Posts by doublelayer

No need to code your webpage yourself, says Microsoft – draw it and our AI will do the rest

Re: I do wonder...

I will bet on "a very large amount". Just try to pick up any html page and see if you can read it from source. I certainly can't. About the fourth time another javascript blob appears, I lose my focus and give up.

I have a web application online that I hand-coded. All the files involved except the images can fit in 24 KB. This includes the backend code as well, so each frontend page that could be presented is tiny. And still it has a number of features. A standard page online is much larger than my entire application.

If you have to simulate a phishing attack on your org, at least try to get something useful from it

Re: Russian Hackers

I wouldn't count on that. Sure, generic phishing attacks are fragile; they can be detected and usually they are ineptly built. However, a standard phishing attack is usually done to get a few people. If an attacker gets four credential pairs out of a thousand people, they're probably quite pleased. There are ways that phishing can be done better, be that "spear phishing" (tailoring everything to one specific victim, which increases the likelihood that someone clicks on it), using various methods to make detection harder (for example, many phishers don't try to pretend to be from a trustworthy domain, but it can be done), or having lots of small phishing sites such that the death of one doesn't really affect much. The proper flagging of this attempt doesn't mean that something else can get through.

A decade on, Apple and Google's 30% app store cut looks pretty cheesy

Re: Exposure?

Not really. Of course, google play won't help with exposure, but it will help keep people who already know about the app from drifting away. When you say in your advertising to go to the google appstore and search a phrase, people know what that means. If you tell them to go to a website, no matter how clear you are on that site as to how to download the APK file and install it, fewer of them will. That's why the google store can effectively constrain developers to using it, even though sideloading is possible. The same would be true, for example, if you told them that the app could be found in FDroid or another relatively unknown store. The non-technical, for most apps, the main customer base, won't get you, and you'll lose their business.

Intel rips up microcode security fix license that banned benchmarking

Re: When will it be safe to by a new system?

I'm glad that works for you. However, there are many tasks that people ask of their computers that a raspberry pi would not do to their satisfaction. Among these are modern games, high-speed browsing (think downloading a multi-gigabyte zip file and extracting it, which on the pi with its USB2 bus and SD card is going to be a lot slower), editing high-bandwidth data (images, audio, or video), even browsing pages with a lot of data to pull down and render and/or having a bunch of tabs open (I wouldn't want to deal with my family's complaints if they tried to do their standard browsing with only a pi core doing that for them). There are a lot of good use cases for one, even when running a full desktop, but there is a reason that a great many raspberry pi users are using them headlessly or as media devices rather than transitioning to having one as their main machine. However, my point was more about viable options for processors in consumer computers. In the sense of performance that is expected of a computer sold these days, intel and AMD are the only providers who 1. have such a processor available and 2. have that processor in a consumer-available machine. ARM has many such processors, but you can't get a computer with one in; the raspberry pi uses a much slower processor. Therefore, the only available alternative should you be concerned about the vulnerabilities or unwilling to hand over more money to intel but still want a standard desktop or laptop is AMd, at least for now.

Re: Silly season...

If you're suggesting that we just ignore the problems, that's not likely. Sure, many of these vvulnerabilities aren't important (now) for our personal machines, but a lot of us, myself included, have virtual machines on a system that probably has some more ones. If there exists something that lets another VM user read or write data from mine, that's not a good thing for me. No matter that my VMs aren't doing something extremely secure, I don't really want others trying to break in.

Note here that I have made some trade-offs in doing this; my VM provider could do a lot of nefarious things if they were so inclined. I have taken that risk and chosen to trust them as a result of my paying them for the service. I am willing to trust that they will not alter my system or extract information, but I don't extend that trust to other users I do not know. The same would be true of each security vulnerability. We don't expect complete security, but we did expect a reasonable level of it. We are justified in being irritated with intel for repeatedly failing to make their processors secure.

Re: When will it be safe to by a new system?

Functionally, there is only one viable alternative, that being AMD. There are a lot of other processor types available, but none that are convenient for consumer computers. ARM processors aren't sold in prebuilt machines, and even if there are ARM motherboards out there, you're probably heading for a compatibility nightmare. While there are some machines running ARM out there that are inexpensive for standard consumer use, would you really want to have a raspberry pi as your main computer for standard tasks? The latest one would be fine enough for browsing, coding, or word processing, but it has a lot of downsides if it is being set up as a desktop.

It's a net neutrality whodunnit: Boffins devise way to detect who's throttling transit

This is completely correct. You could put the original blame on verizon selling an annoying package or the fire department for not paying attention. To the extent there was blame, it would be verizon not terminating the throttling during an emergency. This is definitely not a net neutrality thing, and I think our writer may have mixed these things together. I've reported this to the tips and corrections, in the hopes that it was a mistake or the reporter was just tired at the time.

Australia blocks Huawei, ZTE from 5G rollout

Re: 5 Ears?

Really? I'm not saying that equipment made in countries with large surveillance systems is free from backdoors, but we're talking China here. They have spyware on pretty much everything, but they just won't have it on something big and important? That doesn't make sense to me. If you do want to go full conspiracy theory, it wouldn't matter if the Chinese equipment did in fact have no back doors, because the Australian companies would be going to configure and program it. If a surveillance system needs to be built, that could be done no matter what it runs on.

Redis has a license to kill: Open-source database maker takes some code proprietary

Re: Jolly Good Journalism, El Reg.

Thank you for those posts; they were informative. I will be going through my code and clarifying the licenses. In most of the libraries I have written, they are probably more of a BSD-type thing, as they are less likely to be externally modified, and I'd rather not limit what people can create with it. Still, quite a bit of research to do before I decide on something.

Re: Jolly Good Journalism, El Reg.

I agree entirely. I have periodically considered which license I should use for my own open source projects, and I still don't know. I've never seen a concise argument between the various contenders, and while I have at one point or another read most of them, I can't really remember all the things you are and are not allowed to do with them. At the moment, I have published source without including or mentioning a license and I just leave the users to figure it out, but that is probably not the best way to handle that.

US Democrats call in Feds: There's something phishy going on with our voter database

A security test?

Well, that seems very weird to me. I trust that it happened, but what has to go through one's mind to come up with the plan of action: "Let's run up a fake website for a security test for someone we don't work for, who hasn't asked us for one, and by the way we won't tell anyone about it." I have a feeling that, if I did that to someone, I'd be sued and/or arrested almost immediately.

It liiives! Sorta. Gentle azure glow of Windows XP clocked in Tesco's self-checkouts, no less

Re: Local Optician

"running XP is not really that bad especially if the machines are not connected to the Internet"

For point of sale equipment, it is almost certainly connected, if not to the internet at large, at least a corporate network. You could create a communication system that lets information about payments be sent out without networking, but that is difficult and probably wouldn't be attempted. These vulnerable devices have been used before to gain access to payment information, usually after a breach somewhere else in the network.

Meet the LPWAN clan: The Internet of Things' low power contenders

Re: I have doubts

I will try one more time. I do not think, nor have I ever thought, that the type of devices we are discussing are the types to send video streams or other large data streams.

Now to cover IoT vs IT: IoT is IT. It is a system that runs code, interacts with other devices, and in order to actually come under IoT, must connect to the internet at some point. It may not be exactly similar to other IT devices, and there may be other people to work on it, but it is technology that delivers information, and is more similar to IT infrastructure than infrastructure by most other departments. In addition, most of the things that are talked about as members of the IoT group as a whole are much more complex than something that runs some sensors and can communicate all the relevant information in some 255-byte chunks sent every once in a while. Even if we're limiting ourselves to equipment used in industrial things, there are things that require direct connection because they report information or receive commands in real time, and those things are always called IoT. In fact, if we wanted to split the broad category IoT, the devices better suited to the name would be those connected directly to the internet rather than sensors that use a gateway (of course, if that gateway also allows internet connections, then those sensors also belong to the IoT group).

My doubts are still alive, but not because I fail to see use cases for the technology. I merely see a great deal of complexity in the technology that would make it difficult for some players to use it. Combined with the fact that WiFi exists and can be used by a lot of sensors, albeit with less effectiveness and many downsides (I admit these are there), many might not bother to implement it. This could cause the technology to stagnate.

On the topic of hospitals, many of these already have WiFi. Part of the reasoning for this are patients who must remain there for some time, but the system is also used for wireless devices used by the staff. Those hospitals that lack it often still have wired internet, as they are some of the most computerized locations. I'll admit that I have less experience with factories, but I'd imagine that those for whom the term internet of things is a selling point are probably not strangers to internet-connected equipment on the factory floor.

Re: I have doubts

In fact, I did read the article. If you could reread my comment, please, you will perhaps notice that I mention video as a reason why data limits on WiFi wouldn't apply to devices such as this, as they will not be sending a lot of data.

Hospitals and factories are very often highly networked. They are indoors, and there is electricity running everywhere. Machines, lighting, communications infrastructure, all are there. Especially with hospitals, there are also computers everywhere requiring network activity, not to mention patients who may have phones and laptops with them. Installing WiFi access points in an environment like this would make a lot of sense. FYI, a single WiFi access point doesn't cost anything like $200. A network covering a factory wouldn't be cheap, true, but depending on use case, it could be worthwhile. However, in a highly electrified location, many of the sensors could be directly wired.

The use cases that make the most sense to me are those that need a long range where electricity and networking aren't available, most of which are outdoors. I can think of some use cases indoors as well. If you had a factory without WiFi and you only had one or two sensors, then installing WiFi only for those might have little point. However, if that were the case, I'd assume you could do that more efficiently by having those sensors attached to whatever they're sensing, as there are not that many of them.

I have doubts

I looked into some of these a while ago--I had a system which could benefit from communications at a distance, where there was no WiFi. However, I couldn't justify it, as all the components I could find required a lot of investment in hardware at each point. When you keep in mind that the computing part of a lot of these were raspberry pis, it perhaps makes more sense why I wasn't exactly impressed by the $20 US LoRa boards I found. Of course, I'm not mass-manufacturing these things, but a lot of the IoT things used in industry could probably be set up in a way such that they don't need these. For example, factories and hospitals, as listed in the article, are environments where devices could easily use WiFi connectivity. They are indoors, so in a place that likely already has networking, and a place that has electricity sufficient for the machines to transmit on the comparatively power hungry WiFi. There are lots of cases where something like this could be necessary, but I seriously doubt it's going to replace devices that use more common and less expensive technology.

Another issue is that open standards are a lot easier to develop for. If I build something that can use WiFi, I know it will work with the network infrastructure already in place. If I'm doing things locally, as usually these things will do, there is no data limit problem. Given that anything considering using something with maximum message lengths less than a kilobyte won't be sending video or something like that, WiFi connected to the wider network still won't have a data limit problem. Meanwhile, all these systems seem to require some type of central infrastructure, which is either provided at a lot of restrictions or has to be constructed by the user of the devices. It's a lot of work to do for most applications, so unless the range or power is absolutely necessary, I doubt they get used as often as the predictions estimate.

EU wants one phone plug to rule them all. But we've got a better idea.

Re: It has?

Nor do I. I think it might be best if, instead of thinking up new types of connectors that 1. don't have any faster data rates, 2. didn't get any smaller, 3. took far too long to realize that being flipped would be helpful, and focused on making what is already available better, we'd have better cables. The same applies to all types of fast-charging stuff. If, instead of trying to crank up the voltage or current, phone manufacturers tried to make their phones run at lower power levels and have batteries supporting it such that the typical high-power USB (5V 2.5A) would be fast, then it would be much easier for everybody.

Democrats go on the offensive over fake FCC net neut'y cyberattack

Re: Pai is still damaging society

That is not how any of that works. Net neutrality means that the people running the communication systems can't send some traffic faster than they would ordinarily, and the reason for that is that the only way to do so involves taking something else and slowing it down. It is not that you can't buy faster speeds; you can. Get more powerful servers and high-speed data links and believe me, you'll see your speeds skyrocket. What the net neutrality people advocate is that you can't buy someone else having a worse time. For example, there is not an "expensive car lane" that allows those who have paid more for their cars to bypass traffic, even if they pay for it.

This is usually the reason that companies want to have the ability to change speeds; coms company C wants more money. Video streaming company V wants their competitors out of the way. If V pays C to make all of V's content faster, thus making it a better experience than competitors W, X, Y, and Z, then eventually people stop buying service from W, X, Y, and Z. The two possible options are for W, X, Y, and Z to fail, causing consumers pain because their options have been lost, or for W, X, Y, and Z also to pay C for faster connections. This makes the services of V-Z more expensive, as some of the money the people pay has to go to C for the we-won't-choose-to-kill-your-business tax, and it harms any other business that wants to stream video. In fact, it hurts any other business, period.

If you drop a tablet in a forest of smartphones, will anyone hear it fall?

Because tablets aren't as useful as the companies thought

Companies seem to lose track of what products are going to be useful to everyone and which ones aren't. Then, the sales slump off and they all ask why as if nobody's considered it.

Laptop computer: Hit. People want a lot of computing capacity in a package they can carry with them.

Smartphone: Hit. People want a lot of computing capacity in a package they can carry on their person and use portably or in motion.

Tablet: Let's give them a sort of middle amount of computing capacity running an interface designed for pocket devices, but make it big enough that it can't be carried without a bag or conveniently used for short periods on the road. Why doesn't everybody want one?

Smartwatch: Let's give them a small amount of computing power, and they also carry it on their person, but it does less than the other thing they already carry on them. Do people not understand they should want this?

Of course, all these things that aren't going to attract everyone have use cases that work for some, but businesses shouldn't just expect everything to sell at the same rate. It's not going to work like that, especially if the thing they expect to be their standard is a revolutionary device like a smartphone which has achieved extreme levels of market penetration.

You want to know which is the best smartphone this season? Tbh, it's tricky to tell 'em apart

Re: Tricky indeed...

I disagree. Android is insecure in all sorts of ways, and google, as well as various others if they can get a chance, will collect a very large amount of your data. Apple doesn't collect as much, has more restrictions on third party collection, and has fewer security problems. Apple therefore makes a more secure product.

However, there are a lot of good reasons to dislike IOS. The fact that it's secure doesn't make the lack of choice, the lock-in to apple, the ridiculous expense of the hardware (although certain droid manufacturers are giving apple a run for your money there), or any other annoying elements better. There are trade-offs, but I see them as security versus all the useful features android has that apple doesn't. Security vs side-loading. Security vs removable storage/battery (some conditions apply). On and on.

Also, just because apple's phone is more secure than most android phones doesn't mean that apple is good. Apple could do more to protect their customers' security, and they could easily collect less. I would like to see both. For security changes, I have a very long list for android to do.

Nah, it won't install: The return of the ad-blocker-blocker

Re: Advertising from mobile 'phones

It is possible to remove this, but the setting is hidden so that most people don't try to find it. Also, it has an irritating habit of switching itself back about once a year. If you send relatively few messages from your phone compared to your computer, you're liable to send out a few before you notice that the thing is back.

Wearable hybrids prove the bloated smartwatch is one of Silly Valley's biggest mistakes

Re: re: That's bollocks, it really is.

I don't know what the best use case is for you. Consider these:

Why do people use smartphones over older cell phones?

Me: I like having my email there. I listen to podcasts on the go, and the phone can just download them rather than my syncing something to get them. I like that GPS is just on the phone. A feature phone doesn't do that. For me, the reduced battery life is worth it.

Someone else: I need to have facebook and twitter open at all times. A feature phone can't do that, so smartphone it is.

Another person: I like basic photography, and the best cameras are on smartphones. Also, the photo software on phones is most convenient for me, rather than syncing my photos to desktop.

A fourth person: I want to watch video while I commute. I need one of those massive screens to do it, and a strong data connection. For all those reasons, a feature phone doesn't work.

None of these people agree, and they probably have different kinds of smartphones, but they all have one.

As for smartwatches, I technically own one. However, it is a $20 watch (the Xiaomi Mi Band) which I use as an alarm clock. It vibrates instead of making a sound, which I like. It can't annoy people, even if I've forgotten to turn it off and I'm not there when it goes off. It can do notifications and has fitness tracking features. I don't use them. In fact, I'm so used to using my phone for time that I didn't ever use the watch for that. After a few weeks assuming I might, I no longer even wear the thing except for an alarm.

Others might want the fitness tracking. Others want the GPS on your wrist. Others want the voice assistant. Others want the watch to play music. Many others don't want any of these use cases, either mine or the others. That's a thing that you decide.

Re: Smart watches should be simple

For most use cases, you will not be fine with a weekend's battery life. For one thing, anything that builds a battery with the goal of it lasting a weekend will have a battery that really works for twenty hours. If you're going to build a battery for a weekend, don't accept it until it lasts a week in testing. Some watches are capable of tracking sleep schedules, so you don't charge it at night. Useless feature? Fine. How about that watches can use their vibration feature as an alarm. A silent one that doesn't wake up people who sleep nearby, especially if you're a sound sleeper. Incidentally, if you like that idea, I recommend the Xiaomi MiBand 2 (max $20) with the gadgetbridge app from fdroid.

There are a lot of convenient things a smartwatch could do that would reasonably use up battery and make a month-long life untenable. However, if your users also have a smartphone that does a lot of that, there has to be some discussion as to what things the watch can leave to the phone in the interest of having a good battery life and a good set of features. Telling the time is critical. Most people who buy these watches want notifications. Do they use the watch apps? Do they reply to messages with the watch? Do they really need the watch to connect to cell towers, or would having a WiFi chip that is turned off unless requested be good enough for emergencies like my phone died?

It's not just cost, although that's a problem too, but the fact that the more features nobody wants are shoved into the thing, the slower it runs and the faster it dies. You probably wouldn't buy a laptop that I built where it has three hours battery life, but it also has processors of many different types so you can look at how your code runs on each different platform without leaving the interface. And also it has two independent bluetooth interfaces, making it possible to connect to more devices and turn your computer into a bluetooth peripheral that still has connectivity as a host itself. These features, while you could probably think of a way to use them, aren't in demand. The cost of them, less battery life and a more expensive computer, don't justify it for you.

People hate hot-desking. Google thinks they’ll love hot-Chromebooking

Re: hostile to the future

We aren't anti cloud. Some people might be, but most of us are realists about what it can do well and what it can't.

Cloud has good use cases. Using a cloud for some systems makes a lot of sense. For example, cloud can allow you to deal with things that could take out your systems. A few cloud images, properly balanced, across different geographic regions and perhaps different providers, can give you a lot of certainty that your system will stay up virtually forever from an infrastructure standpoint. It allows things to continue working if something has gone wrong with your in house equipment, and it gives you an online backup that is fast to recover.

There are also some people that I, at least, would prefer to be on cloud. For businesses that don't have IT employees and have a few systems or even just one, there are great advantages to it being in the cloud. The responsibility of managing a system that they don't understand and keeping it secure and functioning can be helped by having a more experienced cloud provider manage some of that, assuming they're not going to hire an IT person.

However, there are major problems with the cloud:

Cloud is slow. Any data that you need to send back and forth is going to be slower when dealing with a cloud provider. That can really mess up some things by making people irritated. If you need a file of any size, it can be really annoying to have it sent to you each time, and the delay while it's saved can be equally disruptive.

Cloud is expensive. When you are dealing with cloud, you pay by the month (usually), for each gigabyte of disk and bandwidth and in some cases for cputime. That can be fine if you want to use something small, but if, for example, you want to have all your company's network disk in the cloud, rest assured that you'll pay for all those files as well as each time a user opens or saves one. A physical disk may cost a bit at the beginning, but really not that much and you can do plenty of things with it.

Cloud is dependent. If some guy with construction equipment wasn't careful, or if the telco didn't properly advise them, your internet line could be damaged. For a business with modern computing and in house tech, many things could be disrupted. Any internet communication systems wouldn't work, which probably includes the phones as well, and people who need to access the internet for their jobs couldn't be particularly productive. However, people who don't need to access the internet as much would be able to continue working. The files they need and many of the systems they use are still in the building, so they work. With cloud, that cut cable has paralyzed the company until it comes back. The files are gone for now. Communication is down, but no systems in house means there is no intracompany system that's still up. Many people will have been disrupted.

Some things could benefit with the cloud. However, taking that fact and using that as a reason for everything to be moved is pointless. Servers sitting in a server room will work just as well as servers sitting in amazon's room, but you have more freedom with the local servers, and more of their activity helps you. Decide what cloud things you want, without buying into a one size fits all myth.

Don't panic about domain fronting, an SNI fix is getting hacked out

Re: How does Encrypted SNI protect against censorship from DNS Providers?

It works like this:

This is the current system, assuming I live in China:

Me: [to DNS server that is not censored] I'd like the address to www.chinadoesntlikeme.com please.

DNS: Here you go.

Me: [to internet system run by China] I'd like to contact the server found at x.x.x.x (insert xxxx:xxxx:xxxx:... if you want) and request the page located at www.chinadoesntlikeme.com/ please.

China: No.

Me: [to internet system run by China] I'd like to contact the server found at x.x.x.x and request the page located at /

Server at x.x.x.x: Welcome to amazon AWS. You can get to this server; just not the sites China doesn't like.

This is the replacement system:

Me: [to DNS server that is not censored] I'd like the address to www.chinadoesntlikeme.com please.

DNS: Here you go.

Me: [to internet system run by China] I'd like to contact the server found at x.x.x.x (insert xxxx:xxxx:xxxx:... if you want) and request the page located at "Q2Vuc29yc2hpcCBpcyB0ZXJyaWJsZS4="/ please.

China: Oh no. We need to let people get to the server, because there are plenty of useful things there. But maybe they're going to get something we don't want them to have. What can we do?

China: We'll let you through for now.

That's how it's supposed to work. However, I'm doubtful. I haven't read the system, so I am not familiar with the way the encryption is being used. However, I have to ask the following questions, and if I actually get the time to read about the system then hopefully I'll find the answers.

1. Why can't China do the encryption themselves and find out what the request for a site they don't like would look like? That implies that it changes in such a way that the originating computer knows how to send such a request, but the system China's using doesn't.

2. Will China change over to just retrieving the site requested, then comparing it to a request that they send. They could just compare them and if they are the same or similar (random junk produced to look different) they could decide to not send the page to the machine.

3. Could China block all these encrypted requests such that only standard requests get through? Is there a way to force them to accept it?

4. Does China have enough power to prevent the big cloud providers from using this? They have enough power for apple to crash their own phones when the Taiwanese flag is seen, AWS to give root accounts on all Chinese servers to a third party, and similar for pretty much every company that does business there. I assume they'd find a way for such a system not to be installed.

PC shipments just rose, thanks to Windows 10

Re: I purchased a New PC this year...

I'm glad that's the case for you. My personal win10 machine and VM are also stable and working fine, even while updating. However, a lot of people's aren't. I might suggest that our boxes are running better due to thorough management and knowledge of how windows works. However, the OS needs to be more stable than that for the person who doesn't know how windows functions or fails to do so, as they'll still be using a machine one way or another. Compared to other operating systems the person may have used, windows 10 has a lot of mechanisms for failing that a windows 7, XP*, older MacOS, or Linux user might not expect.

*XP functionality is only expected from about 2003 through 2011. People still using it should expect a lot to go wrong.

Leatherbound analogue password manager: For the hipster who doesn't mind losing everything

I see your point, but any good system will send you a link that you have to click on, and then you reset your password from there. Short of jumping in ahead of you, which would be a bit obvious, they can't know your password. Of course, they can take some good guesses if they have an evil turn of mind.

Re: Passwords are outdated

This does not work. Here are the problems:

Facial recognition: Systems can be fooled by photos in some cases. Models can be created from video footage and sent to the systems. If compromised, the user can't change their face.

Smart cards: Relatively expensive. Must be written by extra hardware, so a copy of data on the card is usually available. No reader for most cases where they are needed.

More clearly, keys are considered useful because they have what passwords have. They're hard to just guess in most cases, so they act as a delay. They won't keep someone out forever if they are determined, but they make it hard to just open the door. When there is a problem with them, they get changed. Keys and passwords can be hidden. Faces can't, and smart cards can only if every system they get used on are trusted.

Microsoft might not support Windows XP any more, but GandCrab v4.1 ransomware does

Re: High-tech options

Usually. It definitely includes disabling, by force if necessary, wifi, bluetooth, and ethernet. However, depending on the use case, some airgapped systems may need USB or similar for reading or writing data. For example, a machine might include access to systems that analyze data securely. This can't be infected, but it does need to read data from somewhere. If there is too much data to enter manually, it might be brought in on a USB disk or optical disk, either of which could be infected. Security of airgapped machines is thus also very important.

ICANN't get no respect: Europe throws Whois privacy plan in the trash

Re: As an EU citizen..

You should have the right to have your details private. That's the right that is due to you. If I am a company that you deal with, I shouldn't have the right to take your information and sell it without your consent. Even if I need to have that information to do what you paid me for, that doesn't mean I can do anything with it I please. The cookie warning is useful--even if they don't let you say no, you can know not to go there again and to clear your cookies, although I'll admit that I care less about cookies than many other things that are done. The GDPR statements about who has your data, why they have it, and what they are going to do with it provide information that lets you determine whether you trust them with your data and what precautions if any you will take when dealing with them.

Now, onto having the right to know who owns a domain name, no, you don't have that right. More clearly, you don't have the right to know who owns a domain name if that person doesn't want to tell you. Consider a parallel: if you have a phone number and you don't know who it belongs to, you have no right to that information. If it is not listed by the owner somewhere, nobody you ask knows or is willing to tell you, and you can't get the person who answers to tell you, then you're out of luck. I have no obligation to list my phone number somewhere. I have no obligation to answer correctly if someone calls me up and asks who I am. Similarly, you don't have a right to know where I live, where I work, etc. You can find out yourself. You can ask and usually you will be told. I may release that information if I choose, where you can find it and use it freely. But you don't have a universal right to know.

Re: ...that will cause the Internet to fragment

No. TLDs are already split up. The country specific ones already work on that basis, where data is removed from the public database by certain registries (including .uk). This is fine. However, GDPR means that storing data on EU citizens and making money off them for any domain names must be done while respecting their privacy. Therefore, who gets .com? EU people have domains in it, but ICANN is not going to give it to you. If ICANN don't change and they keep .com, they violate EU law and can be taken to court. If ECANN take control of .com, their only way to do this is to take control of parts of DNS as well. We could even get into a situation where both have a .com and someone has the nightmare of making that work out. Two places that both regulate domain names is asking for chaos, and the results of chaos on the internet are usually some country saying "We'll just do this my way and everything will be fine as long as I'm happy with it". In the interest of that not happening, ICANN, either change whois to comply or just scrap it.

Re: Break it all

I have to wonder whether we really need whois anymore. Does anyone still use it to contact people? Anyone who has a dodgy site can just buy anonymity anyway, that is if they don't just put in junk.

Recently, I decided I wanted a domain name that turned out to already be taken, but it wasn't being used. There was no system at the end, so I thought there might be a chance the people who registered it didn't need it anymore. So I did a whois on it to figure out who they were. Fortunately, I got neither junk nor a "privacy service" company. I actually found who owned the domain. And it was a company. I don't know why they have it, I don't know whether they are still planning to use it, and most importantly, I don't know how to find out. The addresses provided are all the main company (which has very little to do with this domain name anymore if they ever did). Somehow, I assume that sending an email to the address listed in whois, which is the same one as on their contact us page, and telling them that I'd like to buy a domain I don't think they're using won't be particularly productive.

I'm wondering, therefore, whether whois is really of use in communicating with someone at the place that has the domain. I can see how this might have been helpful during the early days of the internet, when there were rather few sites online, but now that a lot of this is done automatically, I see little use for the system. Do any of my comments section countrymen have a purpose to keep it around?

Who fancies a six-core, 32GB RAM, 4TB NVME ... convertible tablet?

Re: 10 TB of total storage?

The only thing I can think of is editing a bunch of raw video, which I assume can quickly fill up storage. Other than that, probably not.

Battery?

As much as I'd like one of these super-powerful laptops, any review of them should some tech-knowledgeable journalists get one hinges on the battery life. Running with such power isn't really necessary for the laptop user unless they also intend to utilize the portability aspect quite a bit. If they just need that power somewhere, they can use a desktop, and if they need that power in a variety of similar locations (say, an office building where the machine gets taken between dev lab and presentation room), they could use a reasonably powerful machine remotely accessing something more powerful. However, something like this would be optimal for someone who needs that power on the go or when network connection is lacking. That usually means that they would be operating for a significant amount of time on battery. If this is like some other capable machines, in that it runs for about an hour, it probably won't serve the needs of its major customer.

Every step you take: We track you for your own safety, you know?

Re: Corporate Security

The fact that you can think of a reasonable use case for the software, for which I commend you, doesn't make the software all right. The problem is that you are thinking about how to actually use the software for its stated purpose, which is to make people safe. If I had to use it, I'd definitely prefer to have you running the system and dealing with the results. However, the people who are actually buying this are almost certainly using it to track their employees in a way that is very creepy.

For an analogy, consider keyloggers. You could use one of these for a variety of legitimate purposes. You could use it to help correct frequent errors. You can use one (I've done this) to identify users by their typing style. You can use one to have an audit trail of things entered into systems that don't make it simple to collect one otherwise. All of these uses are possible, but usually keyloggers are used to steal passwords and related information, and saying that it will be used for other purposes followed by, essentially, "trust me" shouldn't just be taken at face value.

This has been done before. Companies that wish to break the law but make it look legitimate make excuses for what they're doing. The people who make software that allows people to test their malware against antivirus never say they thought malware writers would pay them for it, but instead market it as a service for software writers. The people who make malware that enables stalkers to track all phone activity market it as security software. People who make malware that allows people to spy through webcams market it as a convenient way to turn that old laptop into a home security camera. These are deceptions. It would be great if everyone deploying a system was like you, having the safety of the employees in mind, but they aren't, and that reality is important to deal with.

SD cards add PCIe and NVMe, hit 985 MB/sec and 128TB

Re: Super fast...right

OK, thanks. That was very helpful. Of course, the fact that A) MB is often printed in lowercase by many systems, B) bits and bytes are atomic such that a millibit and a millibyte are nonexistent concepts, and C) the point I was making is not related to abbreviations, but merely a translation from the units used by hardware manufacturers because it is more related to the engineering and it makes the system sound better to the units used by people actually using the systems involved (I.E. all of us) make your point significantly less useful. Still, I appreciate the pedantry and will consider myself justly chastised for my inaccuracy.

Super fast...right

I wonder why I'm not buying the extreme speeds they claim. I'm not sure. Maybe it's something to do with:

USB 1:

Speed rating: 12 megabits per second

Speed in real numbers: 1.5 mb/s

Real speed (relatively good): ~350 kb/s

USB 2:

Speed rating: 480 megabits per second

Speed in real numbers: 60 mb/s

Real speed (relatively good): ~4.5 mb/s

USB 3:

Speed rating: 5 gigabits per second

Speed in real numbers: 625 mb/s

Real speed (relatively good): 25 mb/s

You can get faster speeds from these ports--if your device can send at their high rates, you will get data that fast. Still, the type of storage devices that are most frequently used on these (not talking about backup hard drives that cost more) are not capable. Flash drives don't go anywhere near the speeds the ports should let them, and neither do SD cards. Just because the standard can support it won't make SD cards SSD speed. Even if it has been proven to work via someone actually building a prototype, no cards actually providing that functionality will become available.

Also, I'm guessing these "extremely fast" cards will have the same problem that affects current cards that are high speed and high capacity: they're great for storing lots of large files, but if you need to store a great many small ones, they become slow. No problem for a camera, especially those ones that take massive raw image files. No problem for my main use case, audio recorders that are frequently called upon to record for hours. But it is a problem for anything trying to run an operating system off one. Not many operating systems have files that are individually larger than about 128mb, but most do include lots of files hovering between 10 and 100 kb. For the SD card to run the OS, it will need to handle that well. Oh, by the way, do you think all those devices using SD cards will get off their addiction to FAT32, because we're already at the point where that file system isn't useful.

BlackBerry KEY2: Remember buttons? Boy, does this phone sure have them

Re: Here he goes again ...

I can see a small reason for a flip style, but not for a clamshell one. Things like the gemini that offer a tiny laptop, sure, but not a phone doing phone-style things. The benefits I see with the flip style is that you can have some protection of anything delicate, you have more distance between the microphone and speaker so it actually fits your head, and flipping open to answer and closed to hang up is rather nice. However, the phone would have to be relatively large to accommodate that structure with the kind of screen sizes people want nowadays. I'd be fine with a 4-inch screen, but the buying habits of most others, as reflected in the phones being produced at flagship level, clearly disagree. As little as I want a 5.5-inch phone, I want it even less if it is much thicker, which it would have to be. This leads me to the other problem I have with the flip style for a smartphone--there is a lot of surface area for rather little volume, meaning that things like batteries would likely remain in one piece, powering the other. This makes the modular idea rather limited and means the extra thickness won't host extra battery, which is the reason I'm willing to accept that. In addition, current flip designs wouldn't make it easy to have a single flat surface when flipping open, which makes it difficult to orient the screen at a comfortable angle without having to deal with the other half. That other half would be difficult to orient for typing such that the screen is also conveniently positioned. I'm all for flip phones, but I'd like them to remain the small non-smart variety. The flat screen type, in my mind, best fits the way people use smartphones.

Re: Buttons

That may be down to bad design. You either need enough buttons to do the job or a configurable interface (touchscreen usually) with optional buttons with straightforward functionality (I do not want a touchscreen volume control, thanks). Those devices trying to go the middle route and have two buttons for something where ten would be more useful, with patterns of press first button, then immediately press and hold second one, then tap first three times, are giving buttons a bad name that is not deserved.

'No questions asked' Windows code cert slingers 'fuel trade' in digitally signed malware

Re: PKI done properly costs money

I don't think so. You seem to be saying that, if we just got over it and cheerfully spent the money, things would be better. These certs aren't free, and the problem's still there. Perhaps one reason we'd prefer the certification process to be free is that all the power for whether the code we wrote is trusted goes to someone else.

The same is true of https. Sure, you can see having a certificate that isn't self-signed as an indication that the server is likely to be who it says it is, but if you're really in a situation where you can't be sure of that, you have bigger problems. If you're getting DNS poisoned to bounce you or someone's taken over a domain name, the problem is big and needs to be dealt with more strongly. Meanwhile, an HTTPS cert of any type provides the user an encrypted connection to the site and protects them. You have to choose where you go, but https://www.iamevil.scammerparadise.net is still going to be risky no matter whether they paid someone to verify that they owned it.

Dot-Africa saga going to jury trial... thousands of miles away in America

How about no .africa

Regardless of exactly how corrupt ICANN was in this case, it is my opinion that the application for .africa should never have been approved. There are only two groups that should have the rights to .africa:

1. A body selected by a vote of all African countries (that's going to happen).

2. AFRINIC.

What logic did ICANN use to say that some company or even country should have the rights to a TLD oriented at a continent? That should belong to the continent involved.

Chrome sends old Macs on permanent Safari: Browser bricks itself

Re: One in twenty users?

Sort of but not exactly. Since 10.9, new versions of the OS are free and can be installed relatively easily. It's not like windows 10; it will actually run pretty much the same. Since they didn't leave any models on 10.9 (everything on 10.9 supports up to 10.11), they supported it for less. I believe they still release security patches for 10.11 because older machines have reached the last supported OS. Incidentally, I'd recommend everyone running less than 10.11 upgrade to it, because it is significantly more stable, and that nobody upgrade from 10.11, especially to 10.13.

So you're doing an IoT project. Cute. Let's start with the basics: Security

Re: If you don't connect it to the network, ...

But they make it look like connecting it to the network will be helpful. That means that nuts like my parents, who had decided to test out some streaming services, tried to get the TV to stream them for them by having it connect to the network. Of course it didn't work, but now I have to find out how to get this thing back off the network. Somehow, my suggestion of giving them a raspberry pi that they could just connect an HDMI cable to was not seen as helpful.

Ubuntu reports 67% of users opt in to on-by-default PC specs slurp

Well, that was useful

And here we have...what we already knew we would have. People are using computers that look like computers we deal with on a daily basis. Even discounting the fact that most of these are probably VMs, the specs they gave us are the specs of any number of standard machines. You have the laptops (most standard-price ones are 1366x768) and desktops (connected to monitors at 1080p). And you really expect that everyone's using just one monitor. I have a friend who uses her ubuntu setup with three monitors. She's not going to power up all three just to install ubuntu; she'll turn on one, install it, then use all three when she has a real reason to do so. Meanwhile, they did get a report from me; a VM, running at 4gb ram, connected to a monitor at 1080P. What a surprise. I can really see the point of collecting this.

Trainee techie ran away and hid after screwing up a job, literally

Re: Key word is "Trainee"

"but giving them a crappy task that needs little or no training, (except, making the tea for the workers on a site can be a very skilled job to get right, getting everyone's tea made to exactly how they like it, i.e. more or less milk, 3 or 5 sugars)** is part of the training...."

It seems really pointless. Primarily, I'd assume that people should just make their own tea. If there is something that needs to be done by one person so that everyone can do that, fine make the trainee do it, but if that's the main thing they do, it feels like you can't be bothered to respect the skills they are supposed to be enhancing. Theoretically they were hired to learn things because they showed promise. If you're going to use them as a person to do odd jobs for which their experience is by and large pointless, then you might as well have hired someone who didn't have the skills. They'd probably have been somewhat cheaper, there are many people needing the job, and they would have knowledge of what you were going to ask them to do.

"back in the day of apprenticeships, all they did in a machine shop was brush up and clean the machinery until they knew all the names of the parts. it would take time to learn the skills to work on actual client works..."

Exactly! That's what I'm talking about. Sure, they're doing something that is relatively easy, but they are learning something relevant. This part is called X. It is part of that thing over there, and it performs task Y. This is how to clean it properly. Once you've cleaned it, so that we can use it again, you'll learn what part Z does and how you can use parts X and Z together. They may have learned faster if their supervisor just taught them, but that wouldn't be efficient.

In the end, they got the benefit of knowing what was going on, their employer got the benefit of their work, and either they continued to work together, in which case both were successful, or the employee was able to use extra experience to get or set up a career for themselves. Meanwhile, someone who is used as cheap labor for making tea or similar completely unrelated tasks gets next to no benefit. They have learned nothing, so all they get is something to put on their resume that shows that they worked on something. It's single sided toward the company, but there are very many options for it not to be. That's why I have a problem with it.

Canadian utility makes blockchain upstarts bid for their ravenous rigs' electricity supply

Re: Server Farms and Mining Rigs should be...

But what if it's summer but it's been chilly for a bit. Might I fold some proteins then?

How does this work?

If they intend to charge me extra, what stops me from lying about what I'm doing? No, these servers aren't mining, they're running machine learning workloads. Or collecting data for a massive search engine over a database. Or anything that requires a lot of processing. In fact, the electricity company might have trouble figuring out whether that's processing power or power from something else. True, there aren't many things that run 24/7, but how could they tell that a given kilowatt for one of those things was for mining versus anything else I could use it for.

Amazon tweaks its word processor for easier online Office edits

Re: Past its sell by date?

Please don't. I use libreoffice too, but return it in a format that isn't bloated and slow. PDFs break a lot, are ridiculously large for the data stored in them, and usually require far too much software to read.

Schneier warns of 'perfect storm': Tech is becoming autonomous, and security is garbage

Re: One day, ...

Ok. Now I'm curious. Since I can't think of anything that would get rid of all computers while leaving humans, what type of situation can you think of where computers would be banned? And does your theory also account for the populace to comply with said ban? I'd really like to hear your theories, because I'm not thinking that way at all.

In huge privacy win, US Supreme Court rules warrant needed to slurp folks' location data

Victory! for now

I'm very glad to hear this. I hope this is the first step in the advancement of most privacy-respecting regulations, as more and more data is deemed to be personal enough. Here's to the spirit of this decision living on for as long as possible.

How a tax form kludge gifted the world 25 joyous years of PDF

Re: PDF is clunky.

Whatever reason they may have had for losing the document, their mistakes were not the point. The point is that PDF files, although they are lauded as being useful on any platform, frequently lack the feature of making their content available if you don't want to just look at them. Some PDFs have text that can be extracted, but the number that don't is higher than the number that do. If I want to use the contents for some reason, be that copying and pasting code, quoting accurately, or sending data over something where text is more convenient*, PDFs frequently won't work. Sometimes, this is done for security, because I suppose it would be harder to violate copyright with something where copy and paste are made impossible, but usually it's down to someone messing something up or being a control freak because I should view this document in the font they like. With any text-based format, you have the freedom to make it useful by converting it to any format that would work well. The greatest risk is that it won't look as nice on the other end. With a PDF, the message seems to be that you are not allowed to do anything that the original document-writer didn't think of allowing you to do.

*Recently, I wanted to give someone some of the documentation for a system they were using. The only problem was that they were on the other side of an e-mail exchange. I can't send the PDF file because it's 48 mb and there's a limit on attachment size. This file was sent to me, so I don't have a link to it online. I could post it somewhere and let them download it, sure, but copying and pasting the ten-item instruction list would really have been more convenient.