Posts by doublelayer

Selling your identity to North Korean IT scammers isn't a sustainable side hustle

Re: Audricus Phagnasay?!

Criminals smart enough to do the risk-benefit analysis would probably decide the risk of any kind of involvement with North Korea was high enough that it wasn't worth the effort. There is a cap for how much North Korea can pay from the proceeds before it's not worth it for them either. For someone who isn't calculating the risk but goes for the much simpler cost-benefit analysis, the cost for doing this is much lower since it takes relatively little effort to provide copies of a license and store a laptop. Given the large number of people available who are greedy enough to agree to this and stupid enough not to consider the risks, it's not that surprising to me that the price for the service is relatively low.

More broadly, there are a lot of criminals who, when you see the risks they're willing to go to and the benefits they get, don't seem worth it. Small-scale bank robberies, for instance, carry a relatively high risk of getting caught and a moderate risk of having much worse happen to you and tend to have somewhat small payments, and yet people have been willing to do those, sometimes routinely, for a while, at least they did not too long ago though they've gotten much less common. Part of this might be that a lot of us posting here are in careers that are somewhat stable and well-paid, so what seems like a small return to us might be bigger for someone else, but I don't think that's the whole story. I think there are plenty of people who don't think things through, enough that finding accomplices who don't need to do much is easier than we'd like it to be.

Altman sticks a different hand out, wants tax credits instead of gov loans

Re: Workshy Layabouts

You are incorrect and numerous comments already gave you the details. For example, that when the tax credits are refundable, they result in direct payments from the government even if you owed no tax and when they're transferrable, they do the same as long as you sell them to someone else who owes some tax. And, even if they are neither, they can often be stored until you do owe tax, which means that while you do have an incentive to be profitable, which evidently the profit wasn't enough of already, it still amounts to the government giving out money to specific people. If you make up an incorrect definition, you can indeed make them as good or bad as you want them, but you didn't even do that.

Re: Workshy Layabouts

Tax credits are certainly nothing new, being a rather old way of handing money from the government to someone else, whether directly or indirectly. That still involves handing them money. Even in the most limited sense where they cannot be transferred and only count against tax due, it still means the recipients of a tax credit doesn't have to pay tax when everyone else does. In all variations, it is a benefit to the recipient at the cost of the government.

UK tribunal says reselling Microsoft licenses is A-OK

Re: Common sense prevails?

Some machines, especially those intended for corporate customers, are more customizable. Machines sold to individuals don't tend to have so many options. But also, I don't think you would actually find that a single model really has anything near that many options. For example, what are those five WiFi options? Some of them might have WiFi 6E for an extra charge, and maybe there are some with 6E, 6, and 5 as choices, but very few if any will have a fourth no WiFi option and I'm not sure what the fifth would be. In my experience, they don't tend to offer different WiFi cards based on different chips but with the same capability in the same laptop model, and most models have exactly one WiFi option and if you want 6E but it doesn't have it, you either pick a different one or replace the card yourself.

I think you'll find that they do have plenty of prebuilt machines in warehouses for many configurations that are standard. Some models don't have any other choices, and the ones that do still have ones that are more often chosen where speed to shipment is easier if they've already been assembled. At some level, usually an expensive bulk-purchase one, they will custom-build the model requested. This was my original point: they can remove anything, but it does add some work which means it's not as less expensive as it looks from the bill of materials, which is why they don't offer a remove any part you don't want option.

"the whole we don't agree appeals should not be something thats allowed"

They're not. What the statement translates to is "We're going to appeal when our lawyers have decided what the least stupid sounding acceptable reason is, but we don't know what it is yet. They'll find something; they're lawyers." That argument has to be one of the acceptable reasons for appeal, and their lawyers are going to write something that says it is and will keep doing that until they run out of appeal chances or a court rejects them.

Re: Common sense prevails?

That's technically true but in practice wrong. For example, what if I want to buy a certain laptop minus the disk it ships with. I have enough spare disks, or maybe I want a really big one which I'll install separately. Shouldn't it cost less to sell me a laptop without that part? Yes, it does, if you only look at the cost to manufacture the thing. However, when you look at the cost to have multiple lines, track them so you don't accidentally ship someone a diskless laptop when they don't know how to install the disk and then install stuff on the disk, have double the SKUs on your catalog, manage customer complaints when they select the cheaper one because they don't have any idea what "No SSD" meant, install or remove disks from machines when the demand for one model was different than what they guessed during manufacturing, it ends up not being worth it for the manufacturer and they don't bother.

There are many companies that have options without disks or without Windows licenses, on models where they get enough demand for those that it's worth the expense. For a lot of them, they don't see the purpose in doing either, so they don't. This is not unique to computers. Pretty much every physical product is sold in a way where you get all the parts they decided belong together and don't get to select the ones you want individually. There are potential legal problems with OEM license agreements used for the Windows part, but manufacturers' choices are not those.

Why Elon Musk won't ever realize the shareholder-approved Tesla payout

Re: Impossible, unless...

True, if his plan is to sell the shares for cash, he won't get anything close, though he can do that eventually and he would get a lot more than he should. However, that's not what he is going to do. Not only can he borrow against those shares and get a lot more, but the major value of them is that they let him control the actions of the company where he can extract money from it. For example, voting to have Tesla buy AI services from his AI company, services which aren't explicitly defined but a price tag that is. He can take that payment from the AI company which is privately owned.

Developer battled to write his own documentation, but lost the boss fight

Re: I used to own a sports bar/restaurant

Well, if we want to be more specific than we should, it is almost certain that after the drivers find their cars, they do want to relocate them to their next destination, and if they can't find them, they will be unable to relocate them. So although the sign is missing the medium stage, it is telling the customer what they need to do in order to do the thing they almost certainly want to.

Another question is whether or not we should even need a sign to tell you that, if your car has not been relocated by somebody or something else, then it's where you parked it, so unless your intention is to abandon it, you should probably take any necessary steps to remember that.

Re: Hmm

I am fortunate enough that I have never encountered someone who did this severely. Most who I have found need to say something but don't get too unhappy if their changes don't get made. Unfortunately, I know at least one person who had to deal with someone who demanded so many changes that they went to the extent of deliberately including things for the critic to complain about because they would otherwise send round after round of mandatory feedback and force all the team members to stay late into the evening to implement those changes before deadlines. It did not do that person's mental health any good, and of course introducing deliberate confusion or errors into drafts could have had all sorts of other problematic results.

Re: Hmm

Even if we assume all the opinions in the article are wrong, if we agree to accept the facts alleged, the tech writers were not sitting down with the developers to learn the product; they were communicating by written messages volleyed back and forth. Even if the documentation produced by the programmer was complete gibberish, you couldn't make it better without understanding the software, instead getting the kind of thing you would get if you had an LLM write it: clear, well-organized, grammatically correct, and useless. So I still don't think we have enough information to turn the benefit of the doubt to favor them. And if we aren't willing to accept those facts, we might as well make up any story we like because we have no information other than that from the article.

Re: Hmm

I'm not so sure. Of course, we'll only ever have one person's description of it and they're likely to edit anything that they don't want to appear, but nothing in the description says that the problem was missing things which the writing department asked to be filled in. I've known people, and I'm guessing you have too, who could not review something without proposing changes. I wouldn't count out the combination of people trying to justify their jobs and not necessarily being good at them. Most programmers I know would be all too happy to not write documentation, sometimes so much that they don't even though we don't have any writers to do it instead, and the writers probably weren't getting any complaints if the documentation wasn't good.

Ubuntu 25.10's Rusty sudo holes quickly welded shut

Re: I disagree with this statement

I still disagree, with the clearest reason being this sentence:

"When this ends up creating a potentially more insecure binary, it's a problem with all this rust stuff."

Not at all. When this ends up creating a potentially more insecure binary, it's a problem with this particular piece of code. If it was part of Rust, it would impact everything else, but if it was a bug in that one rewrite, then it's as much a problem with all the Rust stuff as sudo's insecure config file vulnerability was a problem with everything written in C (which it isn't, in case a C fan was not sure what I am saying).

If someone badly rewrites something in a language, it does not make the language or the others using it at fault. When we compare the C version of sudo with this Rust reimplementation, it's also not so clear that the rewrite was bad. Yes, the Rust version has vulnerabilities, but so does the C version, and so far, the Rust one has not had one that allows a unprivileged user shell to turn into a root one whereas C sudo has. I think I can sympathize with the negative reaction to something that has been hyped too much, and Rust has received enough hype to be annoying. When that annoyance turns into hyping any problem with the new thing more severely than the original hype, especially with inaccurate statements meant to make a problem seem worse or more unusual than it actually is, then we have another problem.

Re: ninjed me!!!

How is that the logical conclusion and what does it really tell us? What you have in doas is something that does some of what sudo does with an amount of code between that of su and that of sudo. You lose reporting and monitoring, but maybe you didn't need it, but you still have per-user command filtering, but not as many options, and it's still bigger, which we have been using though probably we shouldn't as a proxy for likelihood to contain bugs. All we have from this is the fact that yes, doas also exists and could be another option.

Re: sendmail.cf

I was surprised to see the comment about m4 not getting used precisely because it's used in autoconf and automake and I see those all over the place. I don't really like them, although I admit they are better than not having them is, but I have to use them a lot and therefore I see m4 and things relying on it with some regularity.

Re: ninjed me!!!

Since the tool has access to a lot of important stuff if it has bugs, new vulns in it are found often, sometimes those vulnerabilities have existed for twelve years before you find them, and several of those vulnerabilities like this one or this one have been memory vulnerabilities, both of which let an unauthenticated person elevate to root without special setup, maybe it's not as crazy to think that memory security could be useful. That doesn't mean they did so correctly, but the "thoroughly vetted" argument falls pretty flat, as it does for many tools that get updates frequently enough that bugs slip in. We could argue about what is the best way to prevent that from happening again. Rust is definitely not a magic no problems language. However, when I can find you two problems it would have prevented and they're both that bad, maybe we need more than "but sudo's been around a long time" as a better option.

Re: ninjed me!!!

Because sudo and su do very different things. Sudo has the functionality to allow users to perform only certain commands, to make per-user credential management possible without removing all the privileges, to have logging and monitoring of attempts, and a bunch of features that some people need and some people don't. Su lacks pretty much all of that. In situations where you don't need anything, personal machines often falling into that category, you can choose to save yourself the code and do without. You can also do without su by just allowing root to log in at the shell and no user account can switch to another. But if you include su, you do it because it does something you want, and if you include sudo, it's for the same basic reason. The benefits of sudo are often much more evident on multi-user shared servers, exactly the kind of systems for which it was first written and for which the entire Unix and Linux security model is designed.

Re: I disagree with this statement

That's a problem with rewriting, not a problem with Rust. If it was a problem with Rust, it would mean that something about the language itself made those happen, which it didn't. Rewriting anything complex is almost guaranteed to introduce some bugs, no matter what language you use, even if you use the same language. If you haven't experienced that, either doing it yourself or watching someone else do it, you haven't had much experience. Simultaneously, sometimes there's enough reasons to do a ground-up rewrite of something even when you know there will be debugging to get it to the same level of stability and functionality as the old thing. Everyone gets to decide on their own when that time has arrived and I've never seen it happen without a lot of disagreement.

Networking students need an explanation of the internet that can fit in their heads

Re: Networking students need an explanation of the internet that can fit in their heads

Funny, most of the copies I find online don't write it like that, because writing it like that is weird. Here's one:

"government of the people, by the people, for the people, shall not perish from the earth." is how they are using capitals. That's how all the search results on the first page are using capitals. That's also how most things are transcribed. To use a less US example, if we look at the famous Churchill speech, we can see that it's generally transcribed "That is the will of Parliament and the nation.", because Parliament is being referred to as a proper noun and "the nation" is a specific instance of a noun that's not a proper one.

The internet is the instance of internet we're referring to, mostly because those smaller other internets are not ones we interact with. The original comment clearly understands that there is more than one, but misunderstands what makes a noun a proper one. If there's only one instance of something, or if there's only one instance you choose to care about, that does not make nouns proper by default.

Re: Google maps for Networks !!! :)

But implementors of what, precisely, because if it's an engineer building WiFi equipment, they don't generally have to reimplement the networking part, they have to reimplement the wireless communication part which is very different, and after decoding that to supported traffic, the network equipment they're connecting to handles that part. If they're building that networking part, they're generally either writing code or connecting existing systems together and making them work correctly in a group. In the comment where I described these two groups, I did say that these were a simplification and not the only ones, but lumping everything into implementor is getting the set of students wrong. There is something the student is coming here to do first, and it's likely not poking bits down a single pipe.

Re: Google maps for Networks !!! :)

Depending on what part you are building, it can take a very long time to get from that to any part you actually do. I've seen people try to teach programming starting at the logic gate level, failing to recognize that the young students they expect to teach haven't written a single line of code, so learning about binary nand gates is not going to teach them anything they can use. If you don't teach them things they'll use, they will see the lessons as unimportant. They would be right, because until they've taken the five intermediate levels, they won't be able to solve any problems they actually have, whereas the course that started with some basic code managed to teach the students to solve some basic problems.

In another post, I posited two types of student, those who intend to be administrators and ones who intend to be programmers. Sending data down a single physical pipe helps neither of them because the admins need to connect lots of pipes together and the programmers at least want to be able to set the destination for the pipe they create and likely want more than one.

Re: Networking students need an explanation of the internet that can fit in their heads

There are a lot of nouns that refer to a single thing that aren't proper nouns and aren't capitalized. We do not need to capitalize "the World", even though when anyone says it, they only ever refer to one specific world. Nor would a correct transcription of politicians' speeches write it as "the People" or "the Country", nor environmental reports talking about the vast watery parts write that as "the Ocean". If you make up your own rules of grammar, you'll find people break them a lot because they're not actually rules, because it's not "the Grammar" either.

What's the goal?

I think the most important question when deciding to teach anything is to have an idea of who is reading this and what they intend to do at the end, then start with a high-level summary of that part. It doesn't mean you only cover the things they'll deal with most often, but it does at least change the order you cover them.

For networks specifically, there are at least two and probably more approaches which I will simplify as the administrator approach and the programmer approach. The administrator wants to use all these existing networking things from switches to software to connect their equipment to a network, that network to the internet, that network to another network over the internet without the rest of the internet getting in the middle, all of those things at the same time while consistently routing efficiently so traffic never goes over the more constrained or expensive or less secure parts unless it has to, then all the techniques you need to test that traffic does go where you want and to collect information about what it did so you can modify it. The programmer wants...exactly the same thing, but they want to do it from the perspective of writing a program that has some traffic and getting that traffic delivered, first over a network with no restrictions, then over a network that has many normal ones, then constrained ones, then from all those complex networking scenarios which means they'll also need to learn how those work in order to know what they need to include in their code. The introduction that works for one is likely to put off the other because the programmer doesn't want to start with how you configure VLANs and the administrator doesn't want to start by talking about what a socket's communication domain is.

Happy holidays: AI-enabled toys teach kids how to play with fire, sharp objects

Re: And none of them would be legal in EU

I'll tell you where I live. I live in a world where I thought GDPR was going to make lots of abuses illegal because the law said it and there were nice large penalties, large enough to keep things in line. I lived in a world where I let my optimism run wild. And I live in the world you have to live in where there has been almost no effect from what looked like a revolutionary privacy law. Where it's rarely enforced, and when it is it's against companies that did relatively little compared to the obvious abuses of larger tech companies. Where despite the law's ineffectiveness, politicians from the same countries that passed it are trying to weaken it. I need more than the confident assertions from someone to actually believe that these things get enforced. You disliked my "pseudo examples", which I wasn't really writing as examples, but I note you mentioned not a single piece of legislation that would stop these, not a single enforcement body, not a single example of these things not being available. If specificity is your objection, then why don't you cite the reasons for your confidence, since you must have them if you're not making assumptions.

Re: And none of them would be legal in EU

You assume that, but there are two points you should keep in mind:

1. Some of the laws you are probably thinking about, like the GDPR, allow you to do many things if you write them down somewhere. The report quotes many legal documents explaining what's going to happen to your data, and there's far more that GDPR allows you to do as long as the user has been informed than things it completely prohibits. Doing sketchy things can be legal if you tell people about it.

2. They're not enforcing those laws very strongly. Lots of illegal things under GDPR have happened. Not all of them have been investigated. Not all of the ones specifically reported to data protection authorities have been investigated. Not all of those reported by people with lots of money and lawyers get investigated. What makes you think these things, ostensibly basic toys, are going to get investigated? It may be illegal, but if nobody ever does anything about it, it doesn't look as if it was.

For all I know, you're including more laws than just GDPR. I could easily imagine a toy that tells children about matches being considered a product safety risk, but I could also see the laws never having been written to handle such a thing because the item itself isn't setting the fire, it's just giving more instructions about how something else could than we want. Just because something is dangerous doesn't mean the law intended to prevent dangerous things necessarily prevents it. Your confidence that the laws actually do handle this and that they'll have enough of or any effect seems optimistic to me.

Apple knits up $230 sock for your iPhone in time for Christmas

iPhone as singular proper noun

I often see people who have grammatical errors that really bother them and don't really bother me, except some cases where their complaints are what bothers me because what they think is incorrect grammar is actually normal, but I think I know what they must be feeling because, for some reason, I find it noticeable and unpleasant any time Apple talks about iPhones like this:

"Born from the idea of creating an additional pocket, its understated design fully encloses iPhone, expanding to fit more of a user's everyday items."

I don't think this is necessarily grammatically incorrect, but my brain just demands that there be a word between "encloses" and "iPhone". "Encloses an iPhone", "encloses your iPhone", "encloses the iPhone", all of those would be totally acceptable, but when they say "encloses iPhone", it somehow stands out very starkly as wrong. And in other languages I speak where articles are either absent or less often used, it is back to sounding normal again. Does anyone else have that?

Google to allow Android users with high pain tolerance to sideload unverified apps

Re: Handwave handwave, distraction distraction.

The problem is that anyone is able to look up the website that tells you how to jump through any set of hoops that involves clicking through screens. Most don't bother to because they have no reason, but those people who are willing to justify any loss of features or right to do what I want with the thing I bought in the name of security will often decide that, if it is possible for a child to manage it which it always is, that it's too easy. This works very well with the people who have a different incentive to block me from having that access.

I am worried that whatever Google's method is, it won't involve another security warning, because the method we have now already has two of those so why would a third make any difference? If it involves setting something in your Google account, getting a code from your manufacturer, or any of the many other things they've already used to lock features behind doors that may or may not agree to open for me, it will still be unacceptable.

VLC's keeper of the cone nets European free software gong

Re: Why is the register focused mostly on how VLC is gratis?

Who says they are? For example, when they quote others as saying that Kempf is the "the one who kept VLC free", they don't mean free of charge; the things he prevented wouldn't have introduced a purchase price. I admit that they also don't mean the version of free you're talking about, because you can still have a piece of software under GPL2+ that comes with unwanted additions. But not only has he maintained the code under its original license and kept it up to date and very full-featured, he has kept it free of plenty of things that could have helped him while harming users, for which we are grateful.

Is it possible your view on the article says more about your biases and preferences than anything the article actually had an opinion on?

Aviation watchdog says organized drone attacks will shut UK airports 'sooner or later'

Re: Fight fire with fire?

If we calculate the way that people often do when there hasn't been a recent disaster, we can answer that question. It would go something like this:

The closure of Gatwick cost £50M. That has not happened again in seven years. If we only put teams at the busiest 40 airports, that's £179k per airport per year, which for a 24-hour service means an expected hourly benefit of £20.38. If it costs more than £20.38 per hour to hire staff and equipment, then it's not worth doing it.

Which is not the right way to do this calculation since it's not considering actual risk. It's a very common way to calculate it because it is much easier than calculating actual risk and the people doing it feel like they're being cautious because their calculation assumes that the disaster will happen right now when they know the next one is likely quite a way off. If the next version of this is likely to be a lot worse or if the chances of having it are higher, then the benefit goes up and the comparison changes. However, the "can we afford not to" approach is not any better. It prevents the important work of considering approaches that might work better, be more efficient, and whether we need to do this in the first place. Lots of bad policies have gone into place because a problem was scary enough that it escaped the "not my problem right now" period into the "we must do something, this is something" one.

Not only do we not have a good estimate of risk here, we have no idea what it would take or if it is even possible to build a team as described. How feasible is a drone chase squad? How hard is it for attackers to send up a lot more drones so the chasing team can't chase them all? How hard to speed up their drones so the chasing ones can't catch them? How good is the information they would use to try this. When the chasing drones catch up to the interfering drones, what can they actually do to them to stop them being around; they generally aren't equipped with high-strength butterfly nets or machine guns, and neither could be feasibly attached to anything even slightly cheap. A cool-sounding solution doesn't mean that it works or is achievable.

China hates crypto and scams, but is now outraged USA acquired bitcoin from a scammer

Re: How dare you nick that before us!

That is a possibility, but it assumes facts not in evidence, namely that China had any intention to arrest the person concerned. We don't have any information about whether they knew about, cared about, or had any plans to deal with the crimes alleged in the US indictment. One other assumption you appear to have made is that China was highly represented in the set of victims, whereas many of the scam operations specialize in other countries, especially English-speaking ones. Not all of them, and China has historically cared and done more about those that either targeted Chinese consumers or used kidnapped Chinese citizens, but plenty of them use kidnapped citizens from elsewhere and target other countries, both because they may have more money to steal and because those countries have less ability to get the camps shut down.

But both of those assumptions, while they rely on things the article didn't say, could well be true. China could ask the US to share the cash with victims they have identified there and that does sometimes work, but they may assume that the US will refuse and are preemptively complaining. They may have other reasons for complaining which are less public-spirited though, or it could be a default technique to blame whoever you're unhappy with for whatever thing recently happened.

Secret setting hints haptic feedback coming to Windows 11 UI

Do you really expect this is going to be something admins have to bother themselves with? There are plenty of Windows changes that admins have a reason to care about but this, while I don't think there's any particular benefit to it, also doesn't seem to have any particular downside. Will the fact that 3% of laptops make a vibration when you move a window be such a big problem that it becomes an IT task to stop it?

Re: But

Depending on when they use it, haptic feedback can make some things easier to know when they've happened, which is one reason they're somewhat common on phones because there's less space to use visuals to do that. It's a subjective UX thing, but sometimes, people like it. Whether anyone will here will depend partially on when Microsoft expects to send any vibration feedback and mostly on who has a computer capable of delivering that, because my computers don't have any vibration hardware. I don't know how well haptic feedback works on trackpads that use it to simulate clicks because I don't know if they can also do other types of things, and if the vibration feedback feels like a click, it will probably confuse more people than it helps.

Microsoft teases agents that become ‘independent users within the workforce’

Re: Really ?

Not a salary. That would be too easy to plan for financially. They will get a random amount every month depending on what the software did, which was decided by the software, and since you already agreed to run the software, you agreed to pay for the usage and you got the "benefit" of the usage, so you can't question that bill. I wonder if I can get that deal instead of my salary. Yes, I know I didn't do anything correctly today, but you have consumed 48515931 of my thought cycles and therefore you owe me half the company.

Who's watching the watchers? This Mozilla fellow, and her Surveillance Watch map

Re: KANOTIX is a Linux distribution

How does read-only RAM work? There is such a thing as RAM-resident malware. Of course, it won't persist past a restart, but it can grab things from the session, including your access to wherever you're storing or processing things you intend to keep after the session. Nothing kills interest in something quite as thoroughly or quickly as someone claiming it's impervious to attack.

FBI prevails over convicted fraudster in $345M destroyed Bitcoin dispute

Re: I wonder why they wiped his drives

When you're being investigated for a crime, the investigators will want all of your backups to make sure they are indeed all backups rather than decoys, one of which contains the evidence they're looking for. If they succeed at getting all of them, then what happens to one copy is what happens to all copies. If they don't, it means you've hidden evidence from them which can be a separate crime. Do you see now why it's a question worth asking?

Although I do agree with you in the limited sense that the lack of backups is one reason I don't believe this particular criminal actually had any cryptocurrency. I have other reasons to think that too. That doesn't change the general case being a question we should have better answers to.

Re: I wonder why they wiped his drives

Perhaps the better question is why they aren't legally bound to return them. The only options presented according to the article were giving them access and getting wiped devices back or not giving them access and having the devices destroyed. Either way, the person wouldn't get access to the data on the drives, which makes sense if it was criminal, but most of it probably wouldn't be.

If we're only answering the question of what should happen if there's no requirement to return property, then it's a really easy question to answer, but it's easy because it's an almost entirely meaningless question because the only value lost in the case is a years-old hard drive which is relatively cheap. The important question about data which might be more valuable is one that we should consider, both from the perspective of what the current law is and what we think the law should be. I think we can both recognize that the data stored on a drive can be valuable, either objectively like cryptocurrency* or subjectively like sentimental photos, code that took a long time to write but nobody else cares about, etc. We should decide what rights suspects or criminals have to maintain access to this.

* Even though I am quite certain that the cryptocurrency claimed in this case never existed. This criminal doesn't have to be telling the truth for there to be a potentially big problem with treatment of seized storage devices.

Meta can't afford its $600B love letter to Trump

Re: By the time all this is over

The difference between deflationary and inflationary economic disasters is often a factor of what the government or central bank does in response, and we don't know what they will do and they probably don't either. Partially, that's because they don't have much control either since they take a look at what's happening, guess what it's going to do, and try to take an action to make it less bad which has the chance to succeed or just roll over to more bad but in the other direction. Support either to the investors who are losing money on the bad debts or to individuals whose savings were partially invested with those investors could easily cause inflation, whereas no support could cause a worse deflation problem. Managing the level of support that is enough to prevent the crisis getting worse but not so much that inflation is caused is very difficult even if the people doing it were knowledgeable and trustworthy.

Re: Have to have somewhere to spend all that money

Datacenters are costly to build from a lot of perspectives, but running out of materials isn't really a problem. The materials needed to build the structures would be a rather small part of them because each building is so expensive, so the quantity is not that high. We spend more on building commercial or residential real estate than would be spent on the buildings. Other resources would be more constrained but mostly in a local sense. Datacenters use tons of water, and some of the places they want to put them don't have plans for how to get that much, but that's more a problem of local access and infrastructure cost than a lack of water altogether, and if that was the biggest issue, nothing prevents a datacenter from being more efficient with water; they don't because it's cheaper to waste it, but they easily could. Power is another big problem, and probably one they don't intend to fully solve, but a lot of the money they claim to be spending is on new power generation and this they could also achieve if they allocated enough of the money to it. The really expensive part is all the stuff they're putting into the datacenters, but materials isn't the reason. A top of the line GPU isn't expensive because of the raw materials, but the manufacturing and the intellectual work needed to design them. Running it is expensive because of all the power needed to run it and cool it.

If all the promised things were to be built, materials would not be the problem. There would be lots of problems, including these:

1. All the environmental consequences of building and powering these things.

2. The costs of rushing to solutions and therefore doing something they could have done well in a worse but faster way.

3. The lack of commercial reasons to have that much of it.

4. The fact that they don't age very well unless well-maintained, so they're not even very useful a couple decades from now when someone might want them.

And because they don't have all that money just sitting around, there are a lot more problems related to the finances.

OpenAI's Altman and Friar walk back remarks about federal loan guarantees

Re: Wow, this is going quick

Indeed? Would you please name one? Since you have so many targets, pick one that was as bad or worse. I don't doubt that there are more, and I would like to see them punished as well, but your statement suggests two things I think you'd have a hard time defending: that this is happening frequently and in plain sight, when in fact fraudulent companies including Theranos go to great extents to hide it, and that the response was unfairly harsh on Holmes, when the appropriate response would be to similarly punish anyone else who was doing anything similar.

'Vibe coding' named Word of the Year. Developers everywhere faceplant

Re: Grammar pedant here

Because "architect" as a verb has been a synonym of "design" for many more decades than computers have existed, partially because the noun "architect" has referred to people who design things other than buildings. Its use in software design might be to distinguish fundamental large-scale design decisions which need to be made at the beginning of any large project from the many other design decisions that are relevant to parts or can be added on as features, which when you think about it, isn't that bad an analogy to the architecture you were contrasting it with. You can't invent new rules of English or abolish synonyms, no matter how much you want to defend the honor of architects.

Re: Garbage

I had not read about that before, and I spent far too long trying to parse the 8-stage example in that article. If that is anything like what people were actually supposed to enter, I'm surprised they bothered.

Re: Vibe

In the sense that the invoice gets chopped up into little bits that you get one by one, yes. In the total expenses sense, though, they are more similar.

Rideshare giant moves 200 Macs out of the cloud, saves $2.4 million

I totally expect they've done the calculations and are correct, especially with Macs. However, remember that these are exactly the same finance people who are getting blamed repeatedly throughout this comment section for failing to calculate the costs of the last version. Sometimes, financial decisions are not made with the complete sets of calculations you expect which often leads to having to do similar calculations later on to clean up the mess caused the first time.

In my experience, this especially applies to cloud versus non-cloud, where a lot of the decision gets made by IT and engineering and finance doesn't directly contribute to it at the start. It doesn't matter which decision they make; I've seen bad choices in both directions. Usually, finance does come in later and ask or demand for prices to drop, but they don't know or care what the choice was or try to figure out which approach is better. Maybe if finance had more tech knowledge and the other teams had more attention to financial success, but in my experience, they don't, there's often a lot of compartmentalization between the teams, and everyone wants the easiest solution for whatever they're doing, which leads to little or not-so-little problems.

Re: Yet another case..

I am saying that generic "cloud is always more expensive" arguments are wrong enough of the time that they aren't useful to make, and I don't just refer to the extreme spikiness exceptions you've mentioned. There are various situations where renting machines can be cheaper, and you have to evaluate those costs manually*.

I was also saying that Apple machines make for a very unusual price comparison. I've been saying that for some time. When AWS launched their Macs as a service, I commented that thirty days of rental equals the cost to buy the Mac concerned. That's nothing like normal cloud, where thirty days rental of a server is not enough to buy anything as powerful.

* One example which also often comes down in favor of cloud is a place with very low requirements. There's a base cost to have even one server in a colo. I've done that calculation several times, and until you reach a certain amount of hardware, you can have more capacity in the cloud, including redundancy, than running the bare minimum on your own hardware costs. Depending on the environment, that can sometimes be handled by running the one or few servers in the office of the organization involved, but places that need a few small VMs are also commonly the places that don't have a suitable facility or, in some cases, any office at all. The ones in the middle are where you often need to calculate for much longer to estimate what the equipment and facilities would cost and what the rental in the cloud would cost to compare.

Re: Yet another case..

Maybe being a little less general, though, unless you want to be wrong sometime which doesn't help. Cloud can be more expensive a lot of the time, but if you want a way to make it a lot more comparatively expensive than it otherwise would be, try to run Macs in it. Macs clearly weren't designed for this because you can't run Mac OS in a VM on commodity hardware, or custom hardware, and they don't have DC-scale hardware you can buy from Apple. Combine that with the requirement to rent them by the day, which the article and Grab's statement suggest is Apple's doing although I thought that was AWS's choice, and you've got a recipe for something that is even less connected to hardware prices than normal cloud hosting would be.

If you use this example to predict what other price comparisons would look like, you're going to be making overestimates which won't convince many people who check your calculations. Comparing prices requires creating detailed plans of what infrastructure you're going to use and what you need to set it up. People with an agenda, usually a sales commission, who decide that it can all be done from the cloud, it's definitely less expensive, and let's not bother with those boring plans, are often wrong and always annoying. Unfortunately, the people who have an agenda and say that running in the cloud is always less functional and more expensive, and you don't need to consider those boring plans to know that, are equally so.

Boffins: cloud computing's on-demand biz model is failing us

Re: Remember

Your point being that you can buy boxes with GPUs in them? Because if they can do their research on one of those, great, although depending on how long they need it, renting a similar cloud machine would probably still be cheaper. The problem being that most of the kinds of things they're running can't be run on one of those. Depending on the work, they'll either need a very large number of those or they'll need something completely different, for example something with a lot more CPU power since that is only optimized for GPU.

Or, if they're using GPUs, they might want faster performance on those. That box is as cheap as it is because it doesn't use typical VRAM with its GPUs. In order to be able to fit large models in the RAM, they've gone for cheaper but much slower LPDDR5 shared with the CPU than what you'd find on a normal GPU or on their other accelerators. The cluster I had access to had a lot of real GPUs and was no doubt very expensive to create and operate. It only made sense because the cost could be shared among the biology, physics, and astronomy departments as well as little extra users like me, and people still had to queue and negotiate for sufficient access. A $4000 box with nice GPU performance numbers if you use Nvidia's marketing with numbers for FP4 performance which most research cannot use is really not the same thing.

Re: Sounds like a good use for spot instances ..

The article covered that. They can't do their computing in little chunks that can get interrupted. They need a bunch of instances all running at the same time that stay running until they're done. With some modification of the software they're running, they could probably make it more fault-tolerant so it can restore itself when instances become unavailable, but that won't fix the biggest problem of needing a lot of capacity at once. It just means it will be stalled rather than broken.

Unfortunately, no matter how you go about getting that capacity, that is expensive. You can wait until the cloud provider you're using has that much free, you can buy the hardware for the few times you'll use it, but any way you manage it, it comes at a high price.

Re: Remember

Except for the types of projects covered in the article, it's not cheaper to use your own hardware in the long term because it would be idle for a lot of the time. Buying your own means obtaining a lot of expensive hardware and facilities to install it in just to have it powered down most of the time. Bigger universities often build a computing resource which is shared between project teams in some way where they can express the amount of compute they need and get put in a queue*, but individual teams are not going to have the funding to do that, so if they can't do it altogether, then they have fewer options.

The problems they are having are for very spiky use cases which are a strong point of the cloud but, as the article points out, not infinitely so. The cloud providers aren't too eager to have lots of idle expensive kit either, so they don't overprovision enough that lots of instances can be set up simultaneously. Nobody wants to have lots of idle expensive kit which is why it is hard no matter who you get your equipment from. Running your own hardware is not a magic solution to this unless you started with the magic massive grant, and if you did, the cloud bill might still be the cheaper option leaving more of the magic grant for other expensive things.

* The shared computer has its costs as well. When I was a student, I had access to that and the ability to run jobs. You had to schedule those well in advance and occasionally coordinate with other researchers to make sure you weren't going to cause problems for one another by running too long or interrupting something before it was done.

You'll never guess what the most common passwords are. Oh, wait, yes you will

Re: What about username?

The username is going to be stored in cleartext because they use that to identify you. If you want to have more random data, stick it onto your password to make it longer*, because that's the part that gets hashed if they're doing it correctly. Admittedly, I do kind of do this by using separate emails for different sites, but that's for spam detection and prevention, not account security.

* If they have a maximum password length, then you have a bit better of an argument and a reason to worry about what they're doing with the password you give them.

Re: leave their door key "hidden"

"I wonder how many of the passwords covered in the article were setup as a honeypot ?"

Given that the point of a honeypot is to know when someone got in and what they did, that would be none of them. Honeypots are a little more complex than having a bad password on someone else's site. In addition to being useless, deliberately trying to do that is likely a terms of service violation on that site.

Re: Where are they getting the passwords from?

Some of those will be cleartext or unsalted hashes, both of which make frequency analysis easier. Others will be salted hashes which they tried some old favorites against to make sure they're still in use. Unfortunately, good password storage is another thing that we've known how to do for some time and yet we will probably never see the end of yet another system storing them badly.