Posts by doublelayer

Grab your Bitcoin while you can because Purse.io is shutting up shop in June and you could lose the lot

Re: Respect

"No one is laundering money using gift cards."

Mostly true, but a few people are. Anyone with hundreds of thousands to launder will need something much more intense, and they can hand over quite a chunk to get that. They wouldn't do anything like this. The people with small amounts, for example people who had one successful ransomware attack or payment-request phish probably don't need to worry about that--they can go to an exchange and retrieve cash, claiming they mined a small chunk if questioned. It's those people in the middle with a reasonable but still small income stream coming in bitcoin who need something more anonymous, as they can't arouse suspicion by so frequently going to a physical exchange or providing details allowing them to be identified. Amazon gift cards may not be perfect, but if it can be done anonymously, it might just be enough.

Paranoid Android reboots itself with new Android 10 builds

Re: Wot, no Sammies?

From the Lineage OS supported devices list, it doesn't seem like Samsung is terrible. Of every manufacturer on the list, Samsung has the highest number of supported devices (71 versus 33 for the next highest, LG). However, I note that Samsung's list has quite a few old devices and that some of their devices are listed many times for carrier-specific variants. I think it's a constantly-moving target in that a manufacturer can either be magnanimous with bootloader access or make mistakes that make it easy with one model and then turn around and change their tune quickly, similar to how Huawei locked its bootloaders a couple years back and have fallen of the list of good devices for replacement firmware.

The other side of that coin is that a device can have a completely open software stack and still not get much attention. Only if the phone is owned by enough people will the work get done. At one point, I had found a device where basically everything was open (even most of the hardware, strangely), but it was not found by anyone else because it didn't even have a brand name (I still don't know who made it), it was intended as a very cheap device with poor specs, and by the time the previous owner gave it to me for erasure and I figured out how open it was it was three years old.

Bad news: So much of your personal data has been hacked that lesson manuals on how to use it are the latest hot property

True, but if you publish them where the general public can read them, then you'd better hope that you and everyone else have protected against what it says. What would be useful is to create a closed group of organizations that distribute them internally when they are obtained (and if they can be obtained by theft or without completing a payment I'm all in favor) and another public site where the pathetic wrong ones get released publicly. Anyone who finds that public site won't be able to complete a fraud with the instructions, and we avoid funding the how-to-commit-fraud industry.

An alternate suggestion is that we create some guides of our own, which we submit to the reviewers on these sites until they let us on, then we send all those who purchase it a PDF of that guide but with extra malware inserted. Bonus points if the malware can be written to turn these people in.

Re: When there's a gold rush on

Very good point, but they actually do have a ratings system where accounts need to be verified in order to post reviews. It's weird how normal these sites can look if you ignore what the products are.

Apple: We respect your privacy so much we've revealed a little about what we can track when you use Maps

Perhaps I should clarify my policy. An app can ask for location permission and need it to work (E.G. navigation), and I will grant that permission. An app can ask for location for a clearly-identified feature, such as adding geotagging to photographs, and I will deny it, but if it still works, it can stay. If an app asks for location and does not have either of the previous two excuses, including where I don't know why it wants location, then I will decide the app is untrustworthy and I will discard it entirely. It doesn't matter to me if it works without the permission--if it asked for that, it might be doing other things it didn't ask about but I don't trust.

VPNs: no effect at all. Cell towers and access points happen before the VPN, so if the app can read them, it can use that data to locate you. If you want that not to be possible, you have to add lots of restrictions to what apps are allowed to do. My typical policy is that an app can ask for various permissions and be denied, but if it asks for location and I don't want to give it, that app is evicted with prejudice.

SE's baaaack: Apple flings out iPhone SE 2020, priced at £419

Re: Only took Apple 2 years...

There are a few, but they're not necessarily what you want. For example, the Unihertz Atom XL was reviewed here not that long ago and has a small screen. However, you would then be dealing with a relatively unknown manufacturer, so there are provisos if you decided to buy it. It seems the general public has decided that they don't need to fit their phone anywhere and will take massive screen real estate over compactness; I don't understand why either, but somehow the majority has decided against us.

IP76

"The budget blower is also rated IP76, therefore providing solid water- and dust-proofing."

Sorry, but that's not correct. The first digit in the IP rating number is about dust protection, and it only goes from 0 to 6. Looks like the value is IP67, or protection from immersion in water less than a meter deep for thirty minutes. Alright, pedantry completed, back to normal discussion.

Let's authenticate: Beyond Identity pitches app-wrapped certificate authority

Re: Let me see

We have that. It's a password manager (they can store keys too). This one is more than that because they want to run authentication through their infrastructure. That can sometimes be useful, but there's a reason most current players in that realm are providing secondary-factor authentication rather than primary-factor.

"But also - isn't this already solved rather nicely with biometrics? What does this add?"

No no no no no no no. Biometrics does not solve this problem at all. For one thing, there are devices out there that don't have them. But for the major thing, biometrics do not support many of the security things one usually wants to have with passwords or keys. Try revoking someone's face or fingerprints if that person still needs to log in but an outside party has found a copy. The only solution is to break your biometrics system and give the compromised person a key or password instead. Also, give me a good way of using biometrics to authorize myself to distant machines. I'm working from home at the moment, but I frequently use a key to authenticate and encrypt a connection to a machine kilometers away. To do that with biometrics, the remote machine either has to trust my machine to say that it is me at it, leaving it open to potential attacks on the verification hardware on my machine, or it has to transmit my biometric information on a potentially tappable connection. Neither is good.

So how do the coronavirus smartphone tracking apps actually work and should you download one to help?

That assumes that when they said inexplicable, they meant "the perfectly logical way everyone expects". Maybe, when they said inexplicable, they meant inexplicable in the sense of nobody really knows why the icon changed but it shouldn't have. This app got set up really fast and rolled out to a billion devices--you have to expect that there will be bugs when that happens, including incorrect reports or syncing issues or system malfunctions. It happens with things much simpler than this.

Re: What's to stop...

Should this app get used, there is only one viable solution to this. In order to start alerts, a key associated with a testing facility must be used to confirm that the device's proclamation of a positive test result is trustworthy. That would work reasonably well for this one case, but it doesn't fix any of the other major problems that exist.

Re: "their phone will release the identifiers of all the other devices"

That's a logical way to do it. That way has two problems though:

1. Downloading the full world-wide database could take a while and use too much bandwidth, whereas segmenting it into regions could be flaky.

2. If phones don't upload all the identifiers they've seen, then there won't be a reason for individual phones to frequently ping the server with their own so the server can check for them. If that doesn't happen, using the information for tracking purposes won't work, the advertisers won't pay for the intel on the users, and the NSA and its friends will have a bunch of meaningless numbers instead of a nice graph.

Re: a bit late in my book

"When we all have and use this app, people will be able to have a reasonable assumption that the people they deal with are not infected"

That's wrong, and it's also quite dangerous. This app is, as has been pointed out admirably, only a retroactive notification tool. It can let you know, at some point, whether it's possible you came into contact with an infected person. But the speed and hence the reliability of that depends on the speed and comprehensiveness of testing, and we know that those values aren't great right now.

Meanwhile, if people also assume that, we will have quite the crisis indeed. If people think this app will protect them, catching people before they have a chance to be infectious, they will be more eager to engage in social interaction because the people they are in contact with must not be infected--they haven't been quarantined by the app people. This means more spreading and more pressure on testing infrastructure, which means less comprehensive tests, which means less reliable data from the app, which means more people interacting because none of these people have been quarantined by the app people, which means more spreading and more pressure on the test infrastructure.

If people continued to follow instructions while using this, it could be a little helpful. But if there is any other person who comes to hold an opinion like the one quoted, it will be harmfully counterproductive.

Re: Good for data-less phone plans

"Would you like to"

a) "Be locked down for the next 100 years like now, for that is how long it'll take for herd immunity to arrive with the current system or"

b) "Get a budget smartphone and set it up to use the app"

Good choices, but I think I'd like to choose among these:

C) Not constrain myself to a false dichotomy.

d) Consider quarantines that neither pander to panicking people nor to people who don't care about deaths, but are based on frequently-updated statistics and careful study by epidemiologists and economists.

e) Consider using tracking solutions only in the most extreme of circumstances, rather than jumping immediately to them.

f) Plan for the long run, including how quarantine is set up, how it is shut down, what needs to be done to maintain it, and what needs to be done afterward.

g) All of the above.

h) Items C through F.

I'll choose option H, thanks.

Signal sends smoke, er, signal: If Congress cripples anonymous speech with EARN IT Act, we'll shut US ops

Franchising is weird when the service being provided isn't physical. Usually, you don't need one and you don't have one, and most exceptions only have local affiliates (usually not franchised) to provide local support. Signal doesn't have national franchises now, and for a very good reason: they'd be useless. But let's assume that they did set one up. Essentially, they provide the main system and a national franchise is created which links citizens to it. If the local franchise is connecting people to an encrypted system, they can't access the data being sent. If they were sent an order to divulge that data, they wouldn't be able to comply and could be charged. The owners of the company who authorized the franchise could also be charged on the basis that they did not intend to follow the laws when they agreed to establish a franchise. Enforcing that charge if the owners were out of the country would be difficult, and getting judges and juries to agree would also be tricky, but it is certainly possible in the law to do so.

Consider a simpler example of a franchise: an international chain restaurant. If a local franchise is formed which needs to get ingredients, and the ones they are required to buy break local health laws, the owners of that franchise can be charged for that violation. In addition, the owners of the main business can be charged with breaking the same laws by making that requirement, which is illegal. Again, this isn't a guarantee of a legal victory, but it is a case that can be made which often leads lawyers to try to avoid that risk.

Re: I think it would be rather splendid

Sadly, I expect you'd see this timeline:

1. Law: Is passed.

2. Signal: Is forced overseas.

3. U.S. enforcement body: Tries to pursue Signal legally, can't find a way, blocks them.

4. Legislators: "We want our secure communications."

5. Law: Is modified saying government can use these apps but citizens can't.

6. Signal: Decides that if citizens aren't allowed, government isn't either. Blocks them.

7. Legislators: Write law: "Somebody make us a version of Signal that works for us."

8. NSA: "We'd be happy to. The code is open source anyway. We're just going to stand up a server of our own."

9. Legislators: "Perfect. Send us a link, would you?"

10. NSA: "We have finished setting it up. Now if you could reauthorize our data collection stuff for a century or so, we think we can send you a link."

11. Legislators: "Weird. They thought we were ever going to balk at that. We've been fine with it for two decades; why do they think that's going to change? Well then..."

12. Reauthorization law: Is passed.

13. NSA: Sends link to signal.gov client.

14. Legislators: Install the app.

15. Legislators: "Hey look! It works the same as the last version! Thank you, NSA."

16. Military: "The encryption system we had just got hit with the original law. Can we use this too?"

17. NSA: "Absolutely!"

18. Military: Starts to use the app.

19. NSA: "Any congresspeople being potentially annoying today?"

20. NSA analyst: "Actually yes. There was a new one elected and they're chatting about an oversight bill over us."

21. NSA: "What do we have on them?"

22. NSA analyst: "Everything they've ever sent or received. I'm sure we can find something out of context that can be used against them."

23. NSA: "Wonderful! Do that then."

24. Newspaper: "Newly elected representative [name] who stood for election on a platform of public privacy faces ethics committee investigations."

25. NSA: Evil laughter.

If you operate with a franchise, that doesn't help. First, you are essentially handing that franchise-owner over for all punishments, which isn't very nice. Second, if your franchise does anything, then when their stuff is affected by legal matters you have much more disruption. Third, it doesn't stop you being responsible legally, and you can still get arrested if you show up there. If you can operate electronically, it works similarly except they don't have anyone they can arrest immediately. Their only choices are to try to put pressure on countries you need stuff from or try to block you.

At a very basic level, if you don't operate in the U.S. and you don't need things from the U.S., then the American government can't do anything to you from their law. They can try to encourage your country to go after you, and it has a decent chance of working for them, but they don't have legal methods. So that would be a drastic method, essentially cutting off all of the U.S. The less drastic method that also has some chance of working is to move all operations and supply chains out of the U.S. but continue to allow Americans to use the service. That is technically operating in the U.S., and the U.S. can issue legal complaints, fines, or prison terms, but if you don't live there or have stuff there they can take they may find it difficult to enforce those. That approach could work for Signal, while there are numerous other types of organizations for which that would be a non-starter.

Re: If you follow the money

Do they? The only one that comes immediately to mind is the chat app WhatsApp, which is Facebook-owned. The rest of the big players only seem to offer end-to-end on things they get paid for, and don't bother with it for other communications they work with. Apple, for example, offers relatively good encryption for many of their things, including end-to-end on some, but to use any of those, you have to already have purchased an Apple device. Anything that is clearly mined, such as email services from Google and the like, are not encrypted and there's no pretense that they are. The clearest providers of completely encrypted communication services I can think of are all smaller nonprofits, such as Signal, Tor, or Telegram.

Watch out, everyone, here come the Coronavirus Cops, enjoying their little slice of power way too much

Re: If you're not part of the solution, you are an idiot.

Original quote: ""You are strongly requested to stay in your house, and when you go out for exercise, please be courteous to others and keep 2m apart, and please don't congregate with people you're not living with", well, that's got a chance of being done."

Response: "And Neil Barnes, [original quote] has worked really well so far, hasn't it? They tried that. It did not work. What did you do when Boris said "we are advising you to stay indoors"?"

Not really connected to the rest of your comment, but you appear to have missed their point. The point was about wording, specifically "order" versus "strongly request". The opinion stated there was that "strongly request", though technically a weaker statement than "order", would have produced a smaller sense of injustice and would have been better adhered to by the public. If you knew that, then you know that "strongly request" was not tried by the U.K. authorities (it is much stronger than "advise", and the statement I found when searching for that one had some limits on it), meaning we can't know whether the stated opinion was correct or not. For the record, although I'm not in the U.K., when I received my suggestion (yes, mine was a suggestion) to stay at home, I did so. I have not come within range of others since that time.

Honor 9X Pro: Better specs can't save this smartphone from a barren app store

Re: Apps

Sideloading is easy. But it might not be enough. Google's APIs may be proprietary, sketchy, prone to crashes, and completely unauditable. However, many apps have decided to use them. If you don't have them, and this doesn't, then you may run into problems after sideloading. For example, I am running Lineage OS which I have decided not to poison with Google's APIs. I've just tried a few apps that need them. In general, they look completely fine until they've finished the first set of loading screens, then they crash repeatedly until the phone decides not to try and start them again. This is not a problem for me--I was running these as a test and I could find replacements anyway. For the general public, they might not know why it's crashing like this, and they probably won't understand how to fix it. For those who understand the former but not the latter, they might find unreliable, crash-prone or malware-laced versions of those APIs instead. Whether this is a problem for the consumer hasn't really been determined, but it's worthwhile to understand that sideloading doesn't by itself fix the problem.

Minister slams 5G coronavirus conspiracy theories as 'dangerous nonsense' after phone towers torched in UK

"What's bizarre about turning your router and mobile off at night? I don't see any point in them consuming energy when I'm asleep and therefore have no need for them."

That's not bizarre. What is bizarre is people turning them off some of the time because they think they are dangerous. It's already bonkers to think that they are dangerous after so many tests, but if someone was convinced that they were dangerous, they shouldn't have them turned on at all. It's like saying "I know that driving without a seat belt faster than the speed limit with my lights turned off is dangerous, so I'm only going to do it twice a week instead of three times.". Even the nutcases don't believe their nonsense enough to do what would be warranted if their ravings were true.

Not only is Zoom's strong end-to-end encryption not actually end-to-end, its encryption isn't even that strong

Re: People don't buy encryption

I've heard this argument before. It was stupid then, and it is now. There are three solutions to the problem of not being able to offer some features and provide end-to-end at the same time. They go like this:

1. Offer end-to-end and work on enabling the features in a more security-conscious way (store recordings on the cloud in an encrypted form that cannot be decrypted without the user-stored key, have dedicated call-in boxes with encryption built in that cannot continue to store keys and have individual trackable keys so only authorized ones can be added).

2. Offer end-to-end, and if someone tries to enable one of the features that doesn't work with it, you tell them they can only have one and prompt them to choose.

3. Don't offer end-to-end, don't lie about having it anyway, and cite those reasons when people ask (and most won't ask).

Any one of those is a legitimate way to handle it. What they did wasn't.

Re: Probably not as bad as it sounds

Oh, sure. If I get you an encrypted blob that used to be a frame and try to render it as an image, it won't work and you'll see nothing. But that's rarely the issue. The issue is what happens when I run a program on a captured stream, meaning a bunch of images of similar areas and a bunch of similar sound data. Both of those are very pattern-heavy, and therefore both would be vulnerable to a concerted attack on the crypto. Consider what would happen if I took a compressed audio file which I encrypted in a zip file with a three-character password and rendered it as raw audio. You'd only hear a bunch of noise, and it wouldn't even be the same amount of noise. Yet, given the file, you could decrypt it, decompress the archive, and play back the compressed file with ease. They used a visual example to demonstrate the flaw in a way that was evident to the human eye; they didn't say you could do exactly the same thing with the data in this case, just that a computer could.

Re: Not the end of the world

"they need to stop calling this 'end-to-end' if it isn't, although if it isn't end-to-end then I'm struggling to understand why they need to do a key exchange to give all participants the same key to decrypt the stream?"

It's encrypted as it goes to and from the server. The reason the key needs to be sent to users is that they need to decrypt it after it comes back, the reason it's a separate key is that symmetric encryption like this is faster than asymmetric encryption that was used to send the key in the first place, and the reason it's the same key for everybody is that Zoom doesn't want to use any CPU time decrypting a stream and reencrypting it with a new key for other people (and on that point they're basically correct as doing that wouldn't fix any of their problems). The important detail when considering end-to-end is who generates and sends the key and who gets it. In an end-to-end system, the organizer of the meeting generates it and sends an encrypted version to each participant, and the server moves these encrypted chunks around but doesn't have the ability to read them, while in Zoom's system the server generates a key and sends it to all participants, and maybe stores it or leaks it or actually nobody knows but given what we do know it's probably not good.

Real-time tragedy: Dumb deletion leaves librarian red-faced and fails to nix teenage kicks on the school network

Re: ah yes there were times at work they went round and audited the machines

I used an archive file format the name of which I cannot remember at one point which did work like that, at least to an extent. I think it would stop compressing further after about three runs. My guess was that the algorithm in use had some limits to ensure compression didn't take very long leading to inefficient choices being made. People liked sending files over slow connections at the time so this three-run trick got quite a bit of use.

Re: Our IT professor had us stumped for a long time

Maybe he just managed to get the command prompt to process the incorrect string and reject the original, leaving all other programs to use correct paths. If your main environment is said command prompt, it could hold people back for a while, assuming "cd .." repeatedly wasn't supported yet.* It'd be kind of like the classic prank where a hidden directory is placed in someone's home directory, it is set as the first path directory, and a binary named ls is placed there which runs a real ls and modifies the results for maximum confusion--neither prank stands up to concerted efforts, but both are confusing for quite a while.

*Sorry, I'm young enough that I didn't really use DOS. I don't know if either assumption would have functioned in that environment.

BOFH: Will the last one out switch off the printer?

I wouldn't count on that. Either someone ends up with a much better monopoly than everyone else and wins almost instantly, or you get into a stalemate where nobody owns a monopoly because they're all blocking others' monopolies but the players are too invested in their own chances to do anything about it. At one point during my childhood, I was playing with some people who were far too competitive so, when I finally achieved a monopoly, I added just enough houses to it such that, on average, people would pay me the amount of money they had earned since the last time they landed there, meaning that everyone's balance stayed static while mine climbed slowly but surely. They still didn't give up until we ran the bank out of the big bills. Ah, the freedom of youth where you can waste eight hours moving tokens and it's just an ordinary rainy summer day.

Re: I'd have gone for Risk!!

For me, it's one of a few less popular board games. All of them sound fun. Probably all of them are fun. Except that all of them are played with the same people, and I haven't played any of them before. These people can make many games much less enjoyable because they think they can teach me the game without having me read the instructions, they don't know how to structure documentation, and they really want to win the game which they are definitely going to do because I don't understand how it's played yet. Somehow, these people can suggest complicated games that take hours to learn and, when I suggest that I'm planning to go to sleep tonight, offer the alternative of monopoly, which is just one step above deterministic.

UK judge gives Google a choice: Either let SEO expert read your ranking algos or withdraw High Court evidence

Re: Compromise

That will never happen. Google doesn't want anyone to see these who isn't friendly to them. This could be for one of two reasons. If the data they've submitted is designed to hide or simply doesn't contain damning information that in fact exists, they don't want anyone to stumble on it, whereas if the data they've submitted is genuine, they want absolutely none of it to ever get out, even in summarized expert-created form. Foundem wouldn't want to agree either, because if the evidence shows that they were not targeted or unfairly treated, they don't want to have anyone admit this in court and if the data is on their side, they don't want to have an expert hedge on the denunciation. Court cases so rarely involve amicable discussions.

Huawei P40 pricing is in step with previous P-series efforts – but flagship lacks the apps punters have come to expect

Re: Wireless charging?

"It allows phones to be designed without physical connections, which in turn allows them to be made waterproof, and therefore more reliable."

Nope. There aren't any commonly-available port-free phones out there, and there are plenty of waterproof ones. Waterproof is not incompatible with ports.

"Also, it can prevent data theft or malware being installed"

Nope again. Unless the phone is so completely locked down that it can never be contacted, there is a mechanism for the manufacturer or repair staff to get to it somehow. Having no cable increases the likelihood that it is some magnetic data connector or purely wireless, which actually makes it easier to gain a connection without making it obvious. Whether it is easy enough to make that difference worthwhile depends on how that channel is set up.

Re: It's not really that hard

Yes. I may not trust Google's software, and because I don't I don't have it on my phone. But if someone came to me asking me to put those things on their phone, I'd be very careful to make sure that the only malware they ended up with at the end would be Google's. I am certain that there are many malware-laden versions out there today for Huawei owners, and it's important that anyone who wants to sideload those services don't find themselves installing those. Especially if those phones ever see any of your data, like your correspondence with the user. It's a perfectly reasonable question to ask.

But will the general public agree? Based on my efforts to inform my friends and family about what Facebook and its ilk do to their data, a lot of people are quite interested in maintaining their online profiles and would get annoyed if that were prevented.

Sadly, though I usually want my smartphones closer to Huawei's environment than Google's, Huawei has not given me what I need in a device. I don't want Google apps, so their absence is nice. But I also don't want Huawei apps. I don't want an undisableable Google framework running everything, nor do I want a Huawei-branded replacement. And sadly, Huawei has not reversed its decisions to keep me out of the bootloader, preventing me from installing a replacement OS.

For these reasons, I'm concerned that Huawei may fall in a gap between the two groups. They don't offer enough apps for the general public and don't offer enough access for those who like the freedom of custom Android distributions like Lineage OS. Only time will tell if they manage to sell their system to one or another of those groups or if there is a third one I haven't considered.

Amazon says it fired a guy for breaking pandemic rules. Same guy who organized a staff protest over a lack of coronavirus protection

Re: Bit of a non-story

I'm not going to accuse Amazon or this worker of lying about any of this, but if someone wanted to, there are some very easy lies that make a lot more sense. Instead of lying that he came in when he didn't, Amazon could lie that he was told not to. It is difficult to prove a verbal remark was made. If he wanted to come to work for whatever reason but was told not to, he could either lie that he was ever told not to or lie that someone informed him informally that he had to. The major problem remains, though. The story Amazon's using doesn't make a bunch of sense to me, whereas it has been called plausible above. Since it makes sense to somebody, I'd like to hear the theories that I've not thought to consider.

Re: Bit of a non-story

I am still confused why this is plausible. Could Amazon want to keep him at home? Absolutely. But if they did, why did he insist on coming back in? In their statement, Amazon said that he would continue to receive pay while at home, so if he came in, why? Was the work that fun? People ignore social distancing requirements all the time, but they usually have some reason. They were bored and wanted to meet with friends. They wanted to buy things that they didn't necessarily need. They wanted to go out and make extra money. But I see no reason this guy would have wanted to come to a workplace he thought was unsafe when he wouldn't get anything for doing so.

I posted a comment similar to this earlier, but the votes on that one seem to indicate that I don't know what I'm talking about. Could someone please explain why I'm wrong?

Re: Unions

Except that most do make sense.

Elections: The idea is that people vote for their desired representatives, but human nature leads to people voting without knowledge, people hijacking votes, people faking or suppressing votes, or institutions coming into play to maintain undemocratic governance though the elections exist. They are flawed, and you could attack them on this basis. It does not prove elections useless.

Credit cards: They are a good idea for a payment method and a way of taking out short-term small loans, with a high interest rate to dissuade people using them when they won't be able to pay. But human nature may take over, leading to overspending and a spiral of debt, which can lead to far-too-broad credit reports which get leaked, economic crises, and increased poverty. The idea has flaws, and you could attack it on that basis. But it doesn't prove credit cards useless.

Free beer: It would be nice for those who like beer, but when there are no limits on how much you can have, people end up drinking all the beer so there isn't any free beer for anyone who comes late, and now you have a bunch of drunk people who tend to be harder to manage. The idea has flaws, and you could attack it on that basis. But it doesn't prove it useless.

Re: One Sided Reporting

It's always possible that Amazon warned him, offered to pay him while he stayed home, etc. But does the following story really sound likely:

The man works for a company, but he is unhappy with working conditions; he feels them to be unsafe and doesn't feel the workers are paid sufficiently for the current conditions. Please note that he was willing to accept the pay earlier when he joined the company, so his reservations are about the current conditions although he could already have been displeased. He protests about this to the company. In the next two days, he somehow manages to come into contact with someone who had a confirmed case of the disease in the workplace even though someone with a confirmed case or symptoms of the disease should definitely not have been working there and violate repeated requests, which he seems to do quickly. His employer suggests to him that he should not come in to work, thus not subjecting him to the conditions he felt were unsafe, but that they will still pay him the old rate that he had accepted back when he wasn't so worried about the conditions. He chooses to violate this order despite the fact that he isn't being paid any more for going in, by going in he subjects himself to the conditions he was protesting only two days previous, and he puts his job at risk.

So tell me, if this is the situation, why is he choosing to violate the orders to stay home with pay? Has he demonstrated any incentive to want to be there? He's clearly not getting anything from Amazon for showing up, and he's already indicated he isn't happy with the situation there. The only reason I can think of is that he would want to continue organizing protests, but he could do that by contacting people outside of work. Also, how many warnings can he have gotten and violated? He protested on Monday and was allowed in then, so the warnings to definitely not come to work must have been between the protest and today. That's not a lot of days.

I don't know whether what he or Amazon says is right, but I do know that Amazon's story doesn't make a ton of sense. When you combine that with this particular person having angered Amazon, there are some clear possibilities that are worth consideration. It may be that, if this ever gets investigated, we will find out that there was a miscommunication and he in fact was fired for breaking regulations. But we may find many other things. The situation seems well worth a look.

Fitbit unfurls last new wearable before it's gobbled by Google, right on time for global pandemic lockdown

Re: All your health data are belong to us

I very much doubt that any manufacturer will balk at taking the data and using it as they see fit. However, if you're willing to accept some reduced functionality, there is an app called Gadgetbridge (look in FDroid) that can pair with some trackers and is local only. I don't know how well the supported devices work for your use cases, but for perfect privacy that's probably the only option.

Cloudflare family-friendly DNS service flubs first filtering foray: Vital LGBTQ, sex-ed sites blocked 'by mistake'

Yes, it is.

Censor: Verb

(transitive) To review in order to remove objectionable content from correspondence or public media, either by legal criteria or with discretionary powers.

(transitive) To remove objectionable content.

Their changes are a censorship technique, just a small one that's voluntary. By using their technique, you agree to their definitions of what is acceptable and what isn't. That doesn't mean they're censoring by force or they're violating someone's rights, but anyone who uses the service grants them the right to decide what they think is objectionable. This is a tricky thing to get right, and there's always some site that, if they blocked it, would annoy you. As I'm not intending to use their filter list, it doesn't much matter to me what they do, but it is worthy of discussion when a place starts to make decisions about what they think is acceptable or not in case you disagree with them and might want to modify your behavior accordingly.

Sunday: Australia is shocked UK would consider tracking mobile data to beat pandemic. Monday: Australia to deploy drone intimidation squads

Re: And still

Well, if you live in one of the mentioned countries, you're not allowed to leave it behind (or go out). If they try to reach you on your phone and you don't respond, that's considered reason enough to go after you. True, that system has more holes in it than the average IoT firewall, but it's still more invasive than the drones are.

And still

And still, the drones are much less invasive than tracking that has been covered here in recent days. With the drones, people can be seen as they socialize physically with one another and their socializing can be disrupted. But the drones don't easily allow perfect identification or tracking. Mobile phone tracking does. Drone tracking can easily be noticed. Mobile tracking is easily hidden. Drone tracking has intrinsic limits because the craft must be piloted and even with the most expensive cameras and microphones there's only so much that can be picked up from in the air. Mobile phones are tailor-made for capturing people's actions. In fact, assuming breaking of quarantine orders is as common and severe as recent police action in many places suggests, I would be much happier with Western Australia's reaction than with Singapore's or Taiwan's.

Zoom's end-to-end encryption isn't actually end-to-end at all. Good thing the PM isn't using it for Cabinet calls. Oh, for f...

Re: To be clear ...

"If using it's record to cloud feature (as opposed to record to this PC), the server would need to be given the session key used for the AES streams of that meeting. It is effectively another client for that call."

Some solutions:

1. Record from a local client and upload. No key needed.

2. Record encrypted data and let it be decrypted by the users.

3. Fine, so meetings recorded to cloud need end-to-end turned off. But other meetings recorded locally or not recorded at all would use it. So all I have to do to ensure full encryption is not to record to cloud? Thanks for telling me. Oh, wait.

"The telephone dial in numbers would also need the session key."

Some solutions:

1. User approves numbers individually and sends them keys. The server doesn't need to know, only the phone endpoint, and that can erase them.

2. Provide an option for a secure, user-maintained call-in point. That would be run by the user and therefore can be trusted with keys.

3. Fine, so meetings including phone call-ins need end-to-end turned off. But other meetings using the software clients only, which is most calls, would use it. So all I have to do to ensure full encryption is not to use a phone to call in? Thanks for telling me. Oh, wait.

You are missing the point. The major problem isn't the lack of end-to-end encryption. The major problem is not having end-to-end encryption but lying that you do.

Re: To be clear ...

Ah. So I get to take all Zoom's stuff (obligatory XKCD link). Be right back; I need some new servers. Anyone else want stuff while I'm there?

Internet Archive justifies its vast 'copyright infringing' National Emergency Library of 1.4 million books by pointing out that libraries are closed

Re: It has been explained many times ...

"could we have copyright on the books themselves for say 10 years but a longer copyright on derivative works - to stop the TV and Movie people just counting down for 10 years?"

No. It's not that easy. When copyright ends, the work covered under that copyright goes to the public domain, meaning anyone can get, make, or redistribute copies, and they can modify them too. If someone wants to use the same plot in a different medium, they can do that without restriction if the work they're using is in the public domain.

Now you could modify the law to effectively create such a policy, but it wouldn't be popular with either copyright-opponents or the copyright promotion groups. Probably the easiest method is to lower the penalties for copyright infringement based on how old the work is. Ten years or younger, full value of the infringement. Ten to twenty years, 50%. Twenty to thirty years, 20%. Thirty to forty years, 10%. After forty years, public domain. Therefore, if a person infringes copyright on a copy or two, it's not cost-effective to pursue them for it after a certain period. But if a multimillion movie is made, one tenth of that is still a claim worth making. The copyright holders would say that this law strips them of their effective rights after ten years and would absolutely hate it. People who don't like copyright at all would argue that having any at all, let alone one that lasts forty years is oppressive. Legal experts would argue that the law is too ambiguous with things like calculating the value of an infringement. But if we could somehow convince all these people to work with us to fix it, then we could really make some progress. For the first two hours after which the groups who have been brought together would start a major brawl.

Re: It has been explained many times ...

The best set of restrictions on copyright is a contentious issue, and the only guarantee we have is that we (meaning any set of three or more people) won't ever agree. Still, your twenty five years allegation isn't really true. I want you to point me to a work that meets all of these requirements: 1. It made very little money for the author in the first twenty five years of publication, 2) it became popular after that point and sold many copies, and 3) the author isn't described in literary analysis papers as "recognized only posthumously for their work". I think you'll find that there aren't many things.

Are there movies or TV shows of books that were produced more than twenty five years after the original was published? Of course. Delete the classics that always get revisited. There are still some. But usually, these books were popular soon after publication, had a video version produced soon afterward, and are now being revisited because television series are very popular or the film people twenty years ago did a bad job of it.

But fine, the author should still get money from the latest version of their product because they wrote the original plot. We can make the law allow that without having such a broken one. It's useful to try to balance the protections for creators and the usefulness to society of the unrestricted work. We did it with patents; we can do it with copyrights. Giving them and anyone else who can find a way to piggyback on the law unlimited rights to everything and plenty of penalties to throw at others doesn't a good policy make.

Relax, breaking a website's fine-print doesn't make you a criminal hacker, says judge in US cyber-law legal row

Re: Overly Paranoid.

Researchers are frequently targeted under criminal law based on complaints from people who don't get it which are taken too seriously by police who don't get it. Examples are available in the U.S., U.K., and probably some other places as well. At a lower level, have you ever reported a security problem to someone you don't know? I have, and while you sometimes get gratitude, there's often a measure of suspicion about how you know this and why you're telling them. If you do it a lot because your job is security research, rather than only every once in a while because you find things, you're more likely to encounter someone suspicious enough to call the cops on you. Since they use this law against people who had no malicious intensions, it is very valuable that someone got legal precedent, albeit a fragile one, that they can go ahead without having to worry about American police going after them (or in reality, a legal precedent to tell the police about when they show up).

Huawei rotating Chairman: Chinese government will not 'just stand by and watch Huawei be slaughtered'

Re: Well I used to be fact driven...

"But after Covid there's a bigger picture and proactively not supporting China after crippling the planet might be a thought..."

Because if you don't buy their tech, they will ... not have viruses mutate into deadly forms? What? No, really, what? Something was going through your mind. You had a reason for linking these. But I have no earthly idea what it is. How does any restriction on China short of forcing nobody to come in or out ever help with a virus mutating there? And why China specifically? The permanent quarantine solution can work anywhere. So now I really want to know what benefit on viral spread we can expect from limits on Chinese tech companies.

Cloudflare is over the moon because its pro-privacy 1.1.1.1 DNS service got a clean bill of health from everyone's favorite auditor – KPMG

Re: Not yet, at least

DoH to your own private server is only going to protect you from a potentially insecure local network as far along as your ISP. Of course, compared to standard DNS, it at least gives you that, but nothing more. Your server also has an ISP, and it can watch your standard DNS resolutions to figure out where you're going. If you didn't want to trust Cloudflare, the best way to maintain privacy is to make the server available to others, either a specific set of people to maintain a cap on resource usage or making the server public. Since this inevitably entails quite a bit of resource usage for others and since others don't know for sure that you can be trusted, that might not work as expected.

Hunting for IT staff? Lost your job during the pandemic? Sysadmin vacancies – and a free job ads offer – inside

Re: can't travel

I think that reason contributes, but I also think most employers don't have the resources to start hiring right now. A lot of smaller places are quite low on cash and don't know whether income will head up any time soon. Even those that aren't worried about their finances probably have all their existing employees tied up in other administration. They can't take the time of the existing admins to prove that the new one will know what they're talking about or worse, to train them, because the existing admins have to respond to every support request about remote working stuff not working. And the people who would do the nontechnical side of the interview are probably running triage with other business matters that aren't getting handled well in the chaos. To all out their on either side of this issue, all I can say is that I'm sorry for the chaos and I wish you all the best.