Posts by doublelayer

Huawei new smartphone won't be Mate-y with Google apps as trade sanctions kick in

Re: One question.

Should a technically aware person want to sideload the play store, they can probably do so with relative ease. However, that probably won't be as straightforward for the average user, who would have to install the various Google APIs before the store could work. Although it's pretty simple, finding the required files that will run on the hardware involved and installing them properly is just over that line where many won't bother. I can't say whether that will be a problem for Huawei, because we don't quite know how many people will fall into both the categories "don't want to worry about sideloading APKs" and "need apps from the play store". I can say with conviction, however, that should anyone in my family purchase this device and want to use the play store, they'll be asking me to find and install the packages rather than doing it themselves.

Re: Things that weren't mentioned by most news about this

They can definitely access the web apps. It wouldn't be feasible or desirable to block them, and if Google tried (or the U.S. government tried to make Google do it), they'd be facing a lot of legal complaints they couldn't easily counter. So that deals with gmail and youtube easily. This AOSP device should also ship with the default android mail client, which can also connect to gmail easily. It would be able to show the web interface for Google Maps, but that probably won't be so popular given that people use it for in-vehicle navigation, which the web version doesn't really do. However, there are many alternatives for that, including some open source ones from FDroid that work pretty well.

No access to the play store might be harder to get around, as most users aren't attracted to a phone where they can't as easily install any app they want. It's no trouble for us, because many, including me, don't have any play store apps installed and don't find the prospect of having to sideload something worrying. But for those who want to be able to quickly type the name of their mobile game of choice, they might find that feature removal irritating.

Hong Kong ISPs beg Chinese govt not to impose Great Firewall on them

Yes, it is such an argument. If Hong Kong's internet is cut off, all the data centers will become less popular. Nobody will set up new ones, and people wishing to have servers in a place that can be accessed in China but aren't controlled by China will leave for other locations, probably South Korea for the main Eastern connections and eastern India for overflow. The investment in Hong Kong's data lines will have been wasted, and access to approved data inside China will be made slower because fewer lines will have to take the traffic. That's without considering the loss in business when all the people who used to use those datacenters look at all the datacenters in Singapore and figure that those will work just fine.

Today's Resident Evil: Ransomware crooks think local, not global, prey on schools, towns, libraries, courts, cities...

Yes, we think backups are the solution. Backups isn't just the big box of tapes with all the data from last weekend on them; it includes everything that allows data recovery when data is lost. Whether that be snapshots, extra copies, or the big box of tapes.

You're right that having to restore from backup at the level of off-site external media is costly in time and money, but there are some things to keep in mind:

1. We only suggest doing that if you have to, I.E. the backups that are online and easy to restore from don't work. Frequently, more persistent ransomware will have found those and screwed them up. Yes, you can configure them not to be vulnerable to the typical attacks, and that will protect you from the majority of lazy ransomware. If it does, that's great. If it doesn't, fall back to offline media.

2. Restoring media may be an expensive DR option, but that's to be expected. This is disaster recovery; you only do it when there's been a disaster. There are lots of other disasters where you'd have to do the same thing, but having to rebuild from scratch would cost much more. If the cost is too high for the business, it might be worth constructing a cheaper backup system or one that restores more easily.

3. Paying the ransom is a terrible idea. It guarantees that you have the same problem that let the ransomware get in. They might also stay resident in order to hit you again in a few months or maybe just to add your machines to a botnet.

4. Paying the ransom is immoral. It funds criminals when there is another option, and increases the probability that an attack like this will happen again. If you pay the ransom, you are making someone else pay the real cost for you. That's bad.

They could do that, but they could pretty easily keep an offline backup, whether there or offsite, with relatively similar amounts of effort. If they're not going to do that, they aren't going to do a cloud backup either. If they don't have staff competent enough to keep proper backups, this is going to keep happening.

Apple says sorry for Siri slurping voice commands of unsuspecting users

Re: Random identifier

If they're doing what they say they're doing, the random identifier is just that, a random string assigned when the request comes. In that case, it wouldn't be attached to any other data, not by hash or anything else. Then, after six months, the key with the random string is deleted so anyone looking at the data couldn't be connected with other recordings from the same source. And if they did that, things would probably be fine subject to some extra considerations like the aforementioned backups storing strings for longer, which wouldn't identify users but would allow collating recordings for a device.

But we have no way of knowing whether they are keeping to that. And they have to have known previous to this that having people listen to recordings is dubious at best, but they didn't stop doing it until right now. If they do what they say they're going to do, then I'm quite a bit happier with them. And so far, they haven't lied about not doing something they are really doing, but haven't been particularly proactive in determining when something they admit they're doing is problematic. We'll have to watch them; if they decide to do something like this again, we have to nip it in the bud.

Microsoft's only gone and published the exFAT spec, now supports popping it in the Linux kernel

Re: My uninformed comment

UDF is the solution? I've had a read through the wikipedia article about UDF, and I have my doubts. We'll start with the problem that it's designed for optical media. As in media that can be written a couple of times at most, not one that might have an operating system boot off it or store frequently changed files. There is a version not specifically designed for limited-writes media, but there are others designed specifically for that purpose. This brings us to the next point.

There are a bunch of revisions of the UDF spec. And we all know what that means: lots of poor implementations that support only some of them. And it's not just different release versions, but multiple types of filesystem inside UDF. The wikipedia page includes many statements about what versions different implementations support. Actually, they don't say that. They instead tell us what different implementations "claim to support". Sometimes, such a statement is followed by a statement that only certain subversions are correctly supported, and much of this is for reading only.

My third point can best be made with this quote: "The UDF specifications[7] allow only one Character Set OSTA CS0". When this is a key point in the summary of a spec, and they follow it with a discussion of when this doesn't play well with other encodings, I know it's not fun to deal too much with this filesystem.

Re: Bring compatibility problems to Window, not the other way around

I'm completely fine with you implementing EXT4 support for Windows. But unless it gets installed by default, it's useless for most cases. The average user isn't going to understand that they have to open the partition they see, install the driver, then remove and reinsert the media, probably after restarting, and then it'll work. That will just annoy them. And most people who have EXT4-formatted removable media aren't going to bother partitioning it to include the drivers for Windows, and for that matter Mac OS as well.

For removable media, I want the guarantee that I can plug my disk into anything, and the files will be there without needing to deal with drivers, request extra access to install them, or require reconfiguration. We already have a thing that does that, and it's FAT. The only tiny problem with FAT is that it contains a couple very irritating defects, the most obvious of which is the limit on file size that can quite easily be exceeded. But because we don't have anything else that pretty much every operating system understands, I still use it for most of my removable media. Getting a better version that doesn't have those defects and having that run on everything new would be wonderful. I don't really care which particular filesystem it is; if everyone adopts EXT4 I'd be equally content. But it's got to be built in.

A quick check that might be incorrect suggests that they were granted a central patent in 2009 source, and then the patent would expire in 2026. I'm wondering why the patent was granted in 2009 when the filesystem was released in 2006, so there are some other options. But no, it seems they could keep charging for the patent for a few more years, and if they release it under acceptable terms, they're not going to do so.

Re: What if ...

While they don't necessarily have to use exFAT for that, it is probably the logical choice. ExFAT is a filesystem that plays very well with external media and most operating systems, Linux included if the package is installed. Most other filesystems don't meet one or both of those requirements. If they're also using Linux, you have many other options including the basic EXTs, but that will be more trouble for them than it's worth if they use Windows or Mac OS. Of course, the code installed to let Linux deal with exFAT at the moment won't be all that fast, which a kernel implementation would fix. I am therefore quite hopeful that this does get implemented soon.

Samsung Note10+ torn apart to expose three 5G antennas: One has to pick up something

Re: Ban nontreplaceable batteries

It could easily just be heavier use. If you do more things with your phone, you'll have used up the battery faster (I.E. it doesn't last as long even when new) and put it through more cycles because it kept getting discharged. It could also be that your phone is less power efficient than the one mentioned.

While I'm entirely in favor of phones having more user-replaceable parts, I don't particularly care about anything other than the battery, and I don't care all that much about that either. I know people can replace other parts of phones, but all the devices I've seen this on have been somewhat unstable (E.G. replaced screen panels that don't really feel like staying firmly on the phone). For the battery, I'm really hoping that, after four years or so of use when I'd like a new battery, I can find someone who is making compatible batteries today, rather than shipping compatible ones they've had on the shelf since the release of the phone or releasing batteries that look like they'll probably work, and once they get shipped here individually, I can plug them into my phone I don't want to replace just yet and see if they really do.

In purchasing a phone, I expect that, at some point, it will develop a serious mechanical problem. I could try to fix it or get someone more skilled with a soldering iron to help me, but I know that's likely to make the device function worse. That's why I try to go for cheapness. Modern cheapish Android phones are quite well-built, and I don't feel like I've lost much if it turns out that this one doesn't stay together as long as I hoped and I'll have to replace it after three years instead of six. I can't guarantee any reasonable lifetime of a device, but I can make it so that when the inevitable happens, I'm out much less than I might have been.

Re: Typical Corporate Greed

You don't need a headphone jack. I don't need one either. Probably few of the people posting here need one. But plenty of people posting here really want one, and base their purchasing decisions around that desire. I don't see why you have a problem with them when they complain about a lack of a feature they want. In my situation, the jack is sort of handy, but I don't really use it all that often. When my phone breaks and I need to replace it, I won't make a headphone socket a required feature. But why do you seem to have so much hatred for the connector or people who use it?

Biz forked out $115k to tout 'Time AI' crypto at Black Hat. Now it sues organizers because hackers heckled it

Re: Junk "science"

"Technically you are correct. But if you compare good arxiv "preprints" with published versions you'll find that many have only very minor changes."

In general, Wikipedia provides a useful, comprehensive, well-researched, and balanced summary of pretty much every topic. It's a great start for gaining some basic knowledge about something. And if I want to, I can go in and mess it all up. So can a lot of other people, so there's always some chance that the page you see there has been recently vandalized to contain incorrect information. Similarly, Arxiv is a great resource, given it allows members of the public to access papers without having to pay a journal that isn't actually doing the important part, and for that I'm quite grateful. Still, Arxiv can be polluted by useless documents, too. I haven't read the "paper" produced by these people, and I don't intend to, but just because they've posted it on a mostly reputable site doesn't mean that its contents are of any use to anyone.

Wait a minute, we're supposed to haggle! ISPs want folk to bargain over broadband

Re: Penalising loyal customers - helps competition?

This applies to pretty much every network provider I've seen in any country.

"Get our new UNLIMITED DATA plan just 29.99/month"

"How many lines do you want? 29.99/month/line above four, 43.99 for three and four, 59.99 for the second, and 85.99 for first."

"How much data at usable speeds do you want? 29.99 for 2 GB, 39.99 for 3 GB, etc."

"Do you want to be able to make voice calls with that plan? Add 4.99/month/line above four, 6.99/month for three and four, ..."

"Choose your free phone to go with this plan. Your choices are the latest iPhone at only 54.99/month for the rest of eternity, the Samsung flagship for the same price, a weirdly chosen midrange Android for 34.99/month and wondering why that's the one chosen, the Huawei for 44.99/month, [scrolling, scrolling] [option to choose no device not found in list]"

"Enter discount codes. [These codes may exist, but the most you'll get is a 15% discount on the first month]"

The companies might have a better plan, but I'm too busy hating them to be able to call and ask about it.

Pokemon Go becomes Pokemon No as games biz Niantic agrees to curb trespassing addicts

Ethics

I haven't been affected by people doing this, but in the hypothetical situation, how ethical or unethical do you think it would be for me to set up a device that catches requests for WiFi and establishes connections that don't work to mess up the many phones set to prefer known WiFi networks over cellular, then put it so it covers my yard but doesn't have enough power to extend outside of it. Is that too untargeted?

I couldn't possibly tell you the computer's ID over the phone, I've been on A Course™

Re: I wish my users protected data like this efficient PA

I take the point about asset lists not always being up to date, and I don't think that's the necessary solution to the problem. Yet it's still not the fault of the user concerned. They were, perhaps annoyingly, sticking stubbornly to their security training. In other words, they were doing exactly what we'd want them to do in the case of an attempt at social engineering. Repeatedly shouting at the user to give you information doesn't help prove the point. Asking the user to call back with a trustworthy number does do that. There are other ways to authenticate as internal and/or trustworthy, but none were mentioned. Worse, the user who acted in compliance with their training and was actually able to provide the required information without leaking potentially secure information was penalized in a frankly pretty irresponsible manner.

Contacts-slurping Android malware sneaked onto Google Play store – twice

Re: How it looks to me

It doesn't hurt all that much if other people get slices of the data. Many of them are showing Google ads anyway, and most of the other data collection isn't for ad competition but for spyware purposes. Why should Google care about that?

Also, implementing real checks that catch copied malware code that hasn't been hidden in any way would take, like, a month for a few Google Play engineers. They could be working on something else. Something more useful like ... Android security updates and getting those running on more devices? No, not those. These are cloud engineers after all. How about ... malicious extension detection for Chrome? No, not that either. They're not focused on that type of code. Another idea ... thinking ... thinking ... got it! They could work on preventing ad blockers from working. Sound good to everyone? Well, we've identified the best use of developer time. Go back and get that implemented guys.

Buying a Chromebook? Don't forget to check that best-before date

Re: Keep calm and just install something else

It is a tech site. That's why we know about the potential problems with no security updates, and why we aren't happy to see this being sold to unsuspecting purchasers, both technical and nontechnical. And maybe we can install something, but there are lots of points to consider about that:

1. Some may be locked down or lack driver support for anything other than Chrome OS. So in that case, we can't.

2. Some may lack the specifications to run anything else (E.G. really tiny storage). The purchaser probably doesn't care because they just wanted to run Chrome OS, but it would prevent a useful installation of something else. If this specification limit was the reason for dropping support, I'd drop my objection, but it's clearly not.

3. Maybe the thing to replace Chrome OS doesn't work as well for the intended purpose. For people like us, a full Linux installation would probably be much more useful. For someone else, the lack of any complexity in Chrome OS might have been a selling point. They chose to buy the device because of (or in my mind in spite of) the OS, so it stands to reason that they probably want to keep it. This especially applies to schools; they need laptops that can run a browser and are cheap enough that they can be replaced. Of course they could do that with a Linux distro running on that or similar hardware, but that requires a Linux admin who they'd have to pay. The selling point of these that got them adopted in so many schools was that you didn't need to spend as much time on administration. It turns out you have to spend that in money for new hardware that doesn't provide you any benefits.

4. There is no good technical reason for dropping support like this. If they released a new version of the OS and said "Sorry to any chromebook users still stuck with 16 GB of storage, but we'll need some more for this version. We'll give you security updates for this version for a bit longer, but you will probably want to buy a new one or expand the storage if possible eventually", I wouldn't complain. If they released new versions that need more processing so they run slowly on old hardware, I'd complain about poor coding practices but they would have no policy complaints from me. But they're not doing that; they're setting a death date for the devices and then cutting them off at that point for no good reason.

My MacBook Woe: I got up close and personal with city's snatch'n'dash crooks (aka some bastard stole my laptop)

Re: A note of CA license plates...

Maybe, but with that description of how the plates work, it doesn't sound all that hard to fake. It wouldn't stop someone who was looking at the stolen car, but works just fine when you're worried about someone taking down the number while the car is in motion, which is exactly the situation in this case.

Re: Or

"Floor tiles that aren't glued down, so that if anyone runs then their feet slip and they don't actually move."

Good suggestions except for that one. I don't think health and safety legislation will like that one, and I wouldn't either when an emergency happened.

Re: So here's the advantage to soldering down the SSD

Machines can be locked down to that extent, but many noncorporate ones aren't. Thus, the criminals may be surprised to find one with those precautions implemented because their previous ones have not been so encumbered. It doesn't help the victim very much, unless Apple makes that level of security the default. Of course, if they do that, it won't help people who really want to erase a machine they have a right to erase; if a user has forgotten their encryption code, the IT department will much rather have to reimage the machine rather than throw it away.

Re: "should risk their necks to protect your shiny tech toy "

I might not have intervened, probably because it'd take long enough for me to understand what was happening that I couldn't do anything. But afterwards, when the victim is asking people to witness, I'd definitely step up, no risk involved. Even if all I can say is "I didn't see much, but I can corroborate that I saw a guy running through here with a laptop, and you were chasing him so it was probably yours", I'll do that. Doing nothing while the crime happened is understandable, as it probably took about twenty seconds. Keeping silent afterwards is not very nice, because you could just say "I'm afraid I was facing the other way and didn't see anything" if that's the case.

Re: Serves you right for being a hipster

I have to wonder about the utility of that lock. It's great when you want to leave something on a table, like in a lab, but not as much if you're using it at the time. At best, the thief grabs the machine and runs away, only to find that they can't. Then, they drop the machine and run off. You may still have the machine, but it's now just been dropped, probably with some force. In addition, since they were running and probably tried pulling hard to separate the lock from the machine, it probably also has damage from such forceful tugs on the lock. However, the lock might also signal to someone that you have an expensive machine and they should come get it when you've undone the lock and are putting it away, which wouldn't help at all.

Re: That's horrible.

"Re Mac Vs PC.... evidently the thieves consider MacBooks worth stealing, which suggests that Apple's security measures can be circumvented so that it can be used by someone other than the owner."

You're overthinking this. While people like you or me would think about all sorts of technical things when deciding what laptop to steal, this doesn't necessarily apply to all criminals. Some consider that, I'm sure, but many more might simply choose the mac because it looks expensive and Apple products are known to sell at higher prices on secondhand markets than the average device from another manufacturer. While some others like thinkpads also sell well, the criminals might not be able to identify those immediately.

Here's my guess: these people either have heard from others or have discovered from limited experience that people buy Apple machines and pay quite a bit for them. They probably haven't seen that many people activating the security features; just because Apple has done a lot to make them user friendly doesn't mean that users know they exist. Therefore, the criminals have been able, at least most of the time, to erase the disk and sell it on without being caught. This may be their first victim to have locked the machine, encrypted the disk, or given the serial number out.

"Also, they put effort in their plan to steal a MacBook Air, instead of a more expensive Pro model. Does the Pro's security chip (with its formally Verified OS) prevent serial number spoofing (if that is indeed what is happening)?"

Once again, I doubt it. The air and the pro can be told apart, sure, but at a glance from the back they look similar--a thin metal laptop with a glowing Apple logo. There probably weren't any pros in the shop, or the criminals thought the slightly larger air looked more valuable than the smaller pro. Just because they planned their route in and out of the shop doesn't mean they scoped out their target. They might have planned to go in, grab the best looking laptop, and run out again. The security chips in the machines don't help much if the user doesn't enable them, so the criminals may never have had to deal with that before.

There once was a biz called Bitbucket, that told Mercurial to suck it. Now devs are dejected, their code soon ejected

Re: Git

"A problem not uncommon in FOSS.... And now that Micros~1 has it, it can only git worse."

Microsoft doesn't write git. It's still fully in the control of an open group. Microsoft just bought Github, which is a site that stores and processes git repos. Github might write some code for git, but they don't control it and their code only gets in if the developers of git approve it. Many other sites, like the one the article is about, can also process git repos, and git works identically with each of them. Don't try to blame Microsoft for something they have nothing to do with.

So your Google Play Publisher account has been terminated – of course you would want to know why exactly

I have to admit that I also thought of this passage:

"He [a citizen of Oceania] has no freedom of choice in any direction whatever. On the other hand, his actions are not regulated by law or by any clearly formulated code of behavior. In Oceania there is no law. Thoughts and actions which, when detected, mean certain death are not formally forbidden, and the endless purges, arrests, tortures, imprisonments, and vaporizations are not inflicted as punishment for crimes which have actually been committed, but are merely the wiping-out of persons who might perhaps commit a crime at some time in the future."

It's not directly applicable, but it did come to mind. Do you think I've read this book too many times?

When Google places its play store in a position where it controls a lot of the Android app market, it becomes difficult not to rely on them for your business if your business is writing apps that run on Android. The same is true of Apple. Just because you can sideload apps on an Android device doesn't mean that is generally accepted--Google has managed to make it such that almost all users never do that and have put some scary security warning screens in to dissuade users. Admittedly, what the screens say is true, but they've still gone to lengths to promote the play store. As such, although they have a right to be terrible to developers whenever they feel like it, I feel justified in having a problem with their choice to do so. This guy may deserve to have the account closed, although I don't currently know why, but I think Google should tell him their reasoning. Given that it's almost certainly an automatic account closing process, the program must know the reasoning

Re: Dancing with the devil

"If you want to stop people gaming the system, telling them the rules isn't a good plan."

If you want people not to violate your rules, telling them the rules means they know what they're not allowed to do. If you don't tell people the rules, but you still have rules, you're just a dictator. It's Google's platform, so they have a right to be a dictator if they want, but that doesn't mean we have to like or accept it.

"Guy in this story freely admits to trying to push things to the limits; that's why they banned him."

Did he? I don't remember that from the article. I remember that he did something unusual which was not strictly banned but caused some concern, then he dealt with that in a professional manner. Then, he tried to figure out what the problem was with another app but couldn't on his own and Google wouldn't say. Maybe he did in fact do something that warrants the account closure, but neither he nor I nor you have an idea what it was.

Apple's WebKit techs declare privacy circumvention to be a security issue

Re: The difference bweteen Apple and Mozilla

"Apply [sic] don't want anyone else tracking you because that lowers the value of the information in their posession."

Wrong. They don't want people tracking you because they think that will help them sell more devices to people who like privacy but don't know how to go about getting it themselves. They do collect some information, but their track record with collection is much better than with pretty much any other major tech company. They are doing it for a commercial reason, not out of the goodness of their hearts, but they are at least doing it honestly.

"Mozilla don't want you to be able to track them and their harebraned changes they keep making to Firefox."

Is this a joke? The tracking protection in Firefox blocks trackers from third parties from seeing user information. It doesn't block you from tracking Mozilla. Mozilla releases all their changes in source and documentation form to the public, and they've never seemed to care much whether people like the changes they made. I'm just confused now. What were you trying to say there?

'Hey Google, remind Greg the locks have been changed, and he should find a new place to live. Maybe ask his mistress?'

Re: Random

Probably because it wouldn't help much. These devices don't process speech locally, so if the connection goes down, you couldn't tell it to turn on the radio. You could put a normal set of radio controls on top, but now that's a larger change that the manufacturer doesn't care about.

I don't understand your hotspot suggestion. Are you suggesting that the voice assistant should have a WiFi network for radios? Why? And if you're instead suggesting that it broadcast radio signals for a broadcast receiver to pick up, that's illegal. I'm not sure what you want.

Re: Family Link

Explanation doesn't work completely for children that young. If the system concerned makes it easy enough, the child will probably go ahead with it, especially as they can't do some things without having an account. Explaining about privacy, legal restraints, etc. doesn't really penetrate their minds, because they don't know how many ways they can be tracked. I remember setting up an account in my childhood thinking that I must be completely safe because I used a different name, an address constructed from a random number, fake street name, and a postal code from a directory site, and a birth date set to make my age 27. That account actually was safe, because it wasn't from a company that did extra tracking, but I would not have had the knowledge to determine safe from unsafe. Discipline might not work either; the parents have to know exactly what the child is doing at all times. If the child doesn't understand the systems well enough to know what is allowed and what isn't, they could end up thinking that all activity online is forbidden. In general, I'd try to ensure that the child already has accounts for things they will want to use, such as email, which can be restricted or audited by the parents until the child has a clearer concept of what can happen online. Explanations might help, but I don't think they will be sufficient on their own.

Re: "Parents looking to induct their children into this brave new world of communication"

I suppose the argument could be that these devices, which listen perpetually, are more in keeping with 1984's society than that of Brave New World. On the surface, that makes sense, but on another reading, probably not. In 1984, a malicious government installs the devices and forces their use. In Brave New World, there is a controlling government, but they've gotten everyone in society to never really consider anything. It's still done by force--people didn't give up their old ideas of their own free will--but nobody really cares that that happens and anyone who does care is seen as a weird person who can be ignored, rather than one who needs to be taken away. The use of devices with such a dubious privacy record which people voluntarily decide to purchase and install is on the Brave New World side of the continuum.

Re: Dystopia, one improvement at a time

They've taken something we could already do, by scheduling a message being sent or making a voice call, which is already a normal part of life, and managed to write code to make it unbelievably irritating. Congratulations guys. What's next? Maybe, instead of making a mechanism for people to yell at other people about taking out the trash, you could invent something that takes out the trash. Or just stop inventing things. You've gotten overeager again.

Let's see what the sweet, kind, new Microsoft that everyone loves is up to. Ah yes, forcing more Office home users into annual subscriptions

Re: Ransomware

Perhaps you didn't like my point, but I think it was sufficiently clear. They are using and recommending the docx file format. Yes, Microsoft designed it, but that's not quite enough. They have put it under an open license, which means that it is not proprietary. They cannot argue, for example, that using another program on it, writing such a program, etc is forbidden. Just because a company designed something doesn't mean it's proprietary. Red Hat designed and wrote large chunks of modern Linux distributions, but its license allows others to use it freely. If Microsoft introduced a new, non-open format, then it could be described as ransomware. As it is, they've merely changed their pricing mechanisms to a more annoying one. I don't support that, and I've already said as much above, but the original statement of having to pay to use your files is factually incorrect.

Re: Ransomware

Come on. I don't like subscription model pricing either, but it's not ransomware. Keep paying to use this program, or stop and use another one. Either way, you still have all your files and they still work in other programs. Your definition would apply if they only used a proprietary format or forced all data storage on their systems, but they're doing neither of those things. When the users stop paying for that, they can take their files to LibreOffice, the old installations of standalone office, Apple's iWork, one of those other online word processors (Apple, Google, and Amazon all have one for some reason), or lots of other programs. Come back with your ransomware accusation if they make a proprietary (as in designed to be incompatible, not just designed by them) format or if they delete the "save on disk" option and limit storage to their cloud. Until then, it doesn't apply.

Apple is a filthy AWS, Azure, Google reseller, gripe punters: iPhone giant accused of hiding iCloud's real backend

Re: Not sure it works like that...

It also doesn't exactly work because iCloud doesn't run the same style of backup as AWS does. AWS backs up data on their systems, whereas iCloud backs up data on client devices. If a user decides to buy both of them, they have no guarantee that those two places are going to store the backups in different places.

Consider the following parallel: I store my data with two different companies, each having stored the data in their own datacenters, which are not the same. Each tells me that, if their datacenter is disrupted, for example by the building catching on fire, my data is not necessarily protected. That's why I stored it on the systems of two companies. However, both datacenters are in the same general area. Then, that general area concerned gets ravaged by a massive natural disaster appropriate for the region. Both companies' datacenters get destroyed. You are trying to blame the owner of one of the datacenters concerned. In reality, nobody's at fault though I should have done a little more checking to ensure my backup was stored in a geographically distributed manner.

This is why off-site backup contracts are so complex. When you want a guarantee for where your data is and what can happen to the provider before you lose access to your data, either temporarily or permanently, you can't just assume that things will fall into place without doing the due diligence. If you're concerned that multiple providers will be using the same physical location or system, you have to check that before you go ahead with it.

Re: Wait a minute

Argument fails. If Amazon used a delivery company that was breaking the law, that's where law enforcement comes in. The argument we're trying to parallel doesn't have that, so that particular example is irrelevant. If they used a company I didn't like but wasn't breaking the law, I could decide not to use Amazon. I don't have the right to say "Amazon is using a delivery company I don't like, so they should switch to another one or do the delivery themselves".

Re: A contract is a contract

"If Folgers sold coffee grown by Maxwell and labeled it as Folgers, I'd believe it was grown by Folgers."

From a very quick check online, it doesn't look like either of these companies grows coffee. They buy coffee from other people who grow it then do whatever grinding technique/recipe they use to make their products. I'm going to assume that these products are detectably different; I don't know as I've never tried either, but it helps make your point. Unfortunately, it doesn't help your point enough, because the difference between the companies is what they do to the coffee, from their quality control on the beans to whatever preparation techniques they use. Maybe the companies get their coffee from different subspecies of the coffee plants and from different areas of the globe, but that doesn't get announced in their brands. For all you know, they're buying their coffee beans from exactly the same massive coffee growing company. It's what they do to it that makes it a product. Similarly, Apple has its own software and service, and it buys computing capacity to run it on. Whether it runs on Amazon's servers, Microsoft's servers, Google's servers, servers Apple built that run inside Apple headquarters, or servers that are sourced from mainstream server manufacturers and stacked in a datacenter somewhere random, the service is the same to the users. If there were any difference, including extra non-Apple people having the ability to see unencrypted user data, that would be a problem and a possible cause for complaint. But that's not the case.

"When people defend mega corps with EULA speak, you know people have been mentally conditioned."

First, I'd like to point out that neither the person to whom you replied nor I have used any legal terms, unless you count "Apple's own software and service" as legalese.

Second, we use legal arguments because legal arguments are at play. This is a court case, and part of the discussion is whether the case will succeed. And we're not blindly defending megacorps. I'm sure you can investigate all our post histories and see that we've often denounced many large companies. We defend defensible actions only. And it matters not if it's a company I like or one I dislike, if they're doing something that I don't find problematic, I'm not going to attack them on that basis just because I disagree with something else they do.

Re: T.I.T. Security

I believe that most bank contracts do specify certain things about how things are stored, giving certain assurances of security, insurance, etc. I'm not sure that they all do, but I've seen such contracts for banks where you store money, and I assume the banks where you store precious metals, because their clientele has the money to afford lots of lawyers, has similarly specific contracts.

Apple specifies in its contract that the data will be encrypted and will not be accessible to others, which is similar to the banks saying they will store the items given to them in a secure vault. Neither mention the specific location or locations where that's going to happen. I see no available legal argument for this case, and from the sound of it, I don't think there should be one.

Web body mulls halving HTTPS cert lifetimes. That screaming in the distance is HTTPS cert sellers fearing orgs will bail for Let's Encrypt

Re: Encourages automation, increases security, reduces costs

Everything's possible. However, LE is run by some pretty charitable people with a track record of not being that rent-seeking. In addition, all their code is open and freely-licensed, so someone could copy their system quickly. Of course there'd be some difficulty getting the new system trusted by everybody, but it could eventually happen. I think we'll probably be fine.

Re: DV's only

That's all true, but what's the point? Certs only protect the transport layer, so if they're doing that, they're serving their purpose. Protecting the endpoint is the job of something else.

Re: Money spinner

Short answer: not at all.

Long answer: Not at all, as this is exactly the situation shortened lifetimes is trying to prevent. Well, your first point is. Your second point about a domain having expired isn't at issue, because you are then perfectly within your rights to buy it and get a cert for it, whether your purposes are malicious or not. There's nothing anyone can do about that.

But back to your first point. Let's postulate two servers, Alice and Bob. Both host an HTTPS server with a certificate. Alice has set hers up using LetsEncrypt or someone else with a 90-day expire time. Bob has set his up with a 39-month cert back when they were still in use. Today, you break into both of them and steal their certificate files. You're planning to impersonate these servers on a compromised connection to get users to trust your fake sites. Having stolen the private keys, there's little you can't do. That's why private keys are protected. But you can only impersonate Alice for at most ninety days unless you can break in again. If Alice improves her security, or if you obtained the file by paying for an attacker to obtain the file for you, it could be much more difficult to get a new one. You couldn't use that cert to renew itself; only the real server can do that because LetsEncrypt uses a DNS check. Meanwhile, you can impersonate Bob for quite a long time. His cert is valid for a little over three years. That gives you a lot more time. If neither fix their security, you have access to impersonate them for as long as it takes them to figure it out. If they do fix their security, Alice is safe much earlier than Bob is, unless they realize that the certs have been compromised, in which case they both revoke them and we're back to the same again.

Re: I still wait for Let's Authenticate...

That's a valid point, but it doesn't really affect the current situation. That is a perfectly valid reason not to allow self-signed certs, but nobody's suggesting that. As long as some degree of authentication is used, certs have a profound benefit to security by providing encryption. Letsencrypt does that; although it's mostly a DNS check to determine that the server in question has access to the domain, that will be enough to prevent MITM attacks. Shorter lifetimes doesn't really impact this either, and comes with some security benefits although those can be overstated.

Hey dudes, we need to start living together in Harmony: Huawei puffs up new distributed OS

Re: Miracles

Yes, there are people in this comment thread that are implying or stating outright that Huawei have a captive market in China, which they don't have. It's of course possible that Huawei launches their OS in China, it becomes wildly popular there, and uses this start to take the world by storm. Depending on exactly what that OS looks like, I wouldn't mind that happening. But Windows Phone, Ubuntu Touch, and Firefox OS were all available in China, all had Chinese manufacturers not that that is required, and all could have become wildly popular. Huawei has the advantages of a large number of customers for products running other software and a bunch of money, that is all. They might succeed in leveraging these advantages to good effect. But I've seen enough other people with similar advantages who totally failed to do that that I will not bet on it.

Re: Stop me if you've heard this one before...

I doubt that very much. As I stated in a comment above, they don't have a strong captive market as many other companies have large chunks of the Chinese market and Chinese phone sales are decreasing as they have been in the west as well (though not as dramatically).

But to the main point: I don't think a consortium or other joint venture will convince many other manufacturers to abandon AOSP for China or Android for the rest of the world. This has happened before, but manufacturers usually ended up the worse for it. In many of the cases of attempts at a third mobile OS, other manufacturers were involved and tried to make hardware for it. When those OS projects died, manufacturers lost money on it. In addition, manufacturers would have to consider how a Huawei-provided OS would be impacted by their joining the project. Since Huawei has done all the development and would have most of the hardware, they would stand to gain quite a lot if another manufacturer started working on devices for the OS. Given current conditions in the smartphone market, I doubt if a competing manufacturer would want very much to provide Huawei with that advantage.

Re: And of course, "no details."

That's true, but a look at their supported devices page shows that there are a few problems:

1. They only support 13 devices, and some of those are duplicates (E.G. 3G and WiFi versions of the same tablet).

2. The most recent device supported was released in 2015.

3. And that one that is only four years old carries this statement of perfect performance: "Random reboots, selfies rotated by 180°".

I'd love it if Ubuntu touch survived, but I don't think this counts.

Re: Miracles

Huawei does not own the China market. Not at all. Plenty of other companies hold massive parts of that, Xiaomi being perhaps the most notable. Plenty of the people in the China market who own Huawei phones aren't just going to drop them and buy new ones for a thing that might support Android apps. Many of them will keep their current devices, and many more will seek out phones from other Chinese manufacturers. If the OS has problems, and it probably will, supporting Android applications in use in the China market, people in China may choose to switch to plenty of other devices. It's not a captive market; Chinese citizens have many limitations on their choices, but this is not one of them.

Re: Stop me if you've heard this one before...

Sailfish is not becoming the "main and official OS" in Russia. Certain rights were purchased to use it as the core of some secure devices used by the Russian government. There is a major difference. The main difference of note to those of us who don't live in Russia is that we're not going to get any new devices running normal sailfish as a result of this. So that doesn't mean the availability to users will improve at all in the near future.

Re: And of course, "no details."

Will it really break the monopoly all that much? I know Huawei's a big company and they could put a lot of money into it, but we've seen this before:

Microsoft is a big company and put a lot of development into Windows Phone including hardware. Other manufacturers bought in and made hardware as well. We don't have Windows Phone now.

Samsung is a big company and and put a lot of development into Tizen. The Linux foundation supported it and it was open for other companies to get on board, and several companies did. Samsung's fitness watches run on a thing sort of related to Tizen, but their phone experiment was a failure and the platform died.

Ubuntu's various developers form a big community with a lot of money and and put a lot of development into Ubuntu Touch. Several companies claimed to be interested in building hardware, and a few did. We don't have Ubuntu Touch anymore.

Mozilla has a lot of available resources and put a lot of development into Firefox OS. Several companies saw this as a method to get away from the Android trap and built hardware for it. Firefox OS has died and the lone surviving remnant is a cut-down version that runs on feature phones.

So I'm not expecting miracles here.

Ohm my God: If you let anyone other than Apple replace your recent iPhone's battery, expect to be nagged by iOS

Re: You were lucky.....

I have plenty to say about the poor security of standard Android, and I am currently using an iPhone with the security gap being a major reason in favor, but your point does not really respond to the issue. The issue was that Apple released an update that caused an old iPhone to malfunction. I don't know what the details are on why that happened, but your security comparison doesn't have any relevance to that particular problem with Apple. Speaking for myself, I will say that I am unhappy with Apple's current device prices and sizes, and so when my sensibly sized iPhone dies, I may also shift to Android. Given the security problems, I'll be selecting a device that can be reflashed with lineage OS. But just because Apple has a better security record than the average Android manufacturer doesn't mean other problems they have should be discounted. Apple does lots of things that I dislike, and it is necessary to balance those things against the positives of their products.