Posts by doublelayer

HTTP gets a QUERY method so complex searches can stop pretending to be POST

Re: Idempotent

Judging from the number of people who use it during interviews without fully understanding what it is, what it isn't, and when, why, and how you implement it, I'd say there are a lot of people who think they know what it means who don't actually know what it means. What is necessary for an operation to be idempotent depends on what that operation is and requires you to know some things in order for that to happen. For example, in the financial example from the article, you have to know extra data to distinguish someone repeating the same transaction who should not be charged twice and someone placing a second order for the same amount who should be.

Datacenter MacGyver saved the biggest football match of the year

Re: "he had therefore paid tax on it"

If the bonus had been the same amount in cash, there probably wouldn't be any complaint about the tax since it would be a positive, though incredibly tiny amount. Since it was not enough to be used for anything but was taxed at the same rate, it ended up being a negative, albeit still probably a very small one, to the extent that a recipient would probably turn it down if they knew it would happen in advance.

Red Hat offers RHEL support ‘forever’ for those who need to lock in to legacy tech

"Around here a free version of forever RHEL for the Raspberry Pi would be well received"

But, if they make it, it's certainly not going to be free. Forever support is costly and annoying. They're going to reserve that for the people who are willing to pay large amounts for it to happen. If you want free, you have to do more work, including updating things. The work you are hoping to avoid is exactly the same work that they'd be doing and why it's not cheap for them to do it.

AI tool scours the web for job openings, preps your resume and cover letter

Re: Have your bot call my bot

I doubt the end of the AI bubble will do much about this. When writing a cover letter for a job, you don't need the highest-end LLM that needs a big datacenter to run it. A tiny one can also write a professional-sounding letter that parrots your CV. Sure, when you run it on your laptop, it might take two minutes to write that where one running on GPUs would manage it in a few seconds, but you're running it overnight, you won't notice. I think the only restriction to using this kind of thing is the technical difficulty in setting it up, and recruiters can help those who aren't technical enough. I think only the end of the universe or someone coming up with a new way of applying to jobs (I don't have any ideas there) will change that.

Schleswig-Holstein waves auf Wiedersehen to Microsoft stack

I have been using Linux for quite a while, that's true. However, the things that were listed are the easiest parts, and the difficult ones would likely be difficult for anyone to fix entirely or someone would have already done it. Installing an X terminal is easy*. Figuring out what drivers don't work and how to fix them is hard because they keep changing from model to model and release to release. Therefore, I don't think we would make the IT department's lives any easier by doing the former for them.

In your case, I have not experienced your audio issue, and one of the first things I would do because I'm lazy would be to start several distros, including Ubuntu, Mint, and Fedora to see if it worked on any of them, then use information from one that did work to fix the problem. This is unfortunately a painful process, though many people using Linux are lucky enough to avoid having to do it. Mail clients will depend on what features you need in it. I use Thunderbird, which handles what I need fine enough, but I need email and basic calendar only. Evolution is popular and has a better reputation for replacing other functions of Outlook. Software availability is another true but sometimes overstated problem when switching to Linux.

* I define easy as not just easy for me, but easy for the trustworthy user, which I define as someone who can be trusted to follow an instruction document correctly. The instruction document to install an X client gives either specific buttons to click or a few commands to enter. One to debug sound drivers would have to include a bunch of heuristics about things that might cause it, different debug paths depending on what audio system was in use, and requires the user interpret much more complicated output in order to follow the procedure. I'm confident that an IT department that already used Windows or Mac OS could manage the easy parts with relatively little work if they needed to, and if Linux thin clients was important enough to the business that they were going to do it, then they'd have enough reasons to learn what they needed.

Brown says AI make student brain no work good, teacher should help use it better

Re: "an opportunity to ramp up the difficulty"

Fortunately, we don't really need to know everyone's reason for using the LLM, just whether they did or not. The professor made no claim that relied on a specific, unproven reason a student might have used the thing, nor would academic integrity rules care.

Your alternative explanation for lower final scores isn't actually an alternative. The claim wasn't that LLMs latch onto the brain and disable it, it was that the choice to use it meant students weren't doing what they needed to to properly learn, and your argument also involves students not doing what they need to to properly learn. Whether students did that because "this is too hard, I don't want to bother anymore" or "I have fun things to do, I don't want to bother anymore", the part the professor's talking about remains the same.

Re: Gander

Maybe because that didn't happen in this case? It almost certainly happens. LLMs are a handy tool for people who don't want to do what they are supposed to*. When it does, happen, it would make sense for someone to write an article about it here like this one where that was planned. But it doesn't make sense for this article about students using it and the professor not doing so to segue into unverified accusations against unrelated professors.

* You've argued in favor of that before. I hope this signals you're changing your opinion. LLMs can be misused by lots of people and it causes problems nearly every time. Unfortunately, we have relatively few things any of us can do to stop it.

New tool gives CLIs a warm and GUI feeling instead

Re: Why an AI?

"I did [repeat myself], but at least I seem to be a lone voice, as opposed to a righteous cacophony of self-embigment."

Thanks for that, but I don't think it's making the case that I should shut up, especially as I'm content not to speak about the parts we agree on.

LLMs were not created singlehanded by some researcher at a university who had their toy creation snatched off their repo and sold. Research like that did lead to the first steps, but for the past many years, most people building these things worked at companies who were selling it, and they knew how that selling was happening. My opinion is that that gives them indirect responsibility. They elevate themselves to direct every time, and it has been many times, they backed up those promises themselves at conferences, when a newspaper asked for a technical person instead of the CEO again, in the readmes on Git repos, and nearly every other time they could have told the truth and chose to say something else. That happens all the time.

"I'm puzzled – if an implementation of a design doesn't meet the design spec, then the implementation is flawed."

Agreed. That's just one way that something can not do what it was designed to. If I do not have the design spec, I will treat the advertising as the spec and hold the designers accountable if they are complicit with that advertising.

Re: Why an AI?

"it gets extremely tedious to be in a room full of angry people endlessly and repetitively shouting at each other about something they all agree on, don't you think?"

It does, which is why we've agreed to disagree before. But since you repeated yourself, I repeated my disagreement with you.

"What whose claims say? Answer: not the people who actually develop, design and build the hardware/software;"

That's what we disagree on. I do think those people are directly and actively responsible for the mis-selling. They are often the ones making the marketing claims themselves. When they employ sales staff to do it for them, they know what claims are being made and do not protest them as they stand to gain, and if they are asked directly, they back up the claims. Using your argument, it is completely impossible for anything to do anything other than what it was designed to do, which I consider a tautology and an incorrect one as the only information we have for what the design goals are are the claims of the designers, so whenever those claims and what the thing does disagree, it doesn't do what it was designed to.

Re: Why an AI?

We've discussed this before, but I think you'll find that most of us are not willing to separate the mis-selling from your pedantic and debatable "designed to do". A thing that's being sold is designed to do what they're claiming it does. If it doesn't do what the claims say, that's a design problem and they can't get away from that by pretending the marketers and the developers just didn't know what each other was thinking and doing, especially when it is clear that they absolutely did know and continue to follow the pattern.

Microsoft intros tech that rebuilds dead PCs without requiring local copies of Windows

Re: In 2006 I was able to boot an old Ubuntu LiveCD

"How is this any different ?"

The lack of live CD. Windows had the recovery media which retrieves a Windows installation for a long time too.

More broadly, it isn't about installing an OS from scratch, it's about resetting or recovering one that's already installed. It's also not a big feature. All the pieces required to do this already existed, so all they've done is arrange them together without recommending you write it to a USB disk on something else then use that. This Windows feature is neither very new nor very impressive. However, in an attempt to defend Linux as light years ahead of Microsoft, you and some others are making incorrect comparisons to things that do something completely different. In fact, Linux distros generally don't have this kind of thing, mostly because they think, probably correctly, that their users don't need it because they can easily boot to live USB and clean up whatever they want if there's a boot problem.

Re: Raspberry Pi and Raspberry OS have had this

You're mixing up a lot of things. PXE is not a Windows or Unix/Linux thing. The "P" should make that clear (it stands for "preboot"). Computers running Windows have had PXE for the same time because, if you ever used it on a Linux machine, it was the same PXE that would have been there had it been running Windows instead because neither OS brought it with them. This is not the same. This is a Windows-specific environment which is less resilient but more user-friendly than using PXE to retrieve an installation.

Re: Johnny come lately ?

Windows RE currently does boot from the Windows partition, not the UEFI partition. If the computer is so broken that the Windows partition is gone, then WinRE will not start by default unless someone, the manufacturer or the user, has put a separate WinRE partition on the disk. Admittedly, I have seen more of those on recent machines. Without either of those, you would have to netboot to it or bring a disk with it. This can reinstall Windows from a very broken Windows, but not from an intentionally removed one.

That makes it much less powerful for recovery than Mac OS recovery. However, I must correct you on the disk thing. It used to be true that Macs included that recovery environment on separate storage, and that made it available even when the disk had failed or been removed. That's no longer the case. Modern Macs not only have the recovery environment on the internal storage, they have other parts of firmware on it too. If that storage fails, the Mac is very dead until it is replaced by suitably imaged storage. Only Mac Minis theoretically can have that storage replaced, whereas everything else has soldered chips that Apple does not replace individually.

Re: you’ll need a Windows 11 machine that’s already running Windows Recovery Environment

You don't appear to know what WSL is and on what it is installed or what systemd has to do with this (hint: nothing). These and other errors suggest you are missing other important facts. Please check everything and try again.

Bug in top AI coding agents shows that Unix-era security headaches never really die

Re: If that works it seems like an ssh security flaw

How are you going to prevent it? Symlinks don't ask the destination file if it accepts the link. They don't even check if the destination exists. They just provide a string which the filesystem follows and a label allowing the caller to know that first.

In that example, yes, the ~ will expand to the attacker's username and that's the link that the git repo will contain. However, there are ways around that. There are several predictable absolute file paths you might want to mess with.

Another way you could manage this is to use backward paths by making repeated symlink calls going up several directories and adding a simple directory existence check, like this:

ln -s ../.ssh/authorized_keys config1.json

ln -s ../../.ssh/authorized_keys config2.json

...

As long as this is somewhere in the user's home directory, one of those will find it.

MFA-optional banks leave safe doors (and accounts) wide open for thieves to pillage

Re: How the crims got into accounts :o

Now you're making my point as if it disagrees with me making the same one. A digital signature proves that the email came from where it says it came from. It doesn't prove that where it says it came from is a person you should trust. A digital signature mostly can't do that. And yet that was what you were certain we didn't have and needed, both of which were incorrect assumptions.

"The problem being that the nefarious types can't read your emails or sell your confidential information on to the business sector."

No, that's a different problem. Encryption helps with that problem, but if your emails are being sold, it's probably not interception of unencrypted data that's doing it. But the problem you originally complained about and that the article and all these comments is talking about is that criminals can phish people for bank details, and the ideal solution is either to make it impossible for them to phish (which is exceedingly unlikely) or to prevent them from being as successful even if their phishing messages work. I'm not convinced you understand the elements of the new problem you've switched to, but it's also not relevant to what you or anyone else was talking about earlier.

Re: Passkeys

"Now, if the banks can implement that sort of system for their own staff, why can they not implement it for us plebs who keep money in them?"

They can. But check the existing comments to see the reaction to much simpler methods of security and what some of us tech people, assuming every commenter in these forums is one, think of that. If people refuse to use simple MFA methods, how do you think they'd react to better but more complex ones? Extend that to most customers of a bank who are even less technical. If too many people prefer convenience to security, then convenience is what they'll get.

If you support forcing all customers to use the more secure method, I agree with you in principle but it's unpopular and they don't want to lose customers. That means the best we can hope for is that higher level of security as an optional feature, and some banks do offer that. If you want a challenge-response MFA token login system as separate hardware, you can get it, but you probably have to shop around until you find a bank you like which offers it. More do that via mobile app than do it with custom hardware.

Re: How the crims got into accounts :o

Surely, if those problems are as easy to solve as you claim, you could solve them for us? If you try, one problem you'll run into is that the things you've identified as the problem are not the problem. Digital signature on email? It almost certainly had that; it's called DKIM. It proves the email came from the server that it did come from, not that the server was trustworthy. E2E encryption isn't on email by default, though we could probably extend the CA process to make it easier, but once again, that would only prevent interception, not prove trustworthiness.

As for safely navigating the web, you're asking for the technical equivalent of the entire world not to have anything dangerous in it. It didn't work for the physical world, where hazards and crime continue to exist, and you can't manage it on the web perfectly, nor even do much of an imperfect job without lots of consequences.

We can do plenty to try to improve this. We can write filters to try to catch impersonation and warn users more actively, for example, though it will definitely alert incorrectly sometimes and users will still have to handle that. If you think it's possible for someone to make email perfectly safe and they're just not bothering, you don't understand the problem and won't be able to make those improvements that are possible until you do.

Re: Educate me please

Some of your questions have clear answers, whereas others depend on the procedures at the organization. Taking them in order:

"A passkey is tied to a physical device.": It doesn't have to be. Passkeys are portable and you can export them. You have to remember to do it and this only helps against device failure, not theft, but you can copy passkeys for that situation. Ideally, the service allows you to create multiple ones when you set up so you can have individual ones and revoke any, but there is no guarantee whether they will allow that or only let you have one.

"Isn’t that [replacing a passkey] just “forgot your password?” in another form? [...] If I’ve been socially engineered to give away my first pet’s name etc, is there basically no more protection?": This depends on their procedures, but it is indeed a weak point. They could require you to show up in person with identification to do it, which would make it more secure but significantly less convenient.

"If my device is stolen, how do I revoke that device’s passkey quickly?": The ideal way is to have a second passkey on that account but not on the same device, log in with that, and revoke the previous one. I have some passkeys stored in a secure location for that reason. Unfortunately, that's more thinking ahead which makes passkeys more difficult for others to use. If you only have one, then you probably have to contact the organization and ask them to revoke.

"If the device is snatched from my hand whilst unlocked, is there ever a situation where the passkey can be accessed without further secret knowledge?": This depends how you store them. Those passkeys I can access from my phone require me to reauthenticate to open the app, so someone who steals my phone when unlocked but doesn't know the unlock code (in my case, a different one, though the normal unlock code is more often the requirement) won't be able to get at them. That's the default on some applications, and on others you can use OS features to make it happen anyway.

Re: Educate me please

I think they were talking about passkeys as suggested by the article, user-generated cryptographic tokens.

Re: Passkey issue

A passkey isn't just another password because the private part doesn't have to be known by the external service, only by you. You've probably used SSH keys before, no? It's like that.

Some risks are the same. If someone can copy the key content off your computer, then they've got it too. Other risks are not, if they make a fake page and convince you it's real, the passkey won't work on their page and wouldn't provide a replayable mechanism anyway. They have many problems, but not the one you're suggesting they do.

Software engineers can still rake in big bucks by working for fast-growing companies

Re: Thumb

I'm not sure I got all of this argument, but the main part is a common misconception that has led and will likely continue to lead people to dissatisfaction but is never going to change. The theory holds that, if you are generating something valuable which would not have existed if you didn't do what you did, that you are worth as much as the value you generated. This is incorrect and has two harmful effects.

It is incorrect for two reasons. Had you not done what you did, it's possible someone else would have. This is especially true in a company situation, where someone else decided to hire for a role and set the responsibilities. That is obvious when we consider how much a company can fail even when they have competent employees by assigning them the wrong jobs. Though it's unpleasant, if many others could have done what you did, then you are replaceable and most of the value accrues to whatever was not. The other part is that it's easy to overestimate how much of a job is done singlehanded. Everyone involved thinks they did basically everything, but they're mostly wrong. Joel Spolsky named this the development abstraction layer, but it's far from unique to programming.

This attitude causes two problems. The first is devaluing people when what they do doesn't have an obvious numeric value. What's the value in currency of making sure the printer isn't broken? The other is unbalanced responsibilities. If you think you deserve lots when the thing you worked on was a commercial success, then what do you deserve if it's a commercial failure and the company loses money? Should they retrieve the money they paid to you since you didn't create value? Clearly, they should not; they agreed to pay you for a job and you did it, and whether the lack of value was due to their mismanagement or your failure, it is their problem. But risks and rewards are correlated for a reason, and if you aren't accepting that risk, you also agree that if they make more out of what you built, you were also paid to do a job and you did it.

AMD’s Ryzen AI Halo makes local AI look easy, but at $4K, easy doesn't come cheap

Re: Is it worth it?

OK, how about you collect some prices and compare them here?

I'm guessing it wasn't compared because those are quite variable and depend on usage information they can't estimate, so they'd have to compare a single price for this hardware, or set of a few for different RAM configurations, against a large table of possible costs of hosting depending on provider, model, use case, and use frequency.

Insert token to continue, says AI. Yeah, about that...

Re: "Elon Musk is a big Adams fan."

A lot of tech people are fans of sci-fi, including most of the famous ones. In my experience, many of them also don't understand what they read. Metaphors, context, world building, and other important ways to understand why some plot or setting point happened seem to fly over their heads. Examples of this are all over the place:

* AI promoters describing how AI might take over jump straight to AI control theories seemingly lifted straight from Ellison and Asimov, not considering that their AI works in a completely different way and that they were often using it as a metaphor for human sociology.

* More extremely, a worry that AI might control nuclear weapons or something similarly destructive and decide to kill people with them, seemingly not considering that the science fiction pioneers in the 1950s and 1960s might be thinking a lot about what humans would do with those but that there are many other things a theoretically independent AGI might want to do instead.

* People obsessed with leaving Earth to colonize other planets whose colonies look suspiciously like those envisioned by Bradbury or Clark, not considering that those were mostly made up because nobody knew what it would be like to try to live on Mars and that they often explained how much damage humans were causing by doing it that way.

* People intent on finding aliens whose imagination of what they'd do is remarkably like those from Le Guin's works, not considering that she had a lot of political and philosophical points she was using those to make.

* "Futurists" who, when they decide to imagine the future, grab concepts from every science fiction author that already did that as scenery and pick their favorites, not considering that the people using nanotech surgery machines, fusion power, or immersive virtual reality were either doing that to investigate the consequences of the tech or had it as background whereas the futurist's job is to consider whether it's actually practical or likely to be when they're predicting it, not just if they think it would be cool.

I'm not surprised that Musk considers himself a Hitchhikers fan. It doesn't mean he knows why any of what he likes was written there.

NASA says it will isolate volunteers from the outside world for a year

That depends where the hypothetical settlement or mission is going. On or near the moon, you can probably manage it, but on Mars, radio has a minimum of three minutes latency (one-way) and requires more than a normal transmitter. That's in the ideal case. When Mars and Earth are farther apart with the sun in the middle, latency stretches to over twenty minutes and the sun often gets in the way. Anyone going further than the moon should expect substantial delays and drop-outs, and even those on the moon should expect it to not be perfect.

Re: The psychology of isolation

They probably don't want to put it anywhere dangerous or expensive, but how about the arctic, probably somewhere in Alaska, in a place where help can easily get to them but they couldn't easily get anywhere. It would accentuate the isolation without involving much risk.

If it's just to satisfy my curiosity, I suggest they have two groups, one in that arctic or other remote location, and one back in Houston, to measure how big a difference the knowledge that they're not really isolated causes. The rest of the experiment should and probably already is designed to ensure they are isolated outside of emergencies in all physical cases*, and I'm curious if the psychological factor is as big as this thread supposes.

* Whether they're denied any communication or whether that communication is restricted and delayed, I assume they aren't being given a normal internet connection. Previous experiments managed that, so I doubt this one will go backward on realism. Most of the factors called out in the linked article would apply as much to people required to stay in isolation whether or not there are people outside the walls.

Amazon’s Mechanical Turk to stop accepting new customers – and not even AI can save it

I guess it depends on your definition of remote. If it was controlled by pulling lines from another room, would that count as remote or does remote only include wireless connection?

If the line example does count, then there's argument that the article got it right after all, just not very remote physically. The operator did not hide within the statue, seeing the chess board with their eyes and moving pieces with their hands directly. They hid below the statue, got events from the chess board through a copying mechanism, and moved the hand by moving internal levers on a different board. All that would be required to make that count as remote is to make those things longer so they could do that from another room instead of from inside the box, but though they certainly could have done it, that wouldn't have been as good an illusion.

AI search could kill the web without new quality signals and revenue models

Re: Fixed that for you

This probably depends on your definition of commercial, but there's plenty of noncommercial web that this will hurt as well. Here are several examples, from obviously noncommercial to debatable:

1. Site with information faces increased costs from constant and disguised AI scraping, admin who gets no money from this decides they can't constantly manage this and should shut the site down as they can't maintain the servers under that load while continuing not to monetize in any way.

2. Site that doesn't monetize in any way but does rely on user contributions (of information) to stay updated faces increased burden from scraping while simultaneously not getting that user flow. To stay relevant, the maintainer must collect more information themselves, which may be too much work for them to justify.

3. A site which has a donation button to help with upkeep but nobody presses it if they don't go there.

Even if you've decided that someone trying to make money from a website, and let's be clear that the websites mostly being covered here are open access (or the scrapers would need to bypass a paywall) are for some reason beneath you, there are plenty of sites which don't do that at all.

Re: It will kill content creators, not the web

Both your comments are literally true, but since you knew the original point wasn't making the literal claim, neither argues against it. The web as a technology won't end. How could it anyway? But they weren't talking about that. They were talking about the variety and openness of resources that has been and still mostly is available on it. Similarly, websites don't disappear if search engines won't link to them, but in practice the effect on those operating them can be quite similar depending on what they do. Nobody argued the other side of either of these things, so your responses appear to acknowledge all the points others were making and attach a pedantic correct but unneeded point which you rank most highly.

Oracle outlines all the ways it could lose the farm it bet on AI

Re: Oh, Yeah ... Oracle

A place I volunteered with did consider using their cloud, just for IaaS, a couple years back. They had something bandwidth heavy, Oracle Cloud's bandwidth pricing was much better than their competitors, and the charity doesn't have their own servers or a good place to install them. They probably would have gone with Oracle except for the fact that, when we created an account to test things, it wasn't approved for weeks, when we contacted Oracle to fix that, they assigned us an account manager, evidently assuming we were much larger than we were, still took a week to approve the account, and then we ran into more obstruction creating a low-cost VM. As the unofficial admin of everything, I was a little worried that every management action I was going to do from then on was not going to work until I contacted the account manager whose helpfulness was probably going to decline the first time they realized I was calling myself "volunteer at charity that's mostly other volunteers" and not "CIO of massive enterprise". Hopefully, they've done something about that.

Godot says bye bye AI, bans vibe-coded contributions

Re: Why would people even do this?

Delusion, usually. They want a feature, but the programmer friend they know* wasn't willing to write it for them, they didn't know how to write it themselves, but all it costs is a $20 monthly subscription that can do everything your friend can do, and you probably only need it in months where ideas come up. That's a small price for all the features you want added to any open source software, right?

* Personal anecdote, someone I sort of know contacted me having decided they wanted a piece of software. They told an LLM to write it, which the LLM did, but they needed someone who could compile the generated C++, giving you an idea of their level of competence in the area. I foolishly agreed to run the compiler for them, which produced the following results for each of the versions they provided:

1. Compiler error, but I took pity and fixed it, resulting CLI program didn't work.

2. No compiler error, CLI program crashed immediately.

3. No compiler error, program now mutated into a GUI did launch but didn't do anything.

4. Compiler error, I wouldn't fix it and just sent them the error messages.

It was about this time that they decided the LLM coding wasn't great. It was also about this time they decided to get irritating and treat me like an LLM, because they then asked me to write the code myself. It is not the first time I've been asked to write software for people as a favor, but it was one of the ones I refused most quickly. Some people do not understand what programming, or probably most things, involves and that will just cause chaos if they get involved.

Boffins peg narcissistic leadership as the real driver behind 'return to office' demands

Re: As a non boffin (here under threat of expulsion if I say something stupid)....

Most of the arguments I've seen for work location quality have been mostly or entirely without evidence and take the form of deciding what their preferred work location is then stating that it is better and there's no questioning it. When managers do this, they generally have more power to force people to follow them, but I've seen plenty of that from the remote work supporters as well. Unfortunately, most of the attempts to study productivity have a hard time measuring it, not a surprise if jobs like ours are included where it's almost impossible to decide whether I, writing code, am more or less productive than you, writing code for a completely different kind of thing in a different environment.

Anecdotally, I think there are advantages to being in an office, and people who don't consciously act to facilitate them can easily destroy them and make the office much worse than working remotely. Some of the simple ways that this has been done is to put people in an office where the people they work with are in a different one, thus obtaining the same separation as remote working with the downsides of a different working environment. Another one is designing the office to make things needed for productivity difficult, for instance having no control of noise and not having enough space or equipment. If they're not going to have an office properly, I think it's better not to have one at all, and I expect many who prefer remote work all the time are comparing it to that kind of environment.

Re: @author > error?

I think Ken's suggestion is more likely, because most of the companies are not just not delivering, they can't. Google doesn't have startup-style workers because they don't provide startup-style rewards because they're not a startup. Most of those who join startups do so because they're willing to take a lot more work in return for a chance at a high reward from the success of that startup. If the startup goes from a tiny company nobody's heard of to a household name, and I own 0.5% of it, that will suddenly become very lucrative. Google is not going to have that kind of stock movement no matter how successful the product I've been assigned to is, so that kind of reward will never show up.

Can't is not exactly correct. Google could simulate that if they thought it was important enough. They could, for example, announce that, if the new AI product got X million weekly active users by Y date, the workers would get bonuses of Z thousand shares of Google. However, they won't do that because this is generally a bad idea, being potentially very expensive whether or not the product had commercial success. Working like the stereotypical startup is stressful, can only be done for so long, and only works on projects with specific features. It causes enough problems for workers and companies when they have those things. It only works when managers, sales, etc are doing it as well; startup-style engineering and big company-style everything else will not work. When someone tries that without the reasons people accept the pain, it works even less well.

Where there's a will, AI still has work to do

Re: How hard did they try?

You're doing the same thing you're accusing them of doing, asking the LLM to give you a bunch of questions and counting it as a success because it managed that. Since it only matters if it can take those answers and make a legally valid document afterward, you too have not tried hard enough to know whether it can. While neither of you tried all the things you would need to, the lawyers got far closer than you did. They got a will out of it and analyzed it for validity and content. Theirs is also the test that has some meaning to actual users, since, unless the person who wants a will knows to prompt engineer their way to the right answer, they'll get what the LLM gave the lawyers here.

You're mistating how lawyers work. They don't work like LLMs, where they take the request and generate a document. They work like humans, where they clarify the request, fill in blanks, and then write the document. This is an important difference in many areas, where you have to do a lot of prompting to get LLMs to simulate the planning procedure required to write a document and hope that they can keep track of all those things when writing. Lawyers, programmers, and most other professions which work in this way are so used to having to clarify and add details that they can and often do find all the information purely by asking questions and tracking the answers. LLMs don't by default, and showing that you can get them to do one part doesn't matter unless they can do all the parts.

Re: Do you really need one?

Wills always struck me as similar to software which people should buy off the shelf but still try to reimplement each time. For very complex situations, leaving controlling interest in a business to one child, partial but smaller ownership to another one, cash but no business to a third, contingent on some actions of the children, I can see why you'd need a custom-written one. For most of the circumstances people seem to want to use, it would seem that it should be possible to build one out of simple predefined clauses without an expensive lawyer needed to write the part where you add a non-relative and allocate them something.

Microsoft builds a bouncer to keep bots out of Teams meetings

Re: Explain like I'm five :o

Integrations. By default, they can't, but you can automatically invite bots to things quite easily if you change the right settings, and the bot is probably charged per use and has no reason not to join. Most of those integrations also have ways to indicate that this meeting is private so the bot won't be informed that it exists and not able to join without approval even if it did, but you have to know that exists, how to use it, why to use it, and then do so. Not everybody does.

Re: transcription bots

I can imagine a few reasons:

1. You're having a meeting with some people, and you'll note or remember the important things, but your manager who wasn't in the meeting wants to be able to check the full details.

2. You're having a meeting, and you will try to write everything down, but there's going to be a lot of tiny details and you want to be able to get them all exactly as delivered without spending most of the meeting producing a near-transcript by hand.

3. You have a legal requirement to preserve something, hence a recording, and the transcript makes it easier, if it's at least mostly accurate, to find things that recording contains.

4. There is a person with some or total hearing difficulties who can read transcripts but will have trouble without them.

5. You're having a meeting where you'll need to nail down a bunch of small details which there could be later disagreement about, so just in case there's disagreement later, it could be useful to document what you did decide and why.

6. You're talking to someone who you don't trust to remember or acknowledge what happened and you want external evidence to avoid getting into arguments about whether you agreed to something or not.

Re: Teams Architecture...

Citation needed. $employer, for instance, uses Google Meet, and they have had at least one bot which decided to join more meetings than we wanted it in. Fortunately, it didn't cause a problem because the bot needed manual admittance whenever it was wanted so we didn't push that button, but it still tried. I'm not sure the platform in either case is responsible for what meetings the bot's been informed about (it can't join if it doesn't know the meeting is scheduled) and which of those it decides to join.

Mageia 10 keeps the 32-bit Linux flame alive

Re: old fashioned

I'm afraid I can't remember what thing was doing this out of the box. I'm almost certain this was during the period where I had started using Linux but hadn't yet learned the distro lessons so was still trying new ones frequently. There were many little differences like that, some of them even good ideas, but of course most of the distros probably don't exist anymore.

Re: old fashioned

I've seen that from time to time, including before systemd. The first time I saw it, reboot and shutdown were defined as suids and would check if you were in a group, then restart for you. It matches the rest of the environment because you wouldn't be prompted for your password to hit the shut down button on the GUI, so they make the terminal match it. I don't have a strong opinion in favor of either method. To fix this the way you suggest, I suggest just adding

alias reboot='sudo shutdown -r 1'

to your shell, which will make you enter a password anyway and will automatically put a one-minute cancelable timer on it.

I don't think they have any need to stick with an older 6.12 kernel since 486 support was only very recently dropped. It would take a very long time for I686 to be dropped and all the machines you've named support that, so they can easily go to a newer LTS kernel and still expect to support 32-bit machines.

It's looking like a hot, messy summer for security teams as AI finds countless previously hidden vulns

Re: Patterns in the Noise

"the general consensus *seems* to be that they have become extremely good working with e.g. software, scripting languages and technology [product] configurations"

No, that's your consensus. You've said that in many ways on a lot of topics recently, but as many times as you say they're great at something, it doesn't make them any greater or remove the situations where they're wrong. Talk to other people and you'll find that consensus isn't as general as you think.

While the context would provide a bit of data, one of your questions makes it clear you don't understand how these things work in practice: "Did you get any response when you raised that as an issue with the authors?". What happened was they couldn't raise that as an issue with the authors. The authors were one of a few model makers who do not ask for or accept reports of buggy LLM output from any random person online, partly because there's so many people using it somehow and partly because LLM output does all sorts of weird things for any number of hard-to-debug reasons. Small changes in prompts can radically change whether the LLM's answer is correct or not or whether its answer looks like it answers the question or goes off on a strange tangent and doesn't come back.

Maybe they got non-working JS-style C++ because there was some JavaScript code that interacted. Or because the StackOverflow post it was getting some training data from was related to a similar one containing JS examples, or any number of other random things. The LLM authors couldn't really debug or fix that, and the user definitely couldn't. The only thing is to try a different prompt or a different model and hope something different happens the next time, which it probably will though no promises whether that new thing is useful or not.

Re: Why not make software like every other product?

Those liability-limiting provisions are probably not as legally binding as they look, but there are still problems trying to do that which are more directly applicable to the comparison to other products. Software, especially complex software, has so many functions and methods of it not going right that it's difficult to define what it's supposed to be fit for and how you're supposed to use it, and both of those things will come up in any complaint, whether or not the contract is allowed to limit liability or whether it means anything if it says that. There are cases demonstrating that serious gaps in functionality or security do result in liability regardless of contracts and that companies do have it held against them, but it's all the smaller cases that don't work as well.

Let's compare Windows to a shovel. A weird case, but I think it will make a couple points. Windows has limitations on what it can do, and there are use cases where it will fail. The same applies to the shovel; if you bought a normal kind which was built to deal with leaves or snow, but tried to move wet cement with it, the shovel would probably fail and you would be unlikely to successfully claim the shovel was unfit, even if they didn't warn about that. How does Windows successfully explain what it is fit for when it is a very generic piece of software which can do thousands of things and can't do thousands of other things?

There's also the problem of operating procedure. If I use the shovel as a hammer and it breaks something I hit with it, the manufacturer will get out of the complaint by saying that was not how it was supposed to be used. If you made liability stricter on software, that's also what Microsoft would say with Windows, but they have far more ways to claim that it wasn't their software going wrong, it was you using it wrong. Since there are hundreds of interacting components in Windows, there are far more ways for them to claim that, whether because you actually used it wrong (and many complaints I've seen are exactly that) or Microsoft wanting you to lose even though they were at fault. It's not simple, which is why problems generally have to be large to be guaranteed of victory.

Re: Here's a stupid question

Probably not for a few reasons of capacity and practice. Let's start with the more boring but bigger practice ones. The theory is we hire all these people then tell them to improve things, they look for security problems, find them, and fix them. In practice, what most developers are hired to do is to add features. Please be secure while you do that, please maintain while you do that, if you spot anything during your work toss it on the task board to work on, but still, more software is one of the major things they consider. It's only a short trip from that to deprioritizing the maintenance tasks on the board because we've got an important thing to get done, we can pay down the tech debt after that. Salaries could prevent situations where something a business is relying heavily on is about to get dropped by its solo volunteer maintainer, but the maintainer probably wouldn't have had the chance to work on any maintenance task they thought best if they were being paid.

But leaving practice, what if that's how it went? Perhaps instead of salaries, we called it sponsorship? The maintainer gets paid to maintain and decides on their own how to do that. This probably still wouldn't fix the problem unless that maintainer was focused on finding and squashing any vulnerability they could. This is rarely people's top priority, and it takes more than just having some more time. You have to know what's real and you have to sift through lots of reports from a variety of tools to find the problems. LLMs both help and hurt with this process since they can eliminate some obviously invalid reports but will also generate more detailed incorrect noise for you to search through. This is rarely people's favorite type of maintenance, which is why it's often easier to get a known vulnerability fixed than a new one proactively discovered. You would likely only get what you described if there was a concerted effort to find people who would do it and pay them to do it, and I think you'd find that you need quite a lot of gazillions to do that.

Re: infinite bugs

It probably has a finite number of bugs, but as you fix the old ones, you can make new ones, so the number of possibilities is almost unlimited. That's more true if the solution to people not having the time to fix all of these becomes to have the LLM fix the bugs. I'm not sure I get your point; a finite but large number of bugs that a lot of people need to fix and patch right now when there aren't many fixers and patchers doing it is still a problem.

Re: Patterns in the Noise

Some of what you want is not what you'd get.

Bugs by language wouldn't tell you that one programming language is just bad and you need to stop using it. It's not that simple, both because the LLM will be crap at finding bugs in languages it has little information for and because vulns-per-LOC is not a great metric. Some languages use fewer lines to express the same thing, and some vulns will be pointed out on multiple lines.

The logic of the code is a bit more promising, but you mostly already know that. If the problem's at user input sanitization or validation, it is in user-facing code, but if there's a useful lesson about where that's more likely, you'd have to subdivide that into much more tenuous categories which would get into pointless definitional questions rather quickly.

The general approach is a good one, but it's just as annoying and painstaking as it always is on far more findings. Analyzing each found vulnerability to try to learn why people didn't find it from the start is great, but people often decide to stop doing it the eighth time the answer is "XSS vulnerability slipped through because the creator wasn't thinking about XSS at all and the reviewer thought the output thing was doing autoescaping but it wasn't" or "buffer overflow because there's twelve functions that directly manipulate this memory and one of them reset one of the values incorrectly and the other one assumed it was correct and used it". You have to be willing to keep doing the same thing until you get results that tell you something, then apply those results. A lot of people do this some of the time, and I often help them do it, but I wouldn't expect it to become much more common.

And that is the core of why the "can't fix it themselves" comment was used. It's not literally true, it is possible for someone other than the author to fix it, but when they say it, they usually mean they don't have the experience needed to do it, they don't have the bandwidth to do it to everything they found, they don't have the history to quickly upstream the fix to the project so it would need to be retrofitted into every subsequent version until they got that (which takes more dev time to try to manage), and sometimes also that they don't have the programming skill required to modify the library, only that needed to use it. Whether you consider these arguments valid will probably depend on what they're using, how heavily, and what resources they have, because most of them probably can fix some things that they're choosing not to. But, in the same way, you could pick up some programming guides, learn what's changed, and get to work too, but you probably have some reasons why you don't think that's the best option.

Re: Hidden in plain sight

There are existing standards, some mandatory, out there. The EU's CRA requirements are pretty good for what they cover. The problem is that they tell you what good things you must do, not what stupid things not to do. It's really tricky to legislate the latter, since there are a very large number of possible stupid things, most people would never think of doing most of them so going through the list is pointless, and the people who do them wouldn't understand or care about the list.

The suggestion to subject everything to testing is possible and does match good practice in other areas. However, thorough security testing tends to be expensive in itself and more so when all the fixes have to be implemented and the testing repeated to check anything that got in during the fixing. I've seen security scanners whose main purpose appears to be running just enough scans that you can claim to have tested without risking finding anything too costly to fix. I have a theory that these include a bunch of people who don't know about security rather than having planned that, but either way the outcome is the same. Therefore, anyone building a product gets to choose between proper, but lengthy and costly security testing, or quick but bad security testing, but if their competitors choose the bad version, the competitors get to launch first. I'm afraid that will lead companies to also do bad testing and tell themselves they'll fix it later.

Australia investigating five social media giants for not enforcing ban on kids

Re: Social Media

Good methods might not really exist. We should consider some options, but I think one of the most important things we must admit first is that, if we fail to find good methods, that still doesn't make bad methods good. Even if we can't make social media stop various things we'd like them to stop, we still have reasons not to put an ID check in front of any site some politician wants to control or make it possible for anyone to sue a website to remove any user post they dislike.

The things I most want social media to stop actually are things we have ways to prohibit. Privacy abuses can be detected and they can be punished. The GDPR is an excellent start for a law that would do that, but we'd need to extend it either so that the data protection authorities aren't just for cosmetic reasons or that individuals can bring legal action when regulators have made it clear they're unwilling to enforce the law.

The problem of unhinged content is trickier, but one method I think would be easier than strict liability for anything they leave up is more limited liability about what they promote. Failed to spot a weird post proposing murder, unfortunate. Spotted that post and chose to show it to thousands of people who had no previous connection to it even though 2.3% of them reported it? That was a publishing decision and it can be used against them more easily.