Posts by doublelayer

Boffins debunk study claiming certain languages (cough, C, PHP, JS...) lead to more buggy code than others

Re: poor tools can't be blamed?....sure, sure, suurrrrre

You're allowed to complain about your tools. You're allowed to say that a tool is not fit for purpose and require a better tool to complete it. What you aren't allowed to do is *blame* them, as in "It's not my fault it fell apart immediately after you got it. You should have seen this terrible vice I had.". The tool can be worse, but that leads you to have a worse time trying to build the result, not the result simply being of less quality.

That said, there is at least some argument for poor tools if the person concerned was made to do the job using the poor tool in the same time limit needed for the good tool. However, for programming languages, it is likely not that one is better or worse, but that one is better or worse for each specific coder and their experience.

Are you a Windows 1 in 10 (1809)? Or a mighty 80 percenter (1803)?

Re: 19H1 (aka the Windows 10 April 2019 Update) is likely to hit in a matter of months..

That's the official name. Just as the 1809 update was called the October 2018 update even when it was delayed until November. I don't know who is setting the numbers or the names, nor do I know what the H is doing in that number now, but that's Microsoft's decision.

Q. What do you call an IT admin for 20-plus young children? A. A teacher

Given how many people have mobile phones, it would not be particularly difficult for a child to obtain phone numbers. They could easily get the student's number from their contacts, and with a little effort, gain access to their contacts using a number of methods. I think the risk of bullying is important, as it has proven difficult to prevent. I therefore suggest that we do our best not to make it easier.

However, let's consider some ways the access of these accounts could be abused by others who are not schoolmates. This is yet another source of data, and one that companies would not mind mining. Do we want our children to have their primary school grades analyzed or leaked? I think we can all agree the answer is no. There are many parents who obsessively check the grades of their children, but some of them* would not mind seeing the grades of other children for comparison. They could use this insecurity as an entrance. If we want to overthink this, there is probably a lot of personal information in this that could be used to socially engineer the child, too.

Children do not have much data on them. Their schoolwork can be a very personal thing. Some may divulge it to others, which is entirely their right, but others do not want their friends or anyone else to know all the details. I believe it is extremely important that it remain private to them and their parents. The worst-case scenario with a leaked phone number is irritating calls. This is certainly a thing to be avoided, but I can think of worse things that could be done with leaked educational data.

*Parents spying on students' grades: I know parents who do this, usually by "casually" asking students increasingly leading questions. It is not that many of them, but one is already too many and there is more than one.

Re: "Young students, for example, cannot be expected to remember and enter a password. "

I'm not sure that's accurate. In principle, I agree that the stereotype should die. However, let's analyze some things you claimed:

"And of course the entire computer industry and the Internet was developed by people now nearing their allotted four score and seven years."

That puts the computer industry and internet as developed by people born in 1932. Some of them, sure. Most of them, no. The people who did a lot of the modern-day internet technology were born in the 50s through the 80s. We're not including every computer science professor who wrote a lot of important texts; I'm thinking the engineers at the companies who designed the products we're currently using, from old concepts like HTML and HTTP to newer technologies like JSON. However, I also contend that this doesn't matter; if the point is that older people have had less contact with computers, citing old computer scientists is finding the exception that certainly doesn't disprove the rule.

As for when the majority of people encountered computers, I do not think we can really count the machines of the late 70s and early 80s. I don't think they count for a generational rule because they were not that commonly held by everyone. Remember that a lot of people here had them because we self-select to be more interested in computers. The population at large was not guaranteed to have a home computer in 1985. I would conservatively estimate that, if you were a child in 1990, that you would then be guaranteed to have a lot of contact with computers during your youth. We'll say that this would happen if you were younger than ten years at the time.

This puts our threshold of stereotypical computer familiarity birth year at 1980. In other words, the maximum age for such a person is 38 years. Many teachers are older than this,, as it is a job they typically hold for many years. Since we're talking about primary and secondary schools, I estimate that about a half of my teachers were above the age of 40. Nearly all the teachers were older than 40 in my primary school, though I do not know if that is a pattern.

Of course, this is a stereotype, and will not be generally correct, but I believe I've made clear that there are many people who did not have contact with computers during their youth. There is no guarantee that, even though they have undoubtedly had to use a computer at some point during these past decades, that they are literate in the technology and can successfully manage it. Look at all the people that are, according to this stereotype, supposed to know what they are doing. Many of them are not competent in using it. Unfortunately, while I have found many older people who have no difficulty with technology, I have found many more who reject it entirely or make me wish that they did.

"There is a world of difference between being able to guess the login for a child's reading record and being able to log in to a system which gives you name, address, phone numbers etc."

I beg to differ. Having an address or phone number can lead to spam, sure. Consider, however, how things would go if some students could find the grades for other students. That could be very unpleasant, and lead to torment of various types. There's reason number one not to let it happen. While we're on the topic of torment, a student with an urge to be malicious could log in as another and send in homework, either to have their victim fail or to frame them for an offense. Reason number two. An external attacker could obtain a list of students from the school (this is easy to get) and access all the accounts, either communicating with the child, sending the child elsewhere (think an XSS on the page that probably wasn't built well), or collecting information that could be used to track them. Reason number three.

Access to these systems is sensitive, and must be protected.

I helped catch Silk Road boss Ross Ulbricht: Undercover agent tells all

Re: Great Read

Not so. The way that Tor hidden services work is complex, and I suggest you read about the details and complexities of it because it is intriguing. However, since you are on the Tor network and the .onion is as well, you don't have to go to an exit node. An exit node is only needed when you want to leave Tor onto the regular web again.

As for how to purchase server space without identification, it is a bit difficult for most hosting companies, but it can be done with cryptocurrency or with cash in a paypal account. You have to go to various places to make that truly anonymous, but it works. The mechanics are left as an exercise for the reader. If you do it wrong but think you've done it right, prison time may occur.

Re: More Questions

They might have done that, but they didn't need to. They had access to his email. Presumably, somewhere in the trash folder was an email with the subject line "Your order of a [insert laptop model here] has shipped". It was a laptop, though, so they probably had enough time to look at it as long as they could keep him from pressing any keys.

Apple: You can't sue us for slowing down your iPhones because you, er, invited us into, uh, your home... we can explain

Re: Is everyone taking crazy pills?

That's not the alternative, or at least it shouldn't be the only alternative. The other option is that it works like any other electronic device; it continues to function at its speed but the battery doesn't last as long. You know, like every other phone or laptop.

I wouldn't mind it if they put in an option to underclock for increased battery life, which would be useful both as the battery became old and if there won't be convenient access to recharging for a while. However, I have to wonder what they did to their system that meant it would restart randomly rather than just deplete the battery quickly. That smacks of bad design to me, and the workaround, though perhaps not planned obsolescence, becomes a crutch for defective products. The other option is that they did have obsolescence in mind, and specifically designed it to break. I don't know which it is, but I think the former is more likely. Either way, they messed up.

Re: On the subject of slowing things down...

I would guess that Mojave has tried the APFS rewrite again for those with mechanical drives, and that yours may not have worked all that well. A reinstall might fix that. I have been holding back on the Mojave update; I have all the updates installed, but I prefer to do my massive OS updates as clean installs because I don't have a great history with in-place upgrades.

Re: "Apple had no duty to disclose the facts regarding software capability and battery capacity."

I agree with most of your points, but there is a difference between what they said, "We only warranty these batteries for a year" and what they now say that means "Your battery will only last a year, and if it lasts longer, you should be grateful." They only warranty the devices and all their components for a year because the users are likely the cause of damage after the year, and also they have found that time period to be financially useful to them. The components can and should last much longer than that. Their claim alleges a thing that is not a fact, and they are trying to use it to say that they can do anything they like that affects the hardware as long as the hardware is more than a year old.

As netizens, devs scream bloody murder over Chrome ad-block block, Googlers insist: It's not set in stone (yet)

Re: welp....

"Another - constantly berate your family and friends for how stupid they are and how little they value your time, [...] and you're there only because you cannot tolerate such worthless idiots accessing the internet without someone much more skilled there to take responsibility for watching over their actions [...] [t]hus guaranteeing you will have few people to worry about!"

Thanks for the suggestion. I think that sounds like a wonderful alternative to just not doing it and letting them decide whether they want the system.

If you think that is the attitude that we have, you are not getting the point of our posts. We are not saying that people lack the responsibility to run technology or use the internet. We are saying that some of them lack the knowledge necessary to maintain a self-run DNS server to block hosts themselves and possess other attributes that make support more difficult. Take my post, where I stated that my parents might easily manage to disable such a system in a way that would make it difficult. This is not because my parents have any specific problems. I greatly respect them, and there are many things they can do very well that I cannot do well at all. Unfortunately, Linux administration is not one of those things.

It is not because they disrespect me or my work that this would be problematic; it is because it is complex and I don't need to spend the large amount of time that I predict support will require. If I lived close to them, where I could quickly come over and repair anything, I would likely set it up if they requested. If I could be assured that there would be no hardware interference, I would also set it up. The reality, however, is that the system would probably be interfered with, and I would either have to spend a much longer time repairing it than it would take if I could do so myself, or the users would have to put up with the system being down for a longer time. That does not provide enough benefits to the user or to me as support for the system in that situation to be worthwhile.

Re: There is always the old fashioned way

You could theoretically run your own DNS system that periodically checks all the domains you don't want, and then modifies your firewall to block any address that shows up. However, the better response should they prevent normal DNS is to stop using the thing.

Re: welp....

Unfortunately, this is exactly the problem. I have such a filter on my network. I'd like to install that on my parents' network. One of the aforementioned parents actually wants that, because they do not like ads. However, I haven't done it. The reason: I do not live close to their house, so when they find a way for the system not to work, I'll have to do over-the-phone tech support to instruct a technically-unaware person how to fix an embedded Linux system. You may say that the system would be able to handle most error conditions, and on that you would be right. I don't doubt that it could probably fix itself on most unusual network activity. Unfortunately, these would be some scenarios under which it wouldn't be so capable:

1. Someone pulls the power on it, and doesn't recognize that.

2. Someone needs an SD card, and removes the one running the pi (yes, I do think someone would do that. I have a specific person in mind.)

3. Someone disconnects power at an inopportune time, and the SD card is corrupted. The other version of this is that power fails but something went wrong and the SD card was corrupted anyway.

4. Something goes wrong with their home network, and the technically unaware choose to use the reset button under the theory that that will fix their problem (they have done this before, thankfully I had a backup config for the device from when I set it up the first time).

5. They want to administer their own system, and ask me for the access. It is their network, so I'd have to give them access. I would then be kept up at night answering questions about whatever they used their access to break.

You might respond that this shouldn't stop me, because even if the device breaks, they're no worse off than they are now. Unfortunately, the history of managing those systems says otherwise. Every time something stops working, even though I didn't have anything to do with the problem or in some cases set it up, they will complain to me. These are the people who refuse to use a Linux machine, even as a backup. They may ask me to assist with a problem, but they will also take advice I give and do the things I exhorted them not to do. For example, one of them strongly dislikes Google and complains about them, yet continues to use Chrome, Google search, and gmail. You figure that out; I have told them about Firefox, duckduckgo, and for that matter ad-blocking extensions multiple times. This is a quagmire I don't need to walk into.

Data hackers are like toilet ninjas. This is not a clean crime, you know

Re: Inquiring minds want to know...

"An honest request for advice: how secure is this password? How great is the risk that I may have to spend a day changing my password on some 200 sites?"

This password is not secure. Actually, that's misleading. The password itself is probably fine, depending on length; I assume your name and date combination push the length up, and it is likely not used by others. In that, you're fine. Your problem arises because you use it on multiple sites. This is where it is bad, because it only takes one site to store it in plain text, hash it badly, or have someone persistent check a lot of combinations for them to break into all your other sites. If that happens, it is likely going to happen before you know that one of the sites lost their password database.

Some recommendations:

1. Use a password manager to not have to remember each password. Allowing that to create passwords will ensure that they are strong and unique to each site. You only have to remember the master encryption password to unlock that file. If you routinely have to log in on other devices with no access to yours or you mistrust password managers, you can go with another option, but this is really quite a good option.

2. Use your base, but include a site-specific component to your password. An important note, make this specific part difficult to identify; if it's just the name of the site, it won't stop someone for long. This isn't as secure, but it will protect you from a lot of things.

3. Periodically change the passwords. If you are going to have passwords that are insecure, make sure that they aren't valid for long. If it takes a hash cracker a few weeks to get the database and get your password from it, your password could have been changed before they can use it. Forcing password changes is usually a bad idea because it leads people to use insecure ones, but if you keep having passwords of similar security but change them often, you'll have better insulation against attack.

4. Be vigilant. Keep a list of sites where you have this insecure password system, and if you ever see that one of them is insecure or has been breached, change the passwords immediately.

Again, I'd really suggest using option 1 unless you have a specific reason you don't want to.

Plug in your iPhone, iPad, iPod, fire up the App Store: You have new Apple patches to install

Re: The Joy of updates

The major privacy things are kept. After updates, I'd recommend a trip down to privacy/location/system services, though, as sometimes they change or rename them, which can be accompanied with a turning on where you have turned it off. The one that comes to mind was their thing that is now called significant locations, but used to be called something else. I think it was around IOS 10 when that was renamed and reenabled itself. Mostly, however, apple doesn't really change that many settings as compared to android, so you're probably fine.

Fake broadband ISP support scammers accidentally cough up IP address to Deadpool in card phish gone wrong

Re: Who is to blaim for being taken by scammers?

So in any scenario where something bad happens to someone else, they did something wrong. At least, that is the case in a large majority of cases. Why did you open your door for the armed burglar? Surely you're intelligent enough to check the person at your door in some way before you open it to see them, right? Therefore, it's your fault if you get shot by a burglar. Is that the logic you're using?

Unless the victim knows the scam is coming and chooses to go through with it, which only makes sense if they are really a conspirator in the fact, they are not at fault. They could have done something better. They might be viewed as irresponsible and face consequences for it, for example not getting promoted because the company thinks they shouldn't be given any more responsibility, but it is not their fault that something negative happened to them.

Surface: Tested to withstand the NFL. Microsoft firmware updates? Not so much

Surface firmware problems

I was asked to help fix a surface pro 3 that had developed a firmware problem, in that it would not recognize the correct charge for its battery, so would not hold a charge at all despite having a relatively new battery. This had been fixed in a firmware patch that would not install because "The battery level must be above 40% and the device must be connected to power to install this update". I tried a lot of things to circle around this error, but no luck. In addition, the charging cable, which uses the same strategy as Apple's magsafe connectors so that it can come out easily if disturbed, meant that ordinary activities could pull it out and force a long recovery process. So the people who asked me to fix their surface now have a particularly weird desktop, with its magnetic power plug taped into the socket, the cable taped to the back, and the device taped to the table. The least portable device built with extreme portability as the defining goal.

Want to spin up Ubuntu VMs from Windows 10's command line, eh? We'll need to see a Multipass

Re: Webservers?

Quick answer: yes.

Long question: Why? You could run any OS with webserver in your VM solution of choice. You could exactly virtualize your server environment and share the network connection, thus having local access. If it is a server you don't mind setting up, you could also run apache and any other dependencies (definitely MySQL and PHP but a lot of other tools are supported) directly on windows. I've done it*, and setup is very fast and it works the same unless you have some specifically Linux backends.

*We needed an internal server. They put the windows image on a machine and put it somewhere I couldn't change it. What was I going to do?

Re: I love WSL, since it made scripting on Windows usable after 30 years :)

Powershell is nice and powerful, it can do a lot of the scripting things that CMD couldn't do before, but could they make the commands shorter? When I've written PS code, I've either ended up with monstrous lines of code to run a few commands or I store everything (really everything) in a bunch of confusingly-named temporary variables in the interest of readability. I know you can have long and terrible lines in shell scripts too, but they're less common in my experience.

French data watchdog dishes out largest GDPR fine yet: Google ordered to hand over €50m

re: There is no Refuse option available.

And when the site is not one that you can simply ignore? Sometimes, the site is one you are required to use. Either it is a site run by a business or governmental agency that you must use in order to fulfill some obligation, or in other cases it is the only site providing a necessary service. Other times, there are a number of alternatives, each of which has the same or similar cookie system. I have cookies autodeleted and do some other things to attempt to prevent this from being as creepy as it could be, but it isn't always possible to go elsewhere when these problems arise.

Man drives 6,000 miles to prove Uncle Sam's cellphone coverage maps are wrong – and, boy, did he manage it

Re: Why are physical checks needed?

The tests were done in Vermont, which couldn't be measured fully because a lot of the areas are remote and rural. If congestion was the cause of these subpar measurements, the mobile companies do not know how to deal with congestion. These aren't metropolises we're looking at; the largest city in Vermont is Burlington with ~42000 people in it, and that is the largest city by 250%. Also, a challenge can't be made because an algorithm says the situation is bad, both because the FCC has set the rules to be much stricter than that but also because someone else could write a different algorithm to disagree. They were required to have ground truth, so they went and got it.

Oh snap: AWS has only gone and brought out its own Backup

Re: All fine and dandy

But the major benefit of cloud is that it can be cheaper, conditions apply. The cloud providers sell economies of scale where your usage can be balanced against everyone else's usage to reduce the total amount spent on computing so you only pay for what you're using, as well as your risk of hardware problems which again reduces your cost. Otherwise, cloud doesn't tend to offer much more than you could do with your own hardware. There is a minor benefit in having geographically-distributed systems for faster access by people in distant locations, but this is rarely an issue of paramount importance. If cloud isn't cheaper, the only benefit that is distinctly relatable to cloud is scalability, but again, conditions apply. So many people either jump on the cloud bandwagon or refuse to use any cloud-related product whatsoever without actually looking at whether it is useful in the situation.

Re: All your eggs in one basket

Backing up internally can be useful in a few situations, for example if you messed up your VM or database and need it restored to the way it was before you did that. Mostly, that's an insurance policy against user failure, analogous to internal backups taken off on-prem servers and stored locally. For the typical case of backups, that is restoring data after something has destroyed your current system, it is less useful. Normal cloud activity is supposed to be insulated from things like disk failures by the cloud provider, so, if you are restoring backups for a small scale hardware problem, your provider probably has a major problem and you shouldn't be using them. Meanwhile, if something happens that is large enough that it takes out a datacenter, your backups stored there will be just as gone as the services you ran there. Maybe this backup solution will allow you to download the backup data and store it on a system of your choice, but I doubt it.

It’s baaack – Microsoft starts pushing out the Windows 10 October 2018 Update

Re: "our next generation machine learning model"

I think you may be a bit overzealous in your defense there.

"Again, to be fair to Microsoft they are tasked with rolling out a global update for a user base who are 80-90% computer illiterate,"

Good start. I agree that this is a major problem for Microsoft's engineers.

"many of whom bought computers that were either built or upgraded by a 'mate who knows about computers' or the local back street 100% legal PC repair shop."

Some of them are, but most of them are using computers that were built by the companies that build or sell computers, using the software environment that those companies came up with. Dell, HP, Lenovo, etc. have much more market share each than custom-built machines, especially when considering users who are tech-illiterate. Those machines have many of their own problems, and a great deal of the driver or hardware problems experienced by users can be laid at the feet of those companies, but it is not fair to classify most windows machines as built with extremely weird components.

"Think about the chances of all them 'genuine NVidia GeForce Ultra cards for £30 on ebay' working after the update,"

I don't think those are going to work, but the kind of person who goes to eBay and purchases an obviously not-genuine graphics card is the type who should expect problems. The type who buys a computer from the computer store and has done nothing at all to the hardware shouldn't expect anything like those using counterfeit graphics cards.

"but they'll be the same 'know-it-all' teenagers that you'll see posting YouTube videos about how Microsoft programmers don't care and aren't listening."

Those people are probably not the ones complaining here.

"In short - the fact that Microsoft have a development team that can release this stuff without destroying the world more often is a minor miracle (and anyone who works in software development would agree)"

They are not as hyperbolically bad as comments here might lead one to believe, but they have had times where they didn't do what they should have (the initial 1809 deleting files thing, for example, was purely their fault and could have been fixed when the Windows insiders found it rather than after it deleted standard users' files).

"just ask which development environment is the world's best - Microsoft Visual Studio wins hands down - made by Microsoft developers for developers. (and yes I'm aware Eclipse is better for some use-cases)"

Personal opinion, not necessarily one I agree with, either.

Ahem, Amazon, Google, Microsoft... Selling face-snooping tech to the Feds is bad, mmm'kay?

Re: This is a nice goal

Perhaps an analogy would help. You are in a boat, which is leaking. The hull is weak, so new leaks are going to form soon. You could spend all your time patching every small leak you see. That is like going to each company and trying to stop them; it will help for a while, but it won't solve the problem. Bigger leaks will form, and you will sink. Instead, you should plug the leaks that are a major problem right now, but put as many people as you can on either strengthening the hull so the leaks stop or sailing the boat to a place where it is safer to be after your boat sinks. That would be like trying to pass legislation about the tech, either making it illegal to use or putting restrictions on it. You may have a lot of trouble actually getting that to happen, but a very low probability of something working is better than a guaranteed bad outcome after a delay that will probably not be very long.

Re: This is a nice goal

The point is not that they might as well give up and provide the systems, but that the course of action of contacting each company that plans to make the system available is not going to result in a successful privacy-respecting situation at the end. After delaying the thing for a few months, the system will come into existence anyway. You instead have to do something about the desire by those in power to have such a system running, either to convince them that it is not good (good luck) or to instate regulations in place that make the system better for privacy when they do eventually build it (again, good luck). Simply playing whack-a-mole with the businesses that are thinking of providing it won't work very well because eventually someone who doesn't care about the petitions will come along.

RIP 2019-2019: The first plant to grow on the Moon? Yeah, it's dead already, Chinese admit

Re: Safe reserves and efficiency

Couldn't they have tested this before they tested it on the moon by taking their small biosphere to Antarctica and leaving it outside? They could start when there is a lot of sunlight and then cover the solar panels if present to simulate the nightfall. If the heater can't survive a fortnight in that, it won't on the moon either. The transit costs would be much less.

Goddamn the Pusher man: Nominet kicks out domain name hijack bid

I find this type of person to be really annoying, as they have found a bunch of domains that eventually someone will want and will only give them away in exchange for much more than most of them are worth. That said, they have the rights to those domains, and I don't. It's annoying because I want to buy them for less than the domain resellers want to get, but it is not as if they've done anything improper in obtaining them. If they disappear tomorrow, I'd be happy, but I would not do anything nor would I want anything done to them to take away the things they obtained in a completely legal way.

Re: How about some grace time after expiry?

That doesn't make it anyone else's fault. If the company put their asset under the control of someone and didn't check that that person was doing what they should be doing, it becomes their fault and their problem. You have no right to a domain name; your right to use the name starts when you buy it and ends when your agreed time of purchase ends. At that point, the name is available again. From the sound of it, the policy provides for a convenient length of time so a matter of minutes can't kill the domain. If they didn't notice that 1) the registrar is sending a bunch of important-looking messages to us about our domain and 2) the services that happen from our domain have stopped being used and if you go to the domain you get a DNS lookup failure, then they don't seem to be doing the proper tests I'd expect from the least technical of organizations.

Brit hacker hired by Liberian telco to nobble rival now behind bars

Re: highly skilled hacker

In constructing that malware, there was some work finding holes into the systems. Usually, the default passwords were helpful, but a lot of devices that were supposed to have things like web interfaces limited to local subnets or devices behind NATs and thus harder to find had security holes that nonetheless allowed access. UPNP was a major culprit here, though not in the least the only one.

What a cheep shot: Bird sorry after legal eagles fire DMCA takedown at scooter unlock blog

Legal question

"With the information out there that people can basically steal existing scooters for $30 and a bit of effort, it remains to be seen whether people will stop throwing them in lakes and trashing them in favor of a more illegal approach of repurposing them."

I feel little sympathy for this company as they don't seem to have much of a problem leaving them in people's way, but doesn't the "throwing them in lakes" method of using them also count as illegal, as you are destroying someone else's property? For someone who is considering only those alternatives, at least steal the thing; it's less wasteful.

Peak Apple: This time it's SERIOUS, Tim

Re: Recession ???

I want innovations. My phone is fine, and does the things I do with it perfectly well. For that reason, I do not need another, and the phones out there don't do anything new, so that doesn't tempt me either. If someone did come out with a phone that had new features, that might indeed tempt me into buying it. Some new features are useful. Phones with network connections were useful. Phones with touchscreens were useful. A phone with the capability to have a full sized keyboard with moving keys or a clever simulation thereof that still fits in my pocket would be useful. That's why they should innovate. It would cause people to drop their older devices and buy new ones much faster if the new phones did something useful that the old ones did not, rather than being a different size and having a camera with more pixels.

Re: So where is the new market ?

It's not our job to find a new market for apple. If there is or isn't a perfect new market for Apple to enter, it does not change the fact that they have focused too much on their iPhone line and neglected other products and other opportunities. The brilliance of Apple at one point was that they could find a place that seemed like it didn't need a ton of innovation and they could innovate anyway. Whether the result was pleasing to everyone was not the point; whether you like or dislike iPhones, smartphones, or mobile phones, you can't deny that Apple's creation of the iPhone caused a lot of innovation in the market, both from them and their competitors. However, let's look at where Apple is and where they could go.

Where they are:

They have a few lines of products. Most are somewhat stagnant.

Desktops:

iMac: This is still a normal machine, and suits those who need a lot of computing power (from a standard home user to their pro model with xeons) and wants that attached to a big screen. They have innovated here with higher resolution screens and the pro model with high specs.

Mac Mini: They have updated it with more modern components, but the concept is still the same and the cost has gone up. The components are more expensive, but it isn't the low-cost Apple box it once was.

Mac Pro: The internals are from 2013. I honestly don't know why they're still making them.

Macbook Pro: Their innovation was dropping all the ports for USB C and taking the function keys off for a little strip of touchscreen. I haven't heard anyone all that excited about that.

Macbook air: They dropped the ports off this one too and took the price up a bit. The screen is now higher resolution. I don't think taking a screen they already used and putting it in the air case counts as innovation.

Macbook Retina: The thin, light, and underpowered one. It has been exactly the same since introduction.

iPod Touch: They still sell these with a chip (underclocked) from a phone they stopped selling a long time ago. I don't know why they're making this either.

iPad: Now available in five sizes. Those sizes are small (not updated with modern specs), normal, normal with the capability to use a pencil, large but still smaller than a laptop, and very large but still smaller than a laptop. However, the last major change was the pencil, which doesn't seem to be a major seller.

Apple TV: Maybe the software is changing. I don't own one. It doesn't seem the hardware is, though.

Apple Watch: Wait a minute. How many different versions of this have they made? Four? Well, I don't really know what the innovations are there but I certainly haven't heard about them.

These are all their real products other than the iPhone. Most of them are either outdated or just odd. In other cases, the computers have the modern processors in them but otherwise are the same as the old ones. Taking away the old ports isn't innovation.

Where they can go:

They already are looking at TVs. They could probably do quite a lot. I think that, if Apple built a TV, they could at least get it working with fewer remote control devices, which seem to have multiplied in the past decade. They could also get a streaming service running should they be so inclined. Both of those leave room for Apple to innovate if they wanted.

Apple has a home speaker thing. I didn't mention it above because it's ludicrously expensive and doesn't do very much. However, they could expand into the home automation market much more than they have already. Plenty of home devices could be designed differently.

There are many other markets for them, too. They could become more technical and start building services for developers, for example trying their hand at the cloud services market. They could embrace their artistic users, fix the high-end image, video, and audio programs they've been breaking and make machines for designers of many types (for example, a large screen with their pencil and touch capability but also running a full mac OS and creative software rather than the mobile versions that pretend utility. They could expand their music technology and start producing hardware for those who write music. They could try a watch with fewer capabilities and longer battery life, starting a real competition for the fitness tracker market. They could make a bluetooth headset that 1. doesn't have the various problems seen with bluetooth and 2. doesn't consist of two tiny units that each cost $80 and each fit easily through a street grate.

Diversification without consideration is useless. In fact, it's harmful. But this is Apple. Their business has been finding things that need a new design, and making that new design. Continuing to make the same style of computer with weirder software and an increasing number of flat touchscreens without doing anything else will eventually leave them stuck if they don't find something else to complement them.

Re: RE: Monopolies restrict innovation and invite abuse

"The decline of Microsoft suggests there might be something in that [theory that monopolies are more innovative]. After all, going back 15 years, they had a de facto monopoly on desktops."

Wholeheartedly disagree. Fifteen years ago, Windows ran on most desktops, but Apple still made a bunch of them, and desktop Linux was a thing that existed though it fell down a lot. You also had various small OS projects that had some users. Nowadays, Windows still runs on a lot of desktops, though it's gone down some. And the others are ... Mac OS, Linux, and random things with small user counts. Microsoft had some concerning things going on, but they had not obtained a position of true monopoly, and they have lost some of that market share over the years.

Consider how it would have been if Apple had a monopoly, a true one, at that time. Would they have, for example, switched from PowerPC to Intel processors? Probably not. They did that because the processors were slower per watt than intel ones, making computers power hungry. That meant that people who wanted laptops would not want the Apple-made ones, and Apple had an opportunity to fix that. Eventually, Apple might have made the switch when a new challenger had been making a few inroads, but they would have no reason if their machines were accepted due to a lack of choice.

If a company has a monopoly, it must fear that a challenger will arrive at some point and take their business, and to avoid that it must either innovate or place roadblocks in front of competition. Even if we assume that it always does the former, it has less reason to innovate than does a company that has an active competitor. Its products don't have to be the best for the various customer groups, they only have to be the ones that are available and generally better than the options that can be found easily.

Germany has a problem with the entire point of Amazon's daft Dash buttons – and bans them

Re: A 'proper' use for the buttons

The "we built a light switch" use case for those is indeed really unnecessary. However, it does sound like you could implement many things with these if you were so inclined. It would depend on things like how long the button lasts on its batteries, how good its WiFi access range is, and what happens to it if I put it outside where things get cold and damp, but there are indeed some use cases I can think of for a network-connected button. That said, there are not that many of those use cases, because most of the time that I'm inside, I could do those things more easily with the computers and/or phones that are usually close to me most of the time. The main utility of the button that I can see is allowing someone to activate it from outside my house (for example when I'm not at home). Even then, it's not a real problem. It's not quite hammering nothing because I say there's a nail, but I should maybe find a screwdriver rather than using the hammer to get it in.

Re: Just dumping the stuff in a cart wouldn't be a terrible option.

I would suggest you put a different control that people can use to indicate what they're missing, and then the person who buys that can ensure they get the right thing and the best amount of that. Therefore, if five people notice that the toner is out on the printer you only end up buying one replacement purchase, rather than five times as much. You could have your own programmed buttons for that or you could just put a link on the intranet for each different thing you could run out of. For example, it could work where each printer has a URL on it that indicates it has run out of toner, and sends that notification to the proper place. When the supplies purchaser checks this, they can verify which things need toner, whether there is any in closets that should be used, and then what really needs to be purchased.

Re: A simple idea

"Bear in mind that in a lot of fields [...], people HAVE to purchase, but really, REALLY don't want to have anything to do with the vendor. Amazon Dash buttons offer a straightforward way of avoiding this contact for regular purchases."

That could be done equally easily through normal Amazon use, no physical buttons required. I use Amazon and other online shopping systems, but I don't need a button that has the issues I mentioned previously to interact with those systems.

"You buy the button, and the cost is refunded on your first purchase. It's right there in the article."

I know; I read the article. I was expressing incredulity about that concept. I previously thought that Amazon would give these away with the knowledge that people would buy things more often if they had them. I was surprised to hear that customers were willing to pay money for the button itself, perhaps because I wouldn't want one at all. If they're willing to do that, it's entirely logical for Amazon to sell them. I just find the facts described in the article to be surprising.

A simple idea

Instead of trying to sell people on physical buttons, which are* crazy, give far too little information, and prone to all sorts of hardware problems like running out of power, becoming disconnected from their connection, or being pressed thirty times by the young child your child brought over to play, why doesn't Amazon implement software reorder buttons. If you want to reorder something in the Amazon app, you have to go to the menu, go through your previous orders, find the relevant order, and reorder the item therein that you want. The web is even slower. They could probably create a convenient page that lets users set up one-click reorder buttons, which would be free for them and really convenient to customers. It should take Amazon devs all of a week or two to implement that**.

*Wait. People are buying these? As in paying money for them? Not being given them for free if they ask? Even despite all the problems I mentioned, and the 98% of other problems I didn't mention? Either I'm going insane, or they already got there.

**Given that they already have the order system in place for the physical buttons, they could probably tie some UI elements to that and implement these software buttons in one day if they thought of it.

CES flicks the off switch on massager award… and causes a buzz

Sales site categorization

I've been trying to sell some secondhand network equipment for a friend's charity which does not need it anymore, but I have had difficulty when I posted it under electronics, my reasoning being that it wasn't a computer in and of itself, and that it wasn't exactly accurate to classify it as computer parts. So I waited for a while in the hopes that someone would see it in electronics, but no luck. Then I looked at the things being sold in the computers category. There are a number of computers, but there are various other things. I suppose I can accept that people sell printers and monitors there, after all they are devices that you use with and only with computers, although I still reductively think they should really be somewhere else. I'm not going to fight that battle though because I first have to fight the people selling as computers (these are all real things posted in the past week) printer paper, cameras, bare electric cable, and empty enclosures that once had computer components in them but now do not. Some attempts to categorize just don't work. Whether this is the fault of the options for categories or the people who choose which one to use is an exercise for the reader. In the meantime, does anyone need some switches? Nobody bought them when I reposted them as computers.

Who cracked El Chapo's encrypted chats and brought down the Mexican drug kingpin? Er, his IT manager

Re: Where he went wrong

Some possibilities:

1. El Chapo didn't want to figure out how to generate keys.

2. Admin wanted to have bargaining chips.

3. Admin wanted to turn El Chapo into police.

4. Admin didn't want to get into a situation where El Chapo has generated new keys and lost them, cannot access anything, and is getting mad. When El Chapo gets mad, people tend to die.

5. Admin didn't want someone else to be able to steal keys, because there could be many informants. If you do want to participate in a criminal enterprise and not undermine it, you can only trust yourself and the leader, so it's best to make sure anything important is done by one of you.

6. The admin did in fact do this, and reversed it in order to turn over the data.

7. The admin wanted to have some indication to the cartel that he was providing useful services, and thus that he should not be shot.

Dozens of .gov HTTPS certs expire, webpages offline, FBI on ice, IT security slows... Yup, it's day 20 of Trump's govt shutdown

Re: Comparison

"Not being super clued up with the way my American cousins implement their particular flavour of democracy, I wanted to float an interpretation to see if I "get it"..."

The U.K. and U.S. do things very differently, so it's hard to make a parallel. Yours doesn't really apply.

"Is this essentially the same to us Brits voting some nutter into power (some party that is close to the far left / far right), and then when the nutter Government tries to pass the budget which has us spending £20bn on a wall the MP's don't let the budget pass? However spunking £20bn on a wall was in the party manifesto in which they campaigned on."

Not now. That happens too, but at this point, it's two different groups disagreeing. The most analogous thing in British politics is when two parties that are in coalition disagree or one party has a major split. However, even this is less antagonistic because the coalition implies that the parties did agree at some point on their policy, but have separated. In this case in the U.S., one side campaigned on the policy while the other side campaigned on not allowing the policy to proceed, both receiving enough votes from somewhere to get them a position of power. In this case, this happened across multiple elections because terms overlap, but it would also be possible under the American system to have something like this happen in one election. Each side feels it has a mandate to the voters that voted for them to provide for or block the policy. The people who are in charge can't pass the policies that they want because they lack the votes. However, in the U.K. this would usually lead to a vote of no confidence and another election. The U.S. does not allow that. The executive and legislature are independent, and neither can remove the other. So they continue to have a disagreement until someone changes their mind or they just ignore the topic and do other things. Or in this case, they choose not to do anything at all.

Wanted – have you seen this MAC address: f8:e0:79:af:57:eb? German cops appeal for logs in bomb probe

Re: Home users...check logs...

Separation is good, but why do you need your guest network to be open? I run two networks as well, but I just give the password to the guest network to any guests and don't change it so they can come back. I don't need to carry the traffic of anyone who comes along, either to have free bandwidth or, now that tracking is a thing, get accused of something done by a stranger.

This is the final straw, evil Microsoft. Making private GitHub repos free? You've gone too far

Re: Free! For up to three collaborators!

"If you think taking physical media to people's houses is an acceptable form of backup, you've been very, very lucky to date."

The implication being that this is not reliable? Media in multiple locations prevents things from being damaged should there be a situation where the site and everything in it is damaged in some way such as fire or flood. You could be more protective of the data by having multiple disks to deal with mechanical failure, too. If you're doing it properly, why is this not a viable way to backup data in that way?

"I don't run my own generator, because even though my job requires electricity, it's much cheaper to pay someone else for the electricity they generate in bulk."

But I'm sure you or someone in your institution runs a system for backup power if the systems that get power are important enough. You could theoretically hire someone to have a bunch of generators and bring one to you, but having one there and knowing how to work it provides a lot of benefits.

"Similarly, I could find someone to "mind" a disk for me, but how is that really better than putting it in a remote data center that has a full-time staff that will look after it."

In many ways, it is not. For every option, you hae to look at the benefits but also the costs. For the datacenter, they include:

Benefits:

1. Someone is there to manage it, so it's unlikely to go offline.

2. They have good physical security, so it is unlikely that someone would break in and steal your data by taking the drive.

3. They manage a lot of data, so it is unlikely to be corrupted or lost by accident.

4. The datacenter is probably a long distance from where you are, meaning that you have more geographic stability.

Costs:

1. You may have to pay for its storage, depending on who is storing the data. If you're just putting your drives in someone else's house, you probably don't have to do that.

2. If some disaster does happen and the data doesn't come back online, you don't know where that data is, whereas you could locate and retrieve a backup you made yourself.

3. Various people you don't know may have access to the data because they run the system that stores it.

4. You don't know everything about the system, so it is possible that someone could break in using a vulnerability and steal it.

5. If something happens to the datacenter, you don't know if that system had backups anywhere. Depending on how their system works, your data may still have a single location even if it's spread across multiple physical devices in that location.

When you decide how you're going to store your data, you have to consider both sides of this coin. If you don't, you end up jumping to conclusions about what is better without having the required information to support the assertion. Both are viable options, and which to use depends on how the above points apply and how important each is in the particular situation.

Re: Not impressed

That message has been there for long before Microsoft gained control. I know this as I had a system that was locked down, needed to use github sometimes, and only had Internet Explorer on it. That message appeared every time. Complain about the message all you like, but know that Microsoft isn't responsible for it.

Great, you've moved your website or app to HTTPS. How do you test it? Here's a tool to make local TLS certs painless

Re: But why is it so complicated?

HTTPS can be circumvented by some MITM systems, but not by others. A company proxy likely has that built into it, but that's because the company can control which devices are connected to it and configure them to trust the proxy and to allow http traffic to be left unencrypted until the proxy. A MITM system on a standard network can't necessarily do that to you, because the browser will inform you that the traffic is now in insecure HTTP, that is if it doesn't complain more vociferously which some will do. So HTTPS is still useful against many attacks.

Re: Lol arcane knowledge of memory management

Memory management still needs to be known by most software devs. However, I think that will also decrease in the coming years without much harm. I know quite a bit about it; I taught it for some time. Let's consider other things I taught in the same course. One of them was caching locality. Interesting thing, that. However, when they implemented a system that was supposed to provide increased speed through keeping data close together for optimized caching, it actually ran slower. This had worked a few years before, but it is different now because processors became better at caching things, and the better solution became the one with the least overhead. You could view this as a problem, but the result was that less effort had to be spent on getting the full benefits of the cache. Some people still have to know about the architecture of the cache, either to really intensify performance or to build a better cache, but your standard dev could spend time on the functionality of the software without making things less organized and more fragile to get better performance.

Excuse me, sir. You can't store your things there. Those 7 gigabytes are reserved for Windows 10

Re: 32GB HP Monstruosities

You can't get any modern OS to run on 128MB of memory and 2GB of hard drive space. Not even a modern CLI-only Linux will exist happily in that*. Yes, things have bloated, and Windows is one of those things, but everything has gotten bigger and uses more resources. Therefore, the 32GB/2GB spec is not sufficient for the use case of a workstation.

*CLI-only Linux on 128MB ram and 2GB disk: You can run embedded Linux images on this, but that's not the same. You can probably shove a trimmed-down image into those specs, but it will run terribly. Your issue will most likely be memory. Disk space is less of a concern because CLI packages are so small, but it probably wouldn't be that long before that was an issue too.

Re: 32GB HP and Linux GUI

"...a GUI Linux is still going to use up a bit of memory."

"Yes, but XFCE uses only 100 MB, and LXDE uses about 85 MB."

At the risk of starting a which window manager debate, neither of those is really used that much. You could do a lot of things to get a distribution to exist happily in a gigabyte or two, but most users will want a reasonably modern window manager that they already like. You could also have a Linux installation on one of these that is predominantly CLI*, but that wouldn't appeal to many users even though it would have no problem with the memory limits. In order for that to work, you would need to run not only the desktop system, and a relatively new one at that, but also a browser and libreoffice simultaneously. That doesn't need a lot of resources, but it can still use up enough memory to make the atoms slow.

*a CLI Linux on an atom: I did this with an old atom tablet that someone wanted to throw away. It has a whole gigabyte of memory in it, which put a lot of limits on what I could comfortably do with it. I assembled a Debian distribution for it that stays in CLI unless I manually launch a GUI, in which case it will use Mate. That works for some use cases, though it mostly sits in a cabinet so who can say if the effort was worth it.

Re: keep the users away from the system disk / partition

I can't say I agree there. For servers or systems where the profile could be loaded on multiple devices, that is required. When using a single device in a standalone configuration, however, you will only have the one disk in there in the vast majority of situations. So the data will need to be on that one unless you want to try having a removable media device such as an SD card permanently installed to store that data. I don't recommend that. You could create a new partition that stores user data, but that's just asking for a situation where the user has used all 96 GB of their space and would like to use some of the 16 GB free space on the 32 GB OS partition, but can't. The alternative is valid as well (it doesn't have to be as a result of system bloat; maybe they do want to install extra OS functionality that uses a lot of disk, such as large databases such as those in some foreign language packs. Manually resizing partitions is a pain that may not be needed when the disk is fulfilling a single purpose.

Re: So much for competing with Google..

I just want Microsoft to shrink the windows 10 install image so it fits on a DVD again. It's 4.69GB now. I cannot see that that is needed. I don't think you can fully set up a windows 10 machine without an internet connection anyway so they might as well produce a slightly slimmer build and download the rest of the components after the install. I have about thirty blank DVDs that I don't need but finding USB drives of sufficient size that I don't mind completely erasing takes a few minutes.