Posts by doublelayer

Apple tipped to revive forgotten Macbook Air and Mac mini – report

Re: nice, but...

If you don't like the Mac system, don't buy one. But for all its faults, which I don't deny, it is not a walled garden. When you set one up, you have root access already with most terminal tools. Installing development tools is easy, and installing other packages can be done without much difficulty. They have an appstore, but you can sideload and most applications do. It isn't perfect, but there is little they prevent you from doing to the software. As for the hardware, they are indeed difficult to repair. I might recommend getting an older one, which usually had discrete memory slots at least.

I wouldn't be surprised if apple does turn their macs into a walled garden later on, but they haven't done that yet and if they do, I can hold any mac I have on the version before that, which will continue to function until I find a new thing to replace it with.

Techie was bigged up by boss… only to cause mass Microsoft Exchange outage

Re: Why would you have a maintenance window at 6:30am?

I'd also rather the job where I can do some maintenance from home late at night. However, that option is dangerous. If something breaks that requires me to be on site, then I probably have to go there. At night, when access isn't always figured out, and transport systems might not run as often if at all. Worse, let's say that I say "Sure, I'll work at night for a bit running standard maintenance and also be there in the day. It still adds up to the same amount." Now, they have an expectation that I'll be there during the day. If the maintenance is usually thirty minutes or so, that's fine. When it becomes several hours for a major update or something similar, requiring you to stay up most of the night to work on it, you have less leeway to say that you won't be in. You have a perfectly good excuse, but that often doesn't convince the people who pay you.

Re: Why would you have a maintenance window at 6:30am?

Good logic. My guess is that they wanted the sysadmin there during the work day, but didn't want to hire another one. They can't reasonably ask the person to be there at night and during the day, so they just schedule it for early in the day with the assumption that "We gave you time to run the maintenance, when we wouldn't complain. So if it isn't working at 7:00 when that ends, we feel we have all the excuse we need to yell at you".

The Chinese are here: Xiaomi to bring phones to the UK next month

Re: I love this

I've seen some similar things. I don't think this article is really doing that, other than to point out that Chinese manufacturers haven't been very mainstream until Huawei became so about a year ago. Before then, none of them were all that well-known, although you could buy phones from them.

As for the trustworthiness of the tech, I'm willing to trust most of it. However, there are a few parts that are a little weird. I recently got a Xiaomi fitness tracker to use as an alarm clock (I like vibration alarms). The companion app wanted me to sign a strange license agreement containing such normal phrases as "This product may not be used to damage the reunification of the motherland." and "People with intentions of antisocial or antigovernment actions may not use this product." I found those a little off-putting. Fortunately, I found an open-source companion app instead, so I used that. Still, when faced by things like this that remind you of the system watching Chinese citizens, I believe one could be forgiven for asking whether there's anything creepy in the code that we can't see. I don't really think there is in most if not all cases, but the question isn't irrational.

Should a robo-car run over a kid or a grandad? Healthy or ill person? Let's get millions of folks to decide for AI...

Re: Choosing to kill someone is murder, shirly?

Self defense is one thing. Choosing an alternate victim is another. If there is a person planning to shoot me, and I have a gun, I can shoot them in self defense. If the person is going to shoot me, and I grab another person and shove them in front of me, that's murder on my part. In the case of a crashing car, if given the choice of "die or that person dies", selecting the latter could easily be considered murder, because the victim you chose was not at fault. Hence the person on the sidewalk.

Re: Important 'cause...

Some studies of this effect attribute it to the brain not discarding memories from a point of intense emotion, especially fear. They have done some tests by having people fall off buildings (they were OK with it) and the brain does not appear to overclock. I don't know if anyone's found something different, but that's what I read a while ago.

I'm glad you did not fall into the harbor. That sounds like a terrible experience.

Microsoft promises a fix for Windows 10 zip file woes. In November

Little victories

I don't use windows a lot, but I have an application that requires it to run, which I'm running on an old laptop running windows 10 (it only has to run this one application and a tiny script that sends the data somewhere else, so it needs little processing). I was working next to it yesterday and had inadvertently awoken it. About two minutes later, a message came on the screen. It read "We can't install some updates. Click here for more information". That message made me happy for several minutes.

Memo to Microsoft: Windows 10 is broken, and the fixes can't wait

Re: Am I missing something here?

Windows CE wasn't great, perhaps, but it was stable and did run for mobile PDA-type things. You could use the applications on them, and you could load others. It provided a common platform for applications that would run regardless of device peculiarities, and with some support for modern (of the time) hardware. You could also get some interaction between the mobile device and computer that actually worked, sort of. What other mobile OS had that at the time? As I recall, most of them worked but only with their own programs, or weren't compatible with much else. I think it could have provided Microsoft with a very good entrance into mobile computing, although we'll never know because they threw it away with Windows Phone 7. Still, there are a lot of embedded devices that still run it (I don't know why).

As for normal windows, I've never really loved it, but most versions were acceptable until windows 8. That's when they didn't just alter the interface, but instead crumpled it up and started over. I'd have to give windows 10 a slight edge over windows 8 in the interface department, but that's like saying that it's closer to the top of Mt. Everest because it's standing on a phone book. Meanwhile, everything else still managed to get worse with the release of windows 10.

Re: "Quality" is a structural attribute, not a bolt-on

Me: "changes are much more likely to be written, tested, and put into operation quickly if the codebase is modern."

Response: "Define modern. This sounds very much like the usual rant about having to periodically update legacy S/W i.e. the stuff that's earning the business's income."

Modern refers to the original comment about businesses continuing to run code written in the 1980s because, as the comment claimed, that software was just written really well then so they have no problems. Not only do I not believe the software was just wonderful then, as it probably had plenty of bugs that had to be removed from it back then, but it is difficult to change. Code written in the 1980s will still run, but only on legacy hardware or operating systems which imposes another cost on the business. If you need to update how the software works, your options are:

1. The codebase was written in the 1980s in a 1980s language. In order to modify it, you need people familiar with that language. This is not a ton of people. Many of the people who are familiar with it, looking for a job, and willing to work for you have been writing in different things. I know, for example, a person who wrote assembly for various Cray supercomputers. I don't think he would know how to do that now, though he'd be faster to relearn it than would I.

2. The code is written in a modern language. This may be painful to port from the original code, but it is now easier for it to be modified. You still have to hire good programmers, and you shouldn't do it as cheaply as possible because you'll end up with terrible bugs. However, when you need something updated, it's much easier to find a competent person if the language is more modern. If I found a bug that needed to be fixed quickly, I'd much rather the code be written in C, Python, Java, or most other modern languages than Cobol, because I know I can find someone to write in those languages. I don't know how to find a competent Cobol person, let alone assembly for $random_processor_from_three_decades_ago.

Therefore, I would disagree with the assertion that companies should continue running old code because people just don't write how they used to. I think that's a dangerous course of action most of the time, and although many modern companies forget important testing practices and the like, there are others that still produce reliable code.

Re: Please Please

Me: "For astronomy purposes, can you set your working hours for windows update to during the night to prevent the updates interfering with your imaging?"

Response: "Err.............. astronomy............. stars................. night"

Err. Working hours supposed to prevent updates. Set them to at night, hopefully no updates at night. Updates only in daytime, when no stars visible from ground. On same page now?

No. An operating system that deletes user data is not fit for purpose. It is fatally flawed. It remains flawed even if yours was not the data deleted. Maybe the driver issue could become the ball in a game of blame tennis, but the data deletion issue is firmly in Microsoft's court, and it is not minor.

Re: alternate look by Ars at the same issue

I have to defend the windows insider testers here. Some of them may just approve anything that Microsoft does, but a lot of them just have the time and find some bugs. In general, once Microsoft has produced an insider build containing some feature, new interface, or relocated settings system, they are going to ship that. The insiders don't have the ability to say "That new interface is terrible. Go back to the last one." and actually have that advice taken. They can, however, report bugs. I think the blame can be placed on Microsoft for not listening to the insiders on bugs, which has been amply proven in recent weeks. The terrible interface and functionality changes were all Microsoft's initiative, and I would seriously doubt that any of them ever got run by someone external before they were implemented.

Re: "Sell Office on Steam, make sure it runs on Linux, too"

Most of those things are things that I'd really like Microsoft to do, and that they could (and should) do. However, that list contains some random stuff that while potentially desirable, is not logical for Microsoft to write. Running android apps? You might want it. I'll put my vote in the no pile. Why would Microsoft want to do that? Is there any benefit to their spending a ton of time doing something Google's having trouble with with the result that Google's platform gets a stronger market purpose? For making office run on Linux, why? Not only why do you want office to run on Linux when you don't seem to like either, but also why would Microsoft go out of their way to support a competitor to their product. As for selling it on steam, no thank you. Steam may support Linux more, which is always nice, but I would not like to use it for buying random stuff (I'm not a gamer and so I don't have an account) but also it's not some independent place making open source software for us; it's a business in its own right that is no more trustworthy than others.

My list for Microsoft includes various modifications to windows that you include as well, but could best be summarized as "Make windows good. Act like a normal business that competes on product quality and turn your efforts to actually increasing product quality. If you do that, I'll decide on the products' merits which ones I'll use and for what. Accept my decision when I make it, and try to change it by making your products better rather than torpedoing me." I don't demand or expect that they'll do something that's insane from their business perspective.

Re: "Quality" is a structural attribute, not a bolt-on

I can see your point with agile, but I'd disagree about companies using old code. History shows us that this code wasn't necessarily (and wasn't in practice for most cases) written and tested as thoroughly as possible using wonderful coding practices that we've sadly lost. The code that's still running is probably quite solid given the decades of testing in the field that it has received, but otherwise it's code that can fail as much as any other code. Companies still use it because they have a fear of doing something differently and because why spend money on making the code fast, modern, and perhaps more full-featured when you can not spend that money and instead spend it on the people keeping old hardware and virtualized old hardware functioning?

If they had to change their business practice and modify their software, the changes are much more likely to be written, tested, and put into operation quickly if the codebase is modern. With an old coding system, you need developers familiar with it (fewer people) and ideally people not only familiar in the sense of "I worked on this in the 80's and 90's" but also in the sense of "I can still remember off the top of my head what that hex error code means". Meanwhile, a modern codebase can run on a lot more stuff and can be repaired should it break without needing specialist knowledge.

Re: Please Please

For astronomy purposes, can you set your working hours for windows update to during the night to prevent the updates interfering with your imaging? This might help make these less likely. I assume the software required only works on windows?

Apple boss decries 'data industrial complex' while pocketing, er, billions to hook Google into iOS

Re: He's mostly right

I agree with most of your points, but the anonymity or at least pseudonymity is really needed. If people used something that could identify them reliably, tracking would become really easy (I recommend a book entitled "The Circle" by Dave Eggers to see one likely thing that happens after that). Not only would identifying names used everywhere be a nightmare from a privacy perspective, it would also be very difficult to create. The only methods I can think of that would really do it would be a cure much worse than the disease.

And then there isn't really that much between anonymity and pseudonymity online. I generally prefer using a name that identifies me to others even though they can't track that down very far, but there can be some reasons to want even less identification. I will admit to posting anonymously here, usually when discussing a former employer, because although they probably aren't reading this, and they probably don't know that I'm the person who no longer works there, I'd like them to continue not knowing.

I agree about a lot of the problems you mention. I don't know a way that we can prevent that from infecting our society, but eventually things will get less crazy.

Market benefits

Sure, apple gets benefits from having a product that respects* privacy. I, at least, consider that a good thing. I want companies that respect privacy to have an easier time. The argument that you can't innovate and respect privacy at the same time is ridiculous, and I hope to see new innovators replacing other large market players for whom privacy is seen as a roadblock they can just circle around.

*Apple respecting privacy: Terms and conditions apply. Things look good when comparing products to competitors. Terms are not as pleasant as they appear, just more pleasant than other options.

'The inmates have taken over the asylum': DNS godfather blasts DNS over HTTPS adoption

Re: Well not quite

The best I can think of is that now you have to enter two IP addresses: the DNS address and the authority address. Either that or you have to enter a DNS address and the key it uses, so you find ones that you trust and don't allow the server to send you one. The latter approach requires you to find a trustworthy key, but if you're going to trust that your contact to the server is going through correctly, the key they announce will only work if it corresponds to the real server. It's certainly more complex now

Re: Well not quite

Except this isn't a joke, so there is some risk of it being adopted. If this happens, we should hope that it is easy to set up a less centralized version.

Re: Where do the keys come from?

But you would still have specific IPs to enter to reach those DNS servers. Those would then send you a key to verify and use. Either of those would be known by other systems, including those of censors. So contact to known addresses that are DNS resolvers or containing a key of a resolver that doesn't censor could be identified. What am I missing?

Where do the keys come from?

I need to read the RFC, but I'm not understanding something important. In your standard use of HTTPS, you request a domain through normal DNS, get an IP, and contact that server. That server has a key that you can verify as belonging to them and authorized by a central authority. You get it by contacting the address that you got.

Where does the trusted key come from in DOH? Is the key connected to the DNS server itself? In that case, you could identify all contact to the DNS servers even though you couldn't read them and block them just as well as you could block DOT. If the keys are pre-known, you could modify them to poison which servers are available. So why is DOH superior to DOT? They look the same to me.

Sysadmin running a Mac fleet? IBM has just thrown you a lifeline

Re: "with the chance to enable disk encryption"

I think that just means that security policies, including disk encryption, can be turned on automatically when the machine reboots after setup. Otherwise, you would have to do another thing to set it up either manually or with another reboot.

SQLite creator crucified after code of conduct warns devs to love God, and not kill, commit adultery, steal, curse...

Re: Not the first piece of absurd preaching to come from the SQLite team

Threads are problematic because they can cause a lot of annoying race condition/concurrency problem things. That doesn't make them evil any more than the compiler is evil because it optimizes code into a method that makes it hard to debug, or the operating system is evil because it limits the number of open files you can have. They work in some way, and they each have a reason to do so.

Threads are useful over processes because your code is more united; you can create threads that are nicely connected to a codebase while multiprocessing is uglier. Threads let you have interactions between each other whereas processes don't have convenient communication mechanisms (sighup is not enough). To communicate between processes, you usually have to create your system yourself and it's slower.

As for SQLite, I typically use it only as a convenient type of data storage, or for an application that needs a local database inside itself. For real database requirements, it's not going to have enough features or capacity.

Sure, Europe. Here's our Android suite without Search, Chrome apps. Now pay the Google tax

Re: Google is far better than apple

Imagine that. After you've already paid google for a ridiculously overpriced phone, they let you root it. However, you can't on other phones (not related to topic here, but it annoys me). The issue, however, is that I'm not allowed to sell such a phone if I want to also sell a phone with google play services. Therefore, since they do their best to hobble AOSP only devices, I pretty much have to choose not to make them. Essentially, they have a lock on companies that prevents them from building a competing product, which is illegal.

For me, the consumer, I can't easily get a device that A. is a smartphone, B. Isn't apple, and C. Doesn't run google play services. I can't buy an android phone and remove it (unless it's a pixel, evidently). I don't have any other options. Some of the previous options died due to mismanagement, which is not Google's fault, but even more never got a chance to exist because Google was able to say "If you make a phone with that, we won't let you build anything else".

Re: Google is far better than apple

Apple don't let you do some things with the product they make. That is irritating to quite a few people, and perhaps a good reason not to buy apple stuff. However, they do that because that's their product. Their product lets you do some things, and does not let you do other things.

Google created a product, in your mind better, that also doesn't let you do certain things, like disable google play services let alone delete it. That's their right to do in their product, but they aren't just doing it because that's their product; they are doing it to destroy the competition from their suppliers and others, by making google play services a parasitic effect on their device manufacturers and making it impossible to do pretty much anything without it.

FYI, the thing apple did to reduce device processing that they claimed was for battery reasons was illegal. They got sued, and they got investigated. When apple or google does something actively illegal, and they both do, they get investigated.

Re: Apple do not have Significant Market Power on mobile phones

The word "podcast" clearly indicates its origins. People may not be using iPods anymore, but iTunes still has a podcasts section, where podcasts register themselves so people can find them. There are other directories for podcasts except that 1. A lot of podcast apps use the iTunes directories to make it easy to search for podcasts (because people put their ones in) and 2. other directories rarely have a review system at all. However, apple doesn't use their "market dominance" in simply providing a list of a lot of podcasts to enforce things--podcast apps that are written only for android use the iTunes lists for their search system, nor do they prevent podcasts that don't list themselves there from working. It's just a database, and a really harmless one.

Stroppy Google runs rings round Brussels with Android remedy

Re: Holding action

Yes, it does require some involvement to push updates that need to interact directly with the phone's hardware. However, you could (and they didn't) update most of the operating system without touching the kernel. Not perfect, as sometimes you just need a newer kernel, but it's very doable. They didn't do that, nor did they do anything to make the manufacturers help with the update process. The result being that there is pretty much no phone that you can guarantee will get updates at all, and the ones that you can be pretty sure of will only get them for a year or so before they're dropped. For example, I'm resetting a galaxy note 3 from a friend who doesn't want any personal data on it, and the hardware in it is better than most cheap android phones today, yet it's still stuck four android versions back.

Re: Ha

We are not saying that google doesn't have the right to do with their OS what they want, although that has more limits than you say. However, yes, they have the unlimited right to make it the privacy-invading, closed-source in reality, complete mess that it is. They are not allowed to make it deliberately destroy competitors' systems, which it does. If you build a television that searches out my television and targets it with harmful interference if it isn't one you make, then you have violated the law. You have the right to build a television, but not to destroy mine. No matter how complex your system to destroy competition, no matter how many other useful things it does, no matter how much value people get from it, no matter how much effort they went to to create it, and no matter how much worse the competition is, you don't have the right to do that. It's wrong, and it's illegal.

Chinese biz baron wants to shove his artificial moon where the sun doesn't shine – literally

Re: Eight times brighter than the Moon?

Like most Chinese cities, this place is really busy and has a ton of lights inside buildings. They could probably turn a lot of streetlamps down or off that are near big buildings already pouring a ton of light out and save some money there. Meanwhile, it's going to be more cost-effective to just get more efficient systems for generating power and turning it into light rather than sending even more unneeded junk into orbit.

Open-source this, open-source that, and the end of the Windows 10 Creators Update

Re: Too True.....

For me, usually it works like this:

Me: windows, pause, types "note", enter

Notepad opens.

Me: Closes notepad, windows, pause, types "note", down arrow, enter.

Notepad opens.

Me: Closes notepad, windows, pause, types "note"pad++, enter.

"notepad++" - Bing - Microsoft Edge.

Me: Closes edge, checks that default browser is still set to firefox, Windows, types "note", looks at list. Finds correct position of notepad++ in list, arrows to it, enter.

There might not have been a good search facility before, but I miss when you could pin things to the start menu and they would actually stay there.

Samsung Galaxy A9: Mid-range bruiser that takes the fight to Huawei

Re: Mid-what?

So it's the median. That doesn't always equate with mid-range. Mid-range is a category that falls between low-range and high-range, which usually applies to what a normal person spends. Perhaps it'd be more accurate to do a median of the phones by how many of them were sold, which would probably be more like a mid-range phone. In general, however, a phone that is essentially identical to a $1000 phone and costs $600 is still high-range, even though it costs less. The internals are high-range, and the cost is high-range. If they downgrade the internals, the specs may become mid-range, but the price is still high-range and so the phone is just overpriced. If I start selling phones for $2000, it won't make Apple and Samsung flagships mid-range, it will result in nobody buying phones from me.

6 gigabytes

Out of curiosity, how frequently does a phone actually use six gigabytes of RAM? More specifically, how often does it use it for a reason other than "why ever remove something from memory when you have six gigabytes of it to play in"? There seem to be a lot of phones out there with 2-4 gigs, and I wonder how noticeable the difference is. If I had two phones with exactly the same specs except one has six gigs of memory and the other only four, is there a recognizable difference in standard usage between them?

Yale Weds: Just some system maintenance, nothing to worry about. Yale Thurs: Nobody's smart alarm app works

Deadlock?

Does Google make hardware just so nobody buys it?

Re: Do we care anymore?

I wasn't in on that memo. Just because it uses the Linux kernel doesn't mean it's good. You can build all sorts of things with the Linux kernel running the low-level stuff. The resultant device can be terrible, it can be evil, it can give you no options, and it can lock you out completely. Linux on its own doesn't guarantee anything; it's Linux plus a free user level and access to root and system components that gets you a system that either is great already or can be made so.

Re: ChromeOS Pyrrhic victory

I can see your point about the long battery life making an underpowered device more useful, but consider two points:

1. This chromebook has a ridiculously overpowered processor for the processing it can actually do. If they included a processor that ran with less power, it would run for more time,

2. I like long battery life too, which is why I look into computers with processors that can standby or sleep in many conditions, then load them with operating systems that don't thrash them. I can still do real work on them, rather than be tied to my internet connection. This also helps my battery life because I can shut down my WiFi and bluetooth radios to save even more power when I'm not using those services. I have a laptop that I was recycling for someone else, with a really low-end AMD chip in it. It can run forever with a minimal Linux install, even though it has a smallish battery. I think this one was very cheap when it was bought new, as well (although I doubt the battery life using its preinstalled windows was so nice).

Chinese Super Micro 'spy chip' story gets even more strange as everyone doubles down

Re: phoning home

Some assumptions you made:

1. The chip, assuming it exists, is meant to exfiltrate data.

2. The chip, assuming it exists and is meant to exfiltrate data, would be doing so frequently, rather than sleeping most of the time and sending out bursts on some occasion.

Assuming that it did need to exfiltrate data, it could be doable on Amazon's network if it could be programmed to recognize an AWS image with specific characteristics. The data could be sent to that VM by the kernel, and stored there. From there, it could be encapsulated into traffic that is sent out as normal.

This wouldn't explain exfiltration from other systems, as Apple doesn't run others' VMs on their systems. However, it could be possible to send data in standard-looking packets if there wasn't that much. This is not an explanation, but it is feasible.

It doesn't make that much sense that the chip would have another purpose, although I suppose you could come up with one. It could be a remote destruction device that merely watches for a request, then takes the system down. That doesn't seem like a useful thing to do, but that could be the purpose. I'm sure we could think of lots of other things the chip might be doing if it exists, so let's not assume that exfiltration is the only task it might perform.

Re: Why are ICs always in large packages, how is this dot powered?

I'm not saying it happened--in fact, it seems likely that it didn't happen, but the chip in practice does not need all of the things you say it does. If the original description is correct, it merely sits between a flash chip and a processor, replacing serial traffic. It could use the data traffic from the flash as enough power to inject another signal. After that, the new code could be run just fine by the processor running the servers' firmware, which can do all of the actual stealing, embedding of information into something hard to detect, and exfiltration over the internet. I don't think this happened, but your reasons wouldn't explain why not.

Punkt: A minimalist Android for the paranoid

Re: Rather a sad battery

The point of six weeks of standby is the three times as long you could do other things, like using the tethering if you have an account that will actually permit tethering for long enough to run the battery down. The benefit would be that, with a massive profit margin already, it could be useful to the user without doing much to the company.

Microsoft yanks the document-destroying Windows 10 October 2018 Update

Re: But that wouldn't bring three thousand million, seven hundred and sixty-eight deleted files back

Yes, this would have been much less of a problem if people backed up their files. That's correct. It's also quite relevant, except:

1. There are some people who never back up their files. They aren't reading this comment or this site at all.

2. Microsoft's update system is such that it will run the update when it wants to, without asking you. Therefore, you don't have the chance to say "Let me take a full backup of this before you do that."

3. Windows now gets updated a lot, such that you can't take a ton of time out of your schedule to do something unusual every time it does. I used to be in the camp of always doing a clean install if a new major version of the system was coming out, just to avoid any problems that the upgrade process has. This includes taking a full backup, both through my normal system and onto alternate media that is confirmed bootable or externally mountable in an emergency. I'm not going to do that multiple times a year, thanks.

Re: If this was an Apple product

"The user account I'm typing this from was first created in Tiger in 2005 and has been migrated through all the intervening releases."

In my experience, I've never seen it do anything to the user folder, or really most places on the hard drive. However, it does at times reset settings. You have to go to system preferences to switch them back. I've seen this on IOS too. It's not a terrible bug, but I set those settings and I'd like them to stay that way without my needing to go back in. I've also seen certain installation bugs (the one that hit me when high sierra was launched at me is particularly memorable). Still, I'd say that apple OS releases haven't really had anything as bad as this one on windows.

As usual, I'm glad that yours is working, but if others' systems aren't, there is still a problem.

On the third day of Windows Microsoft gave to me: A file-munching run of DELTREE

Re: Not a good look here.

"No they don't and no it doesn't. They get stored in the AppData profile "

A lot of stuff gets stored there, but I have several programs that put configuration in documents/$program_name/config or something. They usually don't give you any other option. Yes, they're bad programs, which is why I try not to use them. No, I don't have much choice not to.

I don't really have a problem storing data on the same volume as the OS, which simplifies things if I'm using a single-disk machine, like most laptops. However, since they made documents, etc. into libraries, which means that there are several things called documents that are not necessarily the same thing, I've not liked to use them. I mostly use folders of my own choosing, which also helps as I spend a lot of time in the command line when I'm on windows.

You dirty DRAC: IT bods uncover Dell server firmware security slip

Re: CIA? NSA? Not a bug, a 'feature'?

It wouldn't go through customs. A server manufactured in China/Taiwan gets sent to Australia and used for something $agency wants to receive, and it hasn't gone through a U.S. controlled customs. You could intercept it at the factory, or perhaps get the Australians to help you, but you can't get every one of them. And if the Australians will do that one, do you have the same relationship with every other country that server could be going to? Especially if the path is China->Iran, it won't be so easy for you.

Re: CIA? NSA? Not a bug, a 'feature'?

I'm as paranoid as the next security person but somehow I think that the tool that does this won't be something this version-specific. The espionage people wouldn't want something to break just because a new update was released. Also, they'd have trouble intercepting servers manufactured outside their borders between factory and customer. Not that they couldn't do it, but it would be harder to do so to a lot of people at once.

Re: I don't understand

I assume the key and a tiny bootloader checker is hardcoded into something non-writeable, so the code must be signed with the known key and checked before it runs. Therefore, new code can't be installed unless it's signed with the key, and without said new code, you can't ignore the key. Not perfect, but it will probably work. It would be difficult enough to run the previous exploit, limiting the number of people who have sufficient access, so this further restriction will probably reduce the likelihood that something of the kind will happen. Hopefully, dell has really good security on that key.

Decoding the Chinese Super Micro super spy-chip super-scandal: What do we know – and who is telling the truth?

Re: One questions seems to have been missed

As I remember, elemental had a contract with an American intelligence agency, although I don't think they're still doing that. However, that could have made them a target at the time.

Re: Seems like Rube Goldberg approach to spying

That doesn't work. If anything modifies those chips later (I.E. the manufacturer updates something), your bug is destroyed. If the chip is tested, you are discovered. And you can't easily make new holes in the thing because you didn't design it. With a separate chip, the manufacturer updating a chip can't kill you, a test of a component cannot find you out, and you can use all those existing chips to hide yours, which can be really tiny and be set under another chip.

Re: Only just passes the plausibility test for me...

You are right about a lot of this, but have missed a few points:

It would indeed burn itself out and use too much power if running at CPU speeds. It doesn't need to. If the story is correct, it only needs enough processing to inject code into a serial line. That takes a lot less power. After this, the CPU handling the BMC handles all the work.

It probably wasn't (if it exists) created by the factory. Instead, the plans would have been created elsewhere, and a slight modification to the process would be necessary. I don't know much about the organization of Chinese motherboard factories, but if I had plans that were almost identical, I assume the factory could build them just as well.

The point about monitoring internet traffic is a good one. I don't have a great explanation for how that worked. The best I can come up with is that you could set up an image on such a system that could interact with the firmware and exfiltrate information into that VM, then hide the data as it is sent out from that VM with other expected traffic. Still, that's hard. If it actually exists and was used (it could be a sleeper system for some purpose), perhaps some network traffic systems aren't as thorough as we hope.

Re: Chinese agents slip spy chips into Super Micro servers

There are easier ways to have a backdoor, but this way is pretty good for having a backdoor that's hard to spot. If you simply replaced the chip containing the BIOS, made a backdoored flash chip, etc. then all you'd need to do to find them is to test that chip, as they do just to make sure they're working. If, for example, you took a flash chip and asked for its contents, it would be instantly obvious whether the contents were right or not. By having a separate chip to handle that, you would have to test all components of the board together, and that only helps if you know what to be looking for. For the people doing this, it would actually be easier just to see if you can find the chip in the board. So I don't know whether this chip was ever created or installed, but the details make sense if it was.

Re: One thing that apparently happened after this story was posted

While you can't be ordered to lie, you can be ordered not to disclose information. This leaves you with the following options:

Apple: No comment.

El Reg Readers: So clearly it's happening.

Apple: Definitely not. We can categorically deny all of this, in any terms you like. Just read out sentences and we'll tell you that it didn't happen, to avoid any sense of our being disingenuous.

El Reg Readers: It's almost certainly not happening.

Judge, 2022: The government finds for the plaintiffs, owing to clear falsehoods released by the defendant in an attempt to protect them from adverse actions on their share price... [until you fall asleep]

Apple: We can tell you that we aren't under a gag order, and that we haven't found a security device embedded in supermicro servers we purchased between the dates of ... [and other overly specific terms]

El Reg Readers: They sound somewhat confident. Maybe we'll believe them, but we're not entirely sure.

Meanwhile, if there really is no chip and therefore no order, you have the following options:

Apple: No comment.

El Reg Readers: So clearly it's happening.

Apple: Definitely not. We can categorically deny all of this, in any terms you like. Just read out sentences and we'll tell you that it didn't happen, to avoid any sense of our being disingenuous.

Apple attorneys: Yes, this didn't happen, but if you are that specific, someone could find a loophole and get you to say something that we could get attacked for. We don't have the time to evaluate any specific statements, so we should just issue our own denial, as specific as you think it needs to be.

Apple: We can tell you that we aren't under a gag order, and that we haven't found a security device embedded in supermicro servers... [extra details to assure people watching that they're being honest and really trying to demonstrate that there is no cause for worry]

El Reg Readers: They sound somewhat confident. Maybe we'll believe them, but we're not entirely sure.

Microsoft resurfaces Surface kit alongside Windows 10 update

USB-C

"The two portable Surface slabs rely on Microsoft's proprietary Surface Connect port and a USB-A port, which may annoy those who'd prefer USB-C."

I really don't care that much about the USB-C. I consider it a slight advantage to choosing what computer to buy if it has such a port, which frees me to buy things that connect using that port, but I don't own anything using USB-C connectors. In fact, if my only choices were "only USB-A" or "only USB-C", I'd have to go with the USB-A ports. The major problem is the fact that there is only one port. That's not going to work very well for a lot of use cases.