Posts by doublelayer

Just because you're paranoid doesn't mean Google isn't listening to everything you say

I prefer "don't get one", "if you have one, see if you can reprogram them to do something else", and "if you have one and couldn't reprogram it, see how much power you can send through the cable before the device emits a pop and some smoke".

Re: "has violated our data security policies by leaking confidential Dutch audio data."

It's worth knowing that Google doesn't only give this data to their employees. If you've used recaptcha, it also has an audio version for those who cannot see the images or for those who are fed up with the stupid image tests. The audio version plays a snippet and asks the user to write down what the audio said. I think some of the clips are taken from random youtube ads, but others have the distinct sound of phone calls or basic microphones recording in rooms not designed for recording, and from the distribution, it's clear that this is not intentional degradation of sound to make the captcha harder. I have yet to hear anything sensitive because I don't do captchas that frequently and they only do a few words, but I do distinctly remember the one that came from a phone call and said "is at 9:00 tomorrow morning", so I really hope the first part of that sentence wasn't in the system in case it said what that person would be doing at that time.

IBM torches Big Tech's get-out-of-jail-free card, says websites should be held responsible for netizen-posted content

Far too many facets

On one hand, allowing sites nearly complete freedom to allow anything through means they don't do anything to protect against their service being used for very illegal activities. Facebook, for example, hosted (and probably still does) many groups dedicated to the sale of stolen credit cards. They also allow advertisers to post ads that violate laws without verifying who it is or whether there are any problems. In those respects, there is a pretty good case for altering the law to fix that. However, we also need to avoid making places responsible for things that are not really their fault. As much as I despise Facebook for all their violations of privacy, they really aren't at fault as soon as someone uploads something illegal. They should remove it, but they didn't know it was coming. This applies perhaps more strongly to small sites, which don't have the kind of resources it would take to monitor all posts and accounts thoroughly. So there is a case for changing the law, and there is a case to clinging to it. Why do I have the feeling the politicians will take both cases and manage to find that spot in the middle that extracts the worst elements of both?

Facebook: The future is private! So private, we designed some handy new fingercams for y'all!

It comes to mind

Anyone recently read The Circle by Dave Eggers and uncomfortably thinking about the transparent people?

For those who haven't read the book and not planning to (it is a good one), the transparent people are people coerced by pier pressure and the pressure of a massive fictional tech company, the titular Circle, to wear a camera that livestreams everything they see and do and keep it enabled at all times. As the company does this, they manage to use some benefits of the system (E.G. politicians not being able to engage in blatant corruption when on camera) to make it essentially mandatory for anyone important to wear one, which they then use to impose other types of surveillance on the world at large.

'It’s not a surveillance program'... US govt isn't going all Beijing on us with border face-recog, official tells Congress

Given that the Chinese surveillance system was developed using bunches of datasets collected by universities in the west and shared with China by academics who didn't think it through, I think they have plenty of access to all types of faces. Since they were going for high accuracy rather than cheap or fast development, they probably have a much less biased system. Why is it always the evil people who have the best system?

It's not a surveillance program

Thank you for telling us. So all we want right now is to have a look at your files and thoroughly investigate to make sure that's actually the case. Sadly, that's proven necessary given other not-a-surveillance-program systems we've been told about before. After we've seen and accepted your proof, you can keep going. Just come back every year to reassure us with the required documentation that you are still adhering to human rights and not exceeding your authority. Now where are those other agencies we need to do that with? Get in here, guys, and bring your documentation.

Internet imbeciles, aka British ISP lobbyists, backtrack on dubbing Mozilla a villain for DNS-over-HTTPS support

Re: Mozilla

It sounds like you've panicked a bit too much about DoH's security risks. The kinds of problems you could see with DoH connections could also be seen by a user connecting directly to an IP address or using whatever open ports you have to run a VPN or connect through Tor. Either of those would bypass internal DNS controls and would probably flag as risks in your network analysis logs anyway. Since the use of any of those things would be violations of a security policy, you might as well tell people they must use a certain set of configurations that disallow DoH, and using DoH will be a violation of security policy. Wouldn't that pretty much solve that problem?

Re: Mozilla

I would suggest that DNS requests be sent to an internal DNS proxy (if you have internal names, that's already there), which can do the HTTPS stuff recursively from there. Failing that, you could send all requests to that as primary, configure it to only know internal DNS addresses, and have the HTTPS address as secondary.

When using DoH, you have to contend with the possible issue of the trustworthiness of the DNS server, but it is not at all required that CloudFlare or Google be used. DoH could be set up by any existing DNS server with relatively little effort. I've taken a look at a basic implementation of a DoH server. I'm planning to set it up on one of my servers to see exactly how difficult it is, but it doesn't look like it will take very long.

Re: Mozilla

In addition to the pier-to-pier problems mentioned above, there are some other problems you might see with that. Depending on cache policies and the definition for "recent" you're using, that could break various things, as many devices maintain their own caches and contact later. It could also be problematic in various less common but still existing situations, for example when a new remote server is spun up and is accessible only by its IP as a DNS name has not been assigned to it yet, or applications that contact their own remote services, as those might have addresses outside of DNS (for example, some programs with group usage, especially games, list servers on their own main system without using DNS).

'This repository is private' – so what's it doing on the public internet, GE Aviation?

Re: DNS problem only?

Good point. I stated that point badly. I should have phrased it more like this:

I like the basic security provided by the use of NAT that is standard in IPV4 networks due to the small number of available addresses. While this can be done in IPV6, it is not done as standard or recommended by many IPV6 advocates. I am worried that this security will be lost during the switch to IPV6 for the vast majority of people who stick with the default configuration and may therefore be left without either the security of a properly administered firewall or the somewhat unintended but nonetheless available security of private addressing.

Have an upvote for helping me clarify that.

Re: DNS problem only?

The DNS in question would be the internal one for the company, for example instructing the actual public systems that the hostname could be found on a given internal system, and thus allowing a tunnel into the network to be created when that wasn't really desired. The other option is that some DHCP or static routing misconfiguration reassigned the server to a public IP and nobody noticed because DNS still resolved the hostname properly.

I have to say, though this isn't exactly on topic, that this is pretty much the only thing I'll miss when IPV6 takes over. It's nice to have specific IP ranges that won't be available publicly. Yes, I know that I can run an IPV4 network and NAT out to an IPV6 one, and that I should be firewalling anyway, but private space is nice because I know that, should the firewall be misconfigured, unsolicited traffic still won't be able to reach the server because the address can't be routed to.

'Is this Microsoft trying to be cool? Want to go to the Apple Store?' We checked out London's new retail extravaganza

Re: Pavement Plodder

The stores can be helpful sometimes. If there are problems that can't be solved right there, the Apple employees in the nearby store can deal with it. When, for example, I was having trouble talking my brother through a Mac software failure (major software failure resulting in the OS not booting, so no remote control) from hours away, I could send him to the Apple store with a page of instructions I wrote up as to what the machine should be like when they finished with it. They are also reasonably helpful for some minor hardware problems. FYI, if a key tile falls off your Mac keyboard, the Apple store will replace it for you without you trying to hunt down a suitably-sized replacement and install it. At least they used to. I hope they still do. It doesn't change the problems with Apple, and almost all of the things that happen in the stores aren't of use to the technical among us, but they're occasionally mildly helpful.

Did you buy a hot Asus Rog Strix notebook? Like, really hot? Like, super hot? Like, ow-ow-ow my lap's on fire hot?

So, here's what I'm hearing you saying. Let me know if I'm misunderstanding your post.

1. Your machine is fine.

2. Well, actually, your machine is fine after you did some work on it. It isn't stated what it was like before that, but something made you want to reapply thermal paste and pads.

3. So at some point, your computer probably wasn't fine.

4. You are fine with the charger not, if you want to get technical, working as expected in as much as charging the battery under some conditions.

5. Because you are fine with this, and your computer is, to restate things, working fine now, nobody else's could be defective.

6. Therefore, based on your sample size of one person who might not have all the problems and doesn't care about one of them, there is no problem.

Did I get that right?

Oh good. This'll go well. Amazon's Alexa will offer NHS advice

Re: Solution looking for a problem?

I think the original point of the thread is a good one. What kind of information is it actually getting? If it's just querying a page online, how much information can that really provide? Is it going to do a simple search and start reading one of the health topics like this one with little or no reason for choosing it? The content is more nicely phrased on the NHS site, but we could get the same benefit from implementing feature number six on this XKCD.

Facebook and Max Schrems back in court again, both pissed off at Ireland's data regulator

Re: GDPR

This concerns data transfers in 2013. Sadly, GDPR does not apply. They could make some progress, however, on getting enforcement to happen more often.*

*Operative word being "could".

Guy is booted out of IT amid outsourcing, wipes databases, deletes emails... goes straight to jail for two-plus years

Re: A Cryptic Response

They said they completed the recovery effort in ten hours, which implies they had backups of some sort. Whether that is cloud backups that were not destroyed or were recovered in time or physical backups, it seems likely they had something.

My guess is that they brought in some external people at high rates to do it (probably getting them in a rush, too), and that those people took it upon themselves to spend extra money, such as paying for someone to recover data from the hard drives in the mac on the theory that some data might be on that but not yet in the backup. Add in some money for lost productivity and fifty thousand sounds more normal, if still a bit inflated.

Plenty of small places have only one admin. Some very small places have no admin. I, for example, am a volunteer admin for a charity near me. Other than me, they have nobody, outsourced or not. When I arrived, their server was running on the "it better not fall over because nobody knows what it does or how its configured or the login password" paradigm. So it isn't that unusual to have only one admin, or at least one admin who manages all the systems with lower-level admins who do specific systems or systems in specific places. And I could destroy all this place's data in about five minutes should it turn out that I'm evil.

Take the bus... to get some new cables: Raspberry Pi 4s are a bit picky about USB-Cs

Re: Let me get this straight

Of course it makes sense to do that, but here are a few other things it makes sense to do:

1. Have one, and only one, type of cable that can connect to the connector so you can't have, say, a thunderbolt cable which will connect to the port but won't actually work unless both devices are thunderbolt, or a cable that is designed only for visual data so can't carry power or connect two general purpose devices.

2. Have one, and only one, power style so you can't accidentally connect a standard USB 5V system to the newer high-power system and fry it.

3. Make the spec as rudimentary as possible so people who don't read it all the way through (random startups, the raspberry pi people this time unfortunately), are likely to have it work.

And yes, I would have to ask if USB C is really that big an advantage over normal USB. There were a lot of downsides about it, but the flipping cables over to try the other way was a minor annoyance and the connectors proved their longevity.

Re: "the Pi is not a toy but increasing used for serious jobs"

"If you buy and use something designed for a different use, especially if you do just because it's the cheapest around, and you have issues, it's just your fault."

They're not buying it for a "different use [case]". The pi is meant to be a computer with the specified interfaces, and they're buying it to use the computing with those interfaces. It is failing to properly do one of the things it said it would, namely receive power from a USB C connection.

In addition, you're not at fault if a product fails to do something it said it would. The designers or manufacturers or sometimes plain bad luck are at fault. If you still subscribe to this policy, I'm pleased to inform you that I've just started a business. If you have a task you want to perform, send me a message detailing what you're doing and what tech you would be using for that purpose. Our business will happily sell you technology with the same feature set for twice as much. You don't want to buy our solution for twice as much? Well fine, but just remember that if the one you buy doesn't work for some reason including a design flaw, it's all your fault because you decided to buy a cheaper product.

Marriott's got 99 million problems and the ICO's one: Starwood hack mega-fine looms over

Re: Collateral damage in the Cyberwar

There's a clear difference between you getting burgled and a company having customer data stolen from them. I'll lay it out for you:

You get burgled: your stuff is gone. At the very least, you have to go through the insurance claims process and purchase new possessions. Usually, you're out quite a bit of value.

Company has information stolen: Customers have to worry about account compromises and identity theft. Without laws like these, the worst the company itself has to deal with is the risk that people might try to avoid their hotels. Given that this is not a market with an infinite number of participants, that isn't a major risk.

There's the difference. When the negative event only harms you, we don't penalize you for the consequences. When it does, we can look into whether you were at fault. That doesn't mean that you or the company in this case is at fault for the whole thing, and their sentence isn't of the kind you'd get for actually performing that breach, but it is a perfect case for laws against negligence leading to harm, and data protection law better formalizes that in the specific case of data loss. I hope the ICO takes this into account, as a breach can happen to anyone no matter how much security they've done, but I don't see any evidence that they have not.

Re: Just the cost of doing business

If you're referring to the California Consumer Privacy Act, that doesn't take effect until 2020, so California can't impose any penalties based on that law for this breach. By 2020, I'm sure the various amendments proposed by the many definitely consumer-oriented organizations founded just after the CCPA was passed because some consumers in Mountainview and Menlo Park were just that interested will have been installed in the law and it won't have any effect then either.

Wanna sue us for selling your location? Think again: You should read your contract's fine print, says T-Mobile US

A backup plan

So, although we all think arbitration clauses are harmful, they'll probably get supported. I can only hope that the contract makes the company cover the costs for the arbitration unless they are proven to not be at fault (I'm sure they don't want to do that, but I've seen it before in such clauses). Maybe we can get enough people to start individual arbitration cases to show the companies that, if they want this to end within their lifetimes, they should just let the single trial go through.

Chinese government has got it 'spot on' when it comes to face-recog tech says, er, London's Met cops' top rep

I don't know what calculations you tried, but I think you're missing a variable necessary for the calculation of the false negative rate, namely the number of people in the sample who were supposed to be detected. Given that the sample was "the public" and the number of faces in the database is known but the number of people in the database who were actually there is entirely unknown, I would say that, even with an estimation of total sample size that we can assume is completely accurate, we cannot determine or even estimate the false negative rate.

I have no objections to judging the system as crap right now for its abysmal success rate and the unjust plans for its use.

Re: China's not England

"Its really just an upgrade of the traditional PC Plod who knows everyone on his beat"

It isn't and I at least wouldn't want that either. Facial recognition isn't a police officer seeing a person and going "That guy is typically here". It's a system that records my presence, possibly reports me as someone I'm not, then keeps my picture on file and cross-lists it with any other pictures from other places and other times, because they've said they're not going to erase any of this data. That's not what a normal police officer does. In fact, a normal police officer shouldn't spend a lot of time identifying unfamiliar people anyway because sometimes we people visit places we don't frequent, and we're perfectly within our rights to do that.

Now let's deal with your contention that this is just an upgrade of the previous role of a police officer. I don't want my police officers upgraded. We've spent a long time trying to give police enough power to stop crime without giving them enough power to harm citizens' rights. There are lots of ways we could "upgrade" the capabilities of a police officer. Let's start with the easy stuff: remove the pesky requirement to get warrants before searching places. That will speed things up dramatically. It will probably also increase the number of criminals arrested, because there are a few people who find out a warrant is being sought and destroy the evidence before the officer gets there. There would actually be some benefits to removing the warrant requirement. The only problem being that WE NEED WARRANTS TO PROTECT PRIVACY! We need a lot of these restrictions on police activity to protect privacy. Without them, the police become a much too powerful institution, prone to massive corruption and criminal activity in their own right. That's a profound downgrade, and we should not let it happen.

Re: Decisions, Decisions...

I "can't blame states" for wanting to control the internet traffic going through them in the interest of state security? I bloody well can, my friend. It's wrong by nearly every metric. It's censorship, violations of privacy, in itself breaks several human rights laws, and opens the doors to many more intense violations typically characteristic of dictatorships. Every country that does that, whether their control is just watching the traffic, blocking traffic, or manipulating traffic, gets as much blame as I can dish out. China, blame. U.S., blame. Russia, blame. U.K., blame. The sooner they cut it out, the better. To the extent I can, I intend to support movements that result in the cutting out of this unjust and completely blameworthy activity.

Got an 'old' Tesla? Musk promises 'self-driving' upgrade chip ship by end of 2019

Re: I like the idea

Personal self-driving cars don't have to be part of a taxi net. It'd be an optional choice you could do to make money. For those who don't need the money and value immediate access to the vehicle, it wouldn't be a very good use case. It'd be sort of the same as allowing people to rent out your normal car if there was a convenient way to let them in, which doesn't sound like a popular program idea to me.

If this were attempted, there would likely be a requirement for dedicated vehicles for that service. In that case, I assume there would be charging stations located throughout the service area. When a car was low on power it would remove itself from the network, drive to charge, and only put itself back online when it had charged. Whenever there were gaps in traffic where more cars were available than in demand, the cars with the lowest charge would drive themselves to the charging stations as well.

Chrome's default-on ad blocker – which doesn't block adverts on 99% of websites – goes global

Brief summary

If you like privacy, or security, or control, or diversity, don't use Chrome. That pretty much covers any Chrome-based article.

Fibaro flummoxed, Georgia courts held for ransom, and more

Re: Lake City IT boss fired for ransomware payment

I concur in your argument, but most people whose job is hiring IT directors have different ideas. Keeping the systems up right now is their primary goal, plus getting new systems up as fast as possible. Thinking about the longterm is on the list but lower. At times, usually for financial reasons, backup plans are specifically left unfunded (no ability on the part of the IT director to reallocate funds to backup from something else). Of course, in that case, I'd at least have an improvised backup system, but I wouldn't support firing the IT director for a backup problem if this was proven to be the case. And then, there are those cases where someone does some misguided maths and decides that it might be cheaper to pay the criminals than to manually recover and a tech site says it's sometimes a good idea, which could also be a decision made by someone external to IT (though if that happened where I'm working, I'd protest the decision and make plans to leave. I admit, however, that these possibilities are unlikely to be the case in this situation.

Re: Lake City IT boss fired for ransomware payment

The story and videos (if watching these, expect to see about ten video ads inserted), make it sound like this, but I'm not sure. It is possible that the insurance company made the decision, but it is also possible that the city made the decision and the insurance company simply covered part of the expense. If the decision was due to the IT person not wanting to do the work of a restore or not having taken backups responsibly while having the ability to do so, I would see firing them as a logical option. Oh, if anyone from Lake City IT is reading this, you're going to want to reimage anyway because ransomware can just sit there waiting for more data to be put in before locking again. Your television station didn't make it clear that you know that, so just to make sure...

Metropolitan Police's facial recognition tech not only crap, but also of dubious legality – report

I'm not a downvoter, but your question is unanswerable and missing the point. Nobody knows how many people were present, as they didn't test it on that. Also, most of us here, myself included, are not that happy having a 80% rate of someone innocent being taken in for questioning on the back of a system that violates citizens' rights.

Re: It's in its infancy, but it will improve

"Pushing back against facial recognition is a bit of a waste of time. [...] Where you need to concentrate the fight is things like generating spurious criminal charges arising from concealing your face. [...]"

I'm not sure whether to upvote you for your last point, downvote you for your first point, or just boggle at how your last point almost directly contradicts your first point. Facial recognition equipment is in the same category as charging people for not letting them use their facial recognition equipment on you. They're two sides of the same coin, yin and yang. Since we both agree that charging people for hiding their faces is wrong, let's look at the first point. Having that equipment allows them to do the same kind of tracking. It makes it impossible for citizens to have privacy unless they specifically try to, in which case they will be charged. It is not a thing we should just accept, because in addition to it actually being illegal according to current laws, it is so unpalatable to those who like human rights that it should be made even more illegal through additional legislation.

Your comment that "Facial recognition is what cops do so denying them the use of a machine that will help do this is just not going to work" is rubbish for two primary reasons. First, there are plenty of things that cops do, and we accept, but we don't want to extend their abilities. Cops search suspects' houses for incriminating information, when they have a warrant. We could extend this by not requiring a warrant, but we don't because we don't want the police to have that power. We only want them to search places when they have a warrant to do so. Second, facial recognition is not the primary job of a police officer. Even those officers who work directly in public and not, say, investigating existing crimes aren't there to look at everyone's face and determine if they have seen it on a list. They're there to identify crimes and safety risks and deal with them. In almost all cases, they have not seen the perpetrator before, but they still go after them. If the police said they were going to throw away this system and instead employ a bunch of officers whose job it was to go to everyone and stare at their face to identify whether it's on a list, I wouldn't be any happier.

Re: It's in its infancy, but it will improve

* You have a personal tracing device in your pocket RIGHT NOW (your phone).

With as much tracking turned off as I can, and if I was worried that people were actively tracking me with it, I'd leave it at home.

* You have listening devices in your home RIGHT NOW (Smart TV, digital assistant, games console...)

None of those. A few things have microphones and internet connections but I've set them up and know what they're doing. If I was worried that people were actively tracking me with them, I'd disconnect either the microphone or the connection.

* You have behaviour monitoring devices RIGHT NOW (activity tracker, internet connect fridge, home automation...)

None of those at the moment, but I once had an activity tracker that I gave away because I didn't use it. It monitored my heart rate during exercise, and could send it to my phone but I never enabled that. So it was a tracker whose tracking data only went to me, and it lacked the technical ability to report on me. If I was worried that people were actively tracking me with it, somehow circumventing the limitations of the device making this impossible, I'd leave it behind.

* You are using facial recognition RIGHT NOW (Facebook, Windows, Apple...)

None of those. I prefer passwords to log into my computer, and no Facebook account. If I did use a facial recognition system, I'd do so in such a way that the recognition was done using local processing on local data only.

* You are happy to be tracked RIGHT NOW (advertising)

I am not happy. That's why I have ad blockers, tracker blockers, and a DNS filter. Even that is tracking for economic purposes, not complete surveillance, so is not as bad an abuse as what has been considered (and done already) by governments.

Re: Help with "Innovative Solutions"

You may be happy for the Chinese to use your data, but maybe you'll change your mind when you figure out that they can use your data to help improve the technology they use to commit massive human rights abuses on someone else. Consider this (audio), for example. That's what they can use data for, and it can come here once they've perfected it and on the way used it to imprison and kill thousands and eventually millions of innocent people. Are you still fine with it?

King's College London breached GDPR by sharing list of activist students with cops

A suggested solution

As a developer, I'd like to suggest a software solution to this. The relevant modules are presumed to have been imported:

def dealwith(employee):

if !employee.ask("Did you have any knowledge of this?"): return

if employee.ask("Did you report this to the relevant authority?"):

authority=employee.ask("What authority was that, then?")

dealwith(authority)

return

supervisor_knowledge = employee.ask("Did your supervisor know about this?")

security.inform("We have another card for you to block out.", employee.cardnum)

hr.update(employee.id, employment_status=hr.NOT_EMPLOYED, flags=hr.DO_NOT_EMPLOY)

employee.employed = False

for colleague in employee.colleagues:

dealwith(colleague)

for subordinate in employee.subordinates:

dealwith(subordinate)

dealwith(employee.supervisor) # security warning, not trusting potentially unreliable result of variable supervisor_knowledge

employee.inform("Oh, dear. Unfortunately, you're going to have to leave now and never come back.")

return

dealwith(email_to_police.sender)

print("Done")

Microsoft has Windows 1.0 retrogasm: Remember when Windows ran in kilobytes, not gigabytes?

Re: 32 Gigs

Most machines in that class have their storage on soldered-on EMMCs. It's flash and not bad from a speed perspective, but nearly impossible to replace. Usually, these are best with a card in the available slot for all user data storage, but things that have to be on the main disk can still rapidly use up the remaining space, especially Windows updates.

Reach out for the healing hands... of guru Dabbs

The confessions of a fixed problem

I have to confess to rather recently doing the thing mentioned in the article. I had trouble with an internal resource loading--Firefox reloaded it a few times then gave up. An email with my colleague resulted in a theory that I didn't have access yet, so the relevant authority was contacted and access granted. Ten minutes after that, I tried to load the site again, with the same result. I tried Edge too; no dice. I decided I wasn't going to sink to installing Chrome on my machine and contacted my colleague again. When his meeting ended, he came over to check on the problem, but when I clicked the link once more, the page loaded completely fine. As it turned out, security grants only get propagated on the hour plus whatever random time skew the machine running it has and whatever delay is caused by the other grants going through that hour. Still, I felt that embarrassment that comes from having someone come over to help with something that doesn't turn out to be a real problem.

Oz watchdog claims Samsung's leak-proof phones ad campaign doesn't hold water

I'm not saying there is a good reason for complete immersion for a while, but two points are, in my opinion, valid:

First, people might really like the guarantee of water resistance if they think they might run into a water-related accident that could kill their phone. I've had that happen before--I was asked by a friend who was away to ensure a filter was running on a swimming pool they managed as they were trying to sell that house, and I slightly missed the edge as I stepped over. My phone did not survive the two seconds of immersion. If I thought that would happen again, I'd get a phone likely to survive. The same could be true of people who go out on boats for a while, people who frequently use their phone outdoors (E.G. navigation) when there are puddles about, or people who worry about being caught in the rain.

Second, Samsung said their phones were waterproof, and showed examples which were wrong. It doesn't matter if we don't really think the uses of the phones are worthwhile if they were intentionally misleading people about it. If I make a drill and say you can drill through stone with it, you better be able to drill through stone with it or I have been misleading. It's not enough to say "Anyone really wanting to drill into stone would get a more professional tool. They should only be using a drill like that on wood." I said it in an advertisement, and fortunately that's one point where it's not legal for me or anyone else to lie.

Google's Fuchsia OS Flutters into view: We're just trying out some new concepts, claims exec

Re: Since Google invented it

You're missing the point. "Google invented search" means that Google invented an algorithm or rather a set of algorithms they used to create a search engine that was better than the others at the time and is still good today. Of course they didn't invent the concept of searching resources. Similarly, Gutenberg invented a useful form of printing press, but didn't invent the concept of printing or the printing press as a type of product. Arguing that he gets the credit for stuff that existed before him would be weird, but so would be attempting to deny him the credit for developing a technology that proved to be a very successful and influential implementation.

Re: A new OS from Google

Of course there is. I have to write a C compiler that's capable of handling every aspect of modern C because somewhere in its massive codebase, Google has definitely used all the things you never think about, oh and also I'll need a C++ compiler too while I'm at it. I also have to write a compiler for dart, go, and rust. However, I'm not worried that they're really compromising the toolchain. I don't actually need the compiled to differ from the source to be worried (though I think it will happen).

First, there will be a bunch of blobs that need to be added to the kernel to get it to do anything. Any or all of these might harbor any malicious functionality, just like now. There is not a good way to avoid that. I'm sure critical functionality will not be available in the open components, and Google will have nicely built all of that in a closed-source component. After a few years, someone will build an open source replacement for it that kind of works a little bit on some apps but you'll have to compile it yourself, root the device, and do some assorted hacking to actually replace it and also it will break a lot. In addition, without the requirement from GPL to release any changes as open source, manufacturers and mobile providers are free to do the same thing to the kernel that they have been doing to the layers above it. Can I say no thanks?

I don't think Fuchsia will be much worse than Android in the sense that consumer devices will contain a similar amount of spyware and irritating or potentially unwanted bits, it will be difficult to impossible to remove or even disable them depending on device model, and very few people would even try. However, given the choice, I would see Android as much better because we already have years of experience getting around some of this. We have Lineage OS, which, for all its flaws and limited device support, is a trustworthy OS that can actually run on a relatively large assortment of devices. At best, Fuchsia means a return to square one to do all this again. But it could be far, far worse.

ReactOS 'a ripoff of the Windows Research Kernel', claims Microsoft kernel engineer

Re: Methinks he does not know what he is talking about..

Original: "The tech market would collapse overnight."

Response: "No, it wouldn't. In fact, one might argue that the tech market might actually flourish, with the Weapon of Mass Monopolization once and severally neutered. Borland might actually still be a thing."

Really? Borland would still be a thing? When people could find the source for its compiler and use it as they saw fit without paying Borland? How exactly would that have protected them? Sure, the Borland compiler might have been used more, which gives us some ground for a very detailed what-if scenario, but Borland would not have gotten any more money out of that. Also, you think the tech market would thrive when no company could turn a profit from selling their code, only doing support? I can tell you that investors wouldn't be so eager, which is how a lot of risky tech ideas get the ability to start. Sure, I'd love it if every company decided to give me their source for free and we'd see a lot of interesting open source activity surrounding that release, but that's because I don't really care about whether companies live or die; I'm not under the misapprehension that they'd do fine by handing over all their work.

Re: @heyrick - Sounds like a bored dev is trying to make a name for himself

If you buy something with terms that say you now own that thing and the original owner agrees, then you own the thing. After that, it's your thing to use as you see fit unless you choose to sell or give it to someone else. For example, Apple wanted a new OS in the late 1990s, so they looked around to find someone who had an OS, which they found. They then bought that one and used it to make OS X. Before Apple bought it, it was the work and property of NeXT and it was nothing to do with Apple. After Apple bought it, it was the work of NeXT and the property of Apple, and after pretty much the same engineers who worked on it at NeXT did some work on it for Apple, it was the work of Apple. If I write some code and then you join my team and we both work on it, the final product is the result of both of our endeavors and we both get the credit. If you pay me to join my team, I still get credit if I did stuff. If you pay me for the rights to the software I had a lot of credit for with the clear idea that you get the IP and rights to sell, then you can decide how it will be sold, including what the price will be, how you'll advertise it, and what name you use.

I got 502 problems, and Cloudflare sure is one: Outage interrupts your El Reg-reading pleasure for almost half an hour

Even if we could magically decentralize CloudFlare and make people write nice HTML or at least store their own scripts, the internet wouldn't be a lot less fragile. The reason for that is that there are very few places that process all our traffic. There's only one line leading to your house that actually works, but that's a short length that isn't the main issue. The issue is that there's only one line that connects your ISP's local unit to whatever center they have for sending it out of local, and only a few lines (or maybe just one) connecting large areas to other large areas. What happens when cables stop working? Large parts of the internet lose connectivity. Routing around that kind of damage requires a web of lines, but a lot of the world operates on chains of lines instead. It's hopeless; the internet can't really route around damage. We just put our systems in lots of parts so we can weather most small disconnects and otherwise we're hoping nothing really bad happens.

This major internet routing blunder took A WEEK to fix. Why so long? It was IPv6 – and no one really noticed

Re: But... why?

I think it was probably something like 2400:xxxx:.../12, I.E. a more specific address that then got truncated by the typo. For example in IPV4, if someone did 12.34.56.78/8, some programs would just assume that to mean 12.0.0.0/8.

Re: 'Why would anybody notice, particularly?'

I wonder though. It's true that an announcement of an IPV4 block gets reported immediately, but what if I did something like this and announced (we're presuming I have the ability to announce and be taken seriously) a new route for a /2 block, which is around the same size as this block? Once again, almost everyone has a more specific route taking them to the various parts of the network, and completely skips what I said. I think it would be noticed a bit faster, but I doubt there would be "discussion on social media within minutes" because it wouldn't break much. The reason the more typical reroutings do get announced so quickly is that either people start noticing the traffic taking a long time and check the route or the new announcement isn't paired with an ability to actually get to the resource meaning things are obviously broken. If my announcement gets ignored, someone has to notice the anomaly manually and deal with it at that point.

What happens in Vegas ... will probably go through the huge bit barn Google is building in Nevada

Re: Desert Solar Power ?

Rooftop solar panels, while they can power a house, would not be at all powerful enough to take the load of a cloud provider's datacenter. They could put a bunch of solar panels on the ground elsewhere, but they probably won't. However, as such a sunny state, there are quite a few people with solar panels connected to the grid supplying solar power at certain points. Nevada is one of the best states in America for renewable energy.

For a source, see this chart with data from 2017 (it seems from a quick search that solar use has been climbing since then). While the sorting (I did the without hydro option) makes it look like Nevada is actually not as great, its proportion of solar/wind to total is about the same as most of the ones that look to be ranked higher. Depending on which column you use, it looks bad not because Nevada isn't working but because they don't have much hydroelectric power and they're not as big as some other sunny states like California.

I don't mean to assign any credit for this to Google, but if they're going to put a datacenter somewhere, this isn't the worst state from the perspective of environmental impact of attaching to the grid.

Edge-lords crack down on trackers as Microsoft effortlessly kills off PBX phone system, and what's this? Windows Calculator on iOS?

Re: Expensive concerts...

The latest IoT isn't usually on something modern either. Usually, your choices are some version of Linux grabbed by the devs at random before they started coding the app, a version of Android grabbed by the engineers from the "tried and tested" AKA "at least two versions behind" group before they started building the prototype, or a custom lightweight OS that they paid an arm and a leg for and never actually gets security updates, but as long as it's not running the grid people won't bother to try to hack.

Could an AI android live forever? What, like your other IT devices?

Re: Things that breed ... things that heal

There are always those things that you expect to break but yet somehow hold on for a very long time. I was given a thermometer at one point, the kind that measures the temperature outside with a probe. It was clearly made as cheaply as possible, with lots of parts that really felt like they would fall off if you pushed hard enough. I put this on my window from which I was constantly knocking it, but it withstood very frequent falls to the floor without ever losing a piece. It also managed to last about twelve years on a set of batteries. It's still going strong, despite my firm belief when I got it in 2003 or so that it wouldn't last until 2004.

Or that one that is about five meters long because USB works great at those lengths. No, I don't know where it came from. It kind of works, so I keep not throwing it away in case I finally find a use case for it, the same way I keep various other completely working things that don't require anything strange to operate but I don't have any conceivable use for.

Re: "airborne splinters of razor-sharp shards of metal"

I typically remove the screws to reveal the platters, then simply wedge my screwdriver under the platters and give a sharp yank upward. The platters don't survive many of those, though I recommend enclosing the drive in a bag before doing so to prevent the need for aggressive vacuuming.