Posts by doublelayer

Got a pre-A12 iPhone? Love jailbreaks? Happy Friday! 'Unpatchable tethered Boot ROM exploit' released

Yes, to some extent we are assuming that. For the record, I usually want full access to things and I wouldn't have suggested Apple lock things down the way they have. But this degree of lockdown could really be considered a feature as a security measure to some buyers.

Your excuse is logical, but limited. It's possible that various evil people have found their own vulnerabilities in every phone and are perfectly able to do anything they'd like. It's also possible that no evil people have yet found a way in. What's most likely, however, is that some evil people have found a way in and a larger set of other evil people would like one, but don't have one yet. Not perfect by any means, but perfection in security is unobtainable. And protection against many might be considered a better feature to those for whom security is a primary concern than openness of software choice.

YouTuber charged loads of fans $199 for shoddy machine-learning course that copy-pasted other people's GitHub code

Re: Why aren't you writing these articles slamming universities?

Your comment starts off reasonable. We have all seen subpar teaching in established universities, and we all know there are very good online teaching materials. I'll gladly agree to that.

And you then turn around and say that, because this is the case, all the material online is better than a university. That's just wrong. The course referred to in this article, for example, started off pretty badly in that it didn't teach the concepts people need to learn. And this guy doesn't get credit for useful code someone else wrote either; I'm fine if he chooses to teach from it, but he should properly credit the original authors and choosing useful Github projects does not a good course make. The internet has a bunch of information, and for every very helpful resource out there, there are at least ten pages with something outdated, incorrect, biased, or useless. Your all-or-nothing stance is misguided.

Behold the perils of trying to turn the family and friends support line into a sideline

Re: "there was an error message and I clicked on it, what was it?"?

The ones who contact me have realized that the text of the error message needs to be available to me, so they won't clear it (actually they usually clear it after writing down what it said, which isn't so useful when there are two or more options and they chose the wrong one). However, they haven't figured out that all of the text could be pretty important. On the phone, they've read error messages like this: "An error has occurred retrieving mail from the mail server. The error message was some numbers mailserver port something-or-other error blah blah. Please restart the mail client and try retrieving your mail again, or try reentering your account information."* And they will cheerfully loop trying to reenter their mail account information until it is pointed out that GMail probably didn't spontaneously change their password and maybe this has something to do with the network having gone offline.

*Although they typically choose to censor the useful information of an error message with weird gaps of silence instead of filler words, I have put in the filler words here for the effect.

Pro tip: Plug in your Tesla S when clocking off, lest you run out of juice mid hot pursuit

I see the difference, but does it really matter in this very specific situation? If you can't move for the five minutes or so it takes to refuel a traditional vehicle, the person you're chasing probably has gained quite a lead. So you'd still have to contact someone else to chase them while you refueled. For many other situations where speed is important but not critical, the gas engine's ability to refuel faster could be an important factor.

The D in Systemd is for Directories: Poettering says his creation will phone /home in future

Re: Is he off his rocker?

I can think of some options to fix the SSH issue*. But why should I? It's a bad idea, and I don't want to encourage it by solving their problem.

*But I'm going to anyway. Have the SSH process store keys. Users can drop those keys into an SSH database, and only root needs access to that to verify them. They verify the key is present, challenge the user, then request the decryption key. Alternatively, and a worse idea, is to trust any incoming key enough to establish a session, then request a decryption password, then check whether that key is authorized or not. If not, reject the user and log an intense security warning because it means a person has a user's decryption key but is using an untrusted device.

The easiest solution is not to do this to home folders.

I think it's an often-used metric because it was once important, back when laptops couldn't suspend all that well and would go through the battery quickly enough for it to be dead when you wanted it again. Either that or when people had to reboot very frequently. Neither of those have been a major concern for over a decade though, so we could probably stop using it.

Re: That was a serious breath of fresh nerdiness

"Encryption has to come out of the factory enabled"

This is generally fine as long as it makes me set the key. If it uses one set at the factory and simply encrypts that key with the password I supply, that's not acceptable.

"with no way to turn it off"

Not acceptable. I may want to turn it off. If I know enough about how it works to do that, I probably have a reason. For example, if I want people to be able to remove the disk and read it on something else, encryption would completely remove that option. If I want people to be able to boot another disk on it, which isn't encrypted with a key known by the remaining components or at all, the user couldn't do that either.

"and be hardware assisted so there is neglible impact on performance."

That's already the case. Nearly every disk encryption solution uses AES, and nearly every modern processor used in a computer has AES acceleration in hardware. Ask the many people, myself included, doing all their work on devices with full disk encryption. It's fine from a performance standpoint.

"Even myself as an expert am extremely leery of enabling encryption on a device which shipped with no crypto because I know the device would have to reimage and migrate all the data to get to that state."

You're worried that a device will have to be reimaged? Do you know how often that happens? It happens on large upgrades (Windows and Mac, not Linux most of the time). It happens when a disk gets replaced. It happens if a backup is restored. It should happen every time a device changes hands. It is the first step after a company gets a device from somewhere else as they'll apply the corporate image. And it happens when the disk gets encrypted. If you're encrypting the right way, and I'm sure as an expert you would, all the disk has on it at the time of encryption is a basic OS image with the encryption software if that wasn't already included. If for some reason it fails, which doesn't really happen unless you cut power or something, reimage and reencrypt. It'll work fine the next time.

What you're really getting when you ask for this is a device that is stuck with the original factory image, and because you've asked for "no way to turn it off", can't ever be replaced, for any reason. And that's terrible from a security perspective, even if that image and user data is encrypted.

Open-source companies gather to gripe: Cloud giants sell our code as a service – and we get the square root of nothing

Re: "he can pay you to develop it. Or pay you for setting it up on premises"

All that is true. All that is obvious. All that was known when people put their code under an open license. Nobody said you were guaranteed work, just that you had a way to try to get it. It's also true that it is sometimes easier to get paid making something closed rather than something open.

"BTW: RedHat was sold to IBM. Maybe even its business model wasn't working so well to keep on being profitable on its own?"

You either misunderstand how companies work or you don't know how the Red Hat deal went down. Red Hat wasn't "sold to" IBM because they needed to shut things down. IBM bought Red Hat because it was making a bunch of money and IBM wanted their IP and developers. IBM isn't a private capital company that specializes in trying to get something out of a failing company; they're a technology company and they really liked Red Hat's technology. The fact that Red Hat's business model was pulling in revenue from lots of people probably helped get them to that $34B asking price, too. Strike that, it definitely did.

Re: The fundamental difference is...

The cloud providers could argue that they aren't just selling the software; the users could just download that from the original source any time they wanted. Instead, they're charging for the resources the software is run on, and optionally the management of the systems concerned. Clearly, a lot of the value for them is coming from the users' desire to run the software they didn't develop, and they are getting benefits from that, but they could argue that they are not charging users for that software, just the extra services they provide. You decide if this argument is good enough, but as you've said, it should be expected given the pretty explicit way the licenses say people can do that.

Re: "he can pay you to develop it. Or pay you for setting it up on premises"

In the case of many of the companies mentioned, however, the cloud providers aren't continuing development and keeping their code away from people. In many of the cases, all the new code the companies provide, which isn't all that much, is being released freely. The problem these places are talking about is that the cloud places are making bunches of money by selling the administration of this software and the resources it runs on. And while I see the point that these companies are profiting from the work of others, it's also the work others specifically said people could use for whatever purpose without needing to pay them.

This isn't to deny the usefulness of a license like the AGPL; it makes sense why people want it and there are other places that would have had to release a bunch of code if they had AGPL-licensed components. Even if all the projects mentioned in the article were AGPL licensed, however, the cloud places could still charge for servers that run these projects, management of those servers, and programs and scripts that modify the running of that program without being written into it.

Re: "he can pay you to develop it. Or pay you for setting it up on premises"

Some problems we can deal with:

"Can you see the failure of your assertion in the article case?"

Original assertion: "he can pay you to develop it. Or pay you for setting it up on premises"

"1) They don't need to pay you to develop anything, they develop it themselves and don't make it open, as the license doesn't require it"

So clearly, they won't pay you for that, because they paid someone else for that. Doesn't really change the math; you could have been paid for that if they chose you for the job.

"2) They can set it up themselves."

Once again, someone else is being paid for something you could have been paid for if they chose you.

The assertion said that you could attempt to sell further development or setup for money, not that people were guaranteed to provide you with work in that area. There are various services you could provide around an open source codebase, but there are several caveats about those. The primary one is that you would be providing a service that someone else could provide. For example, it would be completely possible for someone else to provide the kind of Linux support for which Red Hat is known. In that case, Red Hat loses. But Red Hat didn't lose, so it clearly works at least some of the time. Meanwhile, I run plenty of code that Red Hat wrote at some point, but I don't pay them for support (using Fedora/Cent OS/other distributions that contain some Red Hat projects, but not using REL). By making their code open source, they accept that some people will be like me, and they realize that this might actually be quite helpful to them later down the line.

"Anyway, the opportunity of making money by developing new features and installing disappear when everybody can obtain and install your software"

Not really. Plenty of people hire open source developers to put another feature in because the developer wasn't already planning to but they are most competent to continue developing on their own codebase. You're correct that there are many other options that don't result in the dev getting money, though. But the opportunity of making money by making people buy the software disappears when you make the software free, too, and we don't complain about that because the dev theoretically realized that when they made that choice.

"you can offer it at far lower prices when you don't have to pay for development also"

This was in the sentence with a discussion about developers, but I presume "you" now means the companies that sell stuff based around the software. And your point is? Lots of people don't pay for everything in their system. The raspberry pi probably would have cost more if they had to pay for development of their own OS to run on it. Instead, they ported Linux, requiring much less code. That resulted in more Linux users, more developers who can contribute code upstream, and a cheaper computer for us. This strikes me as a win-win situation, but your tone above sounds like you took this another way.

Larry Ellison tiers Amazon a new one: Oracle cloud gets 'always' free offer, plus something about Linux

Re: Always free services

I know the specs are terrible for real cryptomining. However, the specs of embedded devices like IoT junk or consumer routers are even worse, and they get broken into for cryptomining quite frequently. If people can find a way of setting up many free VMs through multiple accounts or the like, it could pay off. If not, just having two means a little mining that costs the user nothing. And there are plenty of other things a user could have one of these do without needing more specs. I can think of some tasks a VM like this could do, and I might never need to upgrade them because I already have stuff to run my real systems that I care about. I somehow think Oracle is hoping that I'd try their free versions, decide I need more power, then continue to buy through them. I don't think that will work as well as they think.

Always free services

When places have something they intend to be "always free" or "unlimited", it's usually a sign that someone will have figured out how to exploit it and the offer will be retracted or restricted. For example, I fully expect that people will start to set up the free VMs to do cryptomining or something similar within a week or two. While I'm certain the terms tell people not to do that, that's never stopped these people before. How long do you think each of these offers will last before someone manages to make them less profitable than Oracle had in mind?

Fitbit fitness fans furious following flummoxing flawed firmware float, fleeting feedback, failed fixes

Re: "a full factory reset of their Fitbit device and re-installation of the app"

There are a few companies and open projects that have managed, through repeated and thorough application of reliable testing and concern for user annoyance, to have every update they release work well under nearly all conditions. For those places, I am comfortable updating on day one and, when they eventually make a mistake, be a member of the public that others can learn from. And for everyone else, it'll be at least a month before I let their new thing onto my hardware.

France says 'non merci' to Facebook-backed Libra cryptocurrency

Right reasons, please

There is a problem with this statement. This cryptocurrency is not really a money laundering or funding terrorism risk, at least not more than any other cryptocurrency or thing with value that can be traded. It is a profound risk because of user privacy and corporate control reasons. Why is this distinction important? Shouldn't we accept that the thing is being held up and not complain? No, we shouldn't and I won't, because, if Facebook can keep all complaints about crimes that could be committed by someone else, they can come up with pretty reasonable arguments why those objections don't apply. Then, the system will be seen by governments and assorted nontechnical people as having been analyzed thoroughly by all sorts of places when in fact the important issues have been ignored. We need to keep the focus on user privacy and control and not let someone else divert the discussion.

CEOs beg for America-wide privacy law... to protect their businesses from state privacy laws

Suggested change

I suggest we change the last slogan in the subtitle. Rather than the 1984-inspired contradictory statement, I believe the one introduced in the book The Circle better represents what these companies think. That slogan was "Privacy is theft.", and the fictional company clearly meant it. Let's hope we can prevent that from becoming instated in law with only a thin attempt at disguising it.

Facebook: Remember how we promised we weren’t tracking your location? Psych! Can't believe you fell for that

Re: Things you wish you'd seen . . . . .

I bet it was pretty silent. Just a couple high-level execs and engineers staring at an iPhone with looks of complete horror on their faces. Then the phrase "what are we going to do?". The opposite is possible too; whoever has dedicated their life to ever-increasing collection of location going through a bout of maniacal rage. Either way, I'd like to be far away from it.

Lights, camera, camera, camera, action: iPhone, iPad, Watch, chip biz in new iPhone, iPad, Watch, chip shocker

Pedantry

"As expected, Apple has launched a new iPhone – the 11th version of its smartphone"

Sorry, but Apple has dragged you into its distortion field. They may not know how numbers are supposed to work, but this is their 13th* generation. The only generation that lined up well was the iPhone 4, which was indeed the 4th generation. Everything else (with the possible exception of the 3GS) has been completely off. Other companies like doing this as well. I really have no clue why they like this so much.

*In order, the generations are: original, 3G, 3GS, 4, 4S, 5, 5S, 6, 6S, 7, 8, X/10, 11. I do not include the 5C, which was an iPhone 5 in an easy-to-break plastic case, or the iPhone SE which was an iPhone 6S in an 5 case.

What a bunch of DoSers: Wikipedia says it was walloped by 'bad faith' actors over weekend

Re: Fundamentally flawed model

Wikipedia isn't and never will be perfect. What makes it easy to update also makes it easy to vandalize. But it is a pretty good source of background on a lot of things. Something where people are trying to advertise or where everyone disagrees and thinks Wikipedia is a good battleground excepted, but in reality that's not a lot of the pages there. If I want a simple fact, or if I want a quick overview of something, Wikipedia is a good source for that. It's kind of like an agglomeration of the dictionaries, encyclopedias, almanacs, and other assorted reference books of the past. It contains a little information about a lot of things. When more information is desired, it's time to bring out my researching skills I was taught, including my ability to spot misleading data, but many requests for information are not that serious, and I'm glad we have a resource capable of handling most of them.

Re: Fundamentally flawed model

That was meant as a joke. I'm pretty sure of that. You posted a comment critical of the site, so someone joked that your complaints against it were felt so strongly that you wanted to take it down. Nobody here really thinks you took it down or want to do so.

Mozilla Firefox to begin slow rollout of DNS-over-HTTPS by default at the end of the month

I'm afraid your description is not accurate. You have described encryption of content correctly, but that's not going anywhere. Your statement "move the “Hey Alice” shoutout to a middle man that will see all your messages in between afterwards" is incorrect because that middleman only informs you how to contact Alice; future messages between you do not go anywhere near the middleman and remain encrypted using the old protocol. This is a better parallel:

Alice and Bob want to call each other and exchange encrypted messages. They can exchange public keys if only they can get a phone line. But neither knows the phone number of the other. Alice could call directory inquiries and ask for Bob's number. If she does this, she must trust that service to provide her the correct number, and she must accept that someone might overhear her request. In addition, someone might have intercepted her call to directory inquiries and be pretending to be them, but she could not tell. With DoH, she has a secure connection to the particular system she trusts. She must still trust that they are giving correct information, but her request to them cannot be intercepted or overheard. Once she has the number, things proceed as before.

That's the good version, explaining the positive aspects. However, DoH also has some downsides. It prevents someone else from tampering with the DNS data, but it also prevents you from tampering with the DNS data. Sometimes, you would like to edit that, whether it be for faster caching or content blocking or internal system redirection. That's why DoH must run alongside rather than replace normal DNS. If it becomes mandatory on something, I will no longer use that thing. It's not, as some claim, a security risk in and of itself--if malware can be detected by a DNS request, the malware can also be changed to use one of a number of alternatives for finding an IP address including having one hardcoded in it. But it does allow circumvention of many tools that are quite important. In most corporate environments, it should probably be disabled and made explicitly against company policy.

For real this time, get your butt off Python 2: No updates, no nothing after 1 January 2020

Re: 20 years is a lot of time.

But you don't have to reengineer the code if you just want to keep running it. They aren't going to secretly break all of python 2.7. They just won't update it. So it is a lot like an old operating system, as you can't get support or security updates for Windows 98.

For the comparisons to C, try taking C code from 1975 and compiling it and running it today. Likewise, see if you can get modern C to compile with the initial C compiler. In most cases, you'll be disappointed. However, a lot of it will work. And a lot of python 2 code can be picked up, without any changes, and run in python 3. If you have a sufficiently large codebase, it's likely that some changes will be needed, but you don't have to tear down and rewrite. Could they have done the changes differently? Sure, they could have. But it would not be significantly different, because things break. Languages change. They deprecate things in their standard libraries and introduce new ones. Python is not doing something that other languages have not done.

Handcranked HTML and JPEG japes. What could possibly go wrong?

Re: Oldie Here

My site is a lot like that. Unfortunately, I've been informed that using this format on anything else, including temporary sites that the frontend people will replace, is bad because I haven't included at least twelve image files and about five external CSS files that make the page look like the image they have in their head but can't actually describe. When suggesting that they could design the page to their liking, I am courteously informed that of course they don't know how to do that because they don't have technical jobs, but I'm the software developer so I should know how to make a page that doesn't look old. And thus ends the story of why I'm never doing frontend.

Re: Hmmm..

I think you've gotten things the wrong way. Fiona didn't claim that she was not responsible, simply that others could also be held responsible and she didn't let that happen. The person who decided to put that file on a production server, which was not Fiona (the article makes that clear) should perhaps not have done a straight copy-paste from development to production. That's not new. Anything sufficiently large has stuff in the development folder that isn't to be released in production, and usually a script or two to try to manage that. I'd argue that these others weren't very responsible, and thus that turning them in would have been a pretty nasty thing to do, but I'd also argue that Fiona did little or nothing wrong and was unfairly attacked for a thing that did no damage and was clearly not intended.

Apple programs Siri to not bother its pretty little head with questions about feminism

I see your point. I like civility, and I would like to see everyone, from kids to those a couple generations older than me (who aren't all that much better at it), to start being more polite in conversation. I'm afraid, however, that making an electronic device ask for them will turn it into the worst parody of those over-obsessed people. You know the ones: the people who have actually said the phrase "You didn't say the magic word" without irony to someone over the age of three. It also happens that many of the requests a device like this answers aren't typically said with "please", including most of the ones in my original post. The please essentially becomes another required wakeword for the device, and loses the meaning we* were trying to get across. As such, this has the potential to be counterproductive, and I think it will be pretty silly or irritating, depending on your viewpoint.

*We: In the sense of parents, people programming the devices, and people setting up the devices. As I'm a member of neither group, perhaps "they" would have been the better pronoun.

Echo Dot Kids Edition "will not respond to commands unless they are attended with verbal civilities

Well, now I have to know what that means. "Alexa: Could you please tell me what the weather will be tomorrow?", "Alexa: If it's not too much trouble, would you mind enlightening me to the current time?", "Alexa: If you could set a timer for ten minutes, I'd be very grateful."? Sure, it might get children being polite, right up until they start shouting "Alexa: I don't have a clue what polite thing I'm supposed to say for you to set a reminder, because it's evidently such an onerous task for you. If you could be so kind, order a normal computer or smartphone that does things when I press the button. And I'd like you to confirm that purchase for me, but only when you've got the time." There are lots of advantages to not anthropomorphizing things when you don't have to. If it's not sentient, you don't need to.

Finally! A solution to 42 – the Answer to the Ultimate Question of Life, The Universe, and Everything

Let's really think about this. I don't mind if people want to donate cycles to finding this answer. But why do we care about it? I really like lots of abstract math problems, but they didn't find and execute a new algorithm that can solve these things; they brute forced a bunch of options and found one. If we should need to solve this problem for some reason in the future, and I'm willing to assume we've found one even though I haven't a clue what that would be, does this program give us a new, faster, or organized way of solving for it? From what I've seen, it does not, and we'd have to put more resources into a brute force search. So let's not give it the kind of credit that you've implied. The examples you provide gave us new algorithms, and they turned out to be useful later on. All we got from this are three big numbers.

Computing resources can be quite cheap in cases like these. If that's the way people choose to use them, then that's fine. But let's not give this more credit than it deserves.

OK, let's try that again: Vulture rakes a talon on Samsung's fresh attempt at the Galaxy Fold 5G

Re: It's the way Android takes control of the OS away from the user

I think it's mostly correct. The device will continue to perform some functions. That is true. But as the time between last security update and today increases, it's more likely that malware, anything from a malicious app in the Play Store to a malicious web ad, can get at something I don't want it to. As such, I wouldn't be comfortable using a device without recent security patches for sensitive things like banking or sensitive email. And after a certain point, I wouldn't be all that comfortable using it for slightly sensitive things like most email or having my contacts on it unless I also had a certain degree of protection such as rarely using the web browser so I'd avoid exposure to potentially unsafe code. And while I have some degree of confidence in my ability to detect dodgy things and stay away from them, I don't have that confidence for most of the general public and security is frequently a group activity. I don't expect that I'll have the security update hours after it comes out, but if I'm over a year out of date, I'm a little worried, and if I'm over three years, I'm quite worried. When it's someone nontechnical instead of me, those times are reduced.

Re: I Like The Idea

Removing that screen doesn't give much space; it's a pretty flat piece. Most of the volume of that area is already taken up with a battery and the chips for the phone. The battery would only be a little bit bigger. Meanwhile, losing the smaller screen means using it with one hand just became completely impossible. Also, I'd rather not hold the unfolded device to my face to make a phone call, though you could theoretically let a user place a call with the device unfolded and then fold it in while talking. Then again, the whole folding and larger screen component already means it's not for me, so I'm probably not the right person to assess your suggestion.

Business PC sales up as suits flee looming end of support for Windows 7

Re: Not only am I going to continue using Windows 7 on my main PC...

This is where the easy answers stop. Of course Windows updates are annoying, and they can really mess things up. But it's also true that some of them have useful security patches in them. You've mentioned that the last update applied was in May of 2017; I'm guessing it was the EternalBlue patch, released in March of that year but pushed out with extreme force in May because it was being actively and very successfully exploited by malware. And although I'm sure you're competent enough to prevent most attacks from getting into your systems or damaging things if they managed it, there are other places out there who lack that. For them, the advice to always install security updates is well-founded, because they will at least be able to prevent certain types of malware which could impact their processes or cause data loss.

It's useful to think how easily malware can be installed. If one person using one of your machines is tricked into launching a binary, whether that's by social engineering, a redirection of a download, or something else, security patches are designed to prevent that binary from getting to all the things it's probably after. They're not guaranteed to have discovered the vulnerability the malware is using, but they do patch several each month. If you have enough confidence in your security that you'll catch the binary without needing that, you may be right. Unfortunately, many have had that idea and found out that they were wrong only after seeing the damage wrought by a successful infection.

Acer and Asus unveil some of the world's heaviest laptops ... and some of its lightest

Re: Does not fry the users lap?

Maybe I'm one of those few who do use a laptop on my lap. Then again, mine has side vents and I'm not running all the cores at max power, so no burning here. There are many times when I want to use a computer and there's no convenient surface around, such as in a train/car, auditorium without the folding tables, or house with extended family present so all furniture is being monopolized. I figured lots of people did that. Maybe it's not as common as I thought.

Uber, Lyft and DoorDash put $30m apiece into ballot battle fund to kill gig-economy employee benefits

Re: Taxi Drivers Unite

I'd recommend you consult with a legal or financial advisor before trying to put that into effect. While business expenses incurred by the business concerned are tax deductible, that doesn't apply to many end users who would be taking the ride outside of work. You can't usually deduct your taxi or rideshare bill from your taxes, even if you need it to make money. For the same reason, consumer purchases of automobile fuel aren't tax deductible even if you really need that to get to work. I assumed you had planned for another reason for the payments to be tax deductible, which is where the charity/nonprofit (different term for different countries) discussion came from.

Re: Taxi Drivers Unite

"I think it's time for some market disruption by the drivers,"

I would really like to see that. In many cases, the companies run at least in large part by employees have some major benefits. There are a few cases where they can fall into error, but that's by no means guaranteed.

"they should stump up a little cash each and commission a generic ride booking app that has a simple flat monthly (tax deductable) subscription charge"

That, however, won't work at all. Neither part of that is going to be feasible. Tax deduction only works if the place is a registered charity or nonprofit. There are lots of ways to file as one, but there are usually requirements about working for some specific charitable goal. By most definitions, giving that group more control over what they earn is unlikely to be accepted under the current rules. However, let's assume that either I'm wrong and it is accepted or the law is edited to allow it. The fee still wouldn't be deductible because it'd be considered a purchase, not a donation. Only donations are considered deductible for the purchaser.

As for the subscription, that will fail for pretty much everyone. For many people who don't frequently use the transportation, it won't be worth the average subscription price for the four rides they take a year. Meanwhile, others may get a ride every day, and be profoundly underpaying for that. Worse still, if I have paid for the subscription, nothing keeps me from getting a ride to absolutely everywhere I go, because I've already paid so it's now free. So many more people will be calling rides that there wouldn't be enough drivers to handle the load, yet their revenue wouldn't increase at all. Meanwhile, potential customers would see that it always takes forever to get a ride because all the current customers are using the service five times a day, and they won't sign up. If I have to pay every time I want a ride, I'll probably not take as many, which means there are more available drivers as well as keeping environmental costs down.

Raspberry Pi head honcho Eben Upton talks thermals, stores and who's buying the kit

Re: re: PiTop

The complaint was about the people who make a laptop enclosure for the pi, not the foundation themselves. It's a reasonable complaint, as if you are buying in a currency, they often will at least tell you the cost in that currency. The places that sell the pi give the purchase price in the local currency, after all. As for this company, they have a .com address rather than a .co.uk one, but they have a London address. I'd expect them to have a currency selector on their store, but evidently not.

Re: Wattage limit

They want to maintain the ability to run in power-restricted environments. Maybe it's also a principle thing as well. But imagine trying to run a raspberry pi powered robot off a USBPD cable rather than a mobile phone power bank. While not that many people use their pi for that, you'll see lots of plans and pictures in raspberry pi media, and it wouldn't be so impressive if it were handicapped by a wall connection. I would also say that a raspberry pi's utility to me has often been its ability to run with relatively little power; if I'm running something nonstop or off something with limited power availability, the pi is my go to solution.

It's not exactly easy to make a completely compatible board. The major problem is the SOC. While it's as open as such parts tend to be (now, that took a while to come to pass), you can't exactly go out and buy one. You could probably go out and get a couple million, but that carries a few financial problems. The rest of the parts are very standard. While you could probably make a board with exactly the same shape but a different processor, there's no guarantee that it will work well with existing raspberry pi disk images. Unfortunately, ARM chips can be like that. Furthermore, when other companies try to copy the pi, they want to distinguish themselves from the pi to get customers. Since the pi already has a pretty narrow profit margin, it's hard to compete with it on price. People can, however, compete on specs. For a while, lots of people complained that the pi didn't have gigabit ethernet. Plenty still complain that it doesn't have a SATA connector on the board. Still others had a massive problem with the single gigabyte of memory on previous iterations. In each case, some place tried to make money by making a similar product with those features, usually at a price point at about 1.5 times that of the raspberry pi. I don't know how successful they were, but plenty of those boards are out there.

"TBH I'm amazed there aren't knock-off Pi-es out there. Is there anything proprietary or custom to them?"

There are plenty of similar products. Many of them are so obviously meant to be like the raspberry pi that they've called themselves "[insert other name of fruit] pi". Some actually have better specs than the raspberry pi. However, they are less popular for many reasons. One reason is that they don't have as much community support, sometimes supporting fewer operating systems or working in an incompatible way. Another reason is that, while they often support similar hardware modifications, they aren't directly compatible with the ones designed for the raspberry pi. A third reason is that these usually don't have a guarantee of continued manufacture or software support, something all pi models have received since they first came out. But if you're looking for other versions, you'll find them thick on the ground.

"They are verging on being usable low-end computers now."

They passed this point for many users quite a while ago. It depends what you're doing on them, but for traditional office tasks, the version 3 was quite capable of the load. If you need a lot of memory, nothing before the pi 4 gave you more than a gigabyte, but plenty of use cases didn't need that. It won't replace the full desktop for the people who need that amount of performance, but it could probably replace many an old one.

"Perhaps an official PiBook (in the vein of the OLPC XO netbooks) might be in the offing?"

The PiTop people did make one of these. I'm hoping some other people will also do so, as I found their one somewhat overpriced and underwhelming. Unfortunately, for the price of their enclosure, you can get a comparable laptop with better battery life, builtin storage, and a slightly faster processor. I'm hoping that people will start to realize the potential of using the pi as the computer for various form factors.

Everyone remembers their first time: ESA satellite dodges 'mega constellation'

Re: Isn't satellite broadband pretty much one-way ?

Short answer: no.

Long answer: Satellite phones. Satellite media uplink stations. Current satellite internet. None are new, none require powerful transmitters on the surface. They don't really require all that powerful transmitters on the satellite either when you compare them to lots of other things.

Re: Telecom Companies Rule

You are banking on the speed of light to necessarily generate faster comms. It doesn't. We've had lots of things that used waves traveling at the speed of light to send data back and forth, including nearly every type of radio comms system you could build at the time, and plenty of them were rather slow. The waves move faster through air than through a cable, but what mostly matters is how fast they can be encoded and decoded at the ends. If, for example, the frequencies in use are prone to collisions, that introduces a bunch of latency that wouldn't be there otherwise. Cables don't really have this problem. That's not the only issue either. To illustrate this, consider that modern satellite internet uses the same geostationary orbits that the original ones used, and while latency isn't much improved, bandwidth has been rising rapidly. The electronics have improved; the physics is the same. So just because there are some numbers that look like they make a point, it doesn't necessarily mean they're correct.

In addition, consider how the satellites actually send data. You have to uplink to a satellite. If that satellite isn't in range of the target, it has to send a signal to another one. That might have to happen a number of times before you reach a satellite in the right geographic position, which then downlinks to a ground facility, which uses cable to connect to the host, which then contacts the ground facility with the data, which sends that to the satellite, which has to send the result back to your satellite, and then it arrives at your house. All these factors could introduce latency problems, and some could introduce bandwidth problems. If there isn't a conveniently-located ground facility for your destination, you might end up experiencing most of the cable delay anyway. If you're after a server in a place like Singapore, with a lot of servers and little room for satellite downlink space, you might find that the relatively few satellites there are heavily burdened. A lot of this is difficult to calculate without access to the full documentation that the company has and guessing at part of it. At least, not until it actually goes into service and we can experience it for ourselves. Until then, you might want to think twice before declaring it's definite success with such vigor.

Trade union club calls on UK.gov to extend flexible working to all staff from day one

Re: So because you don't want it, no one else should be allowed.

I think the comment meant that it shouldn't be encouraged, or at least "it is not the case that we must encourage it". I'm not sure I agree with that, but I believe the intended point was weaker than you've described. There are many advantages in working remotely, and there are also disadvantages. Enforcing either could be harmful, but encouraging one over the other might not be. Fortunately, I don't think I'll have to decide on that policy at any point in my career.

Huawei new smartphone won't be Mate-y with Google apps as trade sanctions kick in

Re: And if Huawei allowed unlocked bootloaders

No, I can't see those at all. I can see a pointless ban by the American government as part of a trade war, nothing else. I don't support that, but just because some people somewhere chose to paint the company as a security risk when they're not, that doesn't make every other possibility true. You've claimed that people are out there bricking devices with intentionally damaged firmware and then claiming refunds, but you can't point to who is doing it or when it's happened. In addition, it's completely illogical.

It'd be similar to saying "There are people out there who go into stores, steal the batteries from phones that have replaceable batteries, and replace them with lookalikes that also contain a tracking function and can be primed to explode if the people who built the replacements want to turn the phones into explosives. Therefore, we should not allow replaceable batteries." That statement and yours are similar in that A) nobody is doing that, B) if someone did do that, it'd be completely pointless, and C) if people did do that for whatever reason, the suggested course of actions would not stop them.

Re: And if Huawei allowed unlocked bootloaders

I was responding to "As long as there are companies and secret services that work with mafia methods, you can't afford such liberties. They would be their downfall if they did." Clearly, I misinterpreted it. I misinterpreted it because what you've clarified sounds a bit crazy. Do you have evidence of someone who actually did that? Because other than overworking the company tech support as they reflash their devices, the criminals doing that wouldn't gain anything at all. You only get to claim a refund if the device is manufactured with defects, not if you've deliberately destroyed it.

You don't see, for example, people throwing phones on the ground then shipping the destroyed remnants back and asking for money, because that wouldn't work. And a locked bootloader doesn't really protect against that in any case, because if you really want to render a device unusable, intentionally uploading a corrupted ROM is a relatively time-intensive and very reversible method, I.E. one of the worst options for available frauds. Furthermore, unless you can point to a place that did this, it's a weird argument to make.

I'm sorry that I gave you credit for an argument you didn't make. I thought you were talking about accessing data or preparing a device for resale, because that's the major undesirable thing that criminals do to phones. I apologize for assuming you also considered this aspect, but I believe we are now on the same page. What book this page is in is another question, but one that can wait.

Re: And if Huawei allowed unlocked bootloaders

I don't understand your comment. Are you alleging that locked bootloaders are there to protect us from criminals and surveillance systems? If you are, that's pretty laughable. People steal phones all the time. Most of the time, they don't care about the data and are perfectly happy to reflash the device and sell it on. Even if they could replace the firmware with something else, the phone's serial numbers, IMEI, etc would still be present so the phone would be just as easy to identify as stolen. They don't need to care about the bootloader, only whatever antitheft mechanism the manufacturer has. A good antitheft mechanism doesn't have to be incompatible with an unlocked bootloader; a solution as easy as "Please enter phone's encryption unlock code before the bootloader starts" would serve perfectly.

As for surveillance states, they really care about the data on the phone. Not the hardware itself, just the data. There are only really two ways they go about getting data from a device:

Method 1: They have a phone, and they want to extract all its data but the data is encrypted. In that case, they don't need to replace the firmware, because doing that would wipe out data they need (either all the user data or at least the key used to extract it). They might try to copy the old firmware so they can retry encryption codes, but the antitheft system I described above would hamper them from doing so.

Method 2: They have a phone briefly, and they want to install malware on it to track a user who will use the device in the future. In this case, the last thing they'll do is to replace the firmware. If anything looks different, they'll be caught and the person they're tracking will dump the device. They'll use the tracking software they can install above the firmware level, which can be deployed much more quickly. In either case, a properly encrypted device will prevent them.

Re: Surely Huawei can just facilitate the user adding these?

This proves my point. You have a phone with the required APIs, and all the apps work. Huawei's phone won't have those. Almost all of the apps from FDroid will work perfectly. Many of the apps on the play store will also work perfectly when sideloaded or retrieved from the store by one of the apps you mentioned. However, if an app uses Play Services or another one of Google's proprietary APIs, and many do, the app won't work when installed. It will install properly, but when you try to launch it, it will reach a point where it crashes or doesn't work properly. In order to fix that, a user has to install the required APIs. These exist, but they're not listed on FDroid or in the Play Store itself as Google thinks they've been shipped as part of the default firmware. So the user will have to look for the APKs online, find the versions that run on their hardware, and install them in the correct order. I have no doubt that, when this phone is released, someone will create those APKs and publish them in a matter of days. Users will just have to find an uninfected copy of those and install them correctly. As I said, it's doable, but not without effort.

Re: Surely Huawei can just facilitate the user adding these?

What you need to consider is that none of the proprietary Google APIs are present, meaning most apps in the play store, along with the play store itself, won't work. You'd have to sideload those APIs first, which is doable, but you have to find versions of them somewhere (they're not on FDroid), then load them in the proper order and with some special requirements. Doable, but not without some technical knowledge and having to trust a source of the packages.

Re: So an android phone without the built in google spyware?

They also cannot preinstall the Facebook app, so you get your wish there. Unfortunately, we have no guarantee that they haven't just replaced the Google and Facebook spyware with spyware from anyone else, whether Huawei or someone else they got money from. Though it's probably at least a little bit more private than what Huawei used to ship, I'm still going to recommend an open source variant like Lineage OS for real, verifiable privacy.

Re: This is more of a problem for Google than for Huawei

It's not a stupid question. Huawei makes a lot of phones for the Chinese market and is making money hand over fist in that market. We all know that. But this Google services cut doesn't really hurt that at all, since China has blocked almost all of Google's services anyway for a decade or more. I'd be concerned that they'd lose market share in China if they dropped AOSP for their own custom and untested OS, but if they stick with effectively the same code as they used before, that's clearly not going to happen.

So the major question is how much it will hurt Huawei's ability to sell their phones overseas, and establishing their current market share in various places is a necessary first step to accurately calculating that. And for some countries, their market share is very low, such that it wouldn't be easy to tell if they've lost many customers. For the record, from statistics I found online, and I'm going to have to trust that the internet has correct data on this, Huawei's market share by country is basically this:

Italy: 24.4%

Russia: 14.1%

France: 13.2%

Mexico: 12%

U.K.: 8.1%

Australia: 7.1%

Japan: 4.3%

Canada: 3.8%

India: ~2%, noted to be falling quickly

U.S.: very low, doesn't show on graph

Brazil: very low, doesn't show on graph

Based on these figures, we can see that it's quite logical to ask about the current market share of Huawei by country. If they lose lots of business in Italy due to the services cut, it's much worse for them than if they lose business in Brazil. Americans probably don't see many Huawei devices when out and about, while Russians probably do. And in addition to the mathematical benefits, it gives us a concept of where Huawei does business and where it has yet to take over. I think the question's well worth the asking.

Coin-mining malware jumps from Arm IoT gear to Intel servers

Re: IoT malware targets Intel machines running Linux

It's stated that the access method is SSH, so some options include:

1. SSHing with poor or default credentials to root because not all Linux users are, in your words, self-respecting.

2. SSHing with poor or default credentials to something that isn't root, then elevating to root if the user has sudo privs.

3. SSHing with poor or default credentials to something that isn't root, and therefore installing as a user process. It's not as effective, but it'll mine sometimes and that can't hurt the criminals because why should they care?

I have a public-facing server with SSH enabled. Root can't log in, and anything that can log in has an undisclosed username* and either a seriously difficult password or keys only. Lots of automated login attempts occur, but not all of them are people fruitlessly trying to log in as root. Many are trying things like "admin", "system", "user", or the machine's domain name. The people trying this must be doing it because it sometimes works.

*Undisclosed username: This is not a security measure; I know that security by obscurity doesn't work. What it does let me do is set up a monitor for the SSH logs that can inform me if someone is trying to log into an actual account, thus filtering noise from the pointless attempts. If someone does get a real username, I will know about it and I can figure out where that information came from and where this at least a bit more sophisticated attack is coming from. Unless that filter activates, I don't have to worry about the automatic SSH bots. And while we're on the subject, *checks logs*, nobody's guessed any real usernames since the server was set up two years ago.

Re: So..

In many cases, it already does. If you ever try mining on Windows, you'll probably have to whitelist the directory where you put your miner. In fact, Windows Defender even treats the Monero binaries as malware, even though you can't use them to mine, only to transact. But there are fewer traditional antivirus products for Linux, and they're less common, so I don't know if they also treat mining as suspicious.

Zapped from the Play store: Another developer gets no sense from Google, appeals to the public

Google almost certainly spent a few of their billions on a team of attorneys to draw up a contract that lets them do anything they want, as long as it doesn't break the law, but also some things that do break the law because who's going to check, and insulate themselves from any developer action. Meanwhile, they also have the resources to make sure a challenge in court will last long enough for the other party to run out of money, and if someone smallish challenges them on this contract, I fully expect to see that tactic used.