Posts by doublelayer

PowerSchool paid thieves to delete stolen student, teacher data. Looks like crooks lied

Re: Money Laundering

"money laundering is the act of obscuring or obfuscating the destination or source of money."

No, quite the opposite. Money laundering is the act of providing incorrect information about the source or destination of money and specifically applies when that money is, directly or indirectly, from a criminal source. As the Crown Prosecution Service describes it:

Money laundering is defined in the POCA as “the process by which the proceeds of crime are converted into assets which appear to have a legitimate origin, so that they can be retained permanently or recycled into further criminal enterprises”.

You have it backwards. There are many situations where a business transferring funds to someone they don't know is entirely legitimate. For example, if a business buys items from people for cash, they do not have an obligation to identify those people before paying them. They can claim that as an expense on their records. Sadly, paying a ransom is similarly allowed, hence why the UK police haven't descended on anyone who has and extracted massive fines.

Some of the larger groups did indeed build up a brand name so they could get more payments, but ransomware has long had lots of people infecting with badly written encrypters that wouldn't decrypt or went with the whole infinite extortion loop. Unfortunately, that didn't happen often enough to convince people that paying didn't help. I'm not sure this example will prove any different. While there are people who can hope that their problem will go away for one short bit of pain, people will pay ransoms. I think we will have to prevent them from paying to make a meaningful dent in the problem.

Re: Money Laundering

I'm afraid you were probably mistaken when you explained that, because paying a ransom is not money laundering. It is a bad idea, unethical, possibly illegal depending on your jurisdiction, and should be made illegal where it isn't now, but even when it is, it's not because of money laundering laws which have nothing to do with the money until the criminals have it and want to do something with it. Similarly, it has nothing to do with know your customer laws because:

1. If KYC laws don't apply to whatever type of business you run, they don't affect you. A lot of businesses don't have those regulations in any case.

2. If they do apply to the type of business you run, they require you to identify those who buy services from you, not ones you pay for their services, illegal or otherwise.

If you were a financial institution and you decided to pay the criminals by opening an account for them and depositing funds, KYC applies. If you are or did almost anything else, they don't. If you actually get to choose between these two options, please pick the former in the hopes that the criminals are stupid and will identify themselves to get access to the funds, making them easier to catch. Paying ransoms is legal in a lot of places, including the auditing and tax implications. It is so legal that cyber insurance companies have specialized in doing it, while if it was illegal they'd be storehouses of perpetrators ripe for law enforcement action. I would like to make paying those ransoms illegal so that this stops, but that hasn't happened yet.

If you think using these incorrect legal arguments is helpful in convincing companies not to pay ransoms, I think you're using the wrong path. We have many examples like this article demonstrating how paying doesn't mean the business gets anything, whether the promise is destroying the data or helping with recovery. We can point to PR downsides of even a successful ransom payment which reduce trust. We can point out the consequences to others of propping up a criminal industry. All three of these options has a major advantage which yours lacks: when they call in a lawyer to review the plan, the lawyer won't be able to say "they misunderstood the laws and this actually isn't a problem".

Linux kernel to drop 486 and early 586 support

Re: junk like the Celeron

Why is having a massive profit margin dishonest marketing? Annoying I get. Choosing to buy someone else's product that's reasonably priced, definitely. But if the answer is that their product is actually better, they can make it cheaply, and they're choosing not to let you buy it cheaply, that's just normal. The same reason that I would probably have accepted a lower salary when my current employer hired me, but they offered a certain number and I accepted it or even negotiated it up. It's how everything works and they aren't lying when they say that this is how much you have to pay to get one of these things.

In addition to all the comments about what will still be supported, there's also a lot more choices for embedded systems processors which support Linux just fine. There are probably many cases where an old design does require a 486-compatible chip, but most embedded devices can work as well if not better with a different processor that's running a different ISA with more features, lower power requirements, and because everyone's using them, much cheaper.

Re: Hubble Telescope.......

True, but they implied that the presence of that chip inside the telescope was relevant, which it isn't because it doesn't run Linux, and it wouldn't be even if it did run Linux unless they were pushing kernel updates which, for something that's really hard to fix if it ever didn't like a kernel update, they wouldn't be doing. Nor is it relevant for any machine with one of these CPUs unless the users of that machine have actually been updating the kernel version. There are indeed a lot of old machines with these processors in them. Almost all of the ones I've seen are running old software on the old hardware. Linux 6.12's the last LTS version with support? Some of these things are still running 2.6 kernels and the more updated ones are running 4.x ones. If you're running a 486 with a 6.x kernel, I challenge you to explain why, and only then will I start to worry about dropping support for it. If people haven't updated before when they could have, then I won't be bothered about cutting off the stream of updates they didn't use anyway.

Curl project founder snaps over deluge of time-sucking AI slop bug reports

Re: It's the bug bounty

In addition to the points others have raised, there are two theories for why paying works better than just having an unpaid reporting mechanism, one of which I believe and the other I don't.

The good reason: it convinces people to look for security problems. There are people who will work actively to try to find a problem if they can get paid, whereas if they're working for free, you may only get reports they stumble on by accident. It can be quite cheap, because if they don't find anything, you don't have to pay them. I have not tested this, but I certainly have seen more reports sent when payment was offered, even if many of them were crap.

The less convincing reason: fears that the bad guys will pay for a vulnerability, so profit-oriented people will sell it to them unless they can make money by reporting it. I don't buy this. All of the parts of that are true, but I don't think bug bounty programs make a difference to any one of them. A criminal group will spend more for a good vulnerability than any bug bounty program will pay out. Most people who find one would be unwilling to sell to criminals because they don't like criminals. Most who would be willing don't know how to find them. Those who are willing and able have other reasons to choose not to, such as not having a reliable way of trading their vulnerability for cash when, if they send the details up front, the criminals don't have to pay because they have the vuln now, and if they don't send enough details, the criminals don't pay because they're not sure the thing is real. Someone who can get through all of those hoops will probably not bother trying to see if the company will outbid here.

Re: Sorry to nitpick, but...

AI filters for AI text have been tried for a long time and the answer is usually no. You can make a model that takes a guess, and in many cases, that guess will be reliable, but that's all it will ever be. If people realize you're doing it, they can easily make the guess less correct. For example, comparing real bug reports to AI-generated ones, there's often a significant stylistic difference between the two* so I can assume which are which, but if I am a spammer after a bounty, I can customize my prompt to make the AI write its text less professionally and more laconically, and then it will look more like the human-written ones.

* People write bounties in a lot of forms, but they are often writing more informally, meaning more acronyms, a little less jargon, and slightly worse grammar, than the ones LLMs often produce. They are also written more formally, including the reverse of all three of those differences, than human-written ones that turn out to be crap. I can often guess based on the style how likely one is to be useful, but I have to read and test it anyway because the well-written one could be from someone who just likes to speak formally when they're sending a message to someone they don't know and the one with worse grammar might be someone who isn't a proficient speaker of the language they're writing the report in. All you could do with an AI is try to sort them so the useful ones are higher in the stack.

Pentagon declares war on 'outdated' software buying, opens fire on open source

Re: Enlighten Us !

You won't be able to determine the security of software based on location of the developer. Your country, as well as every other, contains evil people who will intentionally subvert security procedures and incompetent people who will break things by accident. This is why you have to analyze what you're running to some extent, which is indeed difficult. If they decide that doing that with open source software is too hard, they can write everything they run themselves, which will be expensive and means a lot of things they'd get by default with open source they will have to pay for, but maybe it will provide better results. Alternatively, they can use the fact that lots of people should be analyzing open source software when they're running it to distribute the costs of doing this across many organizations running the same stuff, which does happen some of the time already. Alternatively, they can do what most institutions have done so far, they can just not bother to analyze what they're running and hope for the best. Hoping to do it based on nationality guarantees that you'll get bad results while some clueless person thinks they've figured it out.

Top sci-fi convention gets an earful from authors after using AI to screen panelists

Re: Detector triggered...

I'm less confident about this, mostly because this is a very public apology. Those will have been written and rewritten about a dozen times before they're released. LLMs could have been used, but you could get the same effect by just shopping around the statement to anyone trying to make sure it contains the right amount of contrition, explanation, and buck-passing. I also have a filter which works most of the time when the human-written text was written in one go and at most self-edited. I wouldn't have confidence in my filter on stuff written by a group of humans who are trying not to anger anyone.

Commodore OS 3 is the loudest Linux yet

Re: Sell a usb stick?

Why would you pay for that? I think the optical media by mail service was mostly for people who didn't have a network connection fast enough to download those quickly, but most users can now download a normal distribution overnight or this monster in a couple days, and many can shorten that to a normal one in half an hour and this in four. Most users who would have trouble creating the USB disk themselves would also have trouble using Linux or knowing it existed. What would the convenience element be here compared to just downloading and writing it to a disk you already have?

Redis 'returns' to open source with AGPL license

Re: "People moan because it wasn't the open source license they like"

The problem is that, to know whether something is open source, we need a clear definition of what that means. The OSI is not the only place that has a definition, nor do they really get a monopoly on the term. However, I tend not to accept someone else's idea of what it means unless they can provide their own unambiguous definition and apply it consistently. Often, when someone does that, I don't find their alternate definition as convincing or persuasive as the OSI's, which I mostly agree with. This is not for any reverence for the OSI itself. I never check whether the OSI has stamped their seal of approval on a license, and I disagree with them on a lot of things, notably their AI licensing thing which I think is completely wrong. The definition they're using, however, is pretty good.

Most of the faux-open licenses use vagueness to imply that it's basically the same and rely on "it doesn't affect you" to distract from problems. I have a problem with both of those things. A lot of them have their category of people who get extra restrictions if they use the software, a category based on vague conditions like "commercial use", or, in the case of the SSPL, "as part of a service". The licenses do this because the authors want to apply it to certain people, often cloud services. However, it's easy to argue that everything is part of a service unless it's running offline and only used by me personally and everything is commercial use if there's any possibility of money being involved, for example if there's a donation button on the site, even if nobody's ever clicked it. Even if it's only against AWS and Azure today, someone who wants cash could easily change their mind about those terms tomorrow. In all the cases I'm complaining about*, there is already a precedent for this because they just changed their licensing already, so changing their interpretation of "service" is a much smaller change which could cause problems for everyone. That is not a small difference from the AGPL.

* I do not object to someone who writes something from scratch and wants to license it under one of these from the start. I object when someone made their software open source then switches to it, mostly because they are taking the contributions of others to do it, and in some cases, preventing others from using their own contributions without forking.

Re: "People moan because it wasn't the open source license they like"

The SSPL is neither free software nor open source. The SSPL license explicitly violates parts of the OSI's definition* and arguably removes one or two of the four freedoms that are core to the FSF's philosophy**. That's why we have a problem with it. Oh, and it's deliberately doing this to be impossible to comply with so that you pay the copyright owner to get out of it, meaning that they're not even doing this for ideological reasons. The other license they used, the RSAL, is even farther from open.

* The OSD is quite clear. The SSPL clearly does not qualify because it violates rule 9 and, to a lesser extent, rule 6. The text explains how with sufficient clarity that I don't have to go into more details.

** I will go into more details about the four freedoms of the FSF's definition, though. They are not as clearly defined, but the way they have been applied makes it clear that the SSPL removes freedom number zero, the freedom to run the software as you want to. Normal free software licenses impose terms on those who make derivative works from them, whether those are slight modifications or massive additions, but they don't do that on anyone who installs it. The SSPL does. Depending on exactly what you want to do with it, those terms may not be important, but unlike actual free software licenses, they're still there. The nondiscrimination element that is so explicit in the OSD may not appear to be there, but it is often included in freedom number zero, itself considered so obvious a requirement that the FSF didn't think it needed to be listed for a while. Of course, we could argue about how much this matters, I think it does, and you might not, but what's more clear is whether the organizations concerned think so. They do, which is why neither of them support the SSPL.

Re: AGPL

Instead of trying to see this as an argument and picking a side, consider the pragmatic point they're talking about. If you run a project with users and you change the license of that project, some users will face legal consequences, which may reduce your user count even among those who don't object to the new one. This is something for creators of projects to think about when deciding what they want to do with their licensing. Often, if they choose one license and stick with it, they are more popular than if they change it. That is even true for things that start out as proprietary. Many, including me, are completely fine with proprietary code but much less happy about open source code that suddenly switches to proprietary.

Re: AGPL

I am not a lawyer, so you are free to ignore me, but in case you or anyone else wants to know the answer, here it is:

You're using Redis under the AGPL3 with the conditions you described. Here's what you have to do.

1. Your code: nothing. It interacts with Redis through its normal channels. You don't need to change licenses or distribute it.

2. Redis code: if you changed it and made a custom version of Redis, you have to distribute that to anyone who wants and you have to use the AGPL3 to do so.

3. Attribution: Somewhere in an about screen or documentation, you have to say you're using Redis which is AGPL3 licensed and refer people to copies of those, but you can use Redis-hosted versions.

Feel free to get a lawyer to verify this. They cost more, though.

Re: AGPL

Because Redis was clearly looking for the most restrictive license that is open source. They think earning the open source flag back is all they need to do to get developers and customers back. I'm not sure if they're right, but I doubt it, and it's not because AGPL is a problem. Spending a long time not being open source is going to cause problems no matter what license is used when you come out of that. If they're still using a CLA, people who don't want to risk that happening again probably won't write code for them. I don't know for sure that they've killed their chances, as there are places that may pick that back up from name recognition alone, but it's a possibility.

Altman's eyeball-scanning biometric blockchain orbs officially come to America

Re: Proof-of-personhood

In almost all cases, the users' desire for anonymity is more important than other users' desire to know who everyone is or the frequent desire of companies to be able to sell that data. There are very few exceptions. Nothing you listed is among them.

Open Document Format turns 20, but Microsoft Office still reigns supreme

Re: Succes

I think the only major office suite that doesn't (as far as I know) have support for it is Apple iWork. That's not a big surprise since iWork is very insistent on not liking any format except its own; it'll let you export to formats that other software can read, but it does make sure to complain about it if you routinely use it. When I used it, DOCX and XLSX were supported formats, but ODT and ODS were not.

Re: That UK Gov Manadate thing

It's probably a lingering effect of the delay in meaningful support. Microsoft Office has had some kind of support for ODF for a very long time, but it's only since Office 2021 that it didn't come with some footnotes like Windows only or separate conversion process. Meanwhile, Office is one of those things that people don't upgrade very often because they don't see what changes they could need, and they're usually right. The combination means that someone who wanted to use Microsoft Office might still think that ODT files would not work so well if they tried, even though it has been fine and probably would be even if they're on an earlier version.

Re: That UK Gov Manadate thing

I'm sure that some universities or schools do mandate that students use Office to create their Office format documents, but most just specify that they have to be in that format. I used LibreOffice to make them, and nobody ever complained about that, probably because they had no way of knowing I had but also because, as long as it opens in whatever they chose to use, they were happy.

Open source AI hiring bots favor men, leave women hanging by the phone

Re: Now you know why LLMs are popular

No, they want to sell it. Some of them do a little hand waving to try to pretend that their model isn't biased, but as I said in my original comment, they've usually just made the bias results more random because removing bias is hard when the underlying technology is intentionally randomly generating results. VCs probably don't use AI to filter the companies they're investing in because they understand how fallible it is, but they're perfectly happy to sell it as useful to everyone else.

HR departments, meanwhile, adopt it because it saves time. Instead of doing their job, they shove all the candidates into the software. Are they trying to make sure that only some preferred group gets hired? No, they're trying to get their job done faster because it won't matter to them if they ignore a great candidate because the LLM didn't like the format of their resume. The bias in these programs is almost impossible to remove, and sadly the people who would have the best ability to reject it are the ones who benefit by using it (all the resumes reviewed in an hour, let's take the rest of the day off) and not the ones who suffer the consequences (having to work with the random choice the program spat out).

Re: Now you know why LLMs are popular

I don't think so. A deliberate bigot doesn't need AI. They can discriminate on an industrial scale, and they can ensure that their acceptance rate hits their ideal 0% rather than the AI's 10-37%. I think the AI is more likely to be used by people who are clueless and lazy, so lazy they haven't read this or the, by conservative estimate, 754 articles on this subject all of which have indicated that AI recruiting applications have every bias in the book and some that we didn't know about yet. This will perpetuate all those biases again, and when more modern data is fed back into the AI, it will amplify them, but I don't think any of that will be deliberate.

Sadly, the only other category trying to do anything to fix this are the AI writers who do read these studies who want to find a way to have their AI not discriminate. Much nicer than the original bigots, but it really means adding in some extra prompts which change what the bias is but not whether there is one.

Disney Slack attack wasn't Russian protesters, just a Cali dude with malware

Definition from 18 USC § 1030(e)(2)

the term “protected computer” means a computer— (A) exclusively for the use of a financial institution or the United States Government, or, in the case of a computer not exclusively for such use, used by or for a financial institution or the United States Government and the conduct constituting the offense affects that use by or for the financial institution or the Government; (B) which is used in or affecting interstate or foreign commerce or communication, including a computer located outside the United States that is used in a manner that affects interstate or foreign commerce or communication of the United States; or (C) that— (i) is part of a voting system; and (ii) (I) is used for the management, support, or administration of a Federal election; or (II) has moved in or otherwise affects interstate or foreign commerce;

As far as I can tell, it means any computer that is used by any business or government that operates across state lines, plus a couple more specific categories that are already included in that one. US law doesn't allow federal governments to deal with things like that that happen exclusively inside one state, so it can be simplified even further to "a computer the federal government is allowed to charge you with a crime about". None of this seems to be related to any real or notional protection, so there doesn't seem to be any such concept in the law as an "unprotected computer".

How Amazon red-teamed Alexa+ to keep your kids from ordering 50 pizzas

Re: Interesting

No, that wasn't it. It was a specific compiler whose included libraries were triggering something in the AV. Unsigned binaries coming out of GCC were just fine by it. Unfortunately, binaries from GCC wouldn't do what we needed; only that compiler was supported.

Re: A 100% way

Out of curiosity, do you mean the voice age verification thing which I spent three sentences explaining how it would a) annoy everyone and b) not fix the problem? If it was, can I suggest a rereading until you understand the core point, which was specifically that technological patches will never fix the problem, only hide it from the initial glance? It seems strange that you're critiquing the comment by assuming I said the opposite of what I said.

Re: Interesting

"I would think it would be better to have overly active fraud detection than not enough"

In most cases, you're right, but overly active fraud detection can have some significant problems too. I've had online payment systems go totally haywire when the payment wasn't even declined yet; my card simply wanted additional verification of the charge, then approved once it got it. In the meantime, the payment system gave up on me and canceled the order, so I had paid them without completing my order. I ordered a second time which worked, and the situation got cleaned up without too much chaos, but that could cause problems for some groups of people, for example if the transaction was large, they didn't have a lot of cash on hand, and the payments were on a statement before one was removed. It's probably easier to err on the side of caution when I haven't had to experience the effects of frequently incorrect caution. If it was happening to me a lot, I too might want them to dial it down a bit.

I'm reminded of a piece of antivirus software that decided that the output of a certain compiler was malware. I couldn't run any code I compiled because every time I ran it, the file would either be quarantined when it was created or deleted when I tried to execute it. I screwed with the compiler to fix the antivirus's inaccurate judgement, but it probably would have been easy to convince me to remove the antivirus software when I had been fighting with it for a while (work computer, so for better or worse, I couldn't remove the antivirus).

Re: What am I missing here?

The problem is that it's the security on the device that makes the transaction, not the card to pay for it. If I can secure my card, but that device can charge to it, which it needs to have if I'm using it to make other transactions, then the security I added to the card isn't going to help.

While we're at it, I have cards with the default level of security and there don't seem to be a lot of options to change that level. There's no interface that lets me put a cap on number of pizzas I could order at once. There's an opaque fraud detection algorithm which has fortunately never gone off by mistake but admittedly I don't spend much money and a slightly less opaque location tracking algorithm, neither of which can be turned off anyway. The next security level I have is "card locked except for recognized monthly bills". Those are the only two levels I'm aware of that let the card work at all, and since only one of them lets me buy anything I haven't purchased on a schedule for several months, on that one I must remain. I'm not sure what you're recommending is a feasible option for people who have any payment cards.

Re: Interesting

Doing that changes how long you have to retry the situation, not whether it works in the first place. If the system rejected the order out of hand, it wouldn't work a day in advance either. I assume there is a mechanism for verifying that a user is permitted to conduct the action for the ones that have been filtered, so I doubt it's as problematic as the financial fraud detection examples it's being compared to.

Re: A 100% way

Not exactly. I mean AI is dumb and can't be trusted, but this doesn't prove it. What this proves is that the interface is in a situation, to use the security term a threat landscape, where AI is unable to patch the gap. When you're worried about a child sending a command, then filtering out massive orders is important, but so is any other weird command a child might give. A child ordering fifty pizzas can be eliminated by a simple rule, but what about a child ordering a single pizza because they don't want to eat whatever was planned and they are able to correctly understand their pizza consumption potential? That's also a problem, and as long as the system will accept an unauthenticated purchase request, it is possible.

You could try to fix this with yet more AI: do voice age detection to try to eliminate certain requests from childlike voices. In a world with functioning AI that identifies users, that might be how you'd do it. Doing it here will likely lead to even more annoyances, such as the age guessing function to get it wrong and refuse an adult, or if the child is smart, the child using a voice generator to create an adult voice to make the request. Most likely, the method to solve this one is the boring old standby, for any purchase request, get a confirmation from someone with spending authority and provide that person with enough information that they know what's going to happen if they approve. Layers of AI can help to hide the gap, but unless those mechanisms exist, that gap is likely to still be there.

Your graphics card's so fat, it's got its own gravity alert

I think they were saying that you can't play many games on that spec to disagree with the previous commenter, and they were referring to the age of the PlayStation 4 which the previous commenter said was good enough for their uses. It sounds like you may be in closer agreement.

Re: It's difficult to see this...

Weirdly phrased though it was, it mostly made sense to me in that this problem happens because a large number of people, any of which could have done something about it and several of which should have been trying to, failed to fix the problem. Designers of the cards should think about how they're mounted in cases and whether this would work, then they should have tested this to see what happens. Designers of cases should have done the same and either redesigned the cases to handle it or at least provide the parts necessary for the user to manage it. The problem is such that the average buyer would wonder why nobody saw this happening before this was released and why the best solution is a sensor that, as the article notes, tells you when the problem is already bad enough that something is likely damaged now. We can blame users for a lot of this too, because when the graphics card is that heavy, you have to use some common sense about the physics it's going to have on whatever it's connected to, but that is supposed to be the job of engineers at several companies before users should mentally double-check their work.

Fortunately for me, my graphics needs are very simple, so I don't have to worry about multi-kilogram graphics cards.

Chris Krebs loses Global Entry membership amid Trump feud

Re: Too much probing

He had a security clearance before it was unjustly taken away. You get at least as much probing to get that. I suppose that, by the time he had already done it for doing security work for the government, it didn't matter so might as well get the benefits. Such things often mean that the government, and especially the military, have trouble finding all the people they want to work there. That goes for most governments, but the US one complains frequently about how they don't have enough people to do the computer work they want.

The State of Open Source in 2025? Honestly, it's a mess but you knew that already

The places I have worked have used all of these, plus SUSE, Fedora, and Arch (a little), and no one of them has used fewer than two. Sometimes, it can be nice to use a single distro on every machine, but it doesn't always work. Some machines don't change a lot, and they're often running Debian or RHEL so they don't need to be but there's still maintenance. Ubuntu has been a middle ground, now making changes moving it in a longer-term direction if you use LTS versions. Cent OS, Fedora, Ubuntu and you use all the versions, and Arch update faster, which may be useful for some situations where you want to be able to use newer tools that those older distros don't include because they weren't around at the time, and then you've used one and you want to deploy it, so instead of the existing older server images, you make a new one based on a newer version of something that'll get support and now that's one of your servers too. After a couple years of that, you don't have a monoculture anymore and it's less work in the short term to keep those running rather than migrate everything to one thing. Eventually, you have to make some maintenance decision, but that's how you get there.

Re: So . . .

There are a lot more than two camps, and the two don't necessarily hold the same points of view that adherents argue for. I assume from your comment that you're referring to the general attitude toward proprietary code, with Stallman taking a more negative attitude to its existence than Raymond does.

Except he doesn't entirely do that. There are many who think that the existence of proprietary code is unconscionable and should be forbidden by law. Stallman isn't one of them by a wide margin. There are people who think open source code is fine, but they prefer to run mostly code that is maintained by a specific company because it means there's no link in the chain where their function has a license that disclaims liability. Raymond isn't one of them. So the spectrum, if we're using a one-dimensional one for this, goes in both directions from those two guys. There's also a place between their attitudes. I'm also curious where you'd put Bruce Perens, both the original one with all the OSI connections and the new version who is all in on the Post Open (in my opinion very close to closed) license idea. Not to mention that I, who you'd probably file near Raymond, might not be easily placed on such a scale because, while I'm fine with proprietary code, I get annoyed at people who change their licenses to make something previously open source more proprietary. They have the right to do it, but I will dislike them if they do. Neither camp is well-defined, possibly because there are more than two opinions on it, more than one thing to be debated, and we don't tend to choose our opinion by picking a representative.

Arizona laptop farmer pleads guilty for funneling $17M to Kim Jong Un

Re: Norks

Hard currency is quite a big thing for North Korea. They want to import many things they don't have the capacity to make locally, but unlike Russia or other countries in that position, they don't have much they can export to earn the money to do it. If Russia wants some chips, they can sell some oil or minerals for cash and use that to buy the chips. North Korea finds stealing that money to work better because most of the things they make are either needed locally or made inefficiently compared to neighbors. For example, North Korea does make a lot of some agricultural goods, but China makes them much more efficiently, so China exports lots of those things and nobody buys North Korea's, which is actually fine because the North Koreans need to eat something and they don't import food.

So in reality, I think this is mostly about the money, and the backdoors they might install are also about going back and getting more money. Most of their major intrusions are the same thing. North Korea's known attacks are very heavily concentrated in three sectors: cryptocurrency companies, from which they steal money, banks (both retail and central), from which they steal money, and security companies, from which they steal exploits and use them on other people, again concentrated in those three areas.

808 lines of BBC BASIC and a dream: Arm architecture turns 40

Re: "RISC architecture is going to change everything"

You can do equally as much with three instructions and one register. We don't all do that because sometimes we're worried about more than what it is possible for our computer to do, but what it is efficient or feasible for our computers to do.

Re: "RISC architecture is going to change everything"

The chip is Turing complete, so it can run anything you choose to compile for it. It can run IOS if you give it enough RAM. The point is that it doesn't because it would be slow because it doesn't support those thousands of operations. When people want performance, they go to a chip that has thousands of operations. Does that make it non-RISC? Does it mean that RISC was abandoned by ARM in the quest for performance? Since RISC isn't well-defined, there isn't a clear answer to this.

Re: "RISC architecture is going to change everything"

It depends whether you give ARM credit for still being RISC, and if you don't, where you draw the line. The Cortex A-range chip in your phone likely supports a couple thousand instructions. True, they have several subsets of that, the smallest of which (Cortex M0) has only about 55), but you don't run a phone or computer with one of those as the CPU. I don't think I can call that RISC, even if it still has load/store and comes from ARM.

Trump admin freaks out over mere suggestion Amazon was going to show tariff impact on prices

Re: Dihydrogen Monoxide

You can't include that one about a profitable industry in the US. That might outweigh anything else in the list. No, to really clinch it, you have to report that nearly a billion dollars per year is used to import DHMO products and Canada is a source of the raw substance and partially regulates the US's use of it. That should be enough.

TAKE IT DOWN Act? Yes, take the act down before it's too late for online speech

Probably not at all, because these are not lawsuits. These are complaints sent to a different entity entirely, and from a court's perspective, the worst that can happen is an individual image is taken off a website you don't own. In reality, the worst that can happen is getting banned from a website because they don't want to deal with any more complaints or respond to cases where the complaints are untrue. In either example, though, it will probably not match the criteria written in anti-SLAPP laws, and you'd have to use less clear methods to try to respond to someone using these maliciously.

I don't think that means what you think it does. It doesn't mean the law doesn't have force until a year has passed, but that it is fully operational exactly one year after it has. Until then, social media can probably use the "still working on it" excuse for making the process more complicated and not immediately hopping to taking down the things they're told about, but they're still supposed to and can likely be pursued if they don't.

It is probably the most fun the politicians' staff members* get. Come on, wouldn't playing the bacronym game be a little fun if you didn't have to do it too often?

* The ones who would otherwise have to do boring work like writing and reading the tangled words of legislation so their bosses don't have to, not the ones who are preparing for their next election or their social media war. In other words, the staff who do work, not the ones who play the politics game.

Infosec pros tell Trump to quit bullying Chris Krebs – it's undermining security

I wasn't one of the three so far, but if I had to guess, I'd guess that people disagree that that's a strength even sometimes, you didn't explain why you think it is one, so they think you're at least partially wrong.

Open source text editor poisoned with malware to target Uyghur users

From the not very nice translation that Google Translate made of the Uyghur readme/changelog, this editor seems to have a few features that many text editors you could localize either don't have or are specific to Uyghur including:

OCR: I don't have this in my text editors, though you could add it.

Convert between writing systems for Uyghur.

Save to Docx: Most text editors don't bother with this. Localizing LibreOffice and trying to add these features as add-ons would be more work than the average text editor localization.

Features specific to languages that Uyghur users may also know including Kyrgyz.

You probably could bolt these onto another editor, but I'm not sure they're small enough that that's an obviously better option.

Swiss boffins admit to secretly posting AI-penned posts to Reddit in the name of science

Re: “…the risks (e.g. trauma etc.) are minimal.”

"But if you're researchers, social scientists, experimenting on people, the first thing you do is obtain informed consent."

I think you're simplifying the ethics review process to the point of inaccuracy. Testing on uninformed subjects is done frequently, whether that involves bringing in subjects, telling them you're testing one thing, then testing something else*1, or testing on the general public without telling them*2. The review process would not dismiss either type of request simply because the subjects weren't informed. They would ask questions to determine the ethical consequences of not informing the subjects up front, and they might refuse permission when it's too sensitive. If you think this study violates those ethics as well, you could argue for it and I think you'd probably have a point, but if you think it's as simple as "they weren't informed so it would obviously violate the ethics codes", you don't know the ethics codes.

*1: For example, the famous study where people were told to go to another building and watched to see if they'd ignore a person needing help on their way. The subjects were not informed that they'd be tested on that, since the purpose was to see if they'd go out of their way to help, and they weren't informed beforehand that they'd see a person in (simulated) distress.

*2: Many studies involve setting up a situation in a public space and watching what passersby do in response. It's very common.

Generative AI is not replacing jobs or hurting wages at all, economists claim

Re: When was 2024?

You're both right. The data isn't very old, especially given how long it generally takes to create new data. How many people have jobs is often on at least a month's delay as it is, and information about how companies are changing the jobs their employees do is often delayed longer than that if it's explained at all, so the data they've used is probably the latest they have access to. However, if modern LLMs had actually taken over and replaced employees, it wouldn't show up in the last set of data from 2022-2023; the LLMs of that age were much worse, struggling to string a paragraph together.

We won't get the full story until some companies actually try replacing workers with LLMs for a while. Having seen them used, I'm not expecting large changes. While there are a lot of places using them, the quality is still a problem, meaning that companies using them and expecting quality usually need to spend about as much time testing, rerunning, and correcting LLM output as they did doing the thing from scratch in the first place. Various people I know or work with have arrived at different places on the spectrum of how much LLMs are used, and I do know someone who uses LLMs frequently and nonetheless produces good code (he does complain that he has to try five times and then correct manually to get workable code, so I don't know how efficient he is). I'm still waiting to see how badly it fails when a company decides to trust LLM output more readily.

CNCF tells main NATS contributor Synadia that it's free to fork off

Yes, and you could argue that merely adopting such a strategy is already forking the software since it is now diverging from what others used to contribute to and use in such a way that they may only choose one approach: paying or being allowed to use their own work in the way they want. These people have decided to add another level of stupid to the game, though. Most companies that do this have kept the trademarks and domains, so their version gets to keep name recognition. I must admit, I've never seen a company give those away before trying this before.

Signalgate lessons learned: If creating a culture of security is the goal, America is screwed

Re: Who is to blame?

Correct, and in that case, you've moved the endpoint. That can be helpful. If, however, someone got malware onto that endpoint, malware which either takes it online without you knowing or uses one of those ways Mordechai Guri is always making for getting data out of a computer that has no standard connections, then you have the same problem. Which is not relevant to the completely unrelated issue of adding a recipient who shouldn't be on the conversation, because whether they used one terminal or two, airgapped or not, is not anything we're talking about in this article or the comment thread you've replied to.

What the **** did you put in that code? The client thinks it's a cyberattack

Re: Most inappropriate message

Appropriate in the sense of avoiding making customers angry, probably. Appropriate in the sense of proper user design, no, in my opinion. The problem is not the informality or even the command, but that it didn't tell the user what they did wrong or what they should do differently. In fact, I don't entirely understand what this even means. What my mind immediately jumped to is those times where what looks like a simple modal has an OK and a Cancel button, but I can't tell what differences to expect when selecting which one to press. I'm assuming your case was more complex than that, but since I don't know when it would appear, I would be wondering whether this was the equivalent of the abort/retry/fail situation where I was stuck in a loop until I terminated the program. If the users could do anything about the situation, then probably a better error message was possible.

Downward DOGE: Elon Musk keeps revising cost-trimming goals in a familiar pattern

31.72689469541619 ...

Less precise, please.