Posts by doublelayer

OneFileLinux: A tiny recovery distro that fits snugly in your EFI system partition

Re: K.I.S.S.

A USB disk is much cheaper and larger, and you can put whatever you want on that. I don't think there are any security policies allowing booting to a floppy that don't allow booting to a USB drive, so unless you're working with something that doesn't have USB ports, then just use that way. Optical drives are another option that works just as well.

As for this approach, it's interesting, but I wonder how useful it is. I'm guessing that, in order to make it that small, they've excluded lots of things that I have on my recovery USB drives. For a while, my recovery drive was 1 GB in size (the benefit of that one was that it was too small to write other things to so I never erased it). That got lost so now it's a 4 GB drive. In both cases, I could easily add in whatever tool I wanted and keep that for later.

Top EU court crushes Google appeal against $2.65B Shopping antitrust ruling

You want a product, and it tells you some places where you can buy it. How it picks the places to include, how it ranks them, and whether it even found what you were looking for are not specified. Other services attempted a similar thing, and Google often pushed them down the page, both by putting a shopping block on top whenever you did a search that looked like you were trying to find a way to buy something and by moving them down in the search results that appeared below that.

In my experience, many of the "where to buy this item" services weren't very useful. They often reported prices from a small number of stores, missing cheaper places to buy it, and if you actually liked the prices they found, you could easily find that it wasn't available anymore or had some extra terms tacked on that made it unusable. Then again, I only tried using them a couple times, so maybe I just got unlucky.

Feds urge 3D printing industry to end DIY machine guns

The other problem, and probably the largest one, is the description of the part you need. I have not looked and don't have a gun, so I can't prove the article correct, but if it is, here's their description:

"These devices, also known as "switches" or "auto sears," can be smaller than a USB flash drive and made of just a single piece of plastic."

There's nothing that can be controlled when the pieces we're talking about are that simple. One person who knows what they're doing could print thousands, so all you need is one such person attached to people who will distribute them and there could be only one printer involved. That printer doesn't have to be in the country as small plastic things get mailed in all the time. Meanwhile, people who want one of these things probably only want one or two, so it's not like they'll set off many alarms if they get their own printer or borrow another one.

I don't have a solution I can sell to US politicians. I am quite confident that this one won't work.

FTC urged to stop tech makers downgrading devices after you've bought them

Re: Car thing

Yes. The younger generation is brilliant: they invented the concepts of debt and renting. They didn't exist before. Older people have never had either, even when they were young. Now all the young have to do is get the patent royalties on those and their problems will be solved.

I'm not sure why so many people like making a generational thing out of this. Lots of older people buy things with subscriptions, either willingly or not. For instance, some people I know, aged 59 and 63, who purchased those security cameras for which you have to pay every month to use them at all. Their children didn't make them do that; they chose to do it all on their own. Just in case they were unaware, I explained the subscription terms. They were aware and chose to accept it.

To the extent that there is any generational thing here at all, it's because it is easier to make a subscription out of devices with modern technology and the manufacturers are taking advantage of that. It's easier to have a camera that only works with the manufacturers' servers and phone app now that the users have phones it can work with and a connection to keep the cameras and the servers in contact. That would be a more convincing argument if there hadn't been many similar things before which used the same terms. Before there were cameras connected over WiFi to your phone, there were still home security systems, often paid for monthly and managed by a company. It's not just those. Televisions were rented. Cars were leased. People chose that option, or were sometimes not given another option, even before the year 2005.

Subscriptions work because people sometimes choose them. I generally try to avoid them whenever possible, but I'm also comfortable doing some of the work that a subscription involves. If I ever decide I need a camera on my house, I'll do the network setup to get in contact with it when I'm away. I may even build the device, probably with a Raspberry Pi in it. A lot of people who want that are not willing to do that, and when given the option of a single-purchase camera which requires them to learn some network admin or one with a convenient app that just works, they choose the subscription. Some people are just not as frugal as we are or value things differently, and age is not really a factor in it. The important things are that we make clear when something is a subscription and when they're not so that people can make an informed decision and that we prevent companies from switching from "you bought it" to "just kidding, you didn't, and now you have to pay again to keep using it".

Re: This might backfire on consumers

I'm sort of fine with this. If they need ongoing revenue to make something work, I can understand why that is. Sometimes, there really is no way to provide the advertised service without expensive stuff such as a bunch of servers to run software which the embedded chip in the product can't run locally. The important thing is that they explain that, in clear words, right on the product page not in a terms of service document. People should be able to know up front what the hardware costs and what they need to pay to keep it working, which will allow most of them to decide that the monthly payments are not something they want so they will not buy this product. The problems come when they think they've bought something and end up getting a subscription, either because the manufacturer hid that one was involved, or because the manufacturer didn't have one when they bought it but added one later.

Of course the Internet Archive’s digital lending broke the law, appeals court says

I'm tempted to say "read the thread". The original post described that the IA had lent out multiple copies:

"If you have a physical book you can only lend it out to one person at a time. From 2020, the IA were lending out multiple digital copies for each physical copy they held."

The second post suggested that this was not the case:

"They were lending one digital copy per physical copy owned and sued for that."

I replied to clarify that, yes, the court did decide that 1:1 was also not allowed, but that the suit was during, and at least partially because of, the 1:many. I.E. the first poster was correct and the second poster was not.

The IA has been doing CDL since 2011 and has been calling it CDL since 2018. I'm not sure it's ever been clear whether that's allowed or not under copyright law, but it is so close to the line that it could have been ruled legal. If I got to write copyright law, CDL, with some extra provisos around the "controlled" would be legal. Their attempt to do a 1:many arrangement was very relevant to every aspect of this. It certainly led to this lawsuit which has now ruled against CDL as well. It probably helped make the case against CDL. It may have done significant damage to the Internet Archive. It probably has harmed the IA's image and its ability to influence copyright standards, which is quite important as the IA has been one of the organizations that has helped improve the status of the DMCA, something that is probably less likely to succeed now.

"Your feelings, frankly, are irrelevant to the question of whether the publishers should agree to license IA to resume the paired-copy lending, or some other mutually-agreeable scheme, which is what IA is currently asking with the petition."

I'm not sure they are as irrelevant as you say. As an author, their opinion might not matter very much given how many authors there are, but if enough authors disapprove of whatever arrangement comes along, they can push back on it. If, for example, authors decided that publishers were wrong and CDL is great, they could refuse to work with the publishers in this case whenever possible. That seems unlikely, both that they would take that opinion and that enough of them would put that opinion above their commercial interests, but it is possible.

Almost all of this is related to feelings of some sort. A petition similarly has no legal weight, but it's designed to indicate to the publishers the feelings of those who benefited from the IA's programs. Copyright law is unlikely to change, but if it does, it will be the feelings of creators and consumers of copyrighted work that accomplish the change. A lot of those feelings will be attached to money, but people don't argue for a law by saying "I want more money" or "I want this book for free". They tell a story about what those things would do for them in order to sway feelings in their direction.

If I am an artist and paint something the day before I die, my family, or whoever I intended my property to go to, gets the painting and can sell it.

If I am a carpenter and make something the day before I die, my family gets that thing and can sell it.

If I am a businessperson and complete a task and get paid a big bonus right before I die, my family gets the money and can spend it.

If I am a celebrity and am paid to endorse things, and I endorse something the day before I die, my family gets that money and can spend it.

If I'm a programmer and have been employed to write something before I die, my family gets the money that I have saved from that labor and can spend it.

But if I'm an author, programmer, composer, etc and write something the day before I die, my family should get nothing?

In the US, where most of the copyright restrictions happen, the company just gets a time period. Currently, that time period is 95 years, which was repeatedly extended on Disney's request. What that time period should be is certainly something we should debate, and I think 95 years is too long. However, there's no ambiguity involved.

That was the original idea. It is also the idea they were using most recently. It was not the idea they tried to use in the middle. In 2020, right before this court case was filed, they established what they called the "Temporary National Emergency Library". That was a program of letting anyone get a copy of any copyrighted work they held, no matter how many physical copies they had. They kept this up for three months, only stopping it when they were sued (this particular lawsuit).

Their reasoning was logical: in a pandemic, it is harder to go to a library with paper books and some had closed or put restrictions on who could get books. Libraries relaxed that pretty quickly around where I live when they determined that COVID was not going to survive long on a book, but for the first few weeks, that was indeed a problem. However, just because it helps someone doesn't make it automatically legal, and the Archive should have known that. I am convinced that, without this, they might not have been sued at all and they might have had a much easier time of it if they were.

Re: Contradiction in terminis

There are cases about that, but they will take a while to get to court. Even this one took a couple years to get its first case and we're about four years on when the appeals ruling came in. AI companies also have a lot more to spend on lawyers to delay the process. I think that, if they're enforcing the law correctly, they will have to rule against the AI companies on the same basis that they ruled against the Internet Archive, and I hope that they do.

I think the IA's case was quite a bit stronger than AI companies', but that doesn't mean I think the Archive was destined to win this. The problem is that CDL was never clearly legal, that if it is fair use was probably the wrong way to justify it, and that the Internet Archive wasn't making their case easier. I think a rigorous application of CDL should be legalized, but the IA did not help make that case when they used weak DRM making it relatively easy to make more copies and when they decided to lend unlimited copies in 2020. That latter decision was disappointing to me because, when I read that they were doing it, I was almost certain that it would harm them in a trial and it was likely the reason why this one started in the first place. Had they stuck to CDL, publishers might have avoided a trial they might lose because losing it would justify more unrestricted lending terms for ebooks than the systems publishers currently use with libraries, but when the Archive tried to go unlimited, they gave publishers a big incentive to try to smack them down and some valuable ammunition to do it with. I'm sad, but not surprised, to see how it has gone.

What do Uber drivers make of Waymo? 'We are cooked'

1 - Expensive and very time consuming. It's worth it, but people sometimes want to get there today, not in five years. When those years have passed and the new route exists, that will be great for the people in that area, but chances are that there will be a new one that could use a route.

2 - Expensive depending on the demand.

3 - It depends how many people want to go to the places you're talking about. If it works as it often does, where the trip on the public transit is pretty fast but then you have a long walk ahead of you, the benefits during the part where the dedicated rights of way are speeding it up can be wiped out in the walk later on. I generally don't mind that, but that's when I can spend extra time commuting and am not worried about how quickly I'll arrive.

4 - I suppose it depends how much groceries you're carrying. I could easily carry a medium amount on transit where I live, but the trains I've been on before won't be convenient if I'm trying to carry groceries for a longer period or a larger family. We're packed in too tightly and most of the things I'd buy are easily damaged.

Raspberry Pi 4 bugs throw wrench in the works for Fedora 41

Re: no Real-Time Clock

Likely the same thing that the Pi would do a lot of the time: use the wrong, cached time, which is still later, and boot successfully.

But yes, one of the tradeoffs of the strict verification is that, if there is no RTC, the power is lost so the cached time is out of date, and packages were verified during the running session, then they will not verify during boot. Those prerequisites are pretty rare with a server that generally has an RTC that works most of the time and generally isn't losing power unexpectedly given that they often have UPSes and automatic shutdown scripts if power is going to go down. That's less common with a Raspberry Pi which doesn't have an RTC at all and is most often connected to a less reliable power source with no prediction if it is going to fail. With every program, you end up building in assumptions and tradeoffs.

For instance, the same RTC lack can mess with programs that start before a Pi gets a network connection. It's well-known as something you have to consider. Some things that use wall clock time may report odd behavior when it switches from saved, wrong time to real time. Results get reported as applying to huge time periods. Scheduled tasks end up running because the time they were supposed to run was in the middle of that period that really doesn't exist. For better or worse, a lot of programs that are running as normal userspace programs have decided that they will have a clock available and if the clock acts oddly such as skipping entire hours, that's the user's problem. Not every program needs to write special cases for that not being the case, especially since most of them will be unable to tell between a clock acting oddly because the hardware makes it necessary and a clock acting oddly because there's an actual bug or hardware failure causing it. The user on a server will deal with this by a) disabling the verification so boot completes, b) adjusting the clock before the operating system is booted, c) replacing the faulty RTC battery, or d) preemptively doing A because they've decided they don't care. That doesn't mean that it should be preemptively disabled for everyone because some people may choose to do it for themselves. One of the typical attitudes of the Linux community is that you should be trusted to know how something will affect you if you change it and to let you get on with it. Defaults are defaults for a reason, but you're free to change them as you wish.

Re: no Real-Time Clock

"Imagine that on a server that loses Internet at the wrong time - one remote reboot, it doesn't pick up the time immediately / quick enough, and the whole thing just stops? Ridiculous."

Except that server will have an RTC, which even if it's not entirely accurate, means the time will be later than when it last booted, not earlier. The Pi usually saves the time when it shuts down, meaning that the clock should always be wrong at boot but at least not report that time went backwards, but doesn't always. If I install something and lose power, its clock will be earlier than the installation time. Verification of packages is a deliberate decision, and verifying times when doing so is a very normal part of that process. Disable it if you like, but don't pretend that it's always a bad idea.

White House seizes 32 domains, issues criminal charges in massive election-meddling crackdown

"I don't think the Russians could (or would) have been much help in the invasion - as they'd have had to commit their troops to both under allied command, and use the allies supply chain."

I don't see why that would have to be necessary. They could easily attack Japan from the north and west while the other allies, primarily the US, attacked from the south. Other than coordinating aerial action, they could operate somewhat independently if the goal is simply destroying everything until there is no more resistance, then repeating that further ahead. I admit that my picture of how this might have gone is probably biased by an alternative history that did consider this*, but I don't think it's that unrealistic. I agree with most of your other predictions. A more militarized cold war that likely would get warmer, if not a World War III less quick and fiery than the term generally describes.

* The book in question is Joe Steele by Harry Turtledove. Joseph Stalin's parents moved to the US and he became its president, and because he's a dictator, physicists don't want to give him nuclear weapons so there is a delay in making them. They still make them, but not until after the war has ended. Japan ends being split between US and Soviet spheres of occupation similar to real world Korea. It's not the most realistic of premises, but still a fun read.

Yes, different, but how? It's an interesting hypothetical. I'm not sure if you're suggesting that there would be less conflict between the US and Russia if there had never been nuclear weapons, but I think it would be as bad if not worse. This happens if you assume that nuclear weapons never were invented at all, which means you start your alternate history with how the war against Japan ended quite differently, probably with a lot more Soviet involvement. It also happens if you assume that we all simply stopped being able to make them at some point, though the details differ quite a bit depending on when that is.

Admins wonder if the cloud was such a good idea after all

Re: Get over yourselves please

The other problem, other than the snake oil, is that a lot of people want a single choice solution. They want the cloud to either be good or bad, so even without a marketer trying to pretend that something does what it doesn't, you have many people attempting to simplify a complicated problem. The finance person likes the Opex option, so they say that cloud must be better than anything else, so let's switch all our computers to that. Admins, as many here have demonstrated, have some, possibly accurate, reasons to be skeptical of the cloud, but they decide that it means all cloud options are always bad. Sometimes, their reasons are perfectly accurate, but sometimes they're also faulty. For example, one admin I knew who disapproved of cloud for, in my view, the same reason that he disapproved of Linux: he eventually learned how to administer a Windows server without setting it on fire and didn't want to learn anything else ever again.

In many cases, you actually have to calculate it out. What do we want to do. How much does it cost to do it with cloud supplier number 1? How much with supplier 2? How much right here in this building? How much in a colo nearby? What extra things do we gain with each option? The cloud probably provides us faster networking without having to do extra work. The local server room likely decreases our costs to add more systems there. What risks are there with each option. And now that we've done all that boring stuff, we can actually eliminate some options and make a decision. A lot of people want to skip this and use worse reasons, or no reasons at all, to pick one.

Re: Cloud is a financial model not a technology

That is a concern, which is why a good admin will have backups so the servers can be restored and design to scale down to fewer servers if that's needed. In many cases, if you don't have the money to run your servers and you need them to have your company work, you have lots of other problems, so owning the servers won't save you. For example, if you can't pay the monthly cloud bill, are you still able to pay any bills, including payroll, the ISP, the phones? Having your own servers behind a disconnected network link isn't much better.

Re: "The real issue as ever is vendor lock in."

Sovereign data doesn't have to stop you. If your country is large enough, you can probably store your data in different parts. For the big cloud providers in the UK, that's usually London and Cardiff. It also tends to apply to only certain industries or types of data, and the rest can store in Dublin or Amsterdam as they please.

"Pre-cloud, storage was managed to save cost. You stored the bare minimum and archived the rest. Have people become lazy, just storing everything because they can, and because they are not footing the bill?"

Yes, they are lazy, and they are footing the bill. Often more with cloud storage than without it when you grow large enough. That wouldn't change if running on prem. Managing data to figure out what you need now, what you'll need soon, what you'll need in a basement just in case, and what you can throw out is hard and expensive. A while ago, it was expensive in employees, but the employees were somewhat cheap and the space to store the paper was the limiting factor, so lots of people were hired to move it. Now, employees are a lot more expensive, the amount of data they have to consider has grown, and disks are much cheaper. So they just keep storing it.

By the way, the "1Tb drives cost less than £50" factor is related to why a lot of people use cloud storage after all. The drives are quite cheap, so if you want to archive some data offline, they can make a part of the solution. Running those drives costs more, and I'm not talking about electricity. I'm talking about drive bays to hold all of those as hot storage and the servers those bays are connected to just to store and retrieve data on them. If you have lots of data that you want to be available whenever someone who may not be in the same building wants, you'll be spending a lot more per drive to do that. You'll also need lots more storage for redundancy because those cheap hard drives break. There is an area somewhere between "That server holds big drives in RAID where we store all our data" and "We store so many petabytes that we have a team who design and build custom servers for massive storage needs" where finding someone else who does the latter and paying them to store the data starts to make more sense.

Re: Cloud is a financial model not a technology

The comparison to property clarifies some reasons why people might prefer a more expensive cloud. You rented at first because you couldn't buy. There are people who want to start a business that will use some equipment but they can't buy, either the equipment itself, or more likely all the facilities needed to operate it. Fortunately, servers are very easily rented. You also pointed out the major difference between them, which is that buying property is likely to gain in value most of the time, whereas buying a server almost certainly will not. Buying equipment early will probably not help you if you're counting every penny, and if you're not well-resourced, you may have to do that.

That doesn't mean cloud is always better, just that it can be. There are things you can do relatively cheaply with cloud that are expensive to do yourself. One easily understood example is multicontinent systems if you don't have offices all over. Employing a local hardware team is pretty expensive. Not hiring them and just putting your normal hardware team on the next flight when they're needed is less expensive until it isn't. Setting the region in the cloud console to a different country is easy. So if you need that, that can be a cheaper way to get it. As usual, someone actually has to figure out what you need and how much it costs to get it from the various places, which is something a lot of people want to skip for some reason.

Re: Rainy clouds?

Probably some of both, and in the areas of increasing price we can also add the price of workers. Somebody needs to replace broken things and write the software to administer the hardware, whether in cloud or not. When running on prem, the price of the latter is often outsourced to a company from whom management software is bought, but they're probably increasing prices too. It's likely that prices to run a server anywhere has increased, and that when they increased for cloud providers, those providers tacked on a bit more when they raised the prices to account for it. I don't like it, but it is what I can expect from any company; I'm sure those who have higher prices to run their server rooms have passed that on to me and added a bit more as well. I can't stop it, but at least I should not be surprised when it happens.

Re: Cloud is a financial model not a technology

Because they're money now and money continuously, and those are different. Not necessarily as different as accountants like to treat them, but different nonetheless. Have you ever rented somewhere to live? Why didn't you just buy a house? It's just paying for somewhere to live, after all, so surely it's the same. There are sometimes benefits from renting, and sometimes substantial downsides because you've paid a lot more than you needed to and don't have anything at the end, but you can't treat them as the same because there are times where the one that seems the more expensive is the only option that gets you what you need.

What is this computing industry anyway? The dawning era of 32-bit micros

Re: ARMed and Ubiquitous

I still have to give them credit for doing a pretty good job at decreasing their power consumption figures significantly. Not to phone levels, but there's a reason why the low-end X86 boxes nearly all use Intel parts rather than AMD. That market segment may not be the most alluring, but they did find a demand for their low-power chips and they can be surprisingly good.

Re: ARMed and Ubiquitous

I wonder what would have happened in practice if it had been Apple's ISA of choice at that time, because they didn't have billions to throw at their in-house chip designers who have a decade of experience on that ISA and their home-built versions of it. They would have had much less money and they'd have had to give it to someone else to do the chip design work or try to buy ARM. How long would it take before they said something along the lines of "we could extract a lot more performance per watt from this chip if we had the time and money, but we need raw performance now, so let's forget about the power problems and just put more fans in this Performa".

If they had, it's possible that ARM might have focused on the desktop market and become a competitor to Intel and AMD in the late 1990s, but that would mean that it wouldn't have been such a big player in embedded. I wonder if that wouldn't have been worse in the long term for ARM if it found itself wedged between X86/X64 on the high end and something like a better SuperH for embedded. Almost certainly less software would have been written for it, fewer compilers would target it, and there would be less industry experience running it if it was mostly an Apple chip than if it's needed whenever you want to build something handheld.

Re: ARMed and Ubiquitous

I wonder how much of this is speculation based on what we would want rather than what is realistic. Apple could have used ARM chips in Macs at the time, and yes, that would have been decades before they actually did. At the beginning, those would have been fine. However, would that necessarily have kept ARM strong in comparison, or would ARM have become the new PowerPC: good enough, but there is something faster that eventually needs to be switched to?

It is relevant that the current ARM chips came from the enhancement of lower performance, lower-power mobile chips. In fact, might a 1990s-era push for faster performance for mostly desktops have harmed ARM's power usage, something that was important to getting it in every mobile device in the 2000s and 2010s? It certainly did for X86 as Intel discovered when nobody wanted to put an Atom in a tablet.

Telegram apologizes to South Korea and takes down smutty deepfakes

"Why are the makers of the Deep Fake software not being held responsable ? Surely they should have been the 1st bunch people to have action taken against."

Because such software generally exists in three forms:

1. Software specifically targeted at one type of deep fake, often sexual in nature. The people who make that generally don't put their names on that. They make it, they release it, and copies end up passed around the internet. Maybe they've got malware in them too, who knows. Tracking down the original author(s) who might be in any combination of countries is not easy.

2. Software which can generate lots of kinds of images whose protections against illegal ones are either absent or weak. They're owned by large companies that already ignore many laws, such as the one that says you're supposed to have licenses for training material, so even if you identify them, they're not about to let you enforce judgements on them. They'll call up a lawyer who will say that they're not responsible for what someone did with their software, that their software was not intended for any illegal purpose, and go find the user and figure it out. If charges continue to exist, the lawyer files documents and it takes months or years to complete, the way that almost none of the copyright trials have even gotten to trial yet.

3. Open source software which isn't intended to do this but which gets modified. Either it gets modified thoroughly by some person, in which case go back to option number 1 but the author(s) did less work to get the program, or it ends up being relatively easy to break protections and get illegal images. If it's that branch, then government could go after the person who made the open source model, but it would end up angering people who see someone who didn't want that to happen and has no reasonable ability to stop it or defend themselves being punished for what someone else did.

If you have a good way of escaping this triad, let us know.

'Error' causes Alexa to endorse Kamala Harris, refuse to discuss Trump

Re: Conspiracy or ineptitude.

If I had to guess, I'd assume that there were things in the "why to vote for Trump" list that were in a prompt as potentially divisive things that you're not supposed to talk about, so that triggered the response, whereas the training data didn't have as much on Harris because she wasn't the candidate when the model was trained, so it got past the filter. I couldn't know, though, because lots of things are conceivable reasons and it is almost certainly LLM-based, where any protections you try to put in fall apart half the time and any attempt to make them consistently hold a certain opinion is similarly flaky.

An oversight or a deliberate setting would both make a lot of sense to me, but I still think the most plausible one is a combination of both. I doubt they deliberately set the prompt to refuse to speak about Trump but support someone else. The deliberate settings could be on more specific issues that are likely to come up when writing an answer to that question because those are what comes to mind for the prompt writers when they're asked to list political topics that we don't want bad press about. An oversight is not testing to see what actually happens when you add that filter and just assuming that, if you've put something in that rejects political questions, it will reliably reject all political questions. We will probably never know for certain. There's a reasonable chance they won't ever know either, even if they try to investigate.

AI firms propose 'personhood credentials' … to fight AI

Re: That solves neither set of problems.

If your only goal is slowing them down, then you have better ways that won't have stronger impacts on the legitimate users than the illegitimate ones. If I'm a criminal and I want a bunch of verified accounts, then I'm probably planning to make a bit of money out of this. I can bribe some people to go to your office and collect tokens for me; if I'm successful, I'll get it back. Meanwhile, someone who just lives in a rural area will try to go themselves and it will take a lot more time.

There are lots of ways to slow down a transaction. Collect an address, mail something to it, make them enter the number. Get a credit card number, charge something to it, wait for it to post, then return it. In many cases, there is no compelling reason to do either of those things. A physical office visit is worse than both of them in many cases, not that either of those is good.

Re: So what stops me

Basically there is no method for this to work at all. If the identity tokens are used at all, then someone will get them. They might buy them. They might steal them. They might get an issuer to generate lots of new ones. It falls into the same challenge that has hampered all cryptographic key-based systems since we've had them: key management is hard, especially when the users don't care. All the potential harms you point out are realistic, and there are tons more available. For limited groups and limited uses, this could work as well as anything else, but when you try to apply it to the whole internet, it breaks almost immediately.

Three problems with that:

1. Most things I connect to never see my MAC address.

2. Most things that do see my MAC address will happily accept a randomized one, including a continually randomizing one that changes by the hour. Those that won't work with that, for example corporate networks with MAC allowlists, will need one that doesn't change but don't need it to be globally unique or the one specifically issued by my manufacturer.

3. Most computers and phones allow me to change the MAC address manually if not automatically. That doesn't generally apply to IoT stuff, but a lot of the ones that I use will let me do it.

Re: Kill the 1-to-1 concept of identity

What good would that do? There are places where that's fine, and they already let you do that by using something like an email address as an identifier. There are lots of places that don't want that and won't let you do that, so they'll still use something that's unique per person, and if you take away one, they'll find another one. That's never going to end.

Re: EFF

"Apart from birth and death certificates, passports, ID cards (those countries that have them), driving licences, social security, etc..."

Let me guess. You live somewhere where the paperwork seems to be handled adequately, and you've never had significant problems with yours. Congratulations, but your experience is not that of many other people. Yes, if you need to find a place that has validated paperwork, governments are your best bet, but that doesn't mean they're good. It means that all your other options are even worse.

People manage to get born without getting birth certificates. There are some weird people who see that as a good thing. Often, governments don't notice until many years later when that person tries to get some other documentation and can't prove their identity. As a child, any physical paperwork about me was handled by my parents. What would have happened if they lost it, it was destroyed in some way, etc? Problems, many problems. What happens when one person gets copies of documents and uses them to live as someone else? Chaos. For instance, the real person gets put in a mental institution. That's not entirely due to incompetence. Sometimes, the challenges of establishing an identity are that hard.

That is all in a nice developed country that spends lots of money on those databases. It works even more badly when the government is dysfunctional, the identity database had a bomb drop on it, or a government is specifically trying to delete people from the database. It works badly when people travel without reporting in, either because they didn't feel like it or because it's illegal (there are illegal international migrants of course, but in some countries like China, there can be illegal intranational migrants too and paperwork is messy). Or simply a place where people don't report a birth because they've rarely done it before and don't really see why they need to now.

Re: In-Person Verification

That solves neither set of problems. Unless you make them prove identity, you have no way of knowing whether the person that showed up at your office claiming to be X is X or not, so if you issue them some token they can use later, you'll have done nothing other than proving that, at some point, a person was there. Someone who wants tokens for bots can hire a hundred locals and have them walk through your office giving random names and sending the tokens back to base.

Meanwhile, if you're going to solve this problem by collecting lots of identity details, then you don't have to make them show up physically. You can just use the complicated, dangerous, and useless solution these "researchers" came up with. Since you're unlikely to put offices everywhere humans live, the digital solution, while all the adjectives and some much nastier ones would still apply, would at least be implementable while the physical one would have all the same downsides and also not work.

Why is that desirable? Start with something that's not soft. The soft factors will not be suitable passwords and they're very likely to break. They won't be that hard for someone to impersonate, and they will be very likely to show false negatives just because someone's computer broke and was replaced or they clicked on one of those Google ads and ended up using Chrome even though they didn't want to. You'd be constantly ringing false alarms and gaining nothing for it.

That's to say nothing of the privacy nightmare that would be. I do not give my biometrics to any random site on the web. I don't tell them where else I browse. If something is medium or higher security, let's stick with the direct methods. If something is low security, let's also stick with direct methods but we can use a cookie, which I can allowlist, to remember me and keep me logged in. Neither of those is likely to lock me out at an inopportune time. Neither of those will result in well-deserved GDPR fines as your solution almost certainly would.

Elon Musk’s Starlink won't block Elon Musk’s X in Brazil, as required by court order

The reasons for that are complicated, and I'm guessing you don't care about them, so I won't bother going into it. The other important fact there is that the U.S. government took the plane. Not a random company, not a specific company like its manufacturer, but a government. It is much easier for a government to take property from a foreign government, either following or ignoring law, international, treaty, or local. It is much harder for a company to do so. Most courts will ignore the request by saying they don't have jurisdiction. If they find a judge who agrees to let them do it, the country will appeal it and it's likely that the next judge will cancel that. If they get a judgement and try to enforce it, they are likely to have other problems, because if you go after the money that the Brazilian government might hold in a large New York bank, Brazil can threaten that any dollars taken from their account there will be taken back from that bank's holdings in Brazil, holdings which cannot be quickly removed to prevent them from doing that. Those banks do a lot of business in Brazil and don't want to pick a fight, so they can find reasons why the judgement needs to be reconsidered and, since it's likely not to be legally binding either, they are likely to have it reversed before any hard decisions need to be made.

This applies whether the country is democratic or authoritarian and no matter how justified their action is. It is why companies that invested a lot of money in budding dictatorships often lost it. People who stored their money in Venezuela or Russia, for instance, often lost it and were unable to get anyone to give it back. We may have agreed that they deserved it back, but they weren't likely to get permission to start selling off anything those countries had to take.

Canadian artist wants Anthropic AI lawsuit corrected

Re: Less prolific than El Reg even with AI autocomplete

In my, admittedly limited, experience, writing is a lot like code in that speed of words written is a bad metric and that that number is highly variable. Writing documentation, for instance, is something that comes easily to me. I know what this program does because I've been using it for weeks, so now I have to write down a description. I can do so at length. I may still need a review to point out where I've been unclear on something or where I've made a mistake in my haste, but it isn't very difficult and few changes are needed.

Many other types of writing are more complicated because they also include a lot of planning and review. Well-written fiction should be one of those things. It's not just having an idea of an interesting thing for the characters to do and writing down the idea, but you have to make the words paint a picture or you end up with some very boring prose, you have to include sufficient description so that the reader understands the image you planned, and you have to tie that scene to all the rest of the plot. If you mess up on the last part, then at best you end up with a book that's way too disconnected, and at worst your scene contradicts something important and breaks the reader's interest. There is no canonical program out there for you to check your writing against, and therefore you have to do a lot more work. I would not expect people doing different forms of writing to have any similar number for words written per hour of work, and in fact I would expect that different authors, even in the same area, would also have very different numbers.

Re: Boucher using Claude to write 97 books in less than a year

From the other article, the books being written don't have that many words. Two to five thousand words is a short story. The only question is, without reading them, whether the 40-140 images are making this part of the plot, effectively a short graphic novel.

In his defense, writing a bunch of short stories is a very different thing to writing a bunch of novels. I can't know how much effort has gone into any of the short stories without reading them, and I'm not paying to do that. I'd still think that writing a hundred of them in a year probably means there's not that much in them, but it is conceivable for an author to do that by hand and therefore conceivable that someone could use GPT to generate one, then clean it up to be something worth reading. That doesn't mean that's what he has done. There are lots of people who put in some prompts and sell whatever text comes back, and just because he claims not to be one of them doesn't prove he's not.

Techie made a biblical boo-boo when trying to spread the word

Re: Missing detail

It's generally available from VOIP systems which can probably impersonate any number they want, and even if they can't, they have permission to use your number so they can use it on as many outgoing lines as they want. Also, this story suggests it was probably a while ago since it was distributing identical audio messages over the phone which is not as common nowadays, meaning even fewer protections on what number you can use to identify yourself and fewer people who would notice.

Have we stopped to think about what LLMs actually model?

Re: "Whether we burn $500 million a year or $5 billion – or $50 billion a year – I don't care"

"All of which are exactly the sort of errors a student programmer might make."

None of those are the sort of errors a student programmer should be making if they're using the least amount of effort. Including but not using a library, fine, I'll give you that one. Forgetting halfway through that you're supposed to count letters? Making up random Unicode ranges when all the characters I asked about were in the normal ASCII range? We're talking about a three-line program here with at least twenty simple ways of writing it. Most of the errors this system made weren't even in the logic of the program but the set of characters to be checked, and I gave them that part.

I've dealt with student programmers, and of course I was one at one point. There are a few different classes of errors that could be expected. Not dealing with character encodings is certainly one. Not considering scale is certainly it, and it implemented it with a relatively inefficient algorithm, but I don't mind that because that would be my starting implementation too which would be modified if I needed to do this to very long strings. Missing something related to case could happen, so I can give you the original checking upper and lower cases even though I explicitly said "only lowercase". What isn't so excusable is ignoring that I told it to find commas and that neither attempt did so. Well it did find "、", but not ",", and no, I can't give it any credit because it didn't just find "、", but also all the other symbols in that block like 〇, 》, and 〒.

Re: "Whether we burn $500 million a year or $5 billion – or $50 billion a year – I don't care"

"Yes, exactly. Sorting them physically into piles, is a known strategy to cope with human well-known cognitive lack."

Which is why I referred to counting things in a microscope. Biologists are not picking up and sorting cells (or whatever it is they're counting).

"Wow, you’ve fallen right into the anthropocentric trap. Why is counting 3 items so much easier for a human? Because the human brain literally has specific circuits for counting in blocks of 2, 3, 4 and 5."

That's not the point. If there are eleven items, which is neither in that list nor an even multiple, it still won't take as long as 237. Quantity is the problem if the question is losing track, and you are the one who brought up the losing track prospect. Of course, a computer has hardware which is great at not losing track, so a program that was able to make use of that to perform cognitive tasks should be much more reliable than a human would. This is all irrelevant because the computer is not trying to count, as you said yourself:

"You just need to understand the tool you have; and want to succeed at the task in hand, rather than trying to catch it out."

Which I will extend "You just need to understand the tool you have; and what it can do (generate some text) and what it can't (guarantee that the text is at all relevant or correct)". That is the only way you will know whether your tool can let you succeed at the task in hand.

Because yes, it can probably write the program "strawberry".count("r"), but with many other tasks, your suggested solution wouldn't work either. Whenever it has to write a program that's a bit more complicated, it fails and badly. For example, I asked it to write a Python script that would count characters from a larger set. It gave me a valid Python program that counts characters. From another set. I asked it to count the number of characters that were in the lowercase alphabet and a small set of punctuation. It gave me a program that counted letters in the lowercase or uppercase alphabet and no punctuation at all. When I pointed this out, it gave me a new program which had the following criteria:

1. The punctuation I asked it to count were mostly not counted.

2. It told me I needed to import the re (regular expression) library, but never used it.

3. It would now count some characters in Unicode code ranges that didn't include the characters I asked for but did include several others.

4. It stopped counting any letters.

5. The only character from the example string that was counted anymore was ".".

But sure, that's a trivial strategy that works flawlessly.

Re: The linguists clearly having kittens...

Easy. Go to a library, book store, or school. Find one book with the words "English" and "Grammar" on the cover. Read that book. You will be guaranteed to get clear rules for how English must be written. Warning: do not read a second book. If you do, you will get another set of rules which will almost certainly differ in some respects from the first set of rules. Both sets of rules will also have some differences between the way people actually speak and write English when attempting to communicate. You can either accept this or become one of those people who like to point out split infinitives even though nobody else cares.

Re: "Whether we burn $500 million a year or $5 billion – or $50 billion a year – I don't care"

What kind of argument is that? Let's consider your 237 items. I have to count them. Without any physical interaction? What does that mean? I can't pick them up? People count things all the time when they can't move them. I've known biologists who have to manually count things through a microscope. Sure, it seems like incredibly boring work, and it's work that I hope has been superseded as often as possible, but they can manage it. I can count tiles without labeling them. So yes, I can eventually count 237 items, it will just take a while. If I lose count, I will either tell you I lost count or decide that the task is pointless enough that I'm refusing to complete it.

However, the argument is bad for another reason, namely that the quantity isn't the same. Asking someone to count 237 items will take them some time. Asking them to count three items is much easier. There are only three Rs in "strawberry". Quantity is not the problem here. The problem in anthropomorphic terms is that the program does not know how to count. The program knows how to respond to sentences with other sentences. It is not adaptable enough to understand the query, and if it was, the problem would pose no difficulty as it could return to the string to count characters. Incidentally, this disproves your other flawed analogy to translation, as the original string is easily read both during the initial tokenization as well as at any other point before a response is returned. The tool is being asked to do something that it was never designed to do, but it appears as if it should be capable of it, and people treat it as if it is capable of it. The tool is not intelligent because it wasn't intended to be intelligent. It is the user's fault and the user's problem when they wrongly assume that it is.

Re: Sometimes I wonder whether I'm talking to a person

I'm not sure how I work, and I wouldn't automatically say that complex statistics couldn't be it. If it was, then yes, I have internal goals, but those goals are derived from statistical inputs about my situation, and I introspect in order to improve the analysis of those statistics, and my emotional responses are artifacts of the process which are created from the statistical analyses and then used as inputs to the next ones (this one I'm more confident about because sometimes they help and sometimes emotions are distractions which reduce my ability to get to my goals). However, even if that's true, it's the next leap in logic that they attempt which loses me. The way they argue, they seem to be following this syllogism:

Our brains are statistical (you appear not to believe it, I think it's possible but unproven). LLMs are statistical. Therefore LLMs are capable of acting in the same way as the human brain. Therefore they already do act in the same way as some of the human brain.

I have problems with both of the therefores, not just because they're unproven, but because I think there is sufficient evidence to call them both false because we do have some understanding of how an LLM is arriving at its answer and our understanding fits well with the many things it gets wrong where a human trained on the same material would not. Thus, whether we are primarily statistical machines or not, which I can't prove, I am not convinced by the broader argument. I see a lot of people anthropomorphize programs. I think that this may be partially due to the use of analogies in terms (training, reading, hallucinating, etc), but since it's been going on back to Eliza if not earlier, I can't blame the terminology for very much of it.

"If a human being (say a student) is told by an authoritative human they trust (say a professor) that they are wrong, will they stick to their guns or will they scrabble around for another answer?"

I might, because the professor is likely to have a point that I need to consider. But sometimes, I have had disagreements with authoritative humans I trusted where I was right and they were wrong, so that option will be considered. Some of the professors I know understood that and, either to vaccinate people against it or just to have fun, took to questioning answers even when they thought they were completely correct. As a student, I didn't really like that because they always asked the question as if I had made an elementary mistake, and when I stopped looking for what it might have been, they told me that they didn't have any problem with it either, but maybe it was helpful.

Good luck ever getting agreement on a definition for AI. Nobody here will agree, and if by some miracle you achieved it, marketers would come along to break the definition almost as soon as we had one. Some people think AI is an if statement. Others won't accept that a computer is an AI until it breaks out of human control and massacres us, and even as they get attacked by robots the computer designed and built they'll still say that it was just mathematics. My guess is that most surveys about who has, is making, plans to make, or will never touch AI don't bother to define it, so you're seeing an amalgamation of respondents' guesses about what it means in this situation.

Re: The written word

They can be quite good at telling jokes. Take a string that's already in the training data as a joke, and print it. At making new ones, pretty terrible. Then again, I can't be sure that the stuff they print wasn't generated by a human, and there are a lot of humans who are bad at writing jokes. In my opinion, humorous people tend to tell comedic stories rather than inventing wonderful two-line jokes, but if you ask for a joke, LLMs will tend to produce the latter rather than going for a longer premise with many funny asides and a good punch line at the end.

Re: The linguists clearly having kittens...

English has precisely-defined rules too. It's just that there isn't a single organization that's considered the final decider. The result is the same: actual people ignore what those organizations say when they want to communicate. For instance, the French Académie Française hates using words from any other language, so when words from other languages start to be used, they can be counted on to make up a new word or phrase from French words (words they got from a language at a time old enough that they're happy with it). That doesn't mean that French speakers defer to those new lists. When most French speakers I know speak of an audio file on an RSS feed, they call it a "podcast", not an "audio à la demande". It also doesn't say what should happen when their opinion about the language differs from either of the authorities in Belgium and Canada which are independent and have different words in their lists, nor with the many countries where people speak French and don't have an authority trying to manage it.

A standard grammar does no good here. An LLM can follow it, and the best it will get them is that the produced sentences look grammatically correct. It won't help make those sentences factually correct, useful, not random, or any of the other things they're supposed to be.

Check your IP cameras: There's a new Mirai botnet on the rise

Re: Ok, I'll ask

Probably, people want to see through their cameras from not inside their houses. The technically knowledgeable people have firewalled networks with VPNs to access them, which doesn't include everyone. Other people may have made do with giving it a public IP or forwarding a port. If they didn't do that deliberately, it's always possible that the camera used UPNP to do it for them, whether the user actually used the result or not.

A last look at the Living Computers museum before collection heads to auction

Re: A story of things that didn't happen

I would think that storing the data in Exif, which has a comments field, might be more reliable because it would then stay with the image file and could be used in automated sorting. No need to invent a new format because most of them already have support for that. Often, it's used to dump random data from the camera manufacturer, but you can put it to better use.

Hangover from messy Walmart tech divorce ongoing at Asda

Re: "The overwhelming majority of these were completed successfully"

It would be 96,000 and that kind of thing happens all the time when converting records. It would be 100% if there were no weird corner cases, but there are always corner cases when you've relied on something for long enough. Something weird got read off a piece of paper, typed in wrong, automatically imported incorrectly when two databases got merged, is valid under the schema but the schema couldn't represent something important so someone made up a representation for it, extra data was added in a spreadsheet and that got imported into a database which was able to process all the records but they had been mangled by the spreadsheet, or many other things. Ideally, that would not happen. In most large systems, it ends up happening at least sometimes. You don't need pervasive incompetence to achieve that, just that at some point in the many years the systems have existed, someone preferred speed to quality. I'm sure we've all seen that happen before.