't usually have to offer to help. Often, someone who knows you know about computers will ask you for help, and then you have to decide whether to agree, simply say no, or try to make up an excuse why you can't. This is made harder when it's your family or friends doing the asking. I can't count the number of times I've been frustrated with my family members doing something where I've suggested to them that maybe I shouldn't be doing their computer repair, but yet I still end up helping when something else has gone wrong, as I still like them as people and they haven't identified another option for getting out of whatever nightmare they're now in.

For example, I suggested to my parents that maybe they should ask someone else about their computer after they decided, against my advice, to do an in-place upgrade from Windows 7 to Windows 10 without taking a backup, then another in-place downgrade back to Windows 7, again without taking a backup. I recovered their lost files, but I told them the situation was untenable. Before that, I said a similar thing when they were running out of disk space and were trying, fortunately unsuccessfully, to destroy the recovery partition on their hard drive to gain that space (I think it was about four gigabytes) back. My suggestion to run CCleaner which could (and did when I ran it) clear up about thirty gigabytes of windows update files and crash dumps was seen as a stupid idea and why was I suggesting something like that.

But that was before schools developed an odd love of PowerPoint presentations containing the required at least one image per slide and occasional video clips. My teachers never seemed to accept that my talking about the topic would be a completely fine presentation, especially when I was going to say all the stuff I wrote on that slide plus extra information. And having a short piece of text to read while I said it out loud wasn't good enough; I had to provide a picture for each topic. Usually, that meant typing the topic into Google images, selecting one that kind of sort of worked, and slapping it on so nobody would actually look at it. Those files were somewhat large, and after you've done a few, you could easily run into a storage quota were the school to impose one (when I was there, you had no quota because you also had no storage--you were responsible for creating the presentation on some machine and getting it from that machine onto the one that ran the projector).

Re: She's not entirely wrong

There is one of those. If I recall correctly, its exact wording is "Would you like to save your changes?" if not a new document and "Would you like to save this document" if not saved previously. The user in this story consistently clicked "Don't save".

Re: The user is right

The user might have been right, at least at first and given we assume that the way you described it is actually how it happened. However, there was one specific thing the user saw after which they were entirely wrong: "Do you want to save this document?". At that point, the user had received all the evidence needed to determine that the document was not saved or at least needed some amount of explicit user action. There wasn't even any option for the user taking no action or going with the default. When that question was asked, the user was forced to select an option, and the user looked at the box and consistently selected the wrong one.

Users have to read screens. If they don't understand what they see, they should ask questions. If a user sees a box that says "Would you like to perform a test of the building's emergency systems by turning off the power and on the fire alarms?", they should not click yes. Their options are clicking no after coming to the conclusion that they really shouldn't be here or leaving the box up and getting help. It's not suddenly fine if they've not seen the box before or thought it certainly couldn't do what it said.

Caller: What? You thought I called the IT department from my phone? No, I'm using the one from my coworker across the office. Mine's been broken for a month.

Caller: What do you mean why didn't I report it? Who do I report it to? You? But this is a phone, not a computer. Why couldn't you figure out that my phone was broken? Isn't that your job?

Caller: No, I'm sure it's broken. Your system must be wrong.

Caller: No, I didn't hear it ring. It doesn't ring; it's broken. Yes, my computer can access the internet. Well, it could, but it's broken now. That's why I called you in the first place.

[When an IT person comes to the desk:]

Tech: You've turned your call and ring volume to silent, and your computer says "installing updates, please wait".

Other worker: Oh, while you're here, my computer just came up with a message saying IT is remotely controlling it. Is it a virus?

Tech: No, that's probably a mistake. Did this [indicates original caller] person use your phone just now?

Other worker: Yes.

Tech: We thought this was the problematic computer so we logged in to fix it. I'll close that session.

Other worker: You can remote control my computer? And you don't bother to check that you need to? Why can't you do your job better?

Tech: [Suppresses rage and makes fastest possible escape]

Cough up, like, 1% of your valuation and keep up the good work, says FTC: In draft privacy deal, Facebook won't have to change a thing

Re: "it just has to swear it won't break that 2012 agreement"

I suppose there's some hope that this means they will face something massive if they ever break it again, but knowing politicians and their level of knowledge about technological issues, I doubt it. Without a law that makes it clear what is or isn't allowed, there will continue to be pointless little actions like this one. While I'm clearly disappointed that they haven't managed to change Facebook's approach any, I never really expected Facebook to take any real action, and at least they're receiving some penalty that actually impacts their books.

Just because you're paranoid doesn't mean Google isn't listening to everything you say

Re: They are still very much a work in progress

Way to miss all the points. Let's take your comment apart and look at each piece in detail:

"I'm surprised that this website, a website targeted at skilled users of computing technology, has so many commenters who are totally negative about voice assistants. We develop software for a living so we know the problem of developing and testing algorithms. Its 'non trivial', it takes a lot of time and effort to get things to function properly."

And because properly coding software is hard, we should accept massive privacy risks? Why? We don't have a problem with the devices getting the speech recognition wrong sometimes, we have a problem with data being sent out and kept without our permission. In summary, it's not the algorithmic details we have a problem with, but the operations details.

"I daresay they can eavesdrop on me but I can easily turn them off if it was important that they were unable to do so. (I'll overlook the numerous ways you can still be listened in on -- starting with the phone, computer and so on and going on to active listening systems -- you wouldn't believe how easy it is to eavesdrop --"

But your computer isn't listening unless you've been infected with malware. If you were infected with malware and it was listening to you, you'd be unnerved and upset, no? That's what these devices do by design, and we find it somewhat creepy.

"I realize that these systems represent something far bigger than just an amusing gimmick, they're groundbreaking devices in the development of what used to be called man/machine interactions."

No, they're not. They're pretty basic question/answer devices. They can do a rather limited number of things. It can be a useful interface, but the capabilities these have were available years ago.

"beyond mere commands; Alexa can tell when someone's breaking into your house, it can be asked to listen out for smoke alarms and there's even been some quite successful experiments to determine whether it can recognize the sounds of someone having a heart attack. This is cutting edge stuff,"

Yes, those things have been tested. However, given that it can't always recognize whether its own wakeword has been said or not, it can't be that cutting edge. Also, many of those use cases are kind of pointless--assuming the detection of an alarm is meant to alert someone not present, either the homeowner or an emergency service, the potential unreliability of the audio detection could be circumvented by having the alarm itself do the contacting. And once again, our issue is not with the uses of the technology but the abuses by its manufacturers.

"and, yes, it has to all go back to AWS or the Google cloud because we don't know yet how to localize the processing, nobody's quite sure what's needed, what should run where and how to package it so it doesn't require a small power station to run it (important if you're dealing with something that's running 24/7 or from a battery)."

That's incorrect. I built a thing that was kind of like a voice assistant. It had fewer questions it could answer, but as I wanted to code some of my own and my major questions were "what is the weather today" and "what time is it in [insert location]", it did just fine. I did this in part because I had an old computer I didn't know what to do with. Did I mention that this occurred in 2008 and the computer in question was built in 2003? Did I mention that all speech recognition happened locally? The devices need a connection to obtain information to say and stream media, but the manufacturer decision to make the devices pitifully powered and outsource all recognition to their systems was not done out of technical inability.

"So, let's have less of the negativity. If you don't want to play then don't bother with it. (...."

We don't. However, we still have the right to complain about it being creepy, and if we have the chance to prevent privacy violations that are, you know just technically, illegal, we'll do it. I'm tired of the "don't be negative, just don't use the thing" rubbish. On that basis, I could say "don't read our comments as you've made it clear you don't agree with them", but that would be a stupid thing for me to say.

"These technologies will evolve, there's no way to wish them away, so we either learn how to use and control them or become a slave to those who can use them."

There you go. "use *and control*" them. Our issue is that we can't control them. Some people above also don't want to use them, but I have no problem using them or having others do so as long as control can be achieved and used to obtain privacy.

"BTW -- No, I don't work for Amazon or Google. I'm a retiree -- one of those old people that are regarded with amusement because we don't understand computers....or maybe we do, since we've been riding them up from the beginning...."

Given your comments, you either don't understand the types of privacy violations these devices do or you don't care. I'm going to give you the benefit of the doubt and say you do understand and don't care, but plenty of people who have these devices don't understand what is happening to their data, and get freaked out when they discover it.

I prefer "don't get one", "if you have one, see if you can reprogram them to do something else", and "if you have one and couldn't reprogram it, see how much power you can send through the cable before the device emits a pop and some smoke".

Re: "has violated our data security policies by leaking confidential Dutch audio data."

It's worth knowing that Google doesn't only give this data to their employees. If you've used recaptcha, it also has an audio version for those who cannot see the images or for those who are fed up with the stupid image tests. The audio version plays a snippet and asks the user to write down what the audio said. I think some of the clips are taken from random youtube ads, but others have the distinct sound of phone calls or basic microphones recording in rooms not designed for recording, and from the distribution, it's clear that this is not intentional degradation of sound to make the captcha harder. I have yet to hear anything sensitive because I don't do captchas that frequently and they only do a few words, but I do distinctly remember the one that came from a phone call and said "is at 9:00 tomorrow morning", so I really hope the first part of that sentence wasn't in the system in case it said what that person would be doing at that time.

IBM torches Big Tech's get-out-of-jail-free card, says websites should be held responsible for netizen-posted content

Far too many facets

On one hand, allowing sites nearly complete freedom to allow anything through means they don't do anything to protect against their service being used for very illegal activities. Facebook, for example, hosted (and probably still does) many groups dedicated to the sale of stolen credit cards. They also allow advertisers to post ads that violate laws without verifying who it is or whether there are any problems. In those respects, there is a pretty good case for altering the law to fix that. However, we also need to avoid making places responsible for things that are not really their fault. As much as I despise Facebook for all their violations of privacy, they really aren't at fault as soon as someone uploads something illegal. They should remove it, but they didn't know it was coming. This applies perhaps more strongly to small sites, which don't have the kind of resources it would take to monitor all posts and accounts thoroughly. So there is a case for changing the law, and there is a case to clinging to it. Why do I have the feeling the politicians will take both cases and manage to find that spot in the middle that extracts the worst elements of both?

Facebook: The future is private! So private, we designed some handy new fingercams for y'all!

It comes to mind

Anyone recently read The Circle by Dave Eggers and uncomfortably thinking about the transparent people?

For those who haven't read the book and not planning to (it is a good one), the transparent people are people coerced by pier pressure and the pressure of a massive fictional tech company, the titular Circle, to wear a camera that livestreams everything they see and do and keep it enabled at all times. As the company does this, they manage to use some benefits of the system (E.G. politicians not being able to engage in blatant corruption when on camera) to make it essentially mandatory for anyone important to wear one, which they then use to impose other types of surveillance on the world at large.

'It’s not a surveillance program'... US govt isn't going all Beijing on us with border face-recog, official tells Congress

Given that the Chinese surveillance system was developed using bunches of datasets collected by universities in the west and shared with China by academics who didn't think it through, I think they have plenty of access to all types of faces. Since they were going for high accuracy rather than cheap or fast development, they probably have a much less biased system. Why is it always the evil people who have the best system?

It's not a surveillance program

Thank you for telling us. So all we want right now is to have a look at your files and thoroughly investigate to make sure that's actually the case. Sadly, that's proven necessary given other not-a-surveillance-program systems we've been told about before. After we've seen and accepted your proof, you can keep going. Just come back every year to reassure us with the required documentation that you are still adhering to human rights and not exceeding your authority. Now where are those other agencies we need to do that with? Get in here, guys, and bring your documentation.

Internet imbeciles, aka British ISP lobbyists, backtrack on dubbing Mozilla a villain for DNS-over-HTTPS support

Re: Mozilla

It sounds like you've panicked a bit too much about DoH's security risks. The kinds of problems you could see with DoH connections could also be seen by a user connecting directly to an IP address or using whatever open ports you have to run a VPN or connect through Tor. Either of those would bypass internal DNS controls and would probably flag as risks in your network analysis logs anyway. Since the use of any of those things would be violations of a security policy, you might as well tell people they must use a certain set of configurations that disallow DoH, and using DoH will be a violation of security policy. Wouldn't that pretty much solve that problem?

Re: Mozilla

I would suggest that DNS requests be sent to an internal DNS proxy (if you have internal names, that's already there), which can do the HTTPS stuff recursively from there. Failing that, you could send all requests to that as primary, configure it to only know internal DNS addresses, and have the HTTPS address as secondary.

When using DoH, you have to contend with the possible issue of the trustworthiness of the DNS server, but it is not at all required that CloudFlare or Google be used. DoH could be set up by any existing DNS server with relatively little effort. I've taken a look at a basic implementation of a DoH server. I'm planning to set it up on one of my servers to see exactly how difficult it is, but it doesn't look like it will take very long.

Re: Mozilla

In addition to the pier-to-pier problems mentioned above, there are some other problems you might see with that. Depending on cache policies and the definition for "recent" you're using, that could break various things, as many devices maintain their own caches and contact later. It could also be problematic in various less common but still existing situations, for example when a new remote server is spun up and is accessible only by its IP as a DNS name has not been assigned to it yet, or applications that contact their own remote services, as those might have addresses outside of DNS (for example, some programs with group usage, especially games, list servers on their own main system without using DNS).

'This repository is private' – so what's it doing on the public internet, GE Aviation?

Re: DNS problem only?

Good point. I stated that point badly. I should have phrased it more like this:

I like the basic security provided by the use of NAT that is standard in IPV4 networks due to the small number of available addresses. While this can be done in IPV6, it is not done as standard or recommended by many IPV6 advocates. I am worried that this security will be lost during the switch to IPV6 for the vast majority of people who stick with the default configuration and may therefore be left without either the security of a properly administered firewall or the somewhat unintended but nonetheless available security of private addressing.

Have an upvote for helping me clarify that.

Re: DNS problem only?

The DNS in question would be the internal one for the company, for example instructing the actual public systems that the hostname could be found on a given internal system, and thus allowing a tunnel into the network to be created when that wasn't really desired. The other option is that some DHCP or static routing misconfiguration reassigned the server to a public IP and nobody noticed because DNS still resolved the hostname properly.

I have to say, though this isn't exactly on topic, that this is pretty much the only thing I'll miss when IPV6 takes over. It's nice to have specific IP ranges that won't be available publicly. Yes, I know that I can run an IPV4 network and NAT out to an IPV6 one, and that I should be firewalling anyway, but private space is nice because I know that, should the firewall be misconfigured, unsolicited traffic still won't be able to reach the server because the address can't be routed to.

'Is this Microsoft trying to be cool? Want to go to the Apple Store?' We checked out London's new retail extravaganza

Re: Pavement Plodder

The stores can be helpful sometimes. If there are problems that can't be solved right there, the Apple employees in the nearby store can deal with it. When, for example, I was having trouble talking my brother through a Mac software failure (major software failure resulting in the OS not booting, so no remote control) from hours away, I could send him to the Apple store with a page of instructions I wrote up as to what the machine should be like when they finished with it. They are also reasonably helpful for some minor hardware problems. FYI, if a key tile falls off your Mac keyboard, the Apple store will replace it for you without you trying to hunt down a suitably-sized replacement and install it. At least they used to. I hope they still do. It doesn't change the problems with Apple, and almost all of the things that happen in the stores aren't of use to the technical among us, but they're occasionally mildly helpful.

Did you buy a hot Asus Rog Strix notebook? Like, really hot? Like, super hot? Like, ow-ow-ow my lap's on fire hot?

So, here's what I'm hearing you saying. Let me know if I'm misunderstanding your post.

1. Your machine is fine.

2. Well, actually, your machine is fine after you did some work on it. It isn't stated what it was like before that, but something made you want to reapply thermal paste and pads.

3. So at some point, your computer probably wasn't fine.

4. You are fine with the charger not, if you want to get technical, working as expected in as much as charging the battery under some conditions.

5. Because you are fine with this, and your computer is, to restate things, working fine now, nobody else's could be defective.

6. Therefore, based on your sample size of one person who might not have all the problems and doesn't care about one of them, there is no problem.

Did I get that right?

Oh good. This'll go well. Amazon's Alexa will offer NHS advice

Re: Solution looking for a problem?

I think the original point of the thread is a good one. What kind of information is it actually getting? If it's just querying a page online, how much information can that really provide? Is it going to do a simple search and start reading one of the health topics like this one with little or no reason for choosing it? The content is more nicely phrased on the NHS site, but we could get the same benefit from implementing feature number six on this XKCD.

Facebook and Max Schrems back in court again, both pissed off at Ireland's data regulator

Re: GDPR

This concerns data transfers in 2013. Sadly, GDPR does not apply. They could make some progress, however, on getting enforcement to happen more often.*

*Operative word being "could".

Guy is booted out of IT amid outsourcing, wipes databases, deletes emails... goes straight to jail for two-plus years

Re: A Cryptic Response

They said they completed the recovery effort in ten hours, which implies they had backups of some sort. Whether that is cloud backups that were not destroyed or were recovered in time or physical backups, it seems likely they had something.

My guess is that they brought in some external people at high rates to do it (probably getting them in a rush, too), and that those people took it upon themselves to spend extra money, such as paying for someone to recover data from the hard drives in the mac on the theory that some data might be on that but not yet in the backup. Add in some money for lost productivity and fifty thousand sounds more normal, if still a bit inflated.

Plenty of small places have only one admin. Some very small places have no admin. I, for example, am a volunteer admin for a charity near me. Other than me, they have nobody, outsourced or not. When I arrived, their server was running on the "it better not fall over because nobody knows what it does or how its configured or the login password" paradigm. So it isn't that unusual to have only one admin, or at least one admin who manages all the systems with lower-level admins who do specific systems or systems in specific places. And I could destroy all this place's data in about five minutes should it turn out that I'm evil.

Take the bus... to get some new cables: Raspberry Pi 4s are a bit picky about USB-Cs

Re: Let me get this straight

Of course it makes sense to do that, but here are a few other things it makes sense to do:

1. Have one, and only one, type of cable that can connect to the connector so you can't have, say, a thunderbolt cable which will connect to the port but won't actually work unless both devices are thunderbolt, or a cable that is designed only for visual data so can't carry power or connect two general purpose devices.

2. Have one, and only one, power style so you can't accidentally connect a standard USB 5V system to the newer high-power system and fry it.

3. Make the spec as rudimentary as possible so people who don't read it all the way through (random startups, the raspberry pi people this time unfortunately), are likely to have it work.

And yes, I would have to ask if USB C is really that big an advantage over normal USB. There were a lot of downsides about it, but the flipping cables over to try the other way was a minor annoyance and the connectors proved their longevity.

Re: "the Pi is not a toy but increasing used for serious jobs"

"If you buy and use something designed for a different use, especially if you do just because it's the cheapest around, and you have issues, it's just your fault."

They're not buying it for a "different use [case]". The pi is meant to be a computer with the specified interfaces, and they're buying it to use the computing with those interfaces. It is failing to properly do one of the things it said it would, namely receive power from a USB C connection.

In addition, you're not at fault if a product fails to do something it said it would. The designers or manufacturers or sometimes plain bad luck are at fault. If you still subscribe to this policy, I'm pleased to inform you that I've just started a business. If you have a task you want to perform, send me a message detailing what you're doing and what tech you would be using for that purpose. Our business will happily sell you technology with the same feature set for twice as much. You don't want to buy our solution for twice as much? Well fine, but just remember that if the one you buy doesn't work for some reason including a design flaw, it's all your fault because you decided to buy a cheaper product.

Marriott's got 99 million problems and the ICO's one: Starwood hack mega-fine looms over

Re: Collateral damage in the Cyberwar

There's a clear difference between you getting burgled and a company having customer data stolen from them. I'll lay it out for you:

You get burgled: your stuff is gone. At the very least, you have to go through the insurance claims process and purchase new possessions. Usually, you're out quite a bit of value.

Company has information stolen: Customers have to worry about account compromises and identity theft. Without laws like these, the worst the company itself has to deal with is the risk that people might try to avoid their hotels. Given that this is not a market with an infinite number of participants, that isn't a major risk.

There's the difference. When the negative event only harms you, we don't penalize you for the consequences. When it does, we can look into whether you were at fault. That doesn't mean that you or the company in this case is at fault for the whole thing, and their sentence isn't of the kind you'd get for actually performing that breach, but it is a perfect case for laws against negligence leading to harm, and data protection law better formalizes that in the specific case of data loss. I hope the ICO takes this into account, as a breach can happen to anyone no matter how much security they've done, but I don't see any evidence that they have not.

Re: Just the cost of doing business

If you're referring to the California Consumer Privacy Act, that doesn't take effect until 2020, so California can't impose any penalties based on that law for this breach. By 2020, I'm sure the various amendments proposed by the many definitely consumer-oriented organizations founded just after the CCPA was passed because some consumers in Mountainview and Menlo Park were just that interested will have been installed in the law and it won't have any effect then either.

Wanna sue us for selling your location? Think again: You should read your contract's fine print, says T-Mobile US

A backup plan

So, although we all think arbitration clauses are harmful, they'll probably get supported. I can only hope that the contract makes the company cover the costs for the arbitration unless they are proven to not be at fault (I'm sure they don't want to do that, but I've seen it before in such clauses). Maybe we can get enough people to start individual arbitration cases to show the companies that, if they want this to end within their lifetimes, they should just let the single trial go through.

Chinese government has got it 'spot on' when it comes to face-recog tech says, er, London's Met cops' top rep

I don't know what calculations you tried, but I think you're missing a variable necessary for the calculation of the false negative rate, namely the number of people in the sample who were supposed to be detected. Given that the sample was "the public" and the number of faces in the database is known but the number of people in the database who were actually there is entirely unknown, I would say that, even with an estimation of total sample size that we can assume is completely accurate, we cannot determine or even estimate the false negative rate.

I have no objections to judging the system as crap right now for its abysmal success rate and the unjust plans for its use.

Re: China's not England

"Its really just an upgrade of the traditional PC Plod who knows everyone on his beat"

It isn't and I at least wouldn't want that either. Facial recognition isn't a police officer seeing a person and going "That guy is typically here". It's a system that records my presence, possibly reports me as someone I'm not, then keeps my picture on file and cross-lists it with any other pictures from other places and other times, because they've said they're not going to erase any of this data. That's not what a normal police officer does. In fact, a normal police officer shouldn't spend a lot of time identifying unfamiliar people anyway because sometimes we people visit places we don't frequent, and we're perfectly within our rights to do that.

Now let's deal with your contention that this is just an upgrade of the previous role of a police officer. I don't want my police officers upgraded. We've spent a long time trying to give police enough power to stop crime without giving them enough power to harm citizens' rights. There are lots of ways we could "upgrade" the capabilities of a police officer. Let's start with the easy stuff: remove the pesky requirement to get warrants before searching places. That will speed things up dramatically. It will probably also increase the number of criminals arrested, because there are a few people who find out a warrant is being sought and destroy the evidence before the officer gets there. There would actually be some benefits to removing the warrant requirement. The only problem being that WE NEED WARRANTS TO PROTECT PRIVACY! We need a lot of these restrictions on police activity to protect privacy. Without them, the police become a much too powerful institution, prone to massive corruption and criminal activity in their own right. That's a profound downgrade, and we should not let it happen.

Re: Decisions, Decisions...

I "can't blame states" for wanting to control the internet traffic going through them in the interest of state security? I bloody well can, my friend. It's wrong by nearly every metric. It's censorship, violations of privacy, in itself breaks several human rights laws, and opens the doors to many more intense violations typically characteristic of dictatorships. Every country that does that, whether their control is just watching the traffic, blocking traffic, or manipulating traffic, gets as much blame as I can dish out. China, blame. U.S., blame. Russia, blame. U.K., blame. The sooner they cut it out, the better. To the extent I can, I intend to support movements that result in the cutting out of this unjust and completely blameworthy activity.

Got an 'old' Tesla? Musk promises 'self-driving' upgrade chip ship by end of 2019

Re: I like the idea

Personal self-driving cars don't have to be part of a taxi net. It'd be an optional choice you could do to make money. For those who don't need the money and value immediate access to the vehicle, it wouldn't be a very good use case. It'd be sort of the same as allowing people to rent out your normal car if there was a convenient way to let them in, which doesn't sound like a popular program idea to me.

If this were attempted, there would likely be a requirement for dedicated vehicles for that service. In that case, I assume there would be charging stations located throughout the service area. When a car was low on power it would remove itself from the network, drive to charge, and only put itself back online when it had charged. Whenever there were gaps in traffic where more cars were available than in demand, the cars with the lowest charge would drive themselves to the charging stations as well.

Chrome's default-on ad blocker – which doesn't block adverts on 99% of websites – goes global

Brief summary

If you like privacy, or security, or control, or diversity, don't use Chrome. That pretty much covers any Chrome-based article.

Fibaro flummoxed, Georgia courts held for ransom, and more

Re: Lake City IT boss fired for ransomware payment

I concur in your argument, but most people whose job is hiring IT directors have different ideas. Keeping the systems up right now is their primary goal, plus getting new systems up as fast as possible. Thinking about the longterm is on the list but lower. At times, usually for financial reasons, backup plans are specifically left unfunded (no ability on the part of the IT director to reallocate funds to backup from something else). Of course, in that case, I'd at least have an improvised backup system, but I wouldn't support firing the IT director for a backup problem if this was proven to be the case. And then, there are those cases where someone does some misguided maths and decides that it might be cheaper to pay the criminals than to manually recover and a tech site says it's sometimes a good idea, which could also be a decision made by someone external to IT (though if that happened where I'm working, I'd protest the decision and make plans to leave. I admit, however, that these possibilities are unlikely to be the case in this situation.

Re: Lake City IT boss fired for ransomware payment

The story and videos (if watching these, expect to see about ten video ads inserted), make it sound like this, but I'm not sure. It is possible that the insurance company made the decision, but it is also possible that the city made the decision and the insurance company simply covered part of the expense. If the decision was due to the IT person not wanting to do the work of a restore or not having taken backups responsibly while having the ability to do so, I would see firing them as a logical option. Oh, if anyone from Lake City IT is reading this, you're going to want to reimage anyway because ransomware can just sit there waiting for more data to be put in before locking again. Your television station didn't make it clear that you know that, so just to make sure...