Posts by doublelayer

Alibaba wants to get you off the PC upgrade treadmill and into its cloud

Re: Another attempt to kill the "Personal" in PC...

They said their remote system runs Windows or Linux. Those who are choosing Windows can run exactly the same malware as their local Windows machines could. Those choosing Linux can also be hit with malware, and it's probably a custom version of Linux, and how many among the general public are going to click that anyway. This isn't a locked-down OS with extra security features, it's locked-down hardware giving access to the same OS for which you're charged every month.

Re: 1996 called...

"Maybe today's global network infrastructure is better and faster than it was in 1996?"

It is. So let's put ten thousand staff in front of those at home and see how many of them have internet issues ever. Even the tiniest downtime makes this freeze. A longer outage probably causes this to crash. At least with local computing, people can continue to write, read content they've already retrieved, and do a lot of work. This is especially relevant because, despite their protestations, there isn't much of a harsh computer upgrade cycle anymore. A computer from 2015 usually handles everything the average worker wants to do (even one from 2010 handles most of that), and most businesses have been holding on to devices for longer. The recent buying spree was for places that needed portable machines for work from home, but that's already happened. If someone really needs a lot of remote resources, they will use the cloud, but most people don't need that and most who do still want some local computing available to them while their expensive cloud box does the heavy lifting.

Cisco’s 'intuitive security' tool can’t handle MAC address randomization out-of-the-box

Re: Yet another elastoplast with unexpected consequences?

The problem with pre-IOS-14 behavior is that it's easy to convince a device to get handshakes if a phone's ever connected to a network by listening for pings and pretending to be every network. This approach has been verified to work on lots of devices, so if you place a device which will respond to any SSID request, you'll get authentication requests from most passing devices. These don't always work; if it's a secure network, some of the authentication might fail because you don't know the correct key. If it's an open network that you're responding to, those devices just handed you their MACs. If it wasn't, you add that SSID to a list you won't respond to and try again; the phone will send you another ping in a second and you can hope that that one was open.

The software to do this is easy to obtain and configure, mostly used for MITM attacks. Those are tricky because you need to hold your victim near your attack point. If all you want to do is track people, you don't need to worry about the time element (or even the connectivity element) so it's even easier.

Re: Yet another elastoplast with unexpected consequences?

Whether to assign a temporary address is broadly up to the network; a device can request one and be assigned the traditional type with the exact MAC address included. Some networking equipment may not respect user preferences in this way and there's little that can be done. It's easy to identify if this has happened and get the data only under that condition. There isn't any easy way to prevent this from occurring without manually checking the address and leaving the network if it hasn't assigned a temporary address. There are also devices that don't have that privacy setting enabled or don't even allow that privacy setting to be enabled, and those can also be tracked. I am uncertain how much choice phone manufacturers have here, but still it could be an important factor.

Even if we eliminate this particular option by deprecating the original suggestion to embed, we still have the other methods for companies to collect addresses as listed in my original post. Not to mention that the easiest way to get that data en masse is to have ISPs collect it from anyone using their equipment without another device in front of it and sell the database, which could be legal depending on which country you're in and could happen anyway even if it isn't legal.

Re: Yet another elastoplast with unexpected consequences?

"Okay, can you explain how Google, Facebook and Amazon can track via a MAC address?"

Several tiers of detection are possible, including these:

Very invasive: Google: WiFi data collection from StreetView or other hardware, access to phones via Play Services. Amazon: Access to their own tablets via their proprietary components which frequently contact Amazon servers.

Somewhat invasive: All: Collection of IPV6 addresses to collect those which have a MAC embedded in them (default for SLAAC deployments). Facebook and Amazon: Collection of MACs from device from installed applications.

Not proven to happen but possible: Google and Amazon: IoT equipment placed on users' home networks which could collect all MACs in WiFi handshakes. All: Potential to have apps on phones with sufficient permissions to cause them to listen for such handshakes also.

That was what I came up with in the first thirty seconds. Let's see if others can find more. I bet they can.

Google bans stalkerware apps from Android store. Which is cool but... why were they allowed in the first place?

Re: Great they are doing this...

Nothing at all, which is why several companies are writing those apps right now, because tracking one's children is a normal and healthy thing to do. They will ensure that no child can detect or disable these, no matter how technically skilled, or motivated, or terrified of the [stalker] [user] [client] parent.

Re: Stalking app?

Well, they are starting a program where people can report stalking apps*. Any app reported there will be reviewed by a team they're creating*. Any app deemed to be targeting nonconsenting adults will be removed immediately and added to Play Protect*, and the people whose devices were affected will receive information about what was happening to them and helpful resources to be assembled by a partnership between Google and organizations who help victims of domestic abuse*.

*None of those things are actually happening. Google, these suggestions are released in the public domain. Please pick them up.

Who cares what Apple's about to announce? It owes us a macOS x86 virtual appliance for non-Mac computers

"However, the lack of MacOS VMs is 100% Apple patent trolling."

No, it's 100% Apple not wanting to make it available, which is mostly them wanting money and thinking that, by not doing this, they'll make more.

"MacOS is a flavor of Linux"

Wrong. Macs are based around a kernel which is neither Linux nor based on Linux code or behavior. Its userland comes from BSD, not Linux. It has more compatibility with Linux than does Windows or some other things, but it is not a flavor of Linux by any means.

"there is absolutely nothing preventing virtualization besides Apple's lawyers."

Well, some driver work would need to be done, but you're broadly correct. Apple doesn't make it easy because they don't want you to.

Patent trolling is abusing patents which are overly broad, granted even though the holder didn't invent the thing, or in some other way invalid but nonetheless legally granted. Apple might do that sometimes, but that's not what they're doing here. People want a thing. I would like that thing. Apple doesn't want to give or sell me the thing, so I don't get the thing. That's their choice. Patents haven't come into it.

Re: Why is the article writer surprised

"The iPhone 4s can only have music added by iTunes and nothing else. The previous owner hadn't added any apps, so it's useless compared to much older Android phones or tablets or PCs."

Not sure about this. I have an iPod Touch here that's even older than a 4S (this caps at IOS6, 4S stuck on IOS 9), and it allows me to sign in and download apps. Not a lot of those are compatible, but if the app existed long enough, I can get an old version that works. You could probably do the same and better because IOS 9 is more likely to be supported than IOS 6. You could also get an old version of XCode and compile code to it. Whether there's a point is another question, but it should be doable.

I'm assuming here that the comment is referring to the perspective purchase of ARM by NVIDIA. While they're not using ARM's cores, they still have to pay a license fee to ARM in order to be allowed to produce compatible cores of their own. This could give ARM, NVIDIA, or whoever eventually buys it to have some leverage against Apple and increase the demanded license fees, although NVIDIA has promised not to do that.

Re: What is the Author actually asking for?

Yes, Apple didn't bother to make it run in the environments they want to prevent. I'm with the original poster, though. The article specifically says that they don't care if the OS supports new hardware released after now, and they don't care if it gets security updates. At this point, I find myself asking why they need one at all--you can get that and more just by buying an Intel-based Mac today. To me, a VM is only useful if, in 2025, I can still run the latest OS with security patches on the hardware available for purchase then. If what I'm going to get is a VM running what an Intel Mac runs today and nothing more, then I might as well just get an Intel Mac today; the benefit is the same.

Safety driver at the wheel of self-driving Uber car that killed a pedestrian is charged with negligent homicide

Re: Easy issue to resolve

If we had a fully autonomous vehicle we trusted, we'd probably have a switch that puts it into autonomous mode and disables the controls to prevent controls in the hands of people not really trying to drive from messing that up. We should also include a button to make the system autonomously pull over and stop as soon as feasible and another one to put the car into manual control (these have to be hard to press by accident). Not every driver control still has to be there, but enough to handle emergencies which are going to happen.

Re: You had one job...

I did not vote on your comment, but I think your suggested dual input system is unlikely to work and likely to be dangerous. Having the driver steering and braking means the driver is going to disagree with the car some of the time. Either the test isn't going to work because the car keeps deferring to the driver, or the car is going to ignore a lot of the driver's input. That would mean that a driver which is really in better control might have a harder time getting the car to stop because the car knows that the driver doesn't always brake with similar frequency or strength. You could have an emergency takeover button which immediately forces the car to be controlled by the driver, and that might help, but only if the drivers are trained well enough to instinctively press it at short notice.

Never mind that you can run Meet on any old computer, Google unveils specialised hardware for vid-chat plat

Re: Obsolescence?

"Same as if MS shut down their services like Skype for business... you go elsewhere."

I believe the question is asking what happens to the hardware. Can you take it elsewhere with you with existing software support? Could you at least flash another OS and try to build your own? Or does it turn into an expensive brick that can only be used as a fake security camera? Based on some of Google's hardware attempts, option 3 seems likely and option 2 may be possible, but I wouldn't count on option 2 and option 1 will never happen.

.UK overlord Nominet tells everyone not to worry about 'distorted' vote allocations in its board elections

Something finally explained

There have been many stories about the roll-out of second-level .uk domains in the past few years, mostly about how registrars kept adding them then attempting to charge for them. That made some sense if that was the registrar's plan, but it always struck me as a little shortsighted because there was obviously going to be a user backlash which would cost the registrars in settlement and reversing the payments. Until now, I was willing to accept that registrars just aren't very smart and took the risk anyway. Now, things are a little clearer:

"But things get even more complicated than that: the number of members varies from year to year; many members fail to vote; the votes are calculated according to Nominet’s financial records based on paid-for domains – except for when Nominet made an exception for millions of domains it gave away for free as part of the controversial launch of second-level .uk domains."

Any registrar who handed out free .uk domains without asking did that to get extra votes. If anyone's still using a registrar that did this, I suggest you immediately cancel your business with them.

Not content with distorting actual reality, Facebook now wants to build a digital layer for the world

Re: Meh

Email accounts allow person-to-person communication, not publishing. Paper manufacturers make printing possible, not distribution. Megaphone and banner manufacturers may make distribution easier, but they do not provide the venue for it to happen. Facebook is a venue for distribution to happen. Find better comparisons.

Apple takes another swing at Epic, says Unreal Engine could be a 'trojan horse' threatening security

"From what others have said on here Epic were allowed to accept payments from outside the Fornite app using a browser etc?"

Yes, but keep in mind that they're not allowed to mention that possibility in the app let alone actually send people there. If their users find it on their own, it works. They're also not allowed to make it cheaper on their site. If they did any of those things, that would also be a breech of their contract and they'd end up in the same situation they are in now. Apple jealously guards that revenue stream and they're pretty clear about how much they're not willing to take from devs.

Re: "to slide a change into the app that blatantly evaded App Review."

Any system has holes, and anywhere code can run, someone will try to get malicious code to run. Apple doesn't have a malware-proof review system, but their record is pretty good. For this reason, they're probably very irritated about people sneaking code through. On that particular argument, Apple's complaints are understandable. Of course, they're also annoyed about the code that was snuck through and it's not security that has them worried. You can make up your own mind how you feel about that bit.

Oracle hosting TikTok US data. '25,000' moderators hired. Code reviews. Trump getting his cut... It's the season finale

Re: My head hurts

"If you wrote a fictional book with these sorts of goings on 10 years ago you'd be told it was unbelievable."

I think that people would get confused and return the books. The current system makes no sense, but not because it's unbelievable, just because I have no clue what is happening. The premise I understand: the current American administration likes having bargaining chips and is making up pretenses to get them. The rest is totally unclear. What exactly Oracle is doing: I don't know. What ByteDance is doing: I don't know either. What the president thinks: don't know. What the executive departments are doing when they don't know what the president thinks, what the president is going to use to make his final decision when we know he won't be reading the bureaucratic report, who is fighting ByteDance's lawsuit and how, what happened to the deadline of Tuesday which didn't get met, what members of the president's party are willing to put up with, what the members of that party actually think, whether anyone else is going to interfere, I don't know any of this. At least when other political events are happening I can understand enough of what people think and plan to do that I can marvel at the audacity or hypocrisy. With this, I can only sit there and puzzle through how anyone can make plans when there's little or no information from anybody.

Singapore to pay its citizens to wear Apple Watches

How much did Apple pay for this?

I want to know how much Apple has provided to Singapore's funds or to the funds of its legislators to get this to happen. It sounds as if they now have Singaporean taxpayers covering the purchase of their products while their competitors whose devices could do the same thing get nothing. I want to know how expensive buying a flood of Singaporean money is just in case I ever start a company and want to get more customers.

Surprise! Apple launches iOS 14 today, and developers were given just 24 hours' notice

Re: Nonsense

Please read the section of the article that discusses the issue. The problem isn't about testing. Some developers may do that wrong, but that's not what's being discussed. What is being discussed is that developers can't push apps using IOS 14 behavior to the store until the GM goes out. That was last night. Now it's available to users. Those apps haven't been approved yet. The devs are complaining about the speed with which Apple pushed out the release which caused the OS to be there before their reviews completed, not about difficulty testing. I don't care much; I wouldn't install an operating system on day one anyway so I could easily afford to wait for the apps and the OS, but at least understand the complaints before attacking developers about something not connected to what they're talking about.

That long-awaited, super-hyped Apple launch: Watches, iPads... and one more thing. Oh, actually that's it

Re: Something isn't making sense

Ah, that makes a lot more sense. Thanks for the clarification.

Something isn't making sense

"We also saw the same repetitions of Apple’s purported eco-friendliness, which will be put into practice by removing the USB charge cables from its Apple Watch line-up."

Maybe it's just because I don't have one, but I was under the impression that most smartwatches, including Apple's, use a nonstandard connector so they can be more waterproof, smaller, and give their manufacturers an extra income stream from sale of chargers. Even if Apple's watches have always used the same connector, anyone who hasn't purchased one before won't have one and anyone purchasing one now probably got rid of the last cable when they gave it to the same person they gave the old watch to. It seems to me to be the cable least likely already to be available to users. Lightning cables, however, would already be available to anyone who has previously purchased Apple gear (and are more easily purchased at shops), USB-C cables are becoming more common and may soon start to accumulate, and Micro USB cables can be found in quantities of five to ten in any closet in my home (or my family's homes). Am I just wrong about Apple's watches using a cable type specific to that unit and they're more common than I thought? If not, what are they thinking?

Singapore to test compulsory COVID-tracker usage as condition of entry to some venues

Re: This will enable us to open up safely in the coming weeks and months

"The point is you are not allowed in without one. So there should be no unknown persons."

The "unknown" referred to persons who are not known to have the disease, but they do. They are asymptomatic, go in, infect others who will not develop symptoms for a week, and those others will infect still more. The point is that this tracking system is not sufficient to allow completely normal operation while rates of transmission are still high. It can allow some increase in safe levels of social interaction, but if something like this is sold as a panacea which will allow perfect containment of infected people, people may have a false sense of security about what it's going to do. If this leads to normal levels (in a densely-packed city, very high levels) of close contact, it will not take long to prove this point. Sadly, that proof will come in the form of new cases, including deaths and long-lasting health effects. If only we could consider it before overselling something.

Brit MPs to Apple CEO: Please stop ignoring our questions about repairability and the environment

Re: The easy solution

That's easy, but it solves nothing. If I want a phone, I have to get one from someone. One of the benefits that Apple provides is long software support, which I really can't get with Android devices. This means that it is safe to use for longer, lessening my production of electronics going to recyclers. There are a few devices that, via Lineage OS or similar, get support for much longer. I'm currently using one of those. I am going to have to replace it at some point soon though because it is now rebooting unexpectedly (I blame the battery but I don't have evidence). Still, that device has lasted around seven years whereas its manufacturer dropped support and security updates for it in 2015. Unfortunately, scanning Lineage's supported devices list doesn't bode well as they're low on supported modern devices.

You want a real solution? Get the Android manufacturers to increase the lifetime of software and security updates along with some standard for repairability. Otherwise, I'm faced with the choice of Apple (software will last but hardware won't, probably fine since I have a good record of not damaging my hardware) and most other manufacturers (software won't last and hardware ... probably won't be any more repairable than Apple's to be honest). Dropping Apple from my list isn't going to help solve the base problem.

My guess is that they sometimes just "repair" something by going to the back room, finding another device from that range, and swapping the data over. The device which probably could be repaired is put on a stack of things that will be sent to a repair center where the knowledgable repair technicians will eventually repair its fault, erase it securely, and make it available for sale as refurbished once they get around to building that center, which is scheduled to complete in 2030 but might be delayed because they've just had to move it from China to Mexico and they're looking at moving it again to either Argentina or China for some tax reasons. In the meantime, there's no use keeping the broken parts around so into the big bucket for the electronics recycler at the end of each day.

Chinese database details 2.4 million influential people, their kids, addresses, and how to press their buttons

Re: Thought experiment

"Replace Chinese database with Facebook database. Would anyone be shocked at the revelations?"

I would. Only 2.4 million? Facebook can do better than that. China should really consider just buying Facebook's database.

Maybe countries do all try to collect this, but in my opinion, they shouldn't. If a country complains about this database, I would expect them not to have collected their own (well, actually I expect hypocrisy at every turn, but I would hope that they haven't created their own). At the moment, however, we try to prevent our countries from violating our rights in that way, and using this database as an example of why it doesn't matter because China does it too doesn't help.

Re: Oh....bad....bad....bad.....Nothing Like That Going On in the US or the UK.....No Siree!

What was done in the past is important, but a lot less than what is being done today. One is a terrible event for which we should try to atone. The other is a very terrible thing that is harming people actively. If you care about what the British empire did to those it virtually enslaved, you probably don't like human rights abuses. We cannot go back in time and terminate the British empire's crimes, but we could attempt to stop the crimes that occur now. Ignoring those who are harming people because some of our ancestors did similar or worse things to others of our ancestors is missing the point and perpetuating the thing that must be destroyed.

"What utter and complete bollocks. You really think the Chinese are going to invade Europe or the US?"

That's not what the person you replied to was saying. What they said was that, if you live in China, that could happen to you. This is true, because it already has to millions of Chinese citizens. The post was comparing democracies, which don't do this, to China, which does. They weren't claiming that China was going to come to democracies and do it to the people there. The rest of the post has some points that are worth arguing about, which I'll do in a different post, but if you want to argue with this one, understand what was said.

Re: Good old propaganda

The number of people in a database is a relatively unimportant metric. More important ones include the breadth of information in the database (reportedly extensive), the degree to which such information can be used for leverage (uncertain, but sufficient to alarm the researchers), and exactly who is in the database (reportedly people with more influence than the average citizen). Those factors will determine how worrying this is. Maybe after more data about what is contained is released, we may be able to determine how worrying we believe it to be.

Bad apples: US customs seize OnePlus earbuds thinking they're knock-off AirPods

Well, this is also the place that tried to force access to an Apple-owned corporate laptop, so maybe they're just jerks who don't quite understand how to do the "protection" part of their ostensible job.

Don't pay the ransom, mate. Don't even fix a price, say Australia's cyber security bods

Re: I agree with every word

"Good for you - easy to pass judgement when your livelihood is not affected. Would you not do everything in your power to save your business?"

Everything in my power? Even on the brink of disaster? That's a hard no. Consider this situation:

You and I run a business together. It's small, sometimes profitable. We get a large contract which requires us to invest a lot of our money, but it's going to pay us good profits. After considering it, we accept. Then it turns out to be a scam. They've stolen our money. We'll have to declare bankruptcy tomorrow because we haven't the money to pay for the lawsuit to get our resources back. Our employees will lose their jobs. This is terrible and it's not even our fault. We could try to liquidate our resources, but our building's not worth much. Then it strikes us. While our building isn't easy to sell, we've insured it for quite a lot because it's important to us. If we committed insurance fraud, we'd have enough money to save our livelihoods and those of our employees. All we have to do is burn the building down tonight, taking care not to let anything happen to other buildings, and file a claim. Would you commit the fraud?

I'm guessing your answer is no. Why not? The only entity to get hurt is an insurance company. They have plenty of money. They can take it. Still no? If you don't, your employees are going to have to spend tomorrow on the phone to the unemployment office and your bank account is empty. Still not doing it?

Of course you're not doing it, because insurance fraud and arson are wrong. You are doing harm to someone. Paying the ransom, in addition to being a bad idea, is also harming others by making more of a market for others to develop and deploy ransomware. I won't do "everything in my power to save my business" because some of the things in my power are wrong. Sometimes, I have to do what's right even though it would work better for me to do a wrong thing. Some countries make paying the ransom illegal for exactly this reason, but even if yours hasn't, you have to take into account the harm you're going to do. Of course arson is more dangerous than paying a ransom, but if we compared it to insurance fraud without arson, they're quite similar. In fact, I think paying a ransom is worse than otherwise-victimless insurance fraud--I have more sympathy for multiple, mostly small victims of ransomware than a large, cash-rich company. Yet I still won't commit insurance fraud. And I won't pay a ransom either.

Re: Easy to say

Good backup policy requires, absolutely, at least one set which is stored offline and off-site. That's because you need that copy in various cases, including fire, flood, theft, or ransomware. Don't have that and your backups aren't good enough.

Of course there are occasions where people find their system wasn't good enough and they have to make a hard choice between paying a ransom and manually recreating their data. If you do backups right, it's much less likely you'll end up in said situation. But what happens when you do? Well, you have to keep in mind that when you pay, not only do you expose yourself to risk of losing your money on ransomware that doesn't intend on decrypting for you and the possibility that you're now known as a person willing to pay up, but you're funding attacks on other innocent people. It is not only your business that is being harmed, which is why some countries have made the payment of ransoms illegal. People who ignore this are complicit.

Cops called to Singapore golf club after 'wrongdoers' use scripts to book popular timeslots

Re: Why would that help?

The original suggestion is an auction. In an auction, there is no ticket price. In an auction, the person willing to pay the most gets the thing. So unless the person who is willing to pay more doesn't get to attend the auction, they will attend the auction and pay their price there. No scalpers will be able to sell at a higher price because anyone willing to buy at a higher price would attend the auction and buy there at that higher price. Whether that's actually a good suggestion is another question, as it doesn't leave any opening for people who can't pay the high prices, but at least understand the suggestion before discussing that bit.

Re: But They Do Dress Funny

They aren't doing that. Did the site go down? No, it didn't. That's not the complaint. The complaint is that it's not fair that people with bots are getting the nice slots immediately. That's a valid complaint, but it's not a violation of the law. Valid responses include making bots a violation of the terms, cancelling the accounts of people who use them, or taking technical action to prevent the bots from working. All valid things.

Let's say that I post a page to my personal site and you visit it. Effectively, you're performing a DOS because my server is going to send that page to you. If enough of you do it, my server will run out of resource. That's also the exact point of my putting the page up, so people will use my resource to read it. I cannot blame people for using my resources by accessing public services that I put there and made public and could either make nonpublic or in other ways protect. By doing this, I am taking various risks. For example, I have a bandwidth limit and if enough people access my files, I'll exceed it and I'll have to pay a higher bill. I accept that risk when I put files up and allow the public to access them. If I don't want to run that risk, I can take the files down again. It's on me to manage my own resources and set terms. A DOS attack is when someone deliberately intends to take down my system. A flood of interest in the thing the site does which the server isn't able to handle is not an attack.

Using a system for the purpose it was designed isn't misuse. Using that system with a bot when bots are prevented in the terms of service is a violation of that contract. Let's assume they've put that in (if they haven't, they have no case. Assuming they have, they can execute the penalties in that terms document for bot usage, such as closing accounts, charging fees, whatever they think is best and can get customers to agree to. However, it's not computer hacking. It's a violation of what they want.

"I know this is a leap so far I've practically already broken my legs and popped my knees, but it feels very much like 'if it wasn't locked they can't complain someone let themselves in'"

You are entirely correct. You've leaped so far that you're in orbit. If it wasn't locked, but they don't have permission to enter, then the law says they're not allowed to enter. This is a lot more like "it wasn't locked, and there is a big sign saying that people are allowed to come in, and people do come in and we like that, but someone came through with a bicycle and we don't like those". If it's your property, you can tell people not to come in with bicycles even though they're allowed to walk in. You can make them leave if they do so anyway. It is your rule, not the law, that says this.

Adtech's bogeymen are tracking everything - even your web visits to mental health charities, claim campaigners

Re: It's for charidee!

Let's assume that you're correct. To that, I say this: I don't care.

If I drive up to a location where medical care is needed in a car that has seen better days, because I decided to put more money into medications, then I have even more medications to provide. I am not there to impress the locals. I am there to provide help. Those who think I can't and won't help them will watch me prove them wrong, because that's why I'm there. I will tell them of what I can do to help. If I know what I'm doing, they will see that I back up my words with actions. If someone else doubts me, they can see it for themselves or hear the reports. In no way does a fancy car help with this.

Re: It's for charidee!

Well, if you're going to use "You don't know how much they paid for [the cars]", then I can fire it right back at you with "You don't know how much the particular charity paid its director". The problem isn't when charities provide a reasonable salary for people who control it. There are those who think that a decision to run something charitable must necessarily come with a requirement to volunteer everything, which isn't really fair. But simultaneously, there are charities which don't care about their purpose and use their ostensible purpose only for easier fund raising and tax freedoms while funneling the proceeds to some powerful people. We've all seen them. They include places like ICANN, which really needs millions of dollars from the sale of new domains nobody wants so they can fund their incredibly expensive duties of ... well they have to have two lockboxes for the DNSSEC keys, those maybe cost some money.

On the topic of cars, you need a reliable, well-built car if you're going to do field work on unreliable or nonexistent roads. Reliable. In good repair. Not one that looks nice. For one thing, after you drive a car that looks nice off road for a while, it's probably going to stop looking nice, so they're taking something valuable they don't need and causing damage to it. If they were able to explain that the car-maker concerned really wanted to donate a bunch of luxury cars to their charity, I'd accept it (though by auctioning them they might have been able to afford a greater quantity of superior cars or even more medical equipment). However, we have no reason to think that happened. Meanwhile, flaunting expensive items while working with people who probably will never own them is in poor taste, at least in my opinion.

A lot of charities are a lot better at this. You can easily find ones which spend most or all their resources on the specific cause they're working to help with, whose directors are earning a living but not exploiting the assistance of the donors, whose employees and volunteers are different primarily in the amount of time they put in. The fact that many of these exist doesn't make the exploitative charities disappear.

Something to look forward to: Being told your child or parent was radicalized by an AI bot into believing a bonkers antisemitic conspiracy theory

Re: GPT is not a truth-teller machine

Yes. It did what it was meant to do. However, we might want to consider what we want to build things to do. For example, if I built the Infinite Manufacturer, a machine which could make things from a command using only rubbish as input material, I'd have produced quite a successful invention. If I failed to think about what it should do when asked to please manufacture a devastating nerve gas, it might be a good thing to point that out to me so next time I can build either a machine that sanity checks what it's being requested to provide or a machine that doesn't know how to make weapons of mass destruction.

Re: Wibble Wobbles and Letting Cats Out of Bags

It depends where that training comes from. Maybe we could even get GPT3 to teach AMFM to use shorter sentences and that "methinks" is really not that common a word unless we're trying to sound old or whimsical. Then again, I've never figured out exactly why someone unleashed this on our peaceful comments section or why an actual person writes posts from it once a month or so.

Drone firm DJI promises 'local data mode' to fend off US government's mooted ban

Re: Flying sharks

Drones which don't have additional controller hardware but operate from a phone are almost certainly using WiFi. They might also have a Bluetooth connection, but it is shorter range so it's not likely (and that can be logged as well). For that, you can in fact tap the connection on the phone's end or with something in the middle. For drones with a separate controller, it's harder but you can still figure out some things. For example, you can figure out what the frequency is and see if you have to worry about someone listening to it. If it's a band used by cellular providers, then it could theoretically be using that to exfiltrate (and if it's not using the mobile networks but still using those frequencies you shouldn't be operating it), but most likely it's a higher frequency and the only way to listen to your commands, even for someone who does have the decryption keys, is to be near you.

You could test it by connecting both the drone itself and the phone controlling it to a network which logs all the packets. While a company which wants to collect could think up a sneaky way to hide data, it's a lot harder to communicate without an interested party seeing that it's happening. Unless they've decided to include a ridiculously expensive and pointless cellular connection circuit, they will either have to use your network or keep things local. It should be provable whether they've lied here.

Go Huawei, Android: Chinese telco biz claims it will spread Harmony OS for smartphone to devs come December

Re: “Others have tried and failed"

It's already a Chinese ecosystem. Android, minus Google's spyware, plus the popular Chinese apps. All the stuff they use can be maintained and has successfully been maintained for years. They don't need this in order to have a home-grown system.

Chinese nationalism is one thing. It's the wrong thing for this argument. It's the thing that convinces people that Huawei might really be the Chinese government's sigint system, because of course all companies were founded for that purpose entirely. It makes a false equivalence between Huawei and the Chinese state, and it ignores that there are other manufacturers of phones based in China. There are several. Huawei has the largest section of the market share, but if you combine numbers 2 and 3, they have more. Include all the smaller ones, and they dwarf it by hundreds of millions of devices. You can be a Chinese nationalist, want to avoid any foreign-made tech, and still buy an entirely Chinese phone (hardware, OS, apps, network) without Huawei being involved. Or you could buy a device where Huawei is a little involved but it still doesn't run Harmony. Unless Huawei manages to convince the Chinese that other companies based in Shenzhen and Shanghai are somehow foreign, they can't just ride the wave of nationalism for their OS to be a success.

Re: The biggest problem

That's exactly the point. All five of those examples are China-based. All compete with Huawei. This isn't a market where all the domestic players drift along in unity; they're constantly looking to improve upon their devices and increase their market share. And all five of them wouldn't want to adopt an operating system that gives a major market advantage to Huawei because Huawei has seen the code and they haven't. Chinese nationalism goes only so far. It will likely get the most popular Chinese apps ported to Harmony. It may convince people to buy Harmony phones even if the OS is worse than AOSP. It will not make all the other companies fall in line behind what is just another phone company. Huawei isn't the government, and the other phone manufacturers there are not slaves to what one company does.

Re: “Others have tried and failed"

That's far too generous to it. China is a more captive market, but there are lots of smartphone manufacturers there and they're not all Huawei. Huawei isn't making Harmony OS completely open for all of them to adopt; the parts that will be released won't comprise the whole thing. Do you really expect that, when they release this next year, several other phone manufacturers will immediately start licensing it and competing against the people who wrote it using the same software? They won't. Instead, they'll keep using what they used before: Android based on AOSP. Given that's what most Chinese customers are familiar with, that will still be a formidable competitor. It isn't a foregone conclusion that Harmony will lose to Android, but it certainly might. Thinking that Huawei owns the China market is remarkably similar and similarly incorrect as assuming that the Chinese government's international spying section and Huawei are the same place.

Re: The biggest problem

"There will almost certainly be some form of ABI for running Android apps with minimal additional overhead."

Uh, I really doubt that. They might have a few things they can do which increase compatibility, and their compiler will take the same set of languages, but they're ditching all the Android system APIs. If they're going to emulate it, they'll have to include a lot of duplicate APIs and implement what's effectively the thing they already have. Minimal overhead is tricky because we're layering system API calls on top of one another, but it's possible with concerted developer effort. If they do successfully implement this, there's no reason to develop for their OS, because someone could just develop for Android and run that. It also won't help in other markets, because they're not creating an alternative implementation of Google's GMS APIs.

China won't mandate Harmony OS on local devices either. If they do, Huawei's happy. Xiaomi, Oppo, Realme, ZTE, TCL, and everyone else is unhappy. Unless Huawei really does have a very close relationship with the government, close enough that the government will voluntarily kill most of the domestic competition, it's not going to happen. Harmony will have to compete on its own merits. We'll have to wait and see what those will be.

Unexpected risks of using Apple ID: 'Sign in with Apple' will be blocked for Epic Games

Re: More secure? Only maybe

I'm afraid I don't agree on either point. A site can get hacked in a variety of ways, including in a way that allows someone to provide a password and impersonate a user. Just because they originally didn't do so doesn't make the site any more secure unless the site requires third-party sign-in. If the site does require it, it can still be hacked in such a way that the information available to a user is stolen.

On the subject of nothing important being connected to such accounts, you might be surprised. You're correct (I really hope) that no banks or email providers let people do this. However, places which do have this option include places which process payments, collect names, addresses, and phone numbers, enable access to potentially-sensitive documents, or can be used to impersonate someone. A lot can be done with access to lower-level accounts.

Re: How very petty

There is no technical issue. Since Epic violated the agreement, Apple is cutting off all the services they used to provide to Epic. Some of that is going to affect Epic's customers. Apple knows that and accepted the consequences. Epic knew this would happen to them and affect their customers. They chose to take that risk. Who you blame for the pain to the customers is your choice. I can't even bother to make up my mind anymore.

More secure? Only maybe

"It can be more secure to use one or two identity providers run by top technology companies, rather than using separate logins for every internet service, since the likes of Google and Apple are likely to run more secure systems."

That is true, which is why it's so important not to reuse passwords. However, while your password is likely more secure when the big four are the only people who have it, here are some other things that can happen:

Privacy nightmare: Any time you want to log in to something, your provider knows where, when, and how. Including things they have nothing to do with. Do you trust them to have that information? If they ever do get hacked, all your information is neatly stored in one place.

Companies can take it down for you: If they feel like it, the authorization providers can cut off your account or the ability for places you use to use that sign in. In the former case, you lose the ability to log into anything. In the latter, just the specific place (that's this article). Either way, your access could be disabled by someone who isn't the place you're interacting with.

Single point of failure: If the service you're using has a technical issue, or your ISP or theirs has an issue, you could lose access to all your SSO abilities even though you don't have any problem accessing the thing you'd like to log into.

Openness to breach: If your account isn't well-protected, for instance because someone offered you the option to log in with another party but served you a spoofed page which you didn't catch, they could be able to log into other services as you. While all four of these companies offer multi-factor authentication and it's usually well-implemented, that doesn't mean that everyone has that turned on and configured securely. If they don't, this could be a lot like reusing a password.

Compare this with a password manager, and in each case the password manager will win. Use one.

I won't be ignored: Google to banish caller roulette with Verified Calls

Re: I'm trying to think how many unsolicited calls I've actually wanted

That's why my suggestion would include the ability to reject blocked caller ID (or omit it entirely). One interesting option is to be able to announce to the caller that blocked caller ID is not accepted so they can choose to show the number. You are only slightly correct about the phone companies being able to identify spoofed numbers. Often, the originating connection knows who is really calling and bills that person, but that doesn't necessarily mean that, by the time it gets to you, your phone provider knows who it is specifically. This variable is meaningless, however, because you can't really get a phone company to do anything about a report. If you call them today, they won't have much infrastructure for identifying or pursuing the scam, partially because, for connecting the call, they'll get paid a small amount. My suggestions would require them to do this and remove any possibility that they'd conveniently fail to identify the source. Any unwanted calls would have to come in clearly identifying their source, which means most criminal attempts would be stopped quickly and commercial bulk-calling could be more easily targeted by data protection authorities.