Posts by doublelayer

UPS supplier's password policy flip-flops from unlimited, to 32, then 64 characters

Re: WTF - Password length limits?

Not really. If you're getting the password from an HTML form, then it comes through as HTTP post data. The memory for that request is automatically allocated. In most backend languages, you don't have to allocate memory for a string because it's already there. If you're using something where you ordinarily would, C for instance, you still don't have to allocate a buffer because you can just update the hash in a loop, assuming that your hash algorithm is like a lot of others and allows this. There would still be a limit, but it would be whatever your server sets as the maximum size of a post request before it rejects it which is often at least a megabyte.

I don't object to a limit intended to prevent a password from being ludicrously long. 32 characters, almost certainly implemented as 32 bytes and Unicode...well who knows if it works or not, is not that.

Re: WTF - Password length limits?

It is my automatic fear as well. I have a feeling that many sites with a limit are properly hashing them, rather than storing in plain text or symmetrically encrypting them, but there is no way to know that. We also know that many bad sites do one of those things. The other clue that makes me assume that is if they say that some characters are not allowed in a password. If it's non-ASCII characters, then fair enough I am willing to assume that the developer was worried about Unicode encoding and probably didn't have to. If it's trailing or leading whitespace or unprintable characters, I can understand that. If it's ', ", ?, or *, I'm concerned now.

Re: Schrodinger's password

Or until it breaks. There was a site I used. It stored financial data, so I wanted a good password on that. At one point, they simply changed their length limit without telling anyone, but they didn't change it on the login page. While new accounts could not be registered with a password longer than twenty characters, my longer one could still be used to log in. So naturally, I didn't notice that they had done this until some time later when someone put the same limit on the login page's password field. Even now, I don't know if that was intentional or not because their page does not say "maximum of twenty characters" it just stops accepting new characters when you've typed twenty.

How to spot a North Korean agent before they get comfy inside payroll

Re: Think of it as a positive deterrent for offshoring

Every time this topic comes up, you can be relied upon to make incorrect statements about what North Korea does and attempt to excuse their actions. Often, your incorrect statements are trivially disproved by reading the article, such as:

"I'd guess that the poor, duped, employer thinks they're actually employing a cut price someone in China or Russia -- with an emphasis on 'cut price'."

Maybe the pretending to be a local with a citizen's identity, local address, shipping the laptop to another local address where it remains, which is checked by the employer albeit insufficiently, didn't tip you off that the people concerned are not pretending to be Russian or Chinese outsourcers. They're pretending to be remote-working locals.

"The primary driver of insecurity is money, not ideology."

And the primary driver of the fake workers scheme is also money. That's why the work is often poor, because they're trying to get as much money as possible, and why sometimes, those companies get infected with ransomware or have money stolen. In principle, your comment is correct because someone could do that from any country. However, North Korea has an organized system of doing this, meaning that you're virtually guaranteed to get that if you end up hiring someone from there. They have such a system because this is one way they try to earn money for their government, rather than the average scammer who is only in it for themself.

The mystery of the rogue HP calculator: 12C or not 12C? That is the question

Re: Variable length representation

Unless, of course, you're dealing with large numbers. In many calculations, you don't deal with more than six significant figures. Until you have a hundred thousand units of it, in which case you're at six without any decimal places. Let me guess. Do the calculations on one, then multiply by your number of units? There are two problems with that:

1. By all rules of mathematics, there should be no difference to the result if you do this or do not. People who aren't programmers do not and should not have to understand why there is any difference. We do not teach our children in mathematics that multiplication and division are reverses of one another, except if you are doing calculations with floating point numbers because you were supposed to know which ones the computer was going to do wrong and not done them.

2. While it may not be necessary, we do frequently have situations where we actually have that much precision available. I'm trying to estimate the speed of an operation. I've done millions of operations. I have the time taken to do those down to the microsecond. Both of those have over six figures. In many cases, using the floating point and ignoring the error is sufficient for my uses, but nothing prevents me from having and using more precision than that.

In many cases, the lower precision is justifiable in order to get faster computation. Programmers who are writing calculations into their software should be considering this. They don't get to tell their users that their calculations are wrong when the users demand more precision or different handling, such as an integer number of pennies (plan for what happens if fractional pennies are used, because that happens in some cases). There are also situations where speed is not important. One really important one is in a calculator. You're not doing millions of operations per second on a calculator. The calculation they entered is the only one to work on right now. There is no reason not to use something that answers correctly.

Re: Variable length representation

I think it represents that I have 1234567890 of something. Maybe that's a number of people, and I want to know how many would be in a certain group. Maybe it's a number of liters of a material and I'm trying to divide it among multiple containers. The answer to any division with that as the dividend does not vary based on the units involved. Whether I choose to do the calculation that way probably does depend on the units, which is when you would want a calculator to actually calculate using the number you entered.

Your answer ends up simplifying to "you shouldn't need more than 24 bits (7.224 digits) of precision". Sometimes, you do, as I demonstrated with a 10-digit number. Sometimes, just going to double precision isn't good enough. You can solve this by just increasing the precision over and over again or by using something other than floating point to do the calculations. People who use calculators expect and rightly so that you have done this for them. They don't care how you divide the number. They care whether the result is right. If you use 32-bit floats and excuse the incorrect results as the user was calculating the wrong things, you're making a bad product.

Re: Variable length representation

"If going from single to double precision makes a difference…..then you are running your calculations in a numerically unstable way. Fix that."

Sorry, I'm one of those young stupid people. Maybe you can help me fix this:

1234567890.0/10.0 = 123456792

Hmm. That's not the answer generated by my brain, and I've run it passed an 80-year-old person so my brain is probably right. Why did that happen? Maybe the compiler can help make it clear. If I don't put on the .0s, Clang helpfully tells me this:

warning: implicit conversion from 'int' to 'float' changes value from 1234567890 to 1234567936

Well, that's a lot closer to the number, although we still have the 92 instead of the 93.6 at the end. I'm sure the proper analysis would have fixed that. Sometimes, a number is more precise than a 32-bit float. That ten-digit number is not ridiculously high for calculations. The calculation I used to demonstrate this is trivial to do mentally, but a very similar one could be entirely doable with paper and pencil but people don't want to. A user of a calculator who expects it to be able to divide a ten-digit number should not be told that their calculation is the problem and they deserve the wrong answer.

Kelsey Hightower: If governments rely on FOSS, they should fund it

Re: Funding and use

There's no reason why we can't. I know a few open source programs that have built in data collection of some kind. Nearly every time that got added, there was a lot of discussion about whether this was a problem with lots of people quite angry about it. I'm not going to put telemetry into my own open source work. I will try to collect that data through surveys or monitoring of emails sent to the project, and if people don't do either of those things, I'll just have to live with it.

This is a bad idea. Open source exists for many good reasons, including the deduplication of effort so that wheels don't have to be reinvented and so that, if one person stops working on it, it doesn't prevent the rest of the world from continuing on. Trying to prevent people from doing things for free would probably not be possible and would, if you got it, create a lot more problems than it fixes. Nobody needs to work for free. Everyone is free to decide whether they are willing to do so or not, and crucially, when they draw that line. Users of the software should respond to this by doing things (paying) to ensure the continued availability of stuff they rely on, and if they don't, they will only have themselves to blame when problems arise.

Re: Sure, but I have a question:

Probably nothing prevents them. I'm not sure which direction they would try to influence the software in. I could see them trying something bad if, for example, Signal received funding as an open source program. That could be a challenge if this was a general FOSS fund for anything considered open source, but such a general fund seems incredibly unlikely and, if it happened, there are lots of other problems that would probably come up first. If it's specifically for software which the government uses, then there's less of a risk. If government gets its database bugs fixed faster than someone else, that's not a major concern as those bugs likely affect lots of other people anyway. Everywhere in the government that relies on open source cryptographic software also knows why you can't put a back door in it, so I'm not sure politicians will be any more dangerous when funding it than they can be on their own.

Legal: none, unless they signed a specific contract in exchange for the funding. If it's just a donation, none at all.

Moral: In my opinion, spending their donations on something related to the project, meaning that if the developer spends it, they continue to work on the project at least a bit more. That's what I have done, anyway, trying to respect the fact that the donation was received not as a gift, but as support for something. But moral requirements will only ever be an opinion and everyone will have different ones.

It is important not to take a moral opinion and make it a legal requirement. It is why I disagree with people trying to mandate payment for open source, and it is also why I disagree with people trying to force developers of open source to do certain things. A good developer will fix a lot of bugs just because they are bugs, but that doesn't mean that they are now responsible for fixing any bug a user finds. A company can get their changes done faster by a) paying the existing programmers to do it, b) paying one of their employees to do it and upstreaming the code, or c) having some kind of bounty for whoever adds this thing. If they don't think it's going to happen already, they should do one of those things, and if they choose option A which is one of the fastest ways to do it, the programmers can and probably should add some extra maintenance cost to the cost charged.

Disney kicks Slack to the curb, looks to Microsoft Teams for a happily ever after

I can't say I've recognized a pattern with what people are willing to say on it. Plenty of informal things happened on Teams when I used it. I have worked in multiple places where Slack was used. One of them used it pretty much just for work stuff, which was manageable. The ones where it was also used for informal stuff were a bit annoying. I'm not sure if there is an alternative that still lets people do what they're intending, but staying on top of many work-related chats and channels and subchannels and threads while trying not to be distracted by large informal channels, but still being on the informal channels because sometimes important things that weren't work related would be posted there and I wouldn't find out for days was not very helpful to productivity.

There was always a challenge figuring out which channels were monitored and which ones were not. You'd have thought that message frequency would be a good enough indicator of that, but it wasn't because the channels that people weren't watching could sometimes be because a subset of people had taken to using it for communication other people didn't care about.

That seems like a good place to do that when you're starting to try to use Teams properly. You already have a team, it already has people on it, when you click on it, there is a chat window, so surely that's where chats should happen. It's a mess. Not that Slack is better. It's just a different collection of annoyances. If pressed, I'd have to take Teams, but neither of them is winning any awards with me.

Torvalds weighs in on 'nasty' Rust vs C for Linux debate

Re: Hard truths

Maybe they meant Objective C instead of Swift. It was also Apple that made the heaviest use of it (NeXT, really), but it was used elsewhere and is much closer to C. Arguably closer than C++ is.

Crack coder wasn't allowed to meet clients due to his other talent: Blisteringly inappropriate insults

Re: Inappropriate insults

Without any information, it's hard to know what led to that, but I'm inclined to think there was not an excuse for it. If this was a potential harassment, public comments are not as good as actually telling someone in authority who can investigate it, especially when those comments allege consent and, by definition, you're suggesting there wasn't. There's also a possibility that no relationship existed and this comment was intended to cause suspicion and discord. That doesn't mean that the person should not be allowed to say it, but just that I wouldn't jump to the conclusion that it was honest and meritorious to do so.

Starlink's new satellites emit 30x more radio interference than before, drowning cosmic signals

Re: Look...

And this varies a lot by country. Since they specified euros for the price, some of the countries that could apply to are The Netherlands (93% urban), France (82% urban), Spain (82% urban), Germany (78% urban), Italy (72% urban), Ireland (65% urban). Yes, a lot of people live in the wilds, but probably not where that person lives.

Re: Cost to launch a Starlink satellite

I don't have any reason to distrust your numbers. Nor do I really care enough to do the complete analysis. I did look up a few of them, though. For instance, your 100 Gb/s figure for Hughesnet satellites appears to be correct, but North America is also served by Viasat, which has Viasat 1 (130 Gb/s), Viasat 2 (260 Gb/s) and Viasat 3 (1 Tbps). The bandwidth difference is lower than you describe. Most of this is irrelevant to me, and not just because I'm not a customer. The capacity is not the largest issue, and much of the capacity that we're comparing it with would include wired and fixed wireless network capacity which varies based on the user's location.

As for the equipment prices, I've now done some searches and still don't have an answer. The latest information on production prices I found was from 2021 when SpaceX claimed they cost $1500 US to make, having saved some money by mass production and some more by removing the automatic position adjustment. Meanwhile, I see that they can be bought in the US for $300 or $500 depending on location. In order to think that they're not selling these below cost, I have to assume that they've made another 80% manufacturing saving in the past three years, or two if we're considering time between those two news articles. I can't prove either way whether they have.

The business model of selling something below cost and making it up on the subscription works better with a contract but it does not require one, especially when you have a large sunk cost to keep people wanting to spend. A business model of using Starlink availability to discourage the availability of competitive wired service is also a plausible way to make good profits in the long term. From a business perspective, it's actually quite a smart plan. Again, I can't prove whether it's actually their plan, but it would make sense if it were. That wouldn't require running a big loss. I expect that, even if they are selling the terminals below cost, almost all the people who buy it do continue to make monthly payments long enough to pay it off. I wouldn't guess what their accounting looks like, but a small profit or a small loss seems like the most likely result of Starlink service, and I have reason to think the profit will grow in the future.

Re: Cost to launch a Starlink satellite

I don't think they're making a huge loss, but part of the reason I think the situation may be different than you describe is related to statements you've made that have been contradicted before. For example:

"The cost of terminals is covered by the up-front fees.": I've heard, from Musk and from users, that these are sold below cost to be made up later, at least for individuals. I don't know which is true. That they would be is quite logical, because there are many people who would balk at an even higher up front cost who might be willing to pay more per month.

"To give SpaceX money you have to buy out an existing investor because the number of investors is limited. You must also qualify as being both rich and financially competent.": I'm not sure why you would have to be financially competent. I think rich would probably suffice. Few investors would have a problem selling me their shares if I came to them and said "I have no clue whether this is a good investment, but your stake is valued at $100 million and I am willing to give you $1 billion for it"*. Many investors who were rich and supposedly competent have regretted choosing to invest in Twitter, but that hasn't stopped Musk from doing what he likes with it.

This doesn't mean I think they're making a loss, but that without more complete information, I am not certain that they are making a profit. There are many reasons why they might not, for example trying to strengthen their position in the satellite and rural internet market, thereby limiting their competitors. That's a popular tactic for a startup business, with the next step being increasing the prices when people are considered likely to continue paying for a service they have become used to and don't have a good replacement for. See also basically every delivery app that got popular in the last decade. I don't know how much of the true business model is shared with investors, and I'm pretty sure most of that is not shared with the public.

* Okay, there are tax reasons or if they think a > 1000% growth is likely, but you get the idea.

Re: Just for curious...

We probably won't know. It is likely that Starlink's profits will grow as they add more regions. There has been proven demand in many parts of Africa that they don't serve, so that will probably help them if they can add those regions. They're also clearly banking on the connection to phones being profitable, although I doubt it will end up being popular because I expect it to cost a large amount, only allow you to send a few text messages, or both, and I doubt many people will buy that.

In the US, Starlink may be able to sustain their profits by joining other ISPs to prevent the FCC from trying to improve the state of rural broadband. Starlink stands to gain even more than other companies because those ISPs can continue to collect their subsidies, but Starlink can provide service that people want to buy if they can afford it. While Starlink is not very competitive if you have fast wired internet, there are lots of places that don't have that. If they can prevent wires from being installed and keep expanding into those regions, it could make them plenty of money. I'm less convinced that it's making them that much money now, Musk's claims notwithstanding.

UK activists targeted with Pegasus spyware ask police to charge NSO Group

If you bought it from the Mercedes Killycar line, specially designed to hit the person you wanted to hit as quickly as possible and cause the specific damage you desire to your victim, yes, yes I would. That's kind of like asking whether the people who write ransomware software are criminals even if they never run it against victims, just knowingly designing and writing it and selling it to the people who do.

250 million-plus unused IPv4 addresses should be left alone, argues network boffin

Re: Really?

By all means. Implement this change, start offering your services on the block you don't have permission to use, and react with surprise when nobody can access your server. It's relevant because the job of IANA and the regional organizations is trying to make sure the internet works, rather than making IPV4 addresses slightly cheaper. If the block isn't supported by a lot of devices, then that needs to be fixed before they start using them. By the way, that's not just a lot of home ISP modems. It is also plenty of other hardware which would need updating, so even if you turn yours on, there is no guarantee that the ISPs between you and some other server will pass on that traffic.

But you don't have to care. Nothing stops you from trying to use the block anyway. Some companies have used it for an even larger private address space. Go ahead and see if it does what you want.

Re: Really?

My point was that the change isn't a switch on the web UI. It's not a line in a config file. In many cases, it's a kernel code change, which isn't that many lines of code but still requires recompiling the kernel and pushing out that update. Most devices that ISPs provide don't get new kernels from them. New kernels come from the manufacturer who has forgotten all about these boxes years ago. In many cases, the update files don't even change the kernel, just the configs and libraries, making applying kernel updates a more involved process.

There are some other devices which have separate hardware for routing which may have that rule coded in, and in that case, the change is bigger. Again, not that many lines of code to remove the logic, but a lot of stages required to get someone to make that change and get it installed on all the equipment in which that hardware exists. If you think ISPs have the ability to simply make any change of this magnitude, I'm surprised to see you constantly annoyed at IPV6; all they'd have to do is push a kernel version with the existing IPV6 support turned on, after all. That is a lot of work too, but at least a lot of it has already been done. When my ISP didn't offer IPV6, their hardware (optional) had the support. They just didn't give out addresses. Now, they do support it and most modern routers, including their pre-switch hardware, will just connect and use that.

Re: Elephant

They quoted /8 a month, so that would make it 1.33 years. That is unless some countries would like to stop doing CGNAT as ridiculously as some have had to, in which case you could use those in about a week. Most likely, even if we could turn on the whole block, countries that have 1 IP address per 300 people won't get very many of them. If we do all the work of enabling those, I'm sure the cloud providers will happily buy up the blocks and rent them back to everyone with cloud resources.

Re: Really?

A lot of that equipment has not gotten security updates in a very long time. The only reason it's not as big an issue as it could be is that there's a lot of different equipment, so vulnerabilities can't give you access to all of it in one go and a lot of it hasn't been penetration tested enough to find them. Lots of botnets have used some subset of those routers to propagate. While ISPs can theoretically update the ones they provided, they quite often don't, might not really be able to because all they have is remote access to the configuration, not the code, and can't manage some relatively simple things without breaking their users and are therefore conservative with any changes they do make.

Adding either the 240/4 block or IPV6 support requires significant changes to a low-level part of the box. No, an ISP is not going to do that to the equipment they've already sent out unless they have a true monoculture and only have to do it once. They're probably not going to do it to the hardware they own which can't handle those ranges either, even though they don't have to send someone into their customers' houses if they mess that one up. The major difference between 240/4 and IPV6 is that a lot of their equipment will support IPV6 as it is replaced for other reasons, but most of that doesn't support 240/4 either because it was reserved for future use and discarded for speed. Adding either is hard, but IPV6 is easier, more likely to work, and more useful into the future.

Lebanon now hit with deadly walkie-talkie blasts as Israel declares ‘new phase’ of war

Re: If an Icom IC-V82

So that you could send arbitrary messages, rather than ones you had already planned out. Coded messages are fine if you only have a set list of messages to send, but if you want to deliver a message with specific details that you don't have listed beforehand, delivering them with code but without encryption is often trickier than putting some encryption on your text. A preset code will certainly have a code for "abort everything and go to prearranged backup procedure", but probably doesn't have a prearranged code for "adjust what you are going to do, continue doing most of it, but skip step 12", nor for "abort everything but do not use prearranged backup procedure because someone has a copy of that".

There's nothing indicating that they didn't do that, but if they did, they'd have had to get people to copy an encrypted pager message to something else to decrypt it which is inconvenient. Of course, there are codes that can carry arbitrary messages without encryption, but they're weaker than actual encryption and prone to misinterpretation.

Re: If an Icom IC-V82

Since few cheap radios will have their own encryption anyway since it's not allowed on amateur bands, I would probably try to bolt it on. In that case, it wouldn't really matter whether they were digital or not as long as I could patch into the audio connection. However, that sounds like more work than they were doing. Maybe they just didn't think it through or valued being able to receive signals from any radio over keeping their signals encrypted. For the same reason, if I was using pagers, they would only send encrypted messages, but that's probably not what they were doing either.

WhatsApp still working on making View Once chats actually disappear for all

Re: Disappearing privacy

I know, I know. You would somehow ask for operating system providers to not allow users to use screenshots without first getting the approval of any application on screen, or maybe just any application at all. That's the only way they can try to do that and similar to anti-screenshot mechanisms they try to use on phones which only work because they can interfere with things they shouldn't be able to interfere with. Not that it would work either. It will always be relatively easy to copy something that appears in plain text on a screen, and they should give up on preventing that rather than try to make it impossible by imposing their control on everything else a computer can do.

Open source orgs strengthen alliance against patent trolls

You can, but only if you're willing for them to say that you're now forbidden from selling or marketing your software/product/service in the US because you didn't contest their action. It also requires you to demonstrate that their patent really doesn't apply where you are. I would prefer for useless patents to be invalid everywhere, which requires the US, primarily, to do a better job of throwing out invalid patents before they are granted.

The case for handcrafted software in a mass-produced world

Re: Only 36 years?

"I take pride in crafting the most efficient code I can."

But using what metric for efficiency? Because if you're basing your pride on using the fewest possible bytes of RAM, you may be writing inefficiently in so many other ways. Old programmers know this as well if not better than anyone, because sometimes that has to be balanced against the also restricted CPU cycles. In many other cases, programming time or ease of maintenance should take precedence. While there is lots of inefficient code, not everything that uses lots of RAM is inefficient. Quite a lot of it is properly optimized for a world where RAM is cheap and programmer time is not.

As an example, I've written a program that uses about ten gigabytes of RAM. It doesn't have to do that. About 9.9 of those gigabytes are a lot of caches. I could quite easily load that from disk when needed and run in 100 MB. I don't because runtime is better with that caching. Of that 100 MB, I could probably cut that to 10-20 MB. I don't because the benefit of writing quickly without worrying about the 80 MB is more efficient when I have at least 16 GB in my laptop than spending time optimizing, and because I change this program often. It rarely runs exactly the same way from month to month, so adding extra functions is worth the cost to make that fast.

I don't know what pressing Delete will do, but it seems safe enough!

Re: Cameras, Too

I had to do it more often, which is how I know that in Word 2003, you could also highlight the text and press control++. You can subscript with control+-. Maybe those still work in modern Office. There were various techniques available for making the operation faster which didn't require moving everything.

Re: This is a common problem

I've said this before, but it's worth repeating. That will just annoy people who do an "rm -r" and it gets turned into an "rm -i -r" that warns on every file in the directory. To get around that, they'll do an "rm -rf" which stops that. This has two bad consequences: they're not going to see the things normal rm would warn about because they put in a -f, and they're now starting to build -f into their instinctual use of rm.

Re: Ouch!!!

There probably was one, but those boxes often lack important details. If you see a box that says "Are you sure?" with the title "Confirm deletion", then you'll probably click yes unless you really accidentally pressed the delete button. It doesn't say what it is deleting, just that it's deleting something. Even boxes that specifically name the thing will get some click through, but it doesn't help when lots of confirmation boxes are very low on detail.

China wants red flags on all AI-generated content posted online

Independent of their bad reasons for wanting it, the other problem is that their request is not feasible. It is impossible for you to determine whether I wrote this comment or had an LLM write it. Sure, you can guess that, because it makes sense (I hope it makes sense), an LLM probably didn't. However, I could write many prompts and choose the most coherent response to post, and many LLMs are good at writing superficially plausible paragraphs. You could do an analysis of previous posts I've written and try to identify linguistic patterns and match them to this one, but I could have trained an LLM on previous writing or a lot of those could also have been LLM-generated. Whether or not we think this is a good idea, I don't think we're likely to get it.

The only way of getting close is to require that every post is trackable to its origin and can be compared against everyone else's posts to identify the spread of something AI-generated. Even that won't do a great job, though it would be a privacy nightmare. We can agree with China's stated goals, but in addition to disagreeing with their actual goals, we probably have to use different methods if we actually want to come close to achieving something. I'm not sure any methods will work, but I'm quite confident that theirs will not. Most likely, they won't bother to enforce this stuff because it isn't really feasible to guess whether every video on the internet has some AI-generated content in it, but they can have it in the toolbox if they want something to punish one of their tech companies with. This is a pattern that has applied to many of their regulations before; most of the things that are illegal elsewhere are illegal in China, but they only enforce that if they have another reason to do so.

Win 11 refreshes delayed, say PC makers – and here's why

Training LLMs to the extent needed so they look even slightly useful is very expensive in power, time, and chips. That is not something that can easily be done on your computers, though if you're motivated enough, you can do something. You'll just use every computer you have and can borrow or steal for a year and get something not that great at the end.

Running them is easier. The biggest requirement is RAM. To run the headline models, you'll need a ton of that. GPUs with 100 GB of RAM are expensive, so it's not easy to run those. You could, if you wanted, buy one and run a large model. But there's yet another step: intentionally smaller models and quantization. With each of those downgrades, the quality produced by the model will decrease slightly, but it makes it easier to run them. I've done it to play around. With 16 GB of RAM and no GPU at all, I can run an LLM that generates plenty of text and code. Without the GPU, it generates it more slowly, but the response generally starts to appear within ten seconds and is complete in a minute. If you don't have 16 GB of RAM, you can quantize that model and make it run in as little as 4. In my experience, the quality is not that different from the larger models in that yes, they do tend to give you stupid and useless output, but I get that from the large ones too.

If you have something that would benefit from a locally-run LLM, you can accomplish it. The Register has had a few articles explaining some ways to run them. You don't need an NPU or Microsoft Copilot (any of them) to do it.

Re: Cartel Is in Full Operation

All the 2020-era machines already support Windows 11. So the last refresh already makes another refresh unnecessary. I have seen some companies who refresh their computers every 4-6 years, and this is probably what Dell is thinking about. When I have seen that, it has always seemed wasteful and pointless to me, especially as many places I've worked use the slightly longer period of "until it catches fire or there are bits hanging off". I prefer that one most of the time, though it can be taken a little too far.

Re: Five year old PCs need replacing :o

If you're actually using the AI, lots of retraining. Training that sounds like "after it wrote the email for you, read it over. If by some miracle it actually looks like something useful, read it again. If it still does, show everyone. Either one of them will see the big problem in it or we can all witness that an LLM managed to do something accurate for once".

But if it's just Windows 11, not so much. There are always users who need retraining when an icon moves, but that's not everyone. I've run Windows 11 for years now on corporate and personal machines and, although there are some differences between it and Windows 10, it's not anything so massive that users en masse will be confused on how to use a computer.

Begun, the open source AI wars have

You may not know why everything that is there is there, but you at least know what is there. That is the point of having the source.

Let's consider a parallel to software. Microsoft Windows is very similar to LLMs in a lot of ways:

Difficulty to actually use the source: If you had the source, it would be hard to use. Building that takes days on a big set of parallel processors.

It's difficult or impossible to open source: Even if I was named total controller of Microsoft tomorrow, it would be very difficult and expensive for me to get the Windows source code open because there are lots of components they don't own and lots of license snarls to untangle, to say nothing of trying to distribute it to everyone who might want a copy or to provide documentation.

Modifiable: As CrowdStrike has recently demonstrated, I can write some code and embed it deep into the kernel. That's very similar to how I can make some modifications to an already trained model to better tailor it for my purposes.

Modifications distributable: Kernel-connected programs can be distributed in source or binary forms and installed by other people without needing to get Microsoft's permission first, though if I don't give them permission, the users have to work harder to install it.

So does this mean that Windows should be considered open source? The only thing I'm missing here is the ability to see its source code and make modifications that specifically involve changing that source code, and I couldn't feasibly get that code or easily use it if I had it.

I think the answer should be obvious. All these factors can be very relevant to whether someone considers it worthwhile to open source something. It is not relevant to whether they have.

Whether a model is too large to feasibly open source doesn't change how this works. There is no requirement that they be open source. I have some large software which is free, but it's not open source. It's still useful. Large models which are distributed under generous terms can be very similar. The problem is that one of the freedoms provided by open source is missing: the freedom to know what is in the program you're running. The FSF refers to this as "freedom to study how the program works", so I disagree that all four freedoms are there. So far, only one seems present. Without the training data, the prompts the model is based on, the ways it was trained, etc you have a black box, very similar to what I have in the binaries that I'm allowed to use but I don't know what's in them.

In practice, open sourcing a model could be so hard that it's not worth doing. Retraining it to confirm that the binary you have matches the source data, or at least to make a binary that does for you to do later, may be infeasible. Neither of those realities changes what it means to be open source. This should be evident when we compare it to a small model. If a writer of a small model with a gigabyte or two of training data refuses to let me see, let alone modify and retrain, that training data, it is not open source and, as far as I can tell, they might have all sorts of extra unadvertised stuff in there.

Without this, the freedom to modify is restricted. Yes, I can use other methods to change how the model works. You can argue that some of those count as modifying. Several of them are more akin to building a system around the program, the way that if I call a binary from my program, my program isn't a modification of that software, just a user of it. However, I can't modify everything. My ability has been constrained, and not necessarily by my access to resources to use. It has been constrained by the unavailability of the source to this program.

That is a major problem for large models, and it makes it harder to open source them. For that matter, it makes it harder to legally make them at all. This does not change the definitions of open source in the slightest and there are very close parallels in other open source code. For example, there are lots of databases that have been painstakingly written by companies that are useful in a variety of programs. One such type is linguistic data. Open sourcing that is really hard because it took a long time to make it, so you usually have to license it for very narrow uses with very restrictive license terms. I wouldn't get to claim that my software is entirely open source, but just not those databases you need to run it. At best, I can say that my software is open source but won't work, as well or at all, without these closed source libraries. That is what I would do, and people would deal with that if they wanted to run using that more expensive data. I wouldn't lie and claim to be open source anyway.

For smaller models, it is easily achievable. I recently dealt with a model which I thought was badly trained and generating bad results. So I obtained the training data, which came to about 20 GB and was permissively licensed, modified some parameters, and retrained in a different way. I can't do that without the training data. That model was actually open source. For the headline models such as the LLMs or those that generate images or video, 20 GB is tiny as training data goes. For my model, which extracted data from images, it was actually quite large. This makes no difference to the definition. If it is open and it has 100 TB of training data, then if I bother to get that many disks and that much network bandwidth, I have to be able to get and run on that training data. It makes distributing that a lot harder, which is another reason they'll probably choose not to do it, but it doesn't change what is required to have an open model.

It depends how large a model is. Lots of small models can be retrained from the training data by one person. However, I think that is unimportant. Whether people choose to train or not, you still need the training data or they don't have all of the stuff that goes into a model. Trying to call something open when something that crucial is over is similar to this argument about open source software:

Faux-open guy: It's open source.

Me: I couldn't compile and run it.

FO guy: But you didn't, did you? You downloaded the binary release and went with that.

Me: But if I had downloaded the source, it wouldn't have built the entire application, just a couple libraries that connect to the rest of it.

FO guy: But if you had the rest of the source, it's large and it would take hours to compile, so you don't need that. It's open source.

No, it's not. The model without training data is not open either. It's just a free as in beer model. I can bolt stuff on to a closed-source free model just as much as I can to one they've called open.

It's not pointless. Lots of models have training data available. I have several right here. True, none of them are LLMs. The ones I have are more narrow ones that can recognize interesting information from images or model specific actions, but if I want, I can download the training data and the configuration used to train the model, fire up my GPU, and a few short days or weeks later I'll have built my own copy of their model. Releasing the data is easily done as long as you have permission to it, which may be one of the reasons why some people who want to call themselves open don't want to.

OpenAI's latest o1 model family tries to emulate 'reasoning' – tho might overthink things a bit

Re: Chat GPT Apples

I'll try this once more, but it is clear that you're trying to excuse obvious errors and unintentionally insulting people in the process.

Me: If the program meant that you took two away, leaving three, and then something happened to the three, leaving two, then it would say so.

You: Why would you assume that? Moving goalposts?

Because it clearly did say "If you have 5 apples and take 2 away, you would have 2 apples remaining." That was contrasted with the "take away" = "I have the ones I took away" branch. There is no room here for additional actions affecting one of the remaining apples. It could have said it: "If you have 5 apples and take 2 away, maybe someone grabbed one of the remaining ones while you were taking yours, and then you would have 2 apples remaining." It did not. It subtracted wrong. LLMs calculate wrong all the time.

Various types of people like to or find it difficult not to interpret this question in many ways. I have done it. Others in these threads have done it. The main difference is that, even though we've all come up with different interpretations of various apple-related subtraction problems, they either result in a "not enough information" answer, or they state an interpretation and then correctly solve for the number if that interpretation were correct. Nowhere did they simply state that it was unclear, so the answer was definitely 42 and refuse to tell you how that happened. Autism does not cause people to do that either if they're actually trying to solve the problem. While I have no reason to think that I am on the spectrum, I know many people who are, and while they may make fewer assumptions than others would, they would do the calculations right.

From your posts here and elsewhere, you clearly like LLMs as a tool. I have found them frustratingly unreliable. Sometimes, their answer is useful and relevant, but very frequently, very simple errors make their output useless and the time I spent getting the answer wasted. Who knows, maybe you're just excellent at making them not do that in the first place. The problem is that your eagerness to justify obvious errors as not errors suggests that you may not be the best user of them either but refuse to admit the quality issues in the output you are putting to use. You're unintentionally insulting people with autism by suggesting that they would do the same kind of shoddy work, when many of them would not and, in my experience, be more conscientious about the quality of their work than others.

Re: Chat GPT Apples

People with autism do not work the way you're trying to argue they do. If the program meant that you took two away, leaving three, and then something happened to the three, leaving two, then it would say so. If it was swamped by the possible ambiguities because the problem didn't include the sentence "No other actions occurred on the apples concurrent to the taking away process", then it would have rejected the question for ambiguity and not given an answer. It got the calculation wrong. Stop trying to come up with arguments, incorrectly suggesting that a class of people is incapable of simple arithmetic, to justify that.

Re: Chat GPT Apples

They said the ambiguity was intentional. The calculation error, however, was not related. Autism may or may not mean that ambiguous questions get questioned or rejected more, but it doesn't make arithmetic errors the fault of the question asker. If it only considered the meaning "take away" = "I have that subset", then it could just have answered 2. When it also considered the meaning "take away" = "I don't have that subset", it does have to answer 3 to that branch or be wrong. It was wrong.

Incidentally, there is another interpretation of the question. I have five apples. I take two away. At the end, I have five apples. Two of them are with me, and three of them are back there where all five used to be. I didn't give away or throw away, so I never said that I would cease to have either subset.

Feds pull plug on domains linked to import of Chinese gun conversion devices

Re: Repeal the de minimis provision

That's where it would stop working. If I want to import a small item, I have to find a company willing to resell it to me, get the manufacturer in China to sell it to an exporter, the exporter to put it in a shipping container, the container to be passed by customs even though it probably contains a thousand individual packages with different things in them, wait for my distributor to sort out my package, charge me their markup for the action of receiving a box off a ship, then send it the rest of the way. None of that is at all related to the price of sending boxes through the mail. That's the point that the original post inaccurately conflated with the rest of the regulations, because it is entirely independent of the rest of this. Others have described what happens when you have this company in the middle. Either you can't get an item, you can only get it from someone who has applied a 200% markup on it because they're the only person who has imported a box of them and you can't manage it yourself, and you certainly can't use whatever supplier you want because, if you're lucky enough to find someone importing them, they've already decided on one supplier.

There are two problems that are worth solving. One is that we're paying more than China does for sending packages. That's worth fixing, and although it's a tricky diplomatic experience, it's unrelated to the rest of this. The second is the existence of dangerous products. Given all the dangerous products stored in bulk locally in Amazon warehouses, the customs exceptions for small packages isn't a simple answer to that problem either. Most likely, there will still be dangerous items and we won't make a dent in them unless we spend a lot more money in individual enforcement actions against their sellers.

Re: Shutting down the web sites is not the answer

Depending on the location, it can be more severe than that. Usually, it's written to "if they would not have committed the crime without the actions by law enforcement". The US can be one of the stronger countries for it, where entrapment has been redefined to "if their lawyer can argue that they would not have done this without the police involvement". That's not a guarantee that that would work, but almost certainly, most of the people arrested for using the fake site would try the argument.

Re: Repeal the de minimis provision

I am not an expert, and you suggest that you know a lot more than I do, but I'm not sure all the problems you've named are related to the provision they're talking about. For one thing, how much the UPU says shipping a box should cost seems wholly unrelated to whether customs will scrutinize the box. You could remove China from the list of countries whose shipping gets subsidized without affecting this provision at all. I think doing that makes sense, but by bringing it up, you have slightly harmed your other points because that seems unrelated.

The other problem with your description is that many of the things that we want to buy from China don't come in bulk in a container because not that many of them are made. If they are custom design or low-volume items, then they won't bother to have a local distributor or warehouse, make enough that they can have local supplies wherever their customers might be, etc. They might, but probably won't, do that for the United States in the hope that hundreds of millions of customers might make it realistic. That's definitely not going to happen in small countries, which will find it almost impossible to buy the things in the first place. We have to balance that against the problems of dangerous or counterfeit goods sent one at a time, but I'm not sure that should always come on the side of making small shipments infeasible for everyone.

Post-CrowdStrike catastrophe, Microsoft figures moving antivirus out of Windows kernel mode is a good idea

Re: Bad response from Crowdstrike

But low-level code basically doesn't. If you're writing in assembler or in C, a lot of important things do not raise exceptions for every invalid situation. With more clarity, C doesn't have exceptions. Some libraries have their own things that look kind of like exceptions, but they all work a little differently from each other and a lot of code you work with will not have those either. Good functions, including kernel ones, do check for and report errors, but you have to check that manually. If you don't, execution will proceed. You can't do a global check either. For instance, if you try to allocate memory and there isn't memory available, you have to check that right after trying and if you don't, your code will continue to execute until it tries to use that memory that never got allocated.

That's just talking about organized system calls which return errors in a way other than exceptions. There are lots of other things where you don't even have that. If you're dealing with locations in memory and you refer to a location that doesn't exist, isn't yours*, or doesn't contain what you intended it to contain, that's not an exception situation. You will get, respectively, a crash that can't be recovered from, a crash that can't be recovered from, and the wrong data which will probably lead to more bad pointer arithmetic somewhere which will, hopefully soon enough, give you a crash that can't be recovered from instead of a bunch of shredded data and then a crash that can't be recovered from. The only way to do this is to put more effort into not messing up and assuming that you still have, so trying to find out where before the users run the code. CroudStrike did not test their file in the way they needed to. It was a QA problem, and one I have a feeling they've fixed now, but they needed to learn that configuration files that get executed are code and can break things just as badly as the code that looks more familiar.

* When you run as the kernel, basically all of RAM is yours. While a program running in a user account, even root, will only crash itself** when trying to access memory used by another program, the kernel can stomp on memory used by any process. This is one of the reasons why you can't recover from an invalid memory use in the kernel. By the time you know you've had one, the chances are high that several other things are hideously damaged and you don't know what and where they are. Continuing to run is likely to cause more problems than not, so it requires a restart.

** Most of the time. There are some ways to access RAM that is not yours, and predictably, bad things happen when that goes wrong.

Cambodian senator sanctioned by US over alleged forced labor cyber-scam camps

Re: Euphemisms, Repeatedly

In some cases, you could argue that there's a slight difference, though not one that any victim would really care about. For instance, if they are theoretically paid and permitted to leave, but they have been told that they have a debt and must pay it off. This is a common tactic. In turn, this takes two forms. Sometimes, it's actually real in that they can scam enough to pay off a "debt" and then be released. More often, the operators find ways to increase the "debt" whenever that might happen, meaning the payment is basically fake, but they still go through the motions.

I'm not sure "forced labor" is much of a euphemism either. It's pretty clear about what's happening to people and how unwilling they are. When attempts have been made to make a euphemism out of slavery, the slavers tend to have to obscure their purpose more than that. For instance, the "vocational training" required of some Uyghurs in Xinjiang which is as forced labor as this is is a euphemism worthy of the name.

Of course the Internet Archive’s digital lending broke the law, appeals court says

I don't think that's the part they disagreed with. I think they, and I, disagree with the part "in theory a very good idea."

The problem is that there are lots of cases where a company owning some intellectual property is the most logical and only workable solution. If a company hires me to write some code, it isn't very workable for me to own the copyright to the code I wrote for them. It doesn't work for them: how can they sell a product based on the code they paid for when it's split up among anyone who ever touched it? How can they prevent someone else from doing the same? Could their competitor find each of the coders, pay them a small amount, and get legal copies of the same thing the company already paid for? It also doesn't work for me. In almost all cases, I'm going to write my code along with some other people, not all of whom might be there anymore. Can I use and modify the work of someone who no longer works there if they still own the copyright to that part? Do we need to track them, or their next of kin, down and ask for permission for me to view it? I think that, in that example, the company owning the work they paid me to make makes a lot of sense and is a perfect parallel to similar jobs; if I make a physical object at my employer's request, my employer owns the object.

So if a company can own something when they've paid me to make it, it also makes sense that they can buy it from me. To use another coding example, let's say I wrote some code on my own. I've been selling licenses, but there is a company that would like to use it. I no longer want to support it, keep updating it, dealing with licensing discussions. I could try to give them a generous, perpetual license then just stop, but then what if someone else wants it? They could try to track me down and get a license, but I might not be easy to find. I could sell the code outright to the company and allow them to issue licenses, and they could pay me more for the extra power than they would have for the more limited license. I've been part of this from both sides. I've had code I didn't want to sell anymore. Often, I did the easy thing and either open sourced it or just stopped acknowledging that it ever existed, essentially giving up on ever getting more money from it, but if I had a buyer, I'd happily have sold it to them. I've also tried and failed to track down a copyright holder for some code that I would have wanted to buy a license for, but because the person who originally worked on it got bored, you just couldn't because the holder was uncontactable and for the most part unidentifiable.

Both my examples are about code, but similar conditions apply for most types of copyrightable work.