Posts by doublelayer

Nokia 5310: Retro feature phone shamelessly panders to nostalgia, but is charming enough to be forgiven

Re: "pre-installed Facebook app"

In that case, perhaps you could enlighten me to the point I missed? Your comment seems to have left that out.

As I understood it, the comment from which I quoted was under the impression that there was no data available to be stolen by a possibly malicious app. Their comment seemed to indicate that, since the phone couldn't contain a lot of information Facebook would like, it must have no data of value. I listed various types of data that would be entirely obtainable from this device and that it would be undesirable to give to Facebook. Again, if I missed a point, and you understand the point, it would be nice for you to explain yourself. It would have been nicer for you to have done so when you felt the need to tell me; I find discussions work best when people say what they think.

Re: The problem is...

This phone runs on a chip intended for basic phones, with 8 MB RAM. These two facts combine to make it completely impossible to run any version of Android ever released on it. It very much doesn't. Now the Facebook app is concerning, but you can't break out the accusation of Android. If you want to determine whether you trust something, do your research to figure out what it actually runs before jumping to conclusions.

Re: "pre-installed Facebook app"

"What exactly would it be snooping?"

Data collection profile: User ID 18502396963:

Phone number: On file.

Contacts: Logged. Up to date as of 2020-07-19.

Call history: Logged. Up to date as of 2020-07-19.

Text messages: Available for processing.

Images: User has not taken any. Automatic backup is enabled if they do.

Voice recording: Enabled, batch upload pending.

Music preferences: ID3 information has been logged and added to user's advertising profile.

Location history: Available for 22 days, 9:14:43. Warning: location accuracy is low, from nearby tower information only.

An axe age, a sword age, Privacy Shield is riven, but what might that mean for European businesses?

Re: The point of the EU

"The USA wants privacy for its own citizens."

No, it does not. It doesn't want privacy for any other citizens either, but don't think its own citizens are getting consideration or extra things. As government policy goes, it would like for privacy to be deleted from the dictionary and everyone's brain so people stop complaining about all the violations.

Nokia's reboot of the 5310 is a blissfully dumb phone that will lug some mp3s about just fine

Re: Wireless FM radio

Update: Several months after this article, a review stated that a wire was needed for the radio. My assumption of earlier seems to have been incorrect.

Everything must go! Distributors clear shelves of ALL notebooks in Q2, even ones gathering dust over last 12 months

Re: Do you ever change your mind, based on data?t

I don't think that's necessarily true. While most devs don't have a need for the kind of processing that graphic designers do, their workload is often heavier than text entry. In my work, I enter text for a while, then I compile and test locally. This may not require much power (it doesn't do any GPU-accelerated work at all, for example), but if I had to wait five times as long for a really low-end processor to compile some of my bigger projects, I'd be rather irritated. It's true that, when I'm done with my code, I push it to a remote server which compiles again and runs a bunch of automatic tests, but that doesn't liberate me from having to test locally. Most of the time, the automatic unit tests are sanity checks on things that could have broken inadvertently, but if I'm adding new functionality, I not only have to unit test myself, but I also have to run more thorough tests to verify that, not only do the small bits work, but they are put together in such a way that the big goal happens too. I don't push that to a server primarily because I don't want to wait around for my test data to be uploaded (sometimes medium-sized files) a job to be queued, eventually run on a new build environment, a log to be produced, the log to be put in the files section, download the log, then open it to see whether it worked. Instead, I can run the program locally right now, specifying to print the log to the terminal, and see what happens in real time. If the program I'm testing is one that needs substantial processing, and some but not all are, then having a better CPU means I can do that more efficiently.

"How do they expect to set up a home lab, test software and generally be productive with just a consumer phone or tablet? They sound a bit like frauds to me."

Why would they be expected to do any of those things:

"set up a home lab": In normal circumstances, why would I? If I need a lab, there's probably one in the office I'm expected to use. If I have to work from home and keep using the lab's type of hardware, I will either do so from a remote terminal if possible or take the equipment that's already in that lab home with me. If the company doesn't want me to do either of those, they can pay for the lab equipment that I use for them. If I want to have my own home lab, maybe I'll have some of those devices. If I don't want one, my company shouldn't care.

"test software": Why? If I'm testing software for work use, I use work machines. That's the machine in my office, my work laptop, the machine in my office via the work laptop, or one of the servers I have access to. So all I need is the work laptop.

"generally be productive with just a consumer phone or tablet": I don't expect to do that. I expect to be generally productive with work-provided kit. If I need more kit because my job requires it, then work has to provide that. If I happen to have replacements at home, I may volunteer to use them instead of having my work buy and send me them, but otherwise, it's their problem not mine. I'm currently expected to be productive, and I use my own peripherals because I like them, but the computer they're connected to is work-issued. That's all they should expect me to use.

Aggrieved ad tech types decry Google dominance in W3C standards – who writes the rules and for whom?

Re: @doublelayer - Brave

Of course, it can be removed. The point is less that and more that a proprietary blob which is controlled capriciously by a commercial entity got itself adopted as a standard in a supposedly open and independent standards body. Because that happened, users are having that DRM pushed into their browsers, mostly not knowing this. That may have been somewhat harmless because relatively few places use it (I don't have it installed either), but it is not a good sign for things to come if we let companies interested in forcing their will on the standard control the creator of the standard. Whether those are really big or medium-sized ad companies doesn't matter; it should be for internet users and developers, and it should be open.

Re: Brave

"The DRM spec hasn't been a problem for me, using Firefox."

That might be for one of two reasons. Reason 1: you don't use DRM. Reason 2: Firefox includes it. It has since version 47 and it looks transparent to you. It's used on various streaming platforms, but compatible browsers see it and it works without showing the user. So perhaps you do use it and you don't know.

The problem is that other browsers can't just drop it in, both because it's proprietary and because Google owns it and gets to control quite a bit about how it's licensed. If Google says no, then the application can't use their browser to play any DRMed content, and this means most in the public come to see that as a failed browser. This would be a lot like flash except it actually got itself adopted and people don't see it as blatantly; they don't know what to blame when it breaks things.

Imagine surviving WW3, rebuilding computers, opening up GitHub's underground vault just to relive JavaScript

Re: It doesn't need to be runnable

If I was going to put 21 TB of data somewhere for the benefit of historians, it wouldn't be code, or at least relatively little of it would be. Code may tell some how a few of us thought, but it doesn't show much about how we lived except for the readme files. Similarly, if there are translation files in there it might help as a sort of rosetta stone, but that's getting to the goal by quite an inefficient path. A lot of code will look like all the rest of code, moving data chunks around. It won't help historians very much to have driver code for fifty open source hardware platforms that no longer exist. Here's what I would include instead:

Translations of various texts into most languages, trying to ensure that most subjects are covered (technical, legal, scientific, narrative story, and the most important basic description of something likely to continue to exist later on such as the water cycle). This helps with the inevitable language problem.

Dictionaries of all the languages we've included, which helps with extra words when they've figured out the basics.

Books on geography and astronomy, which help clarify what the planet was like when we were around.

Textbooks for most subjects at various educational levels which provide a summary of what we knew or at least what we thought we knew.

Descriptions written of everyday life by people who have been instructed to provide every detail, and most likely to ensure this, describing the life of people who live quite differently to the describer.

And, since I've probably missed several important things, let's just throw in the entire contents of Wikipedia in there.

There's my suggestion, and that probably fits just fine in a single terabyte; at least text-only Wikipedia certainly does and that's probably the largest chunk in the set. It's not perfect by any means, but if I had to figure out what life was like a thousand years ago, I'd rather have had their encyclopedias than a library written in an invented language that reads from devices implementing an arbitrary communications protocol to read chips with another arbitrary protocol.

Re: No binaries over 100KB

It's basically Gentoo everything. First, you retrieve the source for an operating system, Linux for example. This needs various libraries, so you find those too. These need to be compiled, so you retrieve a C compiler. Then you realize that you don't have anything to run on and the compiler's also written in C. Then, you write your own language and compiler for whatever computer you have found, or you use whatever programming language is on the surviving machine available. So basically it would only be useful in a very weird catastrophe. Maybe we should have someone write a book called "How to build a computer out of rocks that knows how to execute some instruction set we designed for computers built with lasers" and put that in the archive too.

FYI Russia is totally hacking the West's labs in search of COVID-19 vaccine files, say UK, US, Canada cyber-spies

Re: Is it Time?

If you'd like an opinion, here's mine: No.

Cutting countries off the internet is bad because it's hard, it gives them extra power, and it harms us. I'll take each point in turn, but these are short summaries. Also, I've used China as an example below for two reasons. First, it's annoying to write and to read "Russia, China, Iran, and countries like them" all the time. Second, the problems I detail get infinitely worse the larger the country and the more activity links them and us, and on that basis China is the most dangerous.

It's hard: In order to disconnect China from the internet, we have to disconnect their lines and/or drop all traffic coming out of them. If we try to cut the lines, we will need to reconnect other places which currently use China's lines for transoceanic communication. Mongolia is going to be the worst hit since they're entirely enclosed by China and Russia, but you have some other countries in southeast and central Asia whose lines are going to need to go through India, meaning getting Pakistan on board and going through war-torn areas. Then, you have to imagine that China will try to work against this, for example by using existing lines that go into Vietnam and masquerading as Vietnamese traffic. Do you really expect Vietnam's government to take drastic action to stop this with one of their closest allies and one with a massive army quite invested in it continuing to work? Of course, any espionage would be much more hidden than that, perhaps starting by going through Myanmar but quickly bouncing to servers in the west operated by agents in some other country.

It helps the countries we are trying to hurt: China spends a lot of money protecting itself from terribly dangerous network traffic containing things favorable to democracy. By cutting off that traffic, they don't have to bother anymore. The important government services will still run on local systems through local comms, so the citizens shouldn't be that affected. And when they are anyway, there is a perfect target: the west. "The west has cut off your internet. They do not like us Chinese. They are the enemy. We didn't do it; they did. Why would you support them?"

It hurts us: Currently, we rely on China for various things. It might be better if we didn't, but we do. We buy from and sell to China, collaborate with Chinese research institutions, all that. If we cut off the communication between us, we have to stop most of that and don't expect what is left to continue for long after the governments start looking for revenge. This means that we cannot get things from there, make money there, or do anything to help the people living there get some rights.

It hurts us even longer: That was what happens in the first month or two, but let me prognosticate a bit further. If we decided to cancel our business relationships in China, which we really might like to do, people interested in human rights might be pleased. People who used to make a lot of money in China, however, won't be so happy. It will be in their interests to bring back their profit stream, and they will try. The easy way to do that is to lobby for new politicians who will restore the ability to trade in China, in return for which the Chinese government will demand various assurances from said country. If Singapore, for example, reopens its internet to China and starts buying things from them, do we give up on this exercise, cut off Singapore too, or wait for the same to happen to us? None look viable to me.

Companies toiling away the most on LibreOffice code complain ecosystem is 'beyond utterly broken'

Re: "Slapping a "Personal Edition" label on a product implies..."

You may have read, but you're doing quite a nice job misconstruing all the points. Let's look at your comments and what they came from:

LDS: "I read the comment. The comment implied LO has no freedom and just they want software from LO they have not to pay for."

gobaskof: "Slapping a 'Personal Edition' label on a product implies [note implies here] you can only use it for personal use, which would be against the license. It is technically legal. But it is wrong [opinion]"

So the original comment demonstrates that they understand that any organization can do as they please with the code, including providing or refusing to provide binaries. That comment disagrees with it.

"RedHat doesn't make the Fedora and CentOS builds - those are "community" projects."

From the Wikipedia article for The Fedora Project:

"The project was founded in 2003 as a result of a merger between the Red Hat Linux (RHL) and Fedora Linux projects. It is sponsored by Red Hat primarily, but its employees make up only 35% of project contributors, and most of the over 2,000 contributors are unaffiliated members of the community.[6] [...] The Fedora Project is not a separate legal entity or organization; Red Hat retains liability for its actions.[15] The Fedora Council is currently the top-level community leadership and governance body. The Council is composed of a mix of representatives from different areas of the project, named roles appointed by Red Hat, and a variable number of seats connected to medium-term project goals.[16] The previous governance structure (Fedora Board) comprised five Red Hat appointed members and five community-elected members."

There's some external community, but Red Hat controls a lot of the code and the organization that owns it. You can argue definitions if you want, but I consider this as having a significant connection to Red Hat.

Original: "But it is wrong and misleading and should not be allowed"

Reply: "Really? This is the mindset of people who think Open Source is 'hey you, work to give me the software I need for free!'"

I don't think that's really true, as the code would exist anyway. It's not that hard to compile most open source projects, so if you don't want to give back, the policy is simple. The original comment was expressing the opinion that labels like "personal edition" imply something that might put off users. Not that they actually do, but that users may believe they do. The opinion was that this belief might dissuade people from adopting it and therefore lose the developers the income from support contracts, extra features, and similar.

LDS: "Again, nobody forbids anyone to take the LO code and make all the builds they like and distribute them. But you can't think to force a company to make the builds you need for free. Otherwise, where's the freedom?"

And once again, the original comment clearly states that there is no requirement forcing anyone to make specific builds, but that if the proposed specific builds were made, they believe that decision to be a bad one. I think part of the reason that leads to this opinion is that it wouldn't be the core LibreOffice team making those decisions, but instead a commercial company, Colabora. It could be considered misleading if someone other than the LibreOffice control organization made software calling itself LibreOffice but with restrictions. It would be legal to do (and again the original comment says as much), but it could sound bad to some people, including the one you replied to.

Re: It's quite clear where the money is:

That's certainly part of it, and I mentioned the discount on Office365 in my mock discussion, but I mostly left that out because exactly the same logic would apply to many a small business. When something is free, they're a lot more forgiving of things like time requirements than if it costs a little less. Even if a completely rational economic analysis says that doesn't make sense, they will do it. Also, in various situations, it does make sense.

Re: "Slapping a "Personal Edition" label on a product implies..."

Read the comment you replied to. The comment acknowledges that it's perfectly legal. The comment acknowledges that any terms or suggestion wouldn't be legally binding. The comment argues that, despite those things, people will see them as in some way binding. The comment alleges that people will decide not to run the software because of this. The comment suggests that these are bad things and so the behavior likely to lead to them happening should be avoided. You can disagree with those allegations, but it's hard when you only argue against the thing the comment didn't say.

Re: Payment workaround?

That message seems carefully worded to be accurate and sound like they use the money for development without ever saying that:

"LibreOffice is made possible by the efforts of thousands of volunteers around the globe, and by the generosity of donors [but those two things aren't related]. Please support our efforts [whatever those may be]: your donation helps us to deliver a better product [somehow, but we won't tell you exactly]!"

I concur with your post; this would be a great avenue for further journalism. I generally thought of TDF as trustworthy, so I don't think they're pulling an ICANN and using the money they pull in for the enjoyment of the board, but if they're just putting it in a bank account, it's not helping the project very much. What do these people do?

Re: It's quite clear where the money is:

I see your argument as well as the similar one from the article:

"Free software has an unfortunate connotation of gratis, free of price," Meeks said. "The FSF (Free Software Foundation) has tried for many years to explain that it is all about freedom. LibreOffice has the word Libre in it. But there's quite a strong sense of gratis in its statutes, which is unfortunate."

However, I must disagree. If you go to anyone who doesn't know the term already, they hear "free software" as meaning £0. This if often a good thing because it can be the initial selling point. Even if they pay money for a support contract, knowing that they could entirely stop payment and still have their product is useful. I sometimes volunteer some computer support time to a charity, and I'll use them as an example. Here's a short but effective method of convincing them to switch:

Me: I notice you're using Office365 at the moment. There's another product that you might try which is free.

Charity director: Well, Office365 isn't that expensive. We get a discount on it and everything.

Me: But this product doesn't cost anything. Not everything is as easy, and we might have to replace a few things with other software, but there's a lot out there that we can use. Not only is it cheaper but it is better in various ways. It can never expire on you.

Director: And it doesn't cost anything?

Me: No. You can buy support if you need help with it, but the software is free.

Director: Can you roll it out to all the machines and we can run a test. If the users like it, we can go from there.

Consider what would happen if getting functional LibreOffice required payment, manually building, or getting from a dodgy-looking site.

Me: I notice you're using Office365 at the moment. There's another product that you might try which is free software, with free referring to your rights to do with the code as you wish.

Charity director: Interesting. So what rights do we have with that that we don't get with Microsoft.

Me: You can modify it in any way you like, share the code, contribute to the community, all that.

Director: You realize we don't have programmers, right?

Me: Yes, but it's still better because it doesn't restrict you like Microsoft's product does.

Director: What restrictions does Microsoft have that this doesn't?

Me: You have to pay a subscription per user every year and you don't have as much choice about how you store your data.

Director: So this is free?

Me: No, but it's cheaper.

Director: Office365 provides us with mail accounts. Does your suggestion?

Me: Well no, but we can use another free software product to do that too.

Director: And we get cloud storage which I've used as a basic backup system. We get that too, right?

Me: No, but

Director: So we have to pay for at least three different pieces of software. Will the prices for all these things still be lower than Office365?

Me: Probably. I know the mailserver software is free and depending on where we do the storage, that could be cheapish.

Director: And how about the hardware the mailserver and storage run on?

Me: You'd have to have that too. You have a server in the closet so we could use that.

Director: You're going to volunteer all the time it takes to switch our mail system over and guarantee us that no email will get lost, because we can't handle outages?

Me: I'd like to, but

Director: Is this really that worse than paying Microsoft, given that it sounds like we're getting a lower bill in return for having no features?

The theoretical director there doesn't understand all the specifics, but they have a point. Having two options, and for each having to pay, means the two enter a type of competition that isn't as present if one of them is free. For us, we know about the freedoms and care, we are confident in our ability to troubleshoot if things go wrong, and we often don't care about spending a bit longer getting some software exactly the way we like it. A lot of businesses don't go that way, and think only about finances and wasted time. If you can't argue a business into using the software, then you lose any money they might have paid for a support contract, and they're not going to suddenly bet on an unknown for a slightly reduced bill.

Google promises another low-end Android effort as it buys into Indian mega-carrier Jio Platforms

Re: One reason only

KaiOS is using most of the code of Firefox OS (global effort) and is continued by an American company. While I think the most effective sales effort for those devices has been in India, it's not an Indian home-grown OS. Incidentally, Google has been one of the most prominent developers of apps for that platform and has invested in the developer. I assume they're preparing for the possibility that they don't keep their chokehold on the low-end smartphone market.

It's Go edition, not Android One

"Nor is there news of how the new device will impact Android One, the slightly-simplified version of Android that Google launched in 2014 to bring low-cost smartphones to India. Android One is currently alive and well and Google promotes a decent range of handsets running the OS."

That's incorrect. You're thinking of Android Go Edition. Go Edition is designed to run in a gigabyte or less of memory with the extra surprise feature of not having compatibility with some things that you will find out at some random time after you make the purchase. Android One, on the other hand, is a guarantee to supply updates for such a long time that most likely all phones will be broken by the time it expires. Well, to supply updates for sort of a long time. Well about half the expected update lifespan of an Apple device and a third of the lifetime for a Lineage OS device.

Yes, I know about the tips and corrections address. I might send a summary there at some point, but I'm not on a machine with a mail client configured at the moment and I'm kind of lazy.

As internet governance meetings go virtual, compromise becomes harder to reach

Re: "The lack of corridor diplomacy affects participants’ ability to network"

The problem with that feature is that the main meeting is still going on. Separate small conversations work when people are between meetings. For example, if my team has a meeting, I pay attention to it, and after it ends, I find the person I wanted to talk to separately and we have a chat while we walk back from the meeting room. I'm not ignoring the others.

Existing videoconference software is perfectly capable of doing that, but it doesn't happen very often for a number of reasons. For example, I used to have conversations with the dev nearest me in the office. Some of these were pointless to productivity but I enjoyed them (I hope and think he did too). Some were useful to our project. Neither type happens very often, even though we have the ability to chat or call one another. I tend not to send messages because I'm not sure whether he's busy, something I can determine by looking at him in the office. I think it's similar here, with the added complexity that previous corridor conversations at a conference like this probably occurred between people who don't know one another very well.

Bad news: Your Cisco switch is a fake and an update borked it. Good news: It wasn't designed to spy on you

Re: Computer misuse act

The article told us what happened. The counterfeiters wrote a bootloader so it would bypass some protection code. Cisco's update had a new bootloader. Cisco's update knew how to install the bootloader and that it would work on their gear. The counterfeit device didn't think it through and installed the new bootloader, wiping out their custom one. Their custom one being required, that didn't end well.

On a legal basis, it's not Cisco's responsibility. If they knew of counterfeit goods, it would have been easier for them to just call law enforcement. But they are not under any responsibility to ensure their updates work on equipment they didn't license the software to run on. Sadly, they often aren't required to make sure their software works correctly on the devices they do build either, though you can sue them for lost productivity if that happens.

Chinese mobile giant OPPO claims new 125W fast-charging spec will fully fuel your phone in 20 minutes

I haven't found charging quickly to be that important. My battery is showing its age and sometimes needs an odd time recharge, especially if I haven't plugged it in the night before, but my solution to this is easier. I have a collection of USB batteries. Some were given to me as presents, and they are large capacity and well-built. Some were given to me as methods to show the company's logo, and those are available if I am ever concerned about losing one. Either way, I can drop one into my backpack and be assured that I can charge my phone should it need it, assuming I haven't borrowed the cable I keep alongside it. These mean the battery doesn't die, extend the time I can be away from power if I ever need that, and can also be used to power other devices in a pinch.

Mozilla unveils $4.99/month subscription-based VPN, says it won't hang onto user logs

Re: Bad timing, sigh

You can, and I have, but that only works for some of the use cases of VPNs. In my experience, people want VPNs for one or more of the following reasons:

1. To provide a secured tunnel to a known endpoint.

2. To access other machines without having them be openly available on the internet.

3. To have anonymized traffic that's difficult to track.

A VPS handles use case 1 easily. It can handle use case 2 with some work (for example, I have mine set up so I can VPN into it, then follow a previously-established tunnel to a device which is on another network). It does not handle use case 3 unless you allow others to use your VPN as well so you can hide among them. That's usually not a good idea because you will use up a bunch of bandwidth and may be responsible if someone uses yours for illegal actions.

Google: OK, OK, we pinky promise not to suck Fitbit health data into the borg. Now will you approve the sale?

We accept your conditions, just prove your honesty

Dear Google. We are happy to tell you that we have accepted your conditions, namely that you guarantee that you have not, are not, and will never use data collected or entered on Fitbit devices for advertising purposes and that it will never be visible to any system which also stores data processed for advertising. We are now happy to approve your sale, but we require one final item. In order to prove that you are complying with your own conditions, we will need to see and audit both of the following systems: A) the code run on Fitbits and any remote system with which they interact (recursively), and B) the systems and data on which you base your advertising decisions. These audits will need to be ongoing while your company continues to produce wearable products or software which interacts with wearable products. If you decide not to comply, we will be required to deny your request to acquire. Please note that providing false information in this step is a violation of laws in every EU member state and punishable by prison terms for every manager and forfeiture of all financial resources. Also please note that information provided during this process may be used by data protection authorities. Congratulations on this approval for your proposed acquisition.

Sueball locked, loaded and pointed at LinkedIn over iOS privacy naughtiness

Re: Free/Libre and Open Source advantage

"I made an Android app that reads the clipboard on startup without asking. It does it to see if the clipboard contents is a URL, in which case it pre-populates a text field with that URL"

That's your choice, but I think it's not that useful for a few reasons.

"I could have added an extra Paste button, but then I'd have to worry about issues like "would the button take up too much room on small displays" (or if it's hidden, would users be able to find it)"

This is why consistent UI decisions across apps are so useful. In most operating systems, there is a typical way to copy and paste and any app supporting those actions does it the same way. If your paste function was available and followed a convention, most users would know how to use it.

"and "would users be confused if pressing the button causes an error message because the clipboard contents is not something we can handle—would it be better to simply not offer the option in that case?"

As I see it, this is a nonissue. If the clipboard contents are not text, you just don't paste any contents into the box. If it is text, you put it in when they paste and let the user decide what to do then. After all, you already have to have some control for a user entering an invalid URL, either a typo or testing you, so if the clipboard contents are invalid, you just report them as invalid just like you would if I mistyped the URL as "https;\\".

These are subjective decisions, and everyone will probably have their own opinion on what is best. For what it's worth, mine and yours differ.

Re: I'm baffled

Well, it's not as simple as that because you may not always use the standard edit controls. In an app that implements a different edit box with different features, say for an actual word processor, you may want to be able to paste into your new area. Apple saw this need and implemented your basic clipboard where you could read at any time. Logically, they could easily have asked the user about whether the app was intended to be reading the clipboard, implemented rate limits, or various other security patches, but they didn't do that. Maybe their IOS 14 changes will include one or more of those preventative patches in addition to the retroactive warning mentioned.

Re: I know not of these matters...

I think most of your statements are wrong there. We'll start with the first one. You can violate privacy without immediately sending the contents of the clipboard off. As a basic example, if you copied it into an internal buffer and used it to perform on-device metrics, even if you never sent those metrics, it could be violating the privacy of data stored in the clipboard. Sure, it's relatively low-level and users should be careful (that is assuming this app only did this while in the foreground), but don't assume that violating privacy requires phoning home. In this case, I don't think LinkedIn was using this as a sneaky data collection feature because it would be so fragile. I think it's more likely that some coder thought it would be useful and didn't think of alternatives or the downsides.

Now on to the code part. You say that checking the clipboard content "is absolutely required if you want to implement "Paste" into anything other than text views and text fields." Not true, because you still only have to read from the clipboard when a user presses that button. The issue here is checking the content in a loop without any button. Then, you said that "you want to know what's in there so you don't have for example a "Paste" button if there is stuff that you can't paste." I disagree, because I find hiding controls that you sometimes have and sometimes don't confuses the users, but that's a subjective UX thing. You can implement format-specific paste in a number of ways, including cancelling a paste operation without changing the original content if the contents are not compatible. You can warn the user or not as you desire.

"And then there's the fact that in Windows, Linux, MacOS, Android, and iOS up to 13.0, everyone does it. For good reasons."

You are assuming the reasons are good. Frequently, I find that good programs wait for me to paste in the contents of my clipboard rather than snatching potentially incorrect data out, though I will admit I've seen some go the other way.

Unless you really need real-time monitoring of clipboard contents for some reason, you are also making your application do a lot of pointless busy looping. This isn't great for performance or power usage if you do it for long enough.

Modular edutech PC crew opens fresh Kano beans with expanded kit and accessories

Some parts not as nice as I first thought

I was interested to see exactly how flexible a device like this would be. It's always nice to introduce children to hardware and software together. Sadly, I don't think this looks like the way to do it. I had one concern after reading this article, and it was that it didn't look like the memory or storage was replaceable on this machine. I get it with memory (sort of), as the processor in this machine probably can't do all that much with more. However, in my opinion, storage absolutely should be replaceable; not only can it wear out, especially with heavy use, but it is useful for people new to hardware to understand how storage works and experiment with different systems, which can be easily accomplished by swapping out disks.

While I had these concerns, I wasn't sure from the article that they applied. Maybe these parts are replaceable and the article just didn't mention it, so I did my research. Well, I tried to do my research. It seems as if Kano doesn't publish the assembly guides for their products on their site, blog, or help center. They do indicate that a printed and illustrated version comes with the device, but I think it's also important that they publish it online for perspective purchasers or in case someone loses it. I wonder why they haven't done this; it's not as if it's valuable without the hardware.

Since I don't have any of the official documentation, I'm only going off some articles I've seen about the launch, both here and elsewhere. Unfortunately, it isn't painting a picture I like. It seems like the hardware assembly is relatively basic: put in speakers, attach battery, close the case. I'm sorry to have to be so blunt, but an assembly process that can be completed in two minutes doesn't teach people very much. If the hardware, described as teaching children, actually gives them little education and less choice, I have to wonder how good the software education experience is. I don't know, and it may be markedly superior, but my initial confidence has waned.

Meanwhile, there are educational computers and kits that I think are more useful. Unsurprisingly, most of these are based around a Raspberry Pi, which already provides a lot of the facilities of this. I have seen laptops based on the Pi which include batteries and touchscreens but also include things like built-in breadboards for hardware hacking. I also know that, even if the manufacturers of these haven't built educational resources into the product, the Pi Foundation has useful resources and so does the community. I'd have liked another provider of this type of resource for students, but I don't have confidence that Kano is one.

It's handbags at dawn: America to hit France with 25% tariffs on luxuries over digital tax on US tech titans

Re: Local sellers can't avoid much taxes

There is a good solution to the problem of large multinationals using tax havens, which is to clarify and reenforce national tax laws so it's harder to use the haven to protect taxable income in each country. There is a bad solution, which is to name the people who are avoiding, which of course these companies do, and specifically target them. Both solutions function in as much as getting some money out of the entities concerned, but the first solution means you don't have to readjust your law when a new egregious offender turns up and the second solution makes you look as if you just have some companies you don't like. I am not here to defend the tech companies; we all know very well how they juggle things around to avoid any taxation or accountability. I come here to recommend a legal solution that is more likely to be accepted and more likely to work in an objective manner.

Re: Pay tax where users reside

There is something to the very high tax rates driving away places that have a lot of money, but there's a lot more to simple greed. Consider that you can hire a lot of skilled accountants for €1 million per year. Imagine that they can reduce your effective tax rate by 10%. Well, as long as your tax bill is over €10 million, you make money by hiring them. I, and likely you, don't have the resources to do that or a tax situation that would benefit greatly. In addition, most likely both of us wouldn't really have a use for massive quantities of money anyway. A lot of rich people and companies don't think that way and will choose any course of action that means more money stays with them, no matter whether there is an ethical way to get there or if they have any use for the extra money added to their accounts.

You can fix that in one of three ways:

1. Make the tax bill hard to circumvent by simplifying it, meaning your accountants can't help you find sneaky ways out.

2. Make a law like France's which simply targets those viewed as most problematic, which lands you in this situation.

3. Try other solutions that might work, but history is not on your side.

IBM job ad calls for 12 years’ experience with Kubernetes – which is six years old

Re: Why wouldn't Tim Berners-Lee have 17 years experience designing websites?

I did not read that far down; thanks for bringing my attention to it. That said, I'm not accepting that; it sounds like at best a pedantic distinction without a difference or at worst an excuse for getting the number wrong. Designing something can happen in many ways, as long as you make decisions about how a thing will look or function. It's pretty broad. When I made students write "design documents", they neither wrote the code nor used imaging software, but they still designed their programs when they wrote up some text. You can design a site in the same way, and you can also do work on making the site look exactly how you want it to. That sounds like design to me.

Re: Mandatory Experience

I have taken to reading the careers pages of sites I'm already on (note to employer: I'm not trying to find another job. I just like to see what they'll come out with). There was a role mentioned on one of these pages that specified that the candidate would need experience with "algebra and geometry". Weird, but they're being clear that mathematical knowledge is required. Except that they specified the specific things you needed to be able to do, including "find real roots of a parabola" and "calculate the volume of a cylinder". I have ever since been confident that, if something should go horribly wrong in my career, I can at least go over to the cylinder place and do quadratic formulas all day. It won't be interesting, but things are never hopeless.

Re: Why wouldn't Tim Berners-Lee have 17 years experience designing websites?

That's part of it, and that does earn the interviewee a demerit. But the tweet contains three components if you ask me:

"We interviewed a 28yo designer in 2012 who told us he had 17 years experience designing websites.": Interviewee claimed to start designing sites at the age of 11 in 1995, which is possible but unlikely.

"I said, 'Tim Berners-Lee doesn’t have 17 years experience designing websites.'": This sounds to me as if the interviewer actually thought this was true. As it happens, it was not. If you count HTML websites on WWW, he had 21-22 years experience. If you count his previous work on CERN-specific pages that worked like websites with hypertext, it is even more.

And then the point about the interviewee not knowing who that was.

When you see PWA, Microsoft and Google want you to think Programs With Attitude: Web app release tool tweaked

Re: Am I the only one

"My thoughts were the opposite. PWA's don't have as much access to the hardware as native apps. Even when they eventually do, how is this different from native apps now?"

Let me count the ways. Um ... sorry, lost count somewhere around twenty three and I should keep working. Fine, here's the short version:

Current mobile operating systems have put a lot of work into sandboxing apps. They don't all do it right, but they mostly try. Users can generally block certain permissions and it isn't trivial for an app to circumvent a denial and get the data anyway. Similarly, it's usually difficult to have one app suddenly start reading the resources of another app. That's unlikely to be the same for a web app, if only because all the sandboxing would have to be started again. Of course there will be protection from accessing the location permission, but will the permission system be as granular? Will it be secure against circumvention attempts? Will it include any sneaky access methods because Google is building it?

In addition, a web app has a very different security profile to a native one. Web apps tend to use a lot of libraries. Those libraries come from really nobody knows where, or sometimes we do know and we might feel better if we didn't. Each of those places can get modified to introduce new code. Since these are progressive, update frequently, move fast and break things apps, our devices would be pulling this new code down and starting to execute it. At least with a native app, the library has to get tampered with, pulled down for the build, and released to the traditional channels. That might not be a reassuring shield but at least there's a shield.

Another issue is with privacy. Theoretically, analyzing network traffic from a web app isn't more complicated than with a native app. In practice, it's trickier. If you are able to intercept apps' traffic to block it, a web app can more easily disguise itself as a browser. Since the app needs to stay up to date, it must ping a server all the time, and because devs are lazy, there is a reasonable chance that it will require a server to function properly. While any app can require a server, it's more likely that a native app which cannot pull libraries from a server will function without one than one which requires a server pushing libraries for installation.

That's the short version. I should probably stop writing now.

You call Verizon. A Google bot answers. You demand a human. The human is told what to say by the bot

Re: I can hear the conversations already

The problem is that, unless they operate the nice kind of call center, you are liable to finally get an operator after an hour of the same two advertisements on a loop to have this discussion:

Client: I am trying to activate a new phone online, but it says that the eSIM requires me to call for activation.

Operator: I will help you resolve this situation. First, may I have the phone number you are using to call us so we can call you back if needed?

Client: Sure. Here it is.

[...]

Operator: So you don't need help with your SIM card then?

Client: No, I need to activate a new device.

Operator: Well, I'm in the troubleshooting call center, but fortunately I can forward you to the activation call center. It'll just take a second.

Client: Thank you.

Advertisement starts again.

System: Good morning and thank you for calling Verizon. How can I help you?

I can hear the conversations already

System: Good morning and thank you for calling Verizon customer support. How can I help you?

Client: I am trying to activate a new phone online, but it says that the eSIM requires me to call for activation.

System: I will help you resolve this situation. First, may I have the phone number you are using to call us so we can call you back if needed?

Client: Sure. Here it is.

System: And now your subscriber number?

Client: Here.

System: And your pin?

Client: Here.

System: Thank you. The SIM card slot is usually located on the side of your phone or in the battery compartment. You may notice a small hole.

Client: Wait a minute. I have an eSIM problem, not a SIM problem.

System: You can use a paper clip to eject the SIM card tray from your device, but make sure to turn it off before you do so. If there is an existing SIM card in the device,

Client: Stop. Cancel.

System: ... remove that card from the tray and insert your new Verizon SIM card.

Client: Other query. Help. Not my question.

System: There is a triangular cutout on the card which should align with the tray.

Client: If I wait it out, will it let me do something else?

System: If your SIM card is too large for the tray, you will need to break out the smaller card ...

Two minutes later:

System: Has this solved your problem?

Client: No.

System: I'm sorry to hear that. How can I help you?

Client: Activate new device.

System: I am capable of recognizing human language. Please phrase your request in full sentences.

Client: I am having trouble activating a new device.

System: I will help you resolve this situation. Is the number you are activating the same as the number you provided earlier? That number was two [long pause] four [long pause] eight [long pause]

Client: Of course not; I can't activate, so I have to call you from a working line.

System: six [long pause] zero [long pause] [...]

Client: [after number has been read] No.

System: May I have the number of the line you are trying to activate?

Client: Here.

System: Thank you. This line is not associated with any devices on your account.

Client: Right.

System: Has this solved your problem?

Client: No.

System: I'm sorry to hear that. How can I help you?

Detroit Police make second wrongful facial-recog arrest when another man is misidentified by software

Re: The real news

That's not true. It happened. It really did. It was nine months ago in a private test somewhere in Europe. And they detected this guy entirely correctly. Well, he wasn't the guy they were looking for, but he was an identical twin with that guy, almost. I mean we put this guy in a lineup, brought in some people, and asked them to look at a picture and point out which of the people in the line was that guy. Everyone pointed at him except for a few of them, but those people didn't select anybody so they don't count.

An email banning our staff from using TikTok? Haha, funny story about that, we didn't mean it – Amazon

Re: Another non-event distracting us

Exactly. That's why trust in the base app is such an important detail. The only relevance to the "pull down arbitrary code" possibility is that someone else could get the code inserted, either by forcing the company to do so, stealing the mechanism, or discovering a vulnerability. The new code would not be released as a potentially detectable update either, making it easier to hide.

I think the best example of such an issue is the vulnerability discovered in WhatsApp a little under year ago. Said vulnerability wasn't intentional (unless you are paranoid), and it allowed arbitrary code execution by crafting an invalid video file. That code would not be able to exit the sandbox of the app, but WhatsApp's sandbox is really big so it proved to be a useful exploit, weaponized by at least a couple groups. If TikTok had a similar mechanism intentionally or through a vuln, it could prove dangerous even if a user trusted the original app. Obviously, I do not know that such a thing exists, but if it did, it would be bad.

Re: Another non-event distracting us

It wouldn't need root access to be able to do things you wouldn't like. I checked out its Exodus privacy report which shows information about permissions and trackers found in its Android app. That's quite a lot of permissions. Malware given access to those would be able to do lots of things, including making and inspecting network traffic. As with far too many Android apps, this app also requests permissions that don't seem to make any sense (install new packages, for example). From inside that sandbox, you can still do a lot.

Now, just because this app requests those permissions doesn't necessarily mean that all are granted or that they work. Nor does it mean that there is something malicious using them. I wouldn't be surprised to hear that TikTok does have a mechanism allowing their developers to push arbitrary code and run it. I also wouldn't be surprised to hear that Facebook has a method to push arbitrary code and run it. I already know that Google does have several ways to push arbitrary code and run it. As with any other application, the degree of trust in its developer and usefulness of the features must be taken into account before deciding whether to use it. I wouldn't trust it, but I also have no inclination to use it and there are already hundreds of other companies' apps that I also don't trust.

A volt from the blue: Samsung reportedly ditches wall-wart from future phones

Re: 5v/12v ring

I suppose the question would then be why. Let's assume you could create secondary circuits at lower voltage. What would the benefit be of doing that? If you still provide the main circuit at normal voltage, your secondary circuit means extra installation, extra possibility for breaking, etc. without removing any of the cost associated with the main one. Meanwhile, providing the ability to use higher voltage may be useful in a limited number of circumstances. For example, most places could probably use LED bulbs at lower voltage (although how low is in question, see the other reply for details). However, some may wish to use a different type of bulb. I know some people use bulbs that release more ultraviolet light to promote vitamin D creation. I don't know if those have a higher power requirement. Most importantly, I don't know what other unusual types of bulbs people use, and I don't know if it's a good idea to make it more difficult for them to do so.

Re: 5v/12v ring

"Agreed, but wondering what the load would actually look like though"

There are quite a few devices capable of drawing high power outside the kitchen (and I'm assuming you are also counting the laundry room and garage in the rooms needing higher power). There is of course the powerful desktop computer, especially a gaming or high-processing dev machine, probably one of the first to jump to mind for us on this forum. But there are other things, some with even higher draw. Printers, for example, can get pretty spiky. Portable heaters which are designed to quickly warm up the immediate area are also power hungry. Vacuum cleaners vary a lot, but I have not yet seen a USB vacuum capable of rapidly cleaning the floor. Fans may not be very hungry, but they will draw quite a bit of current if you run them at 5V. Televisions, speaker systems, and the like run with relatively little power, but high enough that running them together at low voltage is going to push the current level too high. Even laptops with large screens can charge at around 100W, usually through 20V USB-PD, which at 12V is a potentially undesirable 8.33A.

The problem is that there are potential users of increased power elsewhere in the house, so you will want to provide it. Probably relatively few people want to run an 800W GPU stack, but those who do will be annoyed if you take their mains availability away. Since we can easily step down to voltages at the point of the device, but stepping up is going to mean dangerous current draw, it is probably more efficient to leave sufficient voltage for more power hungry devices. If those voltages are never requested, little is lost.

Re: You're funny

"las t time a friend tried charging his iphone here (last years model) he found that with his genuine lead it refused to charge from the usb chargers that we use for our samsung & honor phones, in the end the only thing we found that would charge it was an old charger for a 1st generation ipad mini."

I really don't know about this. I have had iPhones, and they have charged off anything, up to and including a Raspberry Pi. I know I charged one off this really cheap plug next to me which is, let me check, a ZTE. I don't even know how I got a ZTE USB adapter, but it works fine on everything, so it remains in service.

The reluctant log trawler: The buck stops with the back-end

Re: Late 2000s?

Why do you assume that "the 2000s" by default refers to a century? Because for all you know, it refers to a millennium. The only significant figure there is the 2, so any smaller chunk that still includes multiple years is valid, including 2000-2999, 2000-2099, 2000-2009, or for some pedants the 1-offset century and millennium as well. I choose to believe that this happened in the late 2000s, sometime around the year 2978, but the various changes in human culture since now have made it not as funny. Fortunately, they also invented time travel so someone could report it to us.

Re: Fault at both sides

I very much agree. I was expecting to read that a user had realized that, by getting a quote with a different ID, they could trick the backend into purchasing stock at a different price and that a heist by a black hat was on the way. Verify all input from users; they are not to be trusted.

TomTom bill bomb: Why am I being charged for infotainment? I sold my car last year, rages Reg reader

Re: Simpler than I expected

When you purchased your iPhone, did the manufacturer indicate that the contract for service was a component of the product? When you first got your iPhone, did you set up the contract on it as part of the process, or did you set up the contract with the mobile provider and connect the iPhone to it? Both of those things were different for this case. There was one other thing that was different, and that is that there wasn't any contract. This has been clarified by the original source several times above this in the comments: there was no contract, and the charge that TomTom sent out was not a valid charge.

Re: New one on me

Come on. "I can math" has always in my experience been a lighthearted joke in one of two situations: someone expresses surprise at your having done some calculation quickly or when they didn't expect you to do it, or you have made a stupid mistake in mental arithmetic. It's used to juxtapose someone who doesn't know how to phrase that grammatically correctly with someone who is doing mental mathematics. As for "I logicked", I have heard that but very rarely and the grammatical way of saying the same thing: "I used logical thinking to come up with a solution" sounds pretty stupid too.

There are some people who seem to enjoy verbifying nouns, but it's usually sectors like PR or consultants who need new euphemisms or new things they are an expert in that nobody else has heard of so they must be good.

Re: As I read that

"It wiped the car. It just didn't wipe Tom Tom's customer database, which is not in the car."

I get this distinction. When I first read it, I was inclined to agree with it. Having read information in other comments however, I don't think the user is at fault here. It wiped the internal parts of the car. The car was sold with the TomTom device included, meaning that device was in the car at time of purchase. The device interacted with the main car display, meaning that a user could infer, incorrectly in this case, that it was connected to the car's systems and would also be reset on the activation of the wipe. That device didn't get reset or, if it did, didn't update the account it was connected to to inform the account of the reset. And the user didn't have any repeated billing set up on that account. When the charge, wholly unexpected as it was TomTom's error, came through, it presumably indicated in some way that it was linked to that particular Mazda vehicle.

You could see why the original misconception was that Mazda could do something about this. They sold the equipment in the car, their screen controlled the equipment and was used to perform the reset, and the bill mentioned them. Now we know that that wasn't correct, and it wouldn't be fair to them to continue to blame them for much other than failing to warn of this possibility in the reset process. Still, given the limited information available at earlier points in the process, I think the concern was understandable.

Soft press keys for locked-down devs: Three new models of old school 60-key Happy Hacking 'board out next month

Re: Alternatives?

If you go to your lots-of-items-selling site of choice, you can almost guarantee that you will find various budget mechanical keyboards around and even below your price range. I have experienced good results with some of these, but with each you will have some drawbacks. There are those who will not accept any switch type other than the well-known manufacturer they have used before, for example, and budget keyboards tend to use some manufacturer you've never heard of. I tend not to care, but if you do, the budget might not satisfy. Similarly, at that price range you are unlikely to find keyboards with extra features like Bluetooth, detachable cables, or extra ports. If one does contain such a feature, it's likely the only one.

Utilitarian, long-bodied Nokia 5.3 has budget basic specs - but it does cost £150

Re: Got one of these recently

I found a couple low-priced options with removable batteries. I don't know if any are good though. Here's a search with the selected criteria being removable battery, 3.5 mm jack, 2019 or later, and at least 32 GB of internal storage to get rid of the "Go Edition" useless things.

Asia’s internet registry APNIC finds about 50 million unused IPv4 addresses behind the sofa

Re: So, IPv4 addresses are like petroleum

Yes. In many ways they are like petroleum. There is a limited amount. Nobody is really sure when we will hit that limit but we have gotten far enough that there can be problems with the supply. Some groups control a massive amount for no good reason. Large parts of the world have next to none compared to their populations. There are replacements that might be useful if more people were to use them.

IPV6 has many problems, and making any change is difficult, but it is already chaotic to try to find and keep IPV4 addresses. This block may have reduced that pressure for a little bit, but in only one region of the world and only for so long. Given the aggressive CGNAT used in some parts of Asia, I imagine demand for these addresses will be fierce.