Posts by doublelayer

There's Huawei too many vulns in Chinese giant's firmware: Bug hunters slam pisspoor code

I don't think these are backdoors, the Chinese military is better than that, but let's look at a few possibilities in general.

If I want to embed a backdoor into something but not get caught, I have a few options. I could do the standard hard-coded credential backdoor. This has to go unnoticed by the public. If it is seen, it can be tracked to me depending on how much the company wants to protect me. A patch will be demanded to remove the credential, and after that's installed, I'm stuck. I might instead choose to use some libraries I know I can break into. I'd use the latest version with the vulnerability I want, and I'd probably leave a few different ones open. I'd make the access mechanism complex so people can't easily stumble on the way in, but this mechanism lets me have deniability because I can play the "incompetence and not malice" card. It also lets me patch one of my vulnerabilities and maybe get away with leaving another one open. It does take more programming skill to implement this well.

That's how backdoors work. The reason I don't think these are deliberate is because coding standards are so bad. If they were in the middle, I'd have some suspicion, but nobody needs openSSL from 1999 to get a backdoor and that's just calling attention to problems. However, there's one more thing to consider.

If you were the Chinese government, and you wanted a backdoor in Huawei equipment, and the company didn't already have one for you and wasn't planning one for you, what would you do? This would be my plan: I'd get a PLA programmer employed at Huawei. The person I chose would be very skilled and knowledgeable about the type of equipment. If possible, I'd train them on Huawei source code, to which I assume the Chinese government has easy access from a government contract or having broken Huawei's corporate security. This person would then insert some carefully crafted vulnerabilities into the code for the devices. Nobody will notice internally; they're letting obviously insecure libraries through. When libraries are updated, this code can remain for quite a while, being disguised by the unintentional vulns left in by poor coding. This would also be harder to detect because so much focus is being placed on understanding all the rest of the codebase that my relatively small addition can last a while without being questioned.

Re: I'd like a true comparison

That is not true. There were points where three manufacturers were compared, and Huawei lost in that comparison somewhat badly. I am more than comfortable assigning the "bad practices used" label to Huawei from this report. My concern is that other manufacturers may also deserve this label, and I'd like to see it assigned out to all who deserve it.

I'd like a true comparison

I would like to see this type of thorough analysis performed on other manufacturers and their products. Not that I doubt the findings here, but problems like this are critical and something needs to be done about them wherever they may be. No manufacturer should be left out of this investigation; it matters little if a bug was introduced deliberately or accidentally if it is used by a malicious party. Whatever your view on Huawei and the American government, this situation is very bad.

The seven deadly sins of the 2010s: No, not pride, sloth, etc. The seven UI 'dark patterns' that trick you into buying stuff

Re: AVG FREE ANTIVIRUS, I AM LOOKING AT YOU.

How about this one that happened to me just a few months ago. My father (he's not reading this, so I can safely call him nontechnical) wants to do something his laptop can't do right now. I find him a good piece of freeware (in this case true free software with code on github, score) that does that. Knowing how search engines work, I give him the address to type in over the phone, no fooling me. The site looks nice and clean, with only one link saying download, so all I have to do is get him to select the x64 instead of the x86 and we're done and I can show him how to use it. The problem is that I have an ad blocker and he doesn't. He clicked on a download link and installed the thing it auto-downloaded (fortunately not malware but definitely not the thing I had in mind). I got him to run a defender scan just in case and removed the unwanted application with extreme prejudice next time I was near. Ads allow people to infect good sites with their nastiness; this is why we need to block them.

Re: think of the children!

In my experience, you can expect the following reviews:

Five stars:

95%: "$Product works great.", and that's it.

5%: "This product is excellent and here's a page on exactly how I use it and what it does."

One star:

80%: "$Product is crap."

5%: "$Product arrived broken [in some way]", with details that seem like it could be the fault of the manufacturer, the shipper, or simple bad luck and you don't really know.

10%: "Product broke after not very long" with even less detail than the arrived-broken people so you really haven't a clue. One time, I read a review of a hard drive (internal mechanical kind) where the user complained that it had lasted only a few months when strapped to a motorcycle, which wasn't exactly the most instructive in estimating its lifespan in something normal.

5%: "This product doesn't work, and here's a page on what I did with it and why it wasn't sufficient."

Those final 5%s on each of those categories are wonderful, but frequently they're absent. That's why I tend to discount all the one and five star reviews of a product if it has enough reviews and focus on those people who assessed it in the middle. Failing that, I weight reviews by length and go with the longest ones I can find. Failing that, I weigh them by use of certain words. I've found that nearly any review mentioning the word "Linux" is useful, even if you never intend to use the product with Linux.

Re: A Prime example

The problem I typically run into is that, while a seller's site may offer lower prices, it also offers a worse experience through and through. Take a market for electronics parts. I place a relatively small order with them, with my bill coming in at the price of a standard meal. My shipping bill was twice my actual purchase price. I was told I could get a discount on shipping (not free shipping, but a discount) if I increased my order to about the price of a cheap laptop. After purchasing, I got my email receipt, but no information about delivery date or package tracking. Frequently, this is not necessary. In my example, I didn't care when the parts got there and I didn't need to be present. However, it is useful that Amazon provides some clarity as to package delivery, and their low shipping prices don't hurt either, aided strongly by the fact that I can buy all the things I want from multiple suppliers at once and they can be shipped to me in one go. If only they could make it so that the search results were relevant to my search query and included one, but not zero or seventeen, of each unique result.

Microsoft: 2TB or not 2... OK, OK! 2TB. OneDrive dragged kicking and screaming into selling more storage

Easy option

Storage providers should really start looking at the $price per gigabyte or multiple thereof option. At that rate, customers who want lots of data can do that, and the company gets paid. They could do the tiny price for a small amount of storage (E.G. $0.012/GB) version or the larger unit version ($1.20/100 GB), and users would simply buy a bunch of data not having done the maths as to how much it costs. This method would seem to give lots of options for making money as well as keeping customers satisfied. I wonder why few major storage providers do it that way.

Re: "Google will take £7.99 a month off you for 2TB of space"

I think the major use case is for storage of video. If, for example, you either need to take video for your job and quickly send it or simply like the experience, cloud storage lets you take video from one location, quickly sync it off-site, store it in a system that has security and hardware managed by someone else*, pull it down in another place whether you're there or not, and maintain a certain amount of old footage for whatever reason the user might have. Since I don't do this, I don't use very much cloud storage. I do use some on a personal server (I think this counts because it works a lot like cloud), because there are sometimes things I want to have available from multiple places or devices, even if I haven't manually copied it to each one.

*Security and hardware managed by someone else, who might do it badly. Cloud is no guarantee of reliability or security or anything for that matter. Terms and conditions apply. Consider multiple factors before purchasing.

EE-k, a hundred grand! BT's mobile arm slapped for sending 2.5m+ unwanted texts

Re: So EE can't now tell its customers to upgrade to a cheaper plan if they've opted out?

It's a marketing message. Even if it would be a thing I'm interested in, it's marketing. If I stopped you on the street today and said I was selling laptops for any piece of scrap paper (always assuming I was being honest), I'd be marketing to you even though you would probably see how many pieces of paper you could find in your bag. This is the deal with advertising. Sometimes, it actually tells people about things they decide they want. Sometimes, it is an annoying intrusion. Those two sets aren't necessarily mutually distinct. This is why we have things like opt out/in methods for customers to tell places whether they want to see the ads; I have opted in to some communications and opted out to others because I've decided what I want to see.

Please stop regulating the dumb tubes, says Internet Society boss

And there doesn't technically have to be. Firefox supports it, but you can use any DoH server you please by changing the config. I've suggested running a system-wide DoH client that performs requests for applications that communicate with it locally. However, I wouldn't expect Chrome to make this easy to change.

Remember that crypto-exchange boss who mysteriously died after his customers' coins disappeared? Of course he totally stole them

That's unlikely. If he was killed by someone else, they would have had to go to a lot of trouble to get the death ruled natural. His business partners and family members, those who are having property taken to make up the debt, would announce immediately if there were any suspicious parts of the death so they could delay or even prevent their property being seized under the theory that whoever was responsible for his death could also have stolen the money. Since they're not doing that, this leaves only two logical options: 1) he actually did die and you figure out the details that make that work or 2) he stole the money and faked the death, and the company either knows about it or have given up on being able to catch him.

While the first option is possible in that he could have lost the money through some other means and then died coincidentally, possibly aided by stress after losing all the money, the second option is a lot more logical, especially with the small number of large withdrawals as described.

Responsibilities

Clearly, he is almost certainly guilty of massive theft and would have to repay as much as he could if we could find him. I'm wondering, however, what responsibility the rest of this company and its employees should or do have. If, for example, no accounting records were kept since 2016, it implies that the employees of the company were not doing their duties to prevent fraud or keep the company functioning. I'm not exactly sure what exactly they were doing before and after all the money disappeared, but it would seem that they have a lot to answer for, potentially with significant fines as well.

Go fourth and multi-Pi: Raspberry Pi 4 lands today with quad 1.5GHz Arm Cortex-A72 CPU cores, up to 4GB RAM...

Re: Yay!

I can't really agree with a zero and a 4 being the only models. The zero is great for its use cases as a controller for hardware, battery-powered machine, or headless WiFi device, but it's pretty much useless for everything else. It can't so easily be used for education because the price in getting its weird HDMI (that mini one that is between standard and the small one people decided to use) to connect to a school monitor and the USB OTG cable and hub to get input devices makes it more practical to just use the standard pi for that. The compute module helps people build stuff with the pi, which encourages open source development and helps support the foundation as well.

Re: Worst product launch ever!

Probably not. I'm sure the price for the memory upgrade is somewhat less than $10, but it's not like the pi people are going to be raking it in with the small margin on that. Meanwhile, Apple charge premiums of $100-$250 depending on how much additional memory is installed. Their memory may be faster and thus more expensive, but they are making more profit on them, their devices already have a rather large profit margin, and it tends to rub people the wrong way more often. I don't think that's a major problem, but it's useful to concede that there is a difference.

Re: Pi-top

Given their previous pricing, it will probably be a lot more expensive than it should be. My problem with the PiTop idea is that they're making a laptop without some of the hardware standard on other laptops and yet still at a higher price. Having the pi as the brain is great and all, but I give the pi a lot more credit for that than the enclosure.

Re: Gone is the full-sized HDMI type A connector,

This is nice, and I'm tempted as usual to buy one of these. Of course, the pi continues to walk further in the direction of power problems. I understand why they do it, but it makes it harder. At this point, a strong mains powered device will be almost necessary. Gone are the days when you could power a modern pi from a USB phone charger. The zero can do that, but I don't think anything else produced in the last two years can. Similarly, people now need to be recommended to purchase a dedicated power supply with their pi rather than using the old mains to USB adapter and USB cable everyone has in the closet.

Re: Upton reckons that the 2GB version will be the most popular

For me, I'd only consider the 4 GB or 2 GB models. I have enough of these with only a gigabyte of memory. I have never said to myself "I really need more processing but my memory usage is small". Every time I've been tasking the processor, most of the memory is full, too. For that reason, the 1 GB option holds little appeal. 2 GB and 4 GB would both significantly advance. Of course, I have to put all the pis I've collected over the years to use before I start buying more. Or maybe I'll just succumb to the desire again; who knows?

Must watch: GE's smart light bulb reset process is a masterpiece... of modern techno-insanity

Re: Good reason

I can see only two times when a factory reset of a light bulb would be desirable. The first is when ownership over the bulb is about to be transferred. Given that we're talking about cheap light bulbs and not phones or computers, that seems relatively unlikely, although the app reset mechanism would work just fine in this scenario. The second and in my mind more likely situation is that the bulb is not working properly and does not respond to app commands to reset, resync, or reconfigure. In this case, the app can send out its code all it likes and the bulb might easily ignore the reset code because it's broken. The software needed to receive the code is more complex because it has to run the bluetooth receiver and properly decode the result. A simple program in the bootloader that responds to power on/off can run at a lower level, just as a physical reset button could. These options circumvent the problem of a software stack that might break too often. They also introduce the difficulty of flipping switches or removing bulbs from sockets. It's a game of tradeoffs.

Re: Good reason

I think that won't work as well because they need to reset things when they can't connect to an application. Given that, if the bulb can't connect to its app, it's probably well into not functioning territory, it probably won't be correctly using its microphone or light detector. By cycling power to it, the code can be a lot more low-level. Of course, you could have the app play a tone that the bulb listens for when it's turned on, and that could be similarly low-level and would also work.

Re: Good reason

That depends whether these bulbs have some facility for extra power. If they can be removed and stay operational, a reset button would then be safe to include. If not, then you have very few good options. Even if the bulb is in a lamp that doesn't require standing on furniture to reach, it will be rather warm most of the time. It could be configured to reset when removed from the socket, but that wouldn't let people move their configurations from one place to another one. Unfortunately, I have to suggest that turning off and on is probably the best method of resetting the bulb in this scenario. Of course, doing it with less requirement for precise timing and for not that long would really help.

Brave urges UK's data watchdog to join Ireland in probing claim Google adtech breaches GDPR

Re: AI database

Alternate suggestion: don't store them at all. Not in Google's database, not in a normal personal database, not in your whatever-it-may-be database, nowhere.

It's all in the wrist: Your fitness tracker could be as much about data warfare as your welfare

Re: @Splurg The Barbarian - No, no, no, no, no!

But this requires a large amount of user buy-in. If a hundred users start spamming voice assistant things on average once a day, it will be nothing at all compared with the millions of users actually saying real things. Even if we scale it up to a thousand people and twenty times a day, it's still a drop in the bucket. That's one thing neural networks are useful for. We'd need a lot more junk data. If we try to automate it by recording specific things, they won't have to bother with the algorithm; they simply find the weirdest spikes in the data and delete that from the dataset, if they don't find the recording of "Alexa" or "OK Google" being used and program the units to stop recognizing it.

Re: "data warfare"

That's true, but having the data the device collects is not the problem. If you want to know how many steps you do, your heart rate, etc., this is a relatively cheap way to get that. The problem is that they all demand connecting to an app and then sync that data to the app and possibly their servers for who knows what purpose. Instead, they could have everything done on the device itself, or at least from an app that requires no network connection at all.

Re: "data warfare"

Usually, the file system is not at all available and there's very little data about what exactly it does and how. I suggest people on Android who like the data of a fitness tracker check out the Gadgetbridge app from FDroid. It doesn't work with everything, but it can circumvent the need for manufacturer-provided apps for some such devices.

Cyber-IOU notes. Voucher hell on wheels. However you want to define Facebook's Libra, the most ridiculous part is its privacy promise

Re: So what is the blockchain for?

I believe this transcript I stole from Facebook will make the point of blockchain clear:

PR Exec [name redacted]: "We have heard some concerns about the privacy and integrity of our new currency. We'd first like to tell you how we're ensuring that money can't disappear from users' accounts. You may have heard of the revolutionary technology blockchain. This technology is used to ensure the integrity of data, like how much money each user has, even when those users don't necessarily trust one another. You don't have to trust us; the blockchain will keep people from doing anything at all to your data without your specific approval."

Extremely high-level executive [name redacted]: "How will you handle it if they notice you've not answered the privacy question?"

PR Exec: "Standard boiler plate, failing that I just threaten them with their blackmail file."

EHL Exec: "Oh, by the way, how much of the blockchain do we control?"

Tech Exec [name redacted]: "100%, sir."

EHL Exec: "So we could in fact delete all the money in about how long?"

Tech Exec: "It's a big button on the main page. Takes about two seconds to propagate. After all, we have a lot of money to spend on reliable systems for things that matter."

EHL Exec: "What if it goes down?"

Tech Exec: "That doesn't go down. It's not low-importance like all the rest of the services."

EHL Exec: "Well done. You can leave now."

[Sound of door opening and closing]

[Silence lasts eight seconds]

EHL Exec: [maniacal laughter, see recording] [Transcriber's note: If listening to recording, mental health services are recommended, contact transcriber for further details]

Samsung reminds rabble to scan smart TVs for viruses – then tries to make them forget

My family bought a smart TV, and quickly realized that they did not want any of its smart capabilities. It has been told to forget the network, the WiFi credentials were changed, and I added a firewall rule to block any packets coming from the TV's MAC address in case it has the smarts to read my mind and guess the new password. It has been relegated to a simple panel with an unused processor somewhere in it.

Re: OK, I'll bite

The tweet contained a short video (00:19) that presumably showed the method. That didn't play when pressing the buttons on the wayback machine. One could probably look at the page source and find the URL of the video, which might still exist, but I don't own such a TV and I'm far too lazy to bother with that.

Incidentally, the tweets from Samsung in reply to this one are somewhat pathetic. People replied with sarcastic jokes that seeing advertising on television was a symptom of malware, and Samsung's response was "We are sorry to hear that you are having this problem. Please send us a DM with the model number of your phone." Maybe this is why they took the tweet down.

Freaking out about fiendish IoT exploits? Maybe disable telnet, FTP and change that default password first?

And patching needs to happen too

It's well and good to say that telnet and FTP should be closed and to have random default passwords or make the user set the password themselves, but these devices also need regular patching. For example, I needed console access on a friend's router to fix some things, so I logged in using the nondefault credentials my friend had available and enabled the SSH console for the LAN. Then, I attempted to connect. Small problem though, which was that my computer's SSH client failed to negotiate a connection because the only SSH protocols the router supported were considered obsolete (I'm trying to remember the specific ones, but they're slipping my mind at the moment). Maybe this is on my computer for dropping support so quickly, as little harm comes from continuing to support other protocols, but I have a feeling that, if the SSH encryption standards are so old that a client (default OSX client and then openSSH client from Ubuntu) refuse to connect, the router has other security problems too.

FYI: Your Venmo transfers with those edgy emojis aren't private by default. And someone's put 7m of them into a public DB

Re: Can someone tell me why Venmo is a thing?

As for why it's a thing, the various problems with cash have been noted. One could write checks, and that would work most of the time, except that people in general seem to dislike them and prefer paying by card. Venmo provides a method for people to use payment cards to pay individuals. Whether that's important depends on the local alternatives, but the success of Venmo even though it charges a small fee per transaction shows that it provides a service useful for some.

As for why it's public, I have no earthly idea. I didn't think that was the case. It seemed really stupid to me, with no perceivable benefit and requiring the Venmo people to spend a little time on a public interface for viewing them. No idea whatsoever who made that decision and what exactly is wrong with them.

23. 712. 3. 608. 45. 89. 11. 332. 841. 255. You want more? Cloudflare and pals are streaming 'em live from new RNG API

Re: What's it Good For?

Nobody's arguing that it should be shut down. That'd be crazy. However, this site falls into a valley where on-device random number generation is insufficient and where this site would introduce security problems. There are probably a few places that need that degree of entropy, but many of them may have gotten a temperature, static (cosmic radiation), or even human-fed (times of typing or something like that) source. By all means use it if it's needed, but I doubt that people will be rushing out to do so en mass.

Greatest threat facing IT? Not the latest tech giant cockwomblery – it's just tired engineers

Re: Some weird comments on here...

I don't think it's a good thing. I wouldn't be eager to do it. Yet I'm a little proud that I have done it and succeeded. When I was first required to work that long, it felt very difficult. Knowing that I didn't fail under that stress is at least a bit positive, even if I don't want to repeat the experience. Thinking this also lets me take an unpleasant part of my history and use it to my benefit.

'AI is not the cause, it’s an accelerant. The pace of change is challenging' Experts give Congress deepfakes straight dope

Re: Missing the point

"Surely it's up to the consumer/viewer to say "I've seen a video showing X said Y" and not "X said Y". Isn't "don't believe what you see on the internet" a thing still too?"

But that's not good enough. It's well and good if I know something's false, but if someone else believes it, I can still get hurt. Suppose someone is angry at me and makes a fake video of me plotting a crime. I clearly know it isn't true. However, I need my boss to know that as well so I keep a job. I need my neighbor to know that as well so they don't call the police on me. I'd prefer that my friends and family know that so I don't lose their company. When a lie believed by someone else can cause problems for others, it's not enough to say that people should just come to their own conclusions. If something can be done to support the objective truth (I'm not sure there is such a thing, but if), it should be considered quite strongly.

Re: Fakes versus bias

Of course there needs to be critical thinking. Nobody denies that. However, even the most critical of thinker eventually must find some information to trust. They can get that from a number of places, but the fact that video was hard to fake convincingly meant that it could be used as a better primary source for some time. Of course videos could be edited to remove important sections, but it wasn't easy to insert completely false information into them. Many people have grown to consider video a good source of information; if there's video of it, it happened. The problem isn't those who never thought critically about the news, as they have believed whatever they were told, true or false, for a while. The problem is the people who try to find sources and verify things only to find a video that cannot be confirmed.

Re: Well, well, well ........ Who'd have a'thunk it?

I know I shouldn't do this, but I can't help it. The pedantry commands me:

"Question: Listen, you are a hooligan and ruffian! You insult me for nothing! I challenge you to a duel!"

That's not a question. Three sentences, all of which are purely declaratives. Whoever or whatever chopped that book up looking for questions didn't manage that one properly. A little hint for the next patent: most questions in English have at least one of two indicators. The first is that they end with a question mark (?), and the second is that they may contain a word in the set [who, when, what, why, which, how]. Try that one and get back to me.

Re: This AI technology kills Google, FB and Internet at once.

Let's assume all this stuff I skimmed to be correct. Why does it matter to this topic? You're talking at length about text-based AI and making lots of claims about it. The article is about videos made with programs and the policy and societal facets of that technology. Yes, the term AI could apply to both the text-based things you like to discuss and also the neural networks used to work with the videos here, but other than that, your comments don't respond in any way to the article or to any other discussions.

The question I'm asking is how your comments have any relation to this topic. I've read your posts before, so the following answers won't be sufficient:

1. Saying something about how you don't like neural networks because I mentioned them. We're not debating technological differences here; neural networks are what is being used in this specific case.

2. Explaining how synonymous clusters work. That's part of the stuff I'm assuming to be correct because it doesn't matter, and it is not at all related to the technology used to create the videos or the current policies of any part of the government toward them.

3. Telling me that the USPTO is like a blockchain. We don't care.

4. Saying that you don't like SQL or the internet. Not that I have a clue what your problems are with those things, but I don't see that your gripes with these technologies impact on this topic in any way.

5. Saying the $big_institution doesn't like your ideas. Once again, unless it has to do with a faked video or a political, societal, or technological action that could be taken in connection to a faked video, I don't care.

When customers see red, sometimes the obvious solution will only fan the flames

Re: EVERY SINGLE SEARCH RESULT was for a frigging VIDEO.

I doubt it. Reading will still be useful for things like signage or searching through things (skimming isn't so useful when being read to). It also allows reading more privately, as one has to have headphones to listen privately but just has to block their screen to read privately. In addition, it requires those with sight, the vast majority of people, to entirely change their workflow to stop using their primary sense. I wouldn't count on that happening.

Those darn users don't know what they're doing (not like us, of course)

Re: Scoff not

I would argue that two points are simultaneously correct:

point 1: IT people tend to be more dismissive of users than they should,

point 2: IT people have very good reasons to be dismissive of some users.

I've seen both sides, as I'm sure have most others reading these comments. I've seen the IT people who think they know a lot more than they do and think everyone else is an idiot. I've also seen the users who don't know anything and refuse to do anything these IT idiots have suggested. It can often be tempting to ignore one point by focusing excessively on another, but that doesn't help. If you lean to hard on the stupid users, you don't treat the large set of users who have problems, don't know how to solve them, and need and rely the help of IT to keep things going with the respect they deserve. If you lean to hard on IT having an arrogance problem, you end up trying to be nice as opposed to efficient. While the people who actually fall into the "stupid user" group might feel happier at the end, the people who really need IT's help probably aren't getting it. Once again, they lose.

Something should be done about users who waste the time of the IT people. IT people need to respect users more. I think this applies to pretty much every profession.

Hongmeng, there's no need to feel down: It's patently obvious this is Huawei's homegrown OS

Re: "hybrid Android"

Me: "That [installing Google Play Services and other Google apps on non-Google Android] is difficult enough that most users won't know how"

Response: "It is exactly as difficult as installing any other Android application."

I beg to differ. For example, if one wants the Google components on Lineage OS, one has to download the open-gapps suite containing the wanted components and flash that via ADB. On most devices, the Lineage OS wiki specifically includes a warning that this must be done prior to the initial boot or some of the components won't work. That's easy enough to do for people who read this site, but your standard user doesn't want to connect their phone to their computer, tap through scary warning screens on a bootloader and type terminal commands. Yes, some Google apps can be downloaded in apk form and side-loaded, but the number that work without Google Play Services available is relatively small.

Re: Given what "choice" I have as a UK end consumer ...

I did not know that. In that case, I'd be a lot more concerned about purchasing a Huawei device. If the goal is a not-Google build, I'd go with a device that does support Lineage from a different manufacturer.

Re: "hybrid Android"

There is such a ban on manufacturers. It's in the license agreement they need to sign before they can ship devices with the various Google Play components. In brief, it says "You can't sell devices running a version of Android without these components if you want to ship the components on other devices", or even more briefly, "Google Android [x]or AOSP Android. Choose and pay up.". Therefore, manufacturers have to choose whether they're going to try one of the third party versions of Android, but if they do, they cannot offer a Googlefied Android on any of their devices, and all users of their devices will have to install the Google components manually if they want them. That is difficult enough that most users won't know how, and the tools are needed for so many apps that a lot of users won't be happy with a non-Google Android. Therefore, Google effectively hampers manufacturer support for non-Google builds of Android.

Re: "hybrid Android"

Google said that. They said it would introduce a bunch of security risks. To be honest, it might, but it does show that Google isn't really all that happy with people making alternate builds of Android, not that we needed more proof of that. I'd say the ban on someone using Google's services while using any non-Google build would be proof enough.

Re: Here at last!

The point was that Linux has been running on mobile devices, as the kernel for Android, since 2009 or so. It hasn't really provided us, the users, with any of the benefits of Linux. There is no indication that that will change with Huawei's attempts, and a lot of the speculation seems to indicate that a lot of AOSP Android is still there. If those statements prove true, this will definitely not bring on any resurgence in the power of Linux or the openness of smartphone operating systems.

Re: Given what "choice" I have as a UK end consumer ...

Many Huawei devices support Lineage OS. This OS is very good at security updates and will actually protect information. I would recommend using this whenever possible over some completely untested and potentially problematic AOSP release. Perhaps after it's been tested for a few years, but the phrases "version of Android/Linux developed over seven years and not run on any consumer devices" and "running on all of Huawei's consumer devices soon because they have no other choice" don't sound good to me.

Re: Interesting...

Probably they mean things like Play Protect and updates to Google-supplied apps. Presumably those services will be cut. Huawei could still get AOSP security updates, which include most of the fixes that anyone really cares about. Only time will tell if they release them on any consistent schedule, but even if they don't, their devices will probably be about as secure as the typical Android device in the wild anyway given the lax approach other manufacturers typically employ.

Nope, we're stuffed, shrieks Apple channel as iPhone shipments enter a double-digit spiral

Re: SE no longer supported end of 2019

After Apple drops support for a phone for large OS updates, it won't receive major updates to Apple-written apps like Safari. However, it will usually receive at least one more security update and can still run most updates to apps, as the store will continue to function. Usually, apps will support the most recent three OS releases (although in the days of IOS 12 it's typically been four). In addition, as already mentioned here, the iPhone SE will be supported under IOS 13.

Not very bright: Apple geniuses spend two weeks, $10,000 of repairs on a MacBook Pro fault caused by one dumb bug

Re: iD10tic design decision.

I prefer that option. It lets me temporarily disable the screen for various reasons. For example, if I want my laptop to keep computing on something while I sleep nearby (for instance if I'm in a hotel), I don't have to see the lighted screen. I could configure it not to sleep when it's closed, but I like having that capability. A simple key press that turns off the screen can be useful. Of course, if that's going to be part of your typical operating procedure, you should ensure you know how to turn it back up, which in this case would be reseting the NVRAM (hold command, option, P, and R at boot time).

Captec saps tech from Aleutia to put its tiny PCs back to work

There are a lot of options for small computers. Depending on how much power and I/O is required, you have everything from a raspberry pi up to a NUC or the like. These people still seem to be around, and their machines have various features like multiple network ports and lots of expandability that might be useful. There are a lot of small Intel Atom-based computers modeled off the Intel Compute Stick as well, as long as a tiny Atom SOC will serve your purposes (usually, it will not be enough or a raspberry pi will be better value). The past few years have given us a lot of very nice options when form factor is an important issue.

When it comes to DNS over HTTPS, it's privacy in excess, frets UK child exploitation watchdog

Re: re: anarchism in action

I would say not at all. Linux clearly isn't for reasons stated above. GNU is a little less eager to describe themselves as dictators, but someone decides which version of the GNU-related code goes up on the website as the official glibc or utils or HURD kernel. That person has power to decide what they'll call the official GNU code, and the people who wrote a different version that didn't get used don't have that power. They can publish their version, of course, but that doesn't make it GNU approved. Because it is hard to define power, it's hard for anything to be anarchic. Power can at times be the ability to control some place, institution, activity, etc. I don't see any mechanism for ensuring everyone has equal control of every thing, physical or theoretical, in the universe. I'm not convinced I would want to try, either.

There's a reason why my cat doesn't need two-factor authentication

Re: A pretty simple concept really:

"On site, yes. Inside the computer room, no. At the very least they would need to be stored in a data-rated fireproof safe, and putting that inside the computer room itself would be monumentally stupid from a DR view and a waste of space anyway."

Why? I've seen many places where the safe was stored near the computer room, usually next door. The major reason for doing that was security--I.E. the computers and the backups were inside the same security area, and could be dealt with by the same team. The theory was that the safe would protect the tapes no matter where it was stored, and that there could be an additional security problem if tapes were stored in multiple areas and had to be moved frequently between those places.

"Even if they did that, there's always a moment that that safe is full and tapes have to be taken out and stored elsewhere. Or all sets of tapes can be kept in that safe."

This leads me to the next point, which is that this safe could be on-site storage only, with another person responsible for moving them, which brings us to:

me: "or someone else is responsible for moving it to wherever it is going."

Response: "Which again is just stupid, because you want to minimize access to restricted areas. Swapping the tapes in one go does that."

Yes, it does. However, there may be multiple roles. We have technician guy, whose job it is to move tapes around and ensure the systems have media to write the new backup to. We also have information security guy, whose job it is to make sure the tapes are brought to off-site storage or a separate on-site location securely. New tapes are brought to the technician to load into the machines as required, and the security guy comes when needed to remove the tapes after stuff has been written to them, possibly several hours or even days after they've been written. Technician guy is not allowed to leave with a potentially heavy box of tapes, because they could use that vulnerability to leave with something heavy that is not a box of tapes. Security guy is allowed to do this, because they installed or are trusted by whoever installed the security system. Technician guy could remove a box of tapes to make the weight the same, but they are not supposed to do that and could face penalties if they did, hence the problem mentioned in the post.

Idle Computer Science skills are the Devil's playthings

Re: Hire immediately

I'm inclined to be sympathetic and go with the hire option. The type of person who tries something like this and ends up breaking the system as a result is usually the type of curious person who will figure out how everything works and use that knowledge for good. However, I don't think I can do that because of two major problems:

The first problem is that he knew what would happen. If he ran his initial directory bomb long enough that he couldn't recover, that would be just fine and I'd think he should be hired. But he already knew that running this wouldn't help anything and wouldn't be self-limiting. Running it in parallel didn't really produce anything different--it just increased the amount of work needed to clear it up. That doesn't sound like curiosity to me. It sounds like pointless disruption.

The second point has already been made, which is that I'm a lot more likely to consider someone nicely when they've confessed. I've dealt with plenty of people who have done a lot of damage, realized that, and contacted me to give me all the information they have that will help me fix it. I really respect those people; I know that, if we have a problem later when we're working together, they won't hide things from me and they're not going to have some problem letting me help out. By extension, anyone who doesn't confess and leaves me to discover, diagnose, and clear up their problem after they've just left it there is going to find themselves lower on my to-be-hired list than anyone who has confessed or hasn't caused me a problem.