Posts by doublelayer

Opening up the WinAmp source to all goes badly as owners delete entire repo

Re: Simplest solution

Cloud-hosted software as a service has entered the room.

Cloud-hosted software as a service has taken over the room.

Maybe everything you ever run is open source. Not everything I run is. Sometimes, the way to get people to write the code you want to run is to pay them for it, and I don't have the funds to finance the development process myself, but I can easily afford to buy licenses for stuff I want. I prefer to run that stuff on my own computer, but if they're required to hand me the source code in that case, they'll restrict it to running on their servers or whatever environment it takes to prevent me from accessing that code.

Proprietary software is not automatically evil.

Would banning ransomware insurance stop the scourge?

Before you hand it to a criminal, it is not the proceeds of a crime. It is your money. You may read that law again, looking for the part where it defines any payment to a criminal as money laundering, but you won't find it. The rest of the chain, yes. Your end of it, no. In fact, the criminal hasn't done any money laundering until they try to obscure the source of that money. If they go out and say "I have some ransom money and I want to buy something with it", they've only committed the original offenses.

Your overeager interpretation is incorrect in several other ways. Yes, I can get £10k of cash and buy something with it anonymously. The bank will record that I withdrew it. The other bank will likely report that they deposited it. However, purchasing something expensive anonymously with cash is not illegal. Buying something with stolen cash is, and if I am a criminal, I might be charged with money laundering as well as whatever crime gave me the cash. The person I bought the expensive thing from is not required to verify my identity. If they too know that I am a criminal, they are guilty as well. If they do not know that, they are not guilty. Some institutions have a requirement to verify identities first, but not to verify the source of my cash. They too are not guilty, because they have complied with their requirement to have a record of the identity of the payer. Law enforcement may ask them for that information during the investigation, but even if it turns out I am a criminal, they were not supposed to identify that before allowing me to complete a purchase. Even more businesses are not required by law to verify identities and do it anyway.

Your page makes that clear (emphasis mine):

Criminal property (defined in POCA) constitutes or represents a person's benefit from criminal conduct where the alleged offender knows or suspects that the property in question represents such a benefit.

I don't think money laundering means what you think it means. Laundering money is when someone takes money from an illegal source and hides it to appear legal again. If you pay a ransom, the criminal who received it is likely going to launder it so they can buy stuff with it. You are not laundering it because the money concerned was provably yours. You have not laundered any money, just given it to a criminal, which is not currently illegal.

There are a few crimes which come into play just by giving money to someone. Those include funding terrorism or evading sanctions. However, there are a few provisos that you should consider before you take your comment and do a "s/money laundering/funding terrorism/g" on it. First among those is that, to be a crime, a specific entity must be on a list set by your country. If it's not on that list, those crimes do not apply. They would still apply if you specifically requested use of your funds for terrorism, but you didn't. You may also be off the hook if you can convincingly demonstrate that you did not know they were going to a sanctioned person or group. No, that doesn't mean that you have to show proof that you know who it is going to. For instance, North Korea is under sanction, and if I send any money to them, I've committed a crime. They get around this by operating some businesses internationally, for instance several restaurants, mostly in southeast Asia. If I'm traveling in southeast Asia, I don't have to question and record all the restaurants I visit for their ownership. If I pick a North Korea-run one by accident, that's unfortunate. Only if I pick it on purpose is it sanctions evasion. That is why ransomware is a popular way of evading sanctions, because the current laws do not forbid it.

If you don't like how the current legal situation works, that situation must be changed. It is not money laundering to pay a ransom, and it will never be, but we could easily make it a crime anyway. Doing that would likely help quite a lot. I support doing it. We can't pretend that it is already done.

Re: i guess she's saying that law enforcement is pathetic

When you have a plan for having a law enforcement body with the ability and power to find people who are hiding well, whose organization, ringleaders, and many of the participants are in a country that is unwilling to extradite or even investigate them, and who do not need to meet physically, let us know. In the meantime, we will need to plan for how to combat ransomware when you can't catch them. There are only so many of them who will be identified and travel to countries they shouldn't, although when it happens, law enforcement has tended to make them regret doing so.

Sysadmins rage over Apple’s ‘nightmarish’ SSL/TLS cert lifespan cuts plot

Re: OK, then let's focus on really strict security

No. The new owner could have a new certificate, but until my old one expires, it would work just as well if I could get some traffic sent my way. As far as the certificate authorities were concerned, the domain is mine until that certificate expires. That someone else owns and operates it now is not part of the certificate system, and they don't coordinate to cancel mine if someone else sets up a server. Maybe they would if they use the same authority that I used, although even then they might not bother, but if we used different ones, then there will just be two certs covering the same domain.

Trump campaign arms up with 'unhackable' phones after Iranian intrusion

Re: Intentionally Be-bugging Computer Code

And also 3. time spent fixing bugs that were deliberately introduced is time not spent fixing bugs that were actually there. It shouldn't be hard for managers to recognize that time is finite. Shouldn't be, but sometimes I wonder.

They may be right

They may be correct in a few, carefully limited ways about the quality of their code. Not that it's entirely unhackable, but for example, that NSO's existing exploits wouldn't work on it, that people don't have active exploits for it, that there aren't low-hanging vulnerabilities ready for the taking. There is code that obtains that level of quality, although I have no evidence that theirs is. Still, there are some times where code is good enough that finding a vulnerability directly through it is difficult or impractical, so maybe theirs has that.

However, that's not going to help you when attackers bypass it, as they're already trying to because that's cheaper and faster anyway. The humans are the weakest links in this scenario, and there are probably many limits. For example, the quoted figure of ten thousand lines of code actually makes it more likely that they have thoroughly checked that code, but it means that whatever it can do, it's probably not that many things. Maybe that doesn't include connectivity code because it runs on a different chip, in which case there's a place to look for vulnerabilities. Maybe it does, in which case I'm wondering what communication methods it actually supports to fit into that relatively small code limit. If the answer is that it can send text messages, presumably encrypted, and that's it, then the attackers can cheerfully ignore this and go to the systems on which all the information is stored. Sure, they might miss the last minute messages about something, but they'll see everything important enough that someone wanted a permanent note of it. People don't abandon email or group messages to use phones alone, and an attacker might find all the stuff they want on a different system. Even if the phones are unhackable, that won't be enough, and the phones probably aren't unhackable even if the code this company wrote was.

WordPress saga escalates as WP Engine plugin forcibly forked and legal letters fly

Re: Four Fox Ache

Probably the same barriers there always are with a new fork. If a problem is detected in it, who do I think is going to fix it first? Who is going to fix it better? And do I worry that one of them is going to try to screw over the other, for example by making a fix and licensing it in such a way that the other fork can't adopt that fix and therefore delaying their fix?

This happens all the time. When Amazon forked ElasticSearch, Elastic quickly enough introduced a change intended to prevent libraries from working with Amazon's version. They're still fighting that one out, but as I don't use the products much anymore, I'm not up to date with developments there. If I was using these, I'd be worried about SCF's reliability because they might be more interested in making things harder for WP Engine than delivering the thing that the plugin was intended to do. I could use it easily, but I'd prefer not to and I'd be worried if I had to.

BOFH: Boss's quest for AI-generated program ends where it should've begun

Re: you just need to ask AI to sum up the numbers

Probably true. I haven't checked the various competitors for how well their creators have hidden this fact. However, at least some of them have decided that making such elementary mistakes is a bad look and have done the same kind of preemptive parsing that there is in the Google search box to catch and complete arithmetic problems before they arrive at the LLM which can't handle them. It doesn't really change anything important; relying on an LLM to do calculations is a bad idea. However, the easiest ones will probably gradually get fixed. For most of us, this is actually a bad thing. The more simple calculations the LLMs can seem to do correctly, the more complex ones they will be given by idiots who will not check their work.

Re: you just need to ask AI to sum up the numbers

I'm not sure it was meant as a serious suggestion. However, if you don't know enough to write your own sum function, asking AI to do it for you will generate something that might work or might not and you don't have the expertise to figure out where its problems are. If it produces something that crashes immediately, that will at least be clear, but if it works on some but not all inputs, reading the code is the most reliable way to find that out before you rely on it. As such, asking for a program that you can't test is no more reliable and potentially more dangerous than just asking for the answer.

This is even more the case because the spec for the program was vague as always. Summing numbers isn't that hard (except for precision, overflow, speed, or various other more advanced cases), but getting them out of some system, into the program, and the result into a desired location is trickier. If you ask anyone, human or LLM, to write a program that sums numbers from a spreadsheet, most of the code will be related to getting the numbers out rather than summing them. With more potential sources, the program the boss asked for basically can't be written without clarifying where the numbers are going to be, in what format, and where the result should go.

So even though it was meant as mockery, asking for the result at least eliminates all the parsing and retrieval code, which means that lots of possible bugs are not going to be there. As LLM companies improve them, straightforward mathematical tasks will improve. That's not because LLMs will become more intelligent. It is because these companies like to hide the places where their models screw up, and this one isn't the hardest to handle properly. Figuring out whether a calculation is needed and then running that calculation outside the model is already done in some products. It's fragile, so if you need anything complex done it's likely to stop working, but for simple calculations of the kind you could quickly do in your head or on a pocket calculator, it means fewer embarrassing errors.

Smart homes may be a bright idea, just not for the dim bulbs who live in 'em

Re: "Ask me how I know."

Maybe not the lesson that you had in mind. I'm guessing that yours goes along the lines of "never have smart light bulbs". It's a lesson that I find very easy to use, because I still don't have a use for them and I have no difficulty getting to and operating a light switch.

However, if you are a person who needs (for example, not being able to easily get to or operate a switch due to a disability) or wants (for example, I don't know, but some people clearly do) smart bulbs, the lesson is not that you are wrong and need to change. The lesson is that a lot of the bulbs are bad and you probably want to research the options before buying them. I don't know which category Mr. Goodwins is in, but it sounds like he might be. Just because you aren't in either category doesn't mean that everyone is the same.

Compression? What's that? And why is the network congested and the PCs frozen?

When you have people who insist on bad subject lines, sometimes you need it:

Re: Request

Alice, please consider this a high priority request. It is important.

-Bob

Hopefully, you only have one email with the subject line "Request". Even if you do, you may have to delve into your history to find it. But what happens if you have two of them. How do you figure out which one is the important request and which one isn't supposed to happen at all? You could guess based on which one looks more probable. You could contact Bob, but maybe Bob has left for the day which is why he asked you to do it. You could open the headers and see if there is a commonality you can use. If Bob replied all, then probably you could use the other recipients to find out.

Yes, it also causes problems, but sometimes it is necessary.

Re: "Shared Cloudy Thing"

It does as much as can be done in that situation. If they're retrieving a file over HTTP, it will adjust to the speed of their connection, and in nearly all cases, including most cloud services, it can be resumed rather than restarted if the connection breaks.

A point-to-point transfer would be better in some cases, but it too would not deal with the problem of a link that takes too long. It can also be more difficult to set up for the uninitiated, and depending on the protocol in use, more fragile.

UK ponders USB-C as common charging standard

Re: One socket to rule them all

Keep them around for a while, knowing that at some point you'll need one of them. This should last until the third or fourth time when you think you've finally had the occasion where you're going to need them and you test all the cables to find the plug that fits and find that one of the following apply:

1. None of your plugs fit right, even though you've got about forty of them.

2. One of your plugs looks like it fits, and the voltage is wrong, so you cut the wires and used two of them to try to work, and it's not working because it turns out the plug doesn't connect fully, so now you have four pieces of cables instead of two intact ones.

3. One of your plugs fits, but you can't find any information about the voltage and polarity you need because either the manufacturer no longer exists or the manufacturer exists and has twenty different models all of which have different settings and they all look the same.

4. You found out what voltage was needed and you're powering the device, and you're feeling great until it starts to act wrong. This is probably an undercurrent, but who knows for sure.

Then recycle them.

Re: I have one problem with USB C

I'm not sure whether the products are technically violating Apple's patents, but I have a number of magnetic plug adapters that were easily purchased. My laptop, non-Apple, is running off a magnetic USB-C connector and cable. Unfortunately a proprietary plug in the middle, so if the cable breaks I'll have to either buy from the same supplier or switch out the little plug too, but neither part was very expensive. It works the same way that Apple's MagSafe did, although there is one difference I have noticed which is that my cable isn't made of the Apple special insulation, which I trust they also have a patent on. You know, the stuff that somehow manages to peel or melt or somehow come off the cable even though no other cable you own has ever done that. But the magnetic part works the same.

Re: "wall wart of fortune"

There is, but a lot of devices helpfully forget to note these requirements on the product itself or in the documentation. So if the cable for the product has been lost, or more likely it stopped working and the owner binned it before asking you to source a replacement, it can be difficult to figure out where to find this information.

I recently tried to help solve a problem where two quite similar Dell laptops with barrel adapters needed opposite polarities but the same size of cable. The office that had purchased them thought the cables were interchangeable because they were both from Dell and the same size, so when one adapter broke, they cycled some around. It didn't work, though fortunately none of the laptops broke from it. This is why I want USB-C charging on my laptops.

USB-C isn't perfect and could use some standardization. For instance, I'm tired of devices where only some of the ports can charge the device. I don't think it will break the device if the wrong port is used, but it's still a recipe for annoyance. Compared to previous methods, it's still less frustrating.

Why send a message when you can get your Zoom digital video clone to read the script?

Re: And I'd want to why?

You might have noticed that most of those things involve more than seeing someone read it. Theater. You could go to a table read, where you sit in a chair and watch someone read out something on a sheet of paper, but most people prefer to go see the actors move around sets. No sets in an AI-read video. That's out. Film and TV are the same thing, but nowadays you're not limited to sets they can build in a room because they can have the actors moving around in front of fake but realistic-looking things you couldn't see elsewhere. As before, none of that in the video. And radio does not involve watching someone read it. You just listen, although you may just listen to something including music or sound effects. News radio often has the advantage of being faster to receive than was a newspaper, and you can listen while looking elsewhere.

There are reasons for an audio or video to exist, but those reasons rely on benefits of the medium. As I explained in my comment, a video makes a lot of sense if I'm going to demonstrate something rather than just explain it, but the Zoom avatar is not going to demonstrate it for me, and if I used one of the AI models that can actually make a video showing it, I'll spend more time explaining what it should look like so the video is accurate than it would take to make it in person. The advantages that led to the things you mentioned are entirely unavailable for this.

And I'd want to why?

What they might want to think about before building all of this is why, if I have a script, I need a video of a puppet me reading the script. If it's just the script, people can read the script. If they want to listen to someone reading the script, there are lots of text to speech systems out there from which I can get an audio file of the script. If a video is actually needed, it probably is needed so that things other than me might appear in it. If, for example, the script involves me pointing at or even demonstrating things, then we might need a video, but the AI video won't do that. If we need such a video, but I'm rubbish at speaking during the video, then I could do the whole silent actor thing and point at or demonstrate things, then dub in any other voice, including artificial ones. Most people are able to do a video like this well enough that it gets used. Internal videos don't have the highest production standards.

Schools bombarded by nation-state attacks, ransomware gangs, and everyone in between

Re: Attackers

It could work, but you'd have to find students who are good at providing that information without getting caught. With some time, effort, money, and some more time, you could do it. Or for really cheap you could send phishing messages to students and start probing from their taken over laptops.

Similarly, you could get a student to attend courses for a while, excel at their studies, and make a good impression on research professors. That student eventually gets invited onto a research team and does a great job, and then they get invited to work on something the host government cares a lot about and can start sending back the sensitive data. Or you could identify the professor involved by reading public information on websites and papers, look at other public information about them to craft a phishing message, and take a chance at getting access to their work right now. Undoubtedly both happen, but I'm expecting that the cheap option ends up being more popular.

Techie took five minutes to fix problem Adobe and Microsoft couldn't solve in two weeks

Ah, so my Windows installation was not a real OS. But then I installed git for Windows, including its bash environment with all of those except emacs which I could also install, and now it is.

Is this really the level of argument you can go to? The name of the file list command is important?

Re: I've not really used Windows much for 15+ years

I don't think so. Windows wouldn't finish installing until it had restarted the correct number of times, and it would manage its own restarts and run the needed ones. I'm pretty sure that what happened was the person installed Windows 8 but was not aware of the fast startup option or how it worked. Then they installed an Adobe product which needed to restart and probably offered to do so at the end of the installation. Probably if they had let it do that, a normal restart would have been executed, hence why Adobe hadn't caught this problem while testing. The user, however, needed to save some work so didn't let the installation restart for them, and they just shut down. Adobe hadn't labeled the need for a full restart, so shutting down and powering on wasn't good enough for them. Therefore, the application didn't work because it still needed a proper restart.

That's an unusual config. It suggests that your machines are set to boot to USB devices before internal drives, which is atypical and probably not the best choice. Every machine I've used in the past twenty years has required that a USB drive be manually selected to boot to it by default, a default I haven't and don't want to change. One of the major benefits of this is that there isn't much malware which bothers to make external disks bootable infection vectors because, unlike in the age of floppies, the authors know it's not going to be booted to anyway.

FBI created a cryptocurrency so it could watch it being abused

Because "Ponzi scheme" is a more complicated concept than something weird related to money. There are lots of types of financial schemes that are not Ponzi schemes. There are a lot of dubious financial things that aren't fraud at all, just bad ideas for people who don't know what they're doing. There are things that people don't like, either because there are real ethical concerns or because those people don't understand them, which are not any of the above.

Using a term with a specific meaning for things that aren't related to that does not help explain what the problem is, whether you want to explain it to educate someone about what they should do or you want to change the regulations to prevent it from happening at all. Computer crime and things that aren't illegal but should be computer crime won't be fixed if I insist on calling it arson. Financial crime and things that aren't but should be won't be fixed if I insist on calling it a Ponzi scheme.

Copilot's crudeness has left Microsoft chasing Google, again

All the time. It isn't just "Alice suggested we redesign this and people smiled, so we're going to", but if the people concluded that this made more sense than Bob's proposal to change the training documents and leave the code alone, then the notes will say that. If the redesign the code suggestion came up first and was discussed for three minutes, and then the documentation proposal was made and discussed for twenty, and then people said that they thought the training solution was less helpful than the code one, will Copilot properly understand that two thirds of the meeting might have been necessary to decide against something but does not need to be brought up in the next steps email? I don't know, but I wouldn't want to count on it.

Dutch cops reveal takedown of 'world's largest dark web market'

Often, they're referring to Tor hidden services. Not always, and when they talk about domains being seized it might not be, but quite often that is where the illegal markets are set up. If they're doing it correctly, there is no IP address you can enter to arrive there. You have to go through Tor and use the domain name, which is really a public key, to find and connect to the site. It gives people some of the tools required for anonymity, but if you're not careful, you can mess it up, and you also need to do more than just have a hidden service to not be found.

You have issues with 'Issues' always being called 'Issues' in Jira, so Atlassian now allows them to be called ‘Tasks’

Re: Terminology

A ticket is a weird term, although that's hardly going to stop them given all the other weird terms that get used. However, it doesn't really work well for organizing them. A ticket containing a ticket of tickets is not a metaphor that's going to work very well. Of course, you could just have groups containing items or other groups, and if you want you could call the items tickets. If you're only going to have one word for everything in the system, who cares what that word is?

Uncle Sam may force Google to sell Chrome browser, or Android OS

I think that most people, if presented with the search engine screen, would choose Google from brand recognition and inertia. Google is willing to spend billions to prevent that from happening. Either they know better than I do about what people will do with a choice, although those people can still go into the settings and get a choice screen with common engines listed, or the team that does this stuff has a massive budget and no oversight.

What would be the logic of that? I can see a case for Microsoft: if they own both the cloud service and an operating system you might run in it, then they could do what they have to make it more expensive to run Windows in someone else's cloud. But that doesn't apply to either of the other two. Having an online store has no direct conflicts with running servers, and unless they did something like forbidding people to sell stuff in the Amazon store if they used a competitor's cloud (they haven't), there's no reason to break along that line. They do plenty of similar things, but related to things like whose shipping network you use, not whose cloud servers. Likewise with Google Cloud and Google Search.

When you make a case for breaking up a company, you usually have to describe how having positions in those two lines causes a conflict. Each company has plenty of complementary businesses for which you can easily make that argument, but that doesn't mean that every pair of services works that way. Browser and a search engine: yes. OS and app distribution: yes. OS and browser: yes. Search engine and app distribution: probably not unless they were intentionally keeping F-Droid out of search results, but you could try. Cloud servers and a mobile OS: I don't see it. These are important because you need to prove that an abuse exists to split them at all, and the lines where these conflicts exist are where the breaking needs to occur to stop the negative results.

Microsoft veteran ditches Team Tabs, blaming storage trauma of yesteryear

It partially has to do with the function name length, as well as anything else that might be on the line. For example, if line one reads

char *data = someFunction(

then there are people who would like the continuation line to be indented by 26 or 27 more spaces than that line. I am not one of those people, and in fact lining these up is annoying enough that I tend not to adhere to their style unless required, but I've seen people ask for it.

As others have noted, nearly every editor has a setting that sets what the tab key does. Press the tab key and, instead of inserting a tab character, it inserts however many space characters you told it to. Press shift+tab and it removes them back to a multiple of the number you set. I use spaces, not because I think spaces are better, but that others think so and I'm willing to go along with them, but I do not press the space key to insert them one at a time. I press the tab key to insert them in chunks of the appropriate size. For the same reason, my editor is also set that, when I press enter to move to a new line, it fills that new line with the same amount of indentation as the last line. Otherwise, I'd have to press tab to indent every line manually and I don't want to.

It depends how you like your code indented. If, for example, you want a multiline function call to line up the first letter of the second line with the parenthesis of the function call, or in some cases the first character after that parenthesis, then that parenthesis might not be on a tab boundary. My solution to this is to not align that letter and that parenthesis, and I'm using spaces. I just can't be bothered. However, there are people who want those things aligned and if they get their way, then spaces are the only option for doing it.

Bitcoin creator suspect says he is not Bitcoin creator suspect

Re: Imagine

Not the known ones. It would have been quite simple for him to have had a bunch of them, some of which have been transacted over and over again while others stayed quiet. He could have earned no real money from any of his bitcoin or he could have cashed out quite a bit over the years, pretending to be an average miner or trader. We don't have enough information to prove which.

Linus Torvalds declares war on the passive voice

Re: I'm British...

So do many options involving the active voice, though I grant not the example I used.

I fixed the bug in the thing [in a commit two weeks ago].

These changes [but not this one] fix the bug in the thing.

I contend that this is not really a concern that has much relevance. If people are putting in commit messages that do not correspond to what the commit actually does, how they phrase it is not the problem. Anyone doing this is either deliberately dishonest or getting commits confused, and neither is going to be fixed by adding a subject picked from a short list to the sentence. I also wonder where my most typical form would fall. I tend to write commit messages in the active voice but without a subject ("fixes a bug in the thing"). Yes, those are fragments. It hasn't caused a problem so far and sticking "this" on the front won't help.

Re: Linus non est super grammaticos

I'm not sure that the passive versus active voice is going to change how easy change notices are to read. This is a style difference that I don't much object to, but neither do I see it having much benefit to anyone. There are lots of similar style recommendations which I mostly go along with as long as they don't do too much harm.

In the spirit of tiny grammatical details being considered more important than they are, a company for which I worked had a style checker which was particular about the mood of the verb at the beginning of a comment documenting the purpose of a function. I tended to write my descriptions in the indicative mood ("Deletes all the data"). The checker would reject this and require me to phrase it in the imperative mood ("delete all the data"). I don't know why that s was considered so harmful, but it was clear that someone thought so. Some colleagues found the message, which simply demanded the imperative mood, to be confusing. While I did learn the various moods, I'm not sure they're considered necessary education everywhere and so the style check was not only making an issue of something that nobody really should care about but wasting programmers' time in the process.

Re: I'm British...

Opinions on grammar are highly variable and subjective. I see little difference between "the thing was fixed" or "this fixes the thing" when the words are clearly linked to a commit. If they were separated from the code they changed, then theoretically it would be harder to understand, but they aren't and, if they were, the suggested changes wouldn't work either because "this" wouldn't refer to anything specific and could be a certain commit, a batch of commits as an update, or who knows what else. Unless they were requiring that the messages take the form of "commit 28ac9307 fixes the thing", the form of the sentence makes little difference to me.

Musk's Starlink rockets to 4 million subscribers

Re: Can bots be subscribers?

That is true, but a slow connection has to be really slow to make that happen. Most of the time, electronic payment takes a few API calls, none of which are particularly large. Latency can be more important than bandwidth, but neither is very important. The main way for a connection to be the limiting factor is if that connection is unreliable and is constantly dropping packets. Then you can expect the transactions to begin failing. Unlike many uses, most payment terminals would not have any problem processing payments much faster than the people can. Of course, if you posit a single 128 kbps line shared by fifty shops, it could encounter that problem, but that's probably not the kind of alternative that something along a major road has access to.

American Water rinsed in cyber attack, turns off app

Re: It's 2024 ...

"unless that malware is either self-starting (in which case it'll become immediately obvious that something is wrong)"

Not necessarily. Time delays are really easy to build in. They can let you clean up your first exploit before things go wrong so the investigation takes longer or, if you put more time into it, you might be able to pretend that your sabotage is just a cascade of normal failures that happens at an inopportune time. If your aim is destruction rather than getting data, you can manage it even through an airgap that you can only bypass once.

Re: It's 2024 ...

I did read the article. It is not as definitive as you say it is. For example, the sentence you quoted could have a lot of explanations. Here are two possible ones, neither of which you can disprove from the text of the article:

The company currently believes that none of its water or wastewater facilities or operations have been negatively impacted by this incident because they were airgapped, so you'd have had to do something quite specific to get at them, but they don't know for a certainty that that didn't happen. Sure, they're running now, but if some theoretical attacker inserted malware into them which is going to switch them off in three days, they haven't found it yet.

The company currently believes that none of its water or wastewater facilities or operations have been negatively impacted by this incident because the PR employee checked and water is still coming out at least in their house.

And the last few paragraphs are not about this incident, but about one last year. Yes, in that case, the people concerned did connect their systems to the internet, but that doesn't provide that these different people also did so.

If Dell's Qualcomm-powered Copilot+ PC is typical of the genre, other PCs are toast

Re: "Whatever x86 apps I threw at it just ran. Swiftly."

As I understand it, drivers are not emulated, but any other application is. So your drivers will need ARM versions, the same way that 64-bit drivers were required for 64-bit Windows. However, it's pretty different from Windows RT. You can take an application that doesn't hook directly into the kernel and run it under emulation. It shouldn't matter what that application contains, even if you hand-coded it in X86 or X64 assembly. So probably your custom driver systems are going to need an ARM driver to work, but you've still assumed too little compatibility.

Busybox 1.37 is tiny but capable, the way we like Linux tools to be

Re: busybox linux

The post they replied to linked to this GitHub repository with instructions for building a minimal distro using mostly just busybox, but those instructions do indeed involve installing bash too. As far as I can tell, not for any reason other than preferring bash to busybox ash, which I certainly do.

It goes on to also demonstrate adding nix, xorg, and tools for WiFi, but those are optional. The bash step is not written separately so even if you stop at the first bootable thing, the system they specify has bash in it. You don't have to do that.

That might work if it just packaged them, but since it also implemented them, maybe not. Not that I care. I don't think that "do one thing and do it well" was meant as an unbreakable law rather than some advice for an approach that often helps.

Two things, neither completely justified. The first was that, until version 1.3.0, its license was GPL 2 or later. As of 1.3.0, it became GPL 2 only, same as the kernel. Before that, people didn't like the ambiguity involved in letting whatever might show up in GPL version 3 (then unreleased) to be a core part of their system. This was only partially justified because the clarification came in 2006, so it's not like there was much need to deal with it.

The other reason was even less justified, namely that Busybox was a project well-known for pursuing their license rights. If you used Busybox, they would demand the source be released and sue you if you didn't. This rarely if ever gave the community useful code because anyone using Busybox didn't have much of a need to improve it, but it did certainly penalize people who don't comply with a really easy license. This shouldn't really be a problem, and it really wasn't, but some companies can't be bothered to release the source code they haven't changed and contains no secrets. I'm not sure why they find this so difficult, but having tried to get source code from them, I know they exist.

In general, one of the maintainers of Busybox got annoyed at another one and went off to create Toybox. This was in 2006, so before Android really went anywhere. Android had to choose between the BSD-licensed Toybox, run by someone who had added a lot of stuff to Busybox, or the GPL2 Busybox which had lost a maintainer but still had more people working on it. There wasn't an obvious good and bad answer, and it probably isn't that surprising that they went with Toybox. Having done so, Toybox has focused on keeping itself functional for Android, so it's not surprising that they're still using it.

Three and Vodafone: We need to merge because our networks are rubbish

Re: Only 73.03 percent of rural premises in the UK have 4G coverage (from Three)

As a non-UK resident and someone unfamiliar with these companies, I would expect that, in addition to many negative consequences, that would actually happen. That wouldn't stop them from raising prices, canceling deals they no longer wanted to offer, or any number of other problems that arise when competition decreases. However, moving the equipment around to increase coverage is a relatively cheap thing that increases their potential customer base. Buying new equipment to serve rural locations is expensive. Moving equipment isn't, and it's often older equipment that they don't need in urban areas.

Embattled users worn down by privacy options? Let them eat code

Or in other words, it doesn't work. Its failure to work is not because the technology is wrong. It's not because people can't use it or servers can't direct it. It's because those who would have to honor it are not and those who would make them are doing nothing. If they made an API that automatically filled the cookie selection boxes, that would help, but any company that wanted could still set whatever cookies they want. They could say that collection was a strictly necessary cookie. They could say that there was a mixup in their code that ended up setting the wrong cookies. They could set a cookie which was meant to indicate that data collection isn't desired but happens to work as a fingerprint anyway. The suggested API is little different from the do not track signal in that it has no technological enforcement of compliance, if such a thing is even possible, so without strong enforcement from somewhere else, it won't make a change. If you had strong enforcement from somewhere else, you could use the DNT setting, this API, or any similar indicator.

159 Automattic staff take severance offer and walk out over WP Engine feud

Re: People have many conflicting loyalties in life.

That is not entirely correct. Mozilla's guidelines are on modifications rather than binary source. If I take the source code for Firefox and compile it unmodified, it is Firefox. Mozilla is fine with this, and so would a court. To some extent, they're also fine with some modifications, though their preferences aren't entirely clear. Rebranding seems to happen when changes have been made to the binary, for example removing some advertising. Even in that case, they could easily say that they are using Firefox with some changes by the distribution and be fine from a trademark situation because they are. They choose not to because Mozilla would prefer they didn't, but they don't have a legal requirement to. Different rules might apply to trademarked logos, I'd have to check the license, but the name wouldn't be affected.

Re: People have many conflicting loyalties in life.

I don't know how they were using them, but to some extent, this is normal and expected. If you're hosting Word Press, then saying that is stating a fact rather than advertising on a trademark. The "Core WordPress" name could easily be permitted on that basis. They could have used the name in other ways that would be more difficult to justify, and it wouldn't surprise me if they had, but that name doesn't sound like one of those. WooCommerce is another story and could be more a clearer violation.

As for why they might change these, it could easily be that they hoped that making those cosmetic changes would make this lawsuit go away. Not fighting this means less trouble for them even if they think they are guaranteed to win, not to mention that they do benefit from Automattic's work and don't really want to see them destroyed. They don't have to think that their actions were illegal to justify stopping them.

Tesla Cybertruck recalled again. This time, a software fix for backup camera glitch

Re: Two seconds ?

The software is probably larger than it needs to be, either the camera runs a lot of software itself rather than just being a peripheral for the central computer, or the central computer's hardware polling is slow. This is a challenge I've had and seen others have when building larger embedded systems. In most cases, the question is whether to use embedded Linux or run your program on bare metal or with a small, often single-program OS. Using Linux gives you tons of advantages and lets you simplify a lot of necessary work. It also makes the system startup much slower. If you're lucky, you have a chip with good power management or a massive enough battery that you can suspend and be fine. If you're unlucky, you don't have that and must have the user wait through the boot cycle every time they want to use it.

People who work on this more professionally than I do will have other options they consider as well. There are a lot of types of embedded devices. This camera, for example, is probably not booting slowly by booting Linux, though the central console was the last time I saw an analysis of that. At least I really hope they don't need to run a full Linux kernel on a camera.

Meta gives Llama 3 vision, now if only it had a brain

Re: Comparison

Once again, I don't want to know how this compares to random people. That information doesn't help me. I want to know if this tool can do this job when I want this job done. It doesn't matter whether only one person on the planet could do it or whether every child aged five could do it in their sleep. In this specific case, I know that there are lots of people who can do this, so while it might not be everyone on the street, I'm reasonably confident that I could find someone capable of doing it if I needed that.

And if I do want to compare it to random people, I have to do a better job of sampling to find out. A sample of people from one location is an insufficiently random sample in case, for instance, the location is right outside an office containing a bunch of statisticians. I would need to put more effort into my sampling. It is also insufficient because of the conditions of getting their answers. So if we do need that information that I currently don't care about, we still need to do more to get it.

Re: I wonder how good it is at Captchas?

It probably depends on the system involved, but my guess is that it's probably pretty good at many of them. The trickiest element is automating the process of getting the captcha data into the LLM and the response back into the form. Captchas have often given up on keeping determined bots out. They keep really basic bots out and slow down the process for humans, and that's good enough. If web developers were interested in more than that, they might do a better job at not having captchas break things.

Re: Comparison

Because if I'm going to use an LLM, I want it to do something useful. If it can't do it, pointing out that there are some people who also can't do it doesn't help me in the slightest. My question is not how does this LLM compare to a probably pretty bad random sample of people on this task, then repeat over and over again for any task imaginable. My question is how capable is this LLM of doing something to an adequate standard, no matter how large a group of humans are capable of meeting that standard.

In addition, unplanned questions to people off the street is a terrible comparison. A lot more people are capable of giving a detailed description or analysis of something if they have a bit more time and double-check their response than if they're focused on giving you a good enough response so they can leave. I could hire many people to do that task who wouldn't give a good interview if stopped on the street, which is why interviews happen with more normal time constraints.