Posts by doublelayer

Punkt MC02: As private, and pricey, as a Swiss bank account

Re: About google translate mentioned in the article

As far as I can see, that's basically just a proxy. While it works, Google will only see the proxy's address instead of yours, so less tracking of you, but they'll still see the material you're translating and the proxy will see both. This is also until Google breaks it, either deliberately or accidentally.

Fortunately, the AI boom has also meant more capable models which can be run offline and are actually open source. For instance, the models that are now available in Firefox, while they support only a subset of languages, provide reasonable quality and don't use a cloud server to do this.

Re: No Need For Privacy?

I wonder how much of this is privacy theater. If I need more privacy than I can achieve with the hardware I have*, I'm building my own environment. That limits my hardware options and I may have to do some modifications to the software, but using something open means I have at least a little more ability to do that. A modified Lineage or Graphene environment doesn't have a connection to someone else's cloud, doesn't have a mail client that only works on an email account I'm unlikely to use, and still lets me customize as needed. True, that means I lose their VPN, but I'm not quite sure whether their VPN is any more trustworthy than another.

Google paying to be default search on phones is totally against antitrust law, judge rules

Three reasons:

1. Because you're just wrong. Using Bing, the first result for "change search engine on Amazon Fire tablet" tells you how to do exactly that.

2. You can also install other browsers on that tablet. So even if you couldn't change the search engine, and you can, you could install a different browser and set it there.

3. Because Bing is not a near monopoly in search and Amazon is not a near monopoly in tablets. Not that many people buy Fire tablets. This ruling didn't say that paying to have your search engine used was illegal for everybody, but that doing it from such a dominant position to crowd out competition was anticompetitive.

Second patient receives the Neuralink implant

Problem description indicates design fault

Musk said, "The long term aspiration of Neuralink is to improve the AI human symbiosis by increasing the bandwidth of the communication. Because, even in the most benign scenario of AI, you have to consider that the AI is simply going to get bored waiting for you to spit out a few words."

Or, maybe, you could program the AI* not to do boredom. There is no reason why the AI should need to feel bored, and several downsides. An AI that gets annoyed at slow users probably doesn't need faster users. It needs to be a better AI. The same goes for all sorts of other emotions such as anger, schadenfreude, terror, hatred, etc. In fact, we could probably manage without some of the positive ones as well.

The more I hear from "visionaries" or "futurists", the more I see people who read a lot of science fiction without thinking as much as any one of the authors that wrote it. The writer was trying to write an interesting book. The visionary is trying to predict the future and plan the way there. You would think they'd recognize that they need to think even more to successfully do that.

* AI: The science fiction concept of a conscious, intelligent program. Not an LLM. Those don't have emotions.

50 years ago, CP/M started the microcomputer revolution

Re: CP/M Gets AC From Idiot To Mostly Competent!!!!

"What is the core point here apart from making a wrong statement by getting a date a decade wrong?"

We agree that the dates are wrong. Their point, which is mostly irrelevant to TeX, how powerful it was, and when it existed, is that some people care about the visual layout. They said this in order to respond to someone who did not care about the layout:

AC: "if I was writing a modern replacement for "War and Peace", surely I'm interested in the words and not the fonts?"

Their main point was that people do care about layouts sometimes, and they are the reason why WYSIWYG tools existed, and before WYSIWYG tools were practical, non-WYSIWYG tools which handled more than just the words of a document were used. Incidentally, they never claimed that LaTeX was WYSIWYG as it was specifically their example of a non-WYSIWYG tool. They got the tool wrong in that description, but their core point, although it has mostly been lost to smaller details, is correct. Some people do care about more than the words. They are the reason why WYSIWYG editors have existed, and that is at least partially the reason why LibreOffice has so many features that take up so many resources.

Re: CP/M Gets AC From Idiot To Mostly Competent!!!!

"TeX itself is a decade older, and contemporaneous with the Alto, but TeX is not even slightly WYSIWYG."

But they weren't saying that it was. They were saying that it was a non-WYSIWYG way of writing when you care about the visual design, rather than just writing down words, pointing out that, even without WYSIWYG software, people wanted to do that. Most of the LaTeX software isn't WYSIWYG either, though they've now got some that render instantly.

Tesla that killed motorcyclist was in Full Self-Driving mode

Re: human was just a passenger

I think self-driving cars can be a good thing. I expressed so yesterday in these forums. However, what Tesla has, and for that matter all the other things that an individual consumer can buy, are not self-driving and it's important that we make this clear. There may be a time where some cars are safe enough to be driven by software, but that time is not now. Right now, the perfect isn't being the enemy of the good. The perfect and the extremely bad are teaming up to be the enemy of the good. If people keep seeing the stories of supposedly "full self driving" vehicles killing pedestrians, passengers, child-sized mannequins, and everything else that Teslas can't prevent themselves from hitting, then the public is going to believe that self-driving vehicles are a misnomer and never will be safe. This means that we should do two things.

The first is preventing anyone from saying, suggesting, or implying that their car can drive by itself when it cannot. That means that level 4, I.E. the user's attention is not required at all during automated driving, at least, is required before using any of these terms. Perhaps this will need to be extended to level 5. Second, that people who enable features that are not self-driving should be as liable for damage caused as anything else. They can turn around and sue the manufacturer if they want, though they'll probably find it hard because they now have a manual full of paraphrases of "yes, we lied about the self-driving", but they can try. The manufacturers should be liable for selling a product using deceptive tactics, but the driver needs to be liable for using them in a dangerous way.

Linux updates with an undo function? Some distros have that

Re: Atomicity

"I think mobile devices get this right—OTA updates, sandboxed applications, and fool-proof system upgrades..."

Sandboxed applications work great until you want to do something with more than one of them that wasn't already thoroughly thought through by its author. If an application wasn't courteous enough to store your data in the accessible storage locations, then you have an annoying time getting it back out, and that's if you have root access. If you don't, you're probably not getting it out, and it doesn't matter too much if you can because you'll never get it back in. By the way, if it does store the data in accessible locations, then there isn't much sandboxing left because anything with access to the storage can read and write everything there.

Also, I'm not sure calling Android system updates "foolproof" is entirely honest. They rarely brick things, but that's mostly due to the small number of them and the fact that they should be easy to test before the manufacturer releases them. If they do brick things, there is no automatic recovery. There is no manually selecting a recovery. No backup image is stored because there's not much storage in phones and they've already taken plenty for the system-installed apps, so taking double that for a backup partition isn't considered a good option. Since everything is custom to the device, your only options to recover from a bricked device are these:

1. Find a system image from your manufacturer (a few of them have it, but mostly good luck). Manually boot to recovery and sideload it over (unless it won't let you, which is many of them).

2. Go to XDA and find a post by someone whose identity and trustworthiness you don't know. Download the image and tools they provided and run them. Hope that they don't contain malware and that they're actually for the device you have.

I don't think that mobile devices are a great model for how we should do updates. Ripping and replacing a root partition to update a single binary in it just means using about a hundred times more bandwidth than you need without providing any more certainty that it will work or that you can recover if it didn't. Having two root partitions, with or without full replacement on an update, at least lets you recover from a bad update. Snapshots give you even more ability to rewind.

Ransomware infection cuts off blood supply to 250+ hospitals

Re: Out of the generosity of their hearts?

There are a lot of nonprofits in the industry. They can still sell services at an expensive price so long as they reinvest the profits into their organization or pay it to the employees rather than having shareholders to return it to. When doing blood donations, they likely think that the potential for profit is low and people may be more willing to donate to a nonprofit. Even many hospitals are nonprofits as well, though by no means all of them. There are many for-profit parts, including insurance, independent labs and clinics, a lot of individual practices, and who knows how many middlemen, but that doesn't mean that every part is.

Re: Data Stewardship License (Overran the Edit Time-Window)

From their description, they are using a fallback plan. We don't know how effective that is, but there is a reason why blood suppliers from other places are sending their backup blood to this organization, not directly to hospitals. Clearly, they still have some ability to get the blood where it needs to go, just a degraded capacity.

Also, many of your alternative methods would have very different effects on their operations. An earthquake near their main computers would likely leave those in other locations (four US states covered) undamaged. A blizzard might interrupt power, but backup power would still work fine, but driving might be the problem. They would need different contingency plans for many of those scenarios, and only they know whether they have them and how good they are.

Five months after takedown, LockBit is a shadow of its former self

No, can't have that. That would give the evil west something, and that has to be prevented at all costs. Lots of other options are acceptable: imprisonment, forced work on some state computer thing, just take all his money and set him free to make some more, but there will be no sending criminals away for someone else to try. I'm also guessing that, until law enforcement announced his identity, the attention from the central government was probably quite low.

Probably a record of a specific contact and payment method, so something that can be used to track them down, but not as convenient as names and addresses of its members. Affiliates that were good at their jobs would probably have good enough opsec that their contact method doesn't identify them and, for those who got payments well before the raids, have probably already extracted their money and hidden again. Those who are not so good could perhaps be identified by law enforcement based on their connection to the organization.

DigiCert gives unlucky folks 24 hours to replace doomed certificates after code blunder

Well, yes, that would have been simpler, but on basically any other descriptor (better, more likely to actually get used, more functional, less frustrating, less corrupt, ...) it would have come out worse. Perhaps the only simpler method that would be anywhere close to secure is if certificates were granted by domain registries, mainly because a lot of certificates are granted because the person requesting them has DNS control. Even then, there are reasons to prefer something else.

Re: Anyone else smell a tipping point coming...

I'm not sure how that will change. Getting more CAs is not a quick process given how much trust is required. Dispensing with CAs is even harder.

Compared to other distros, Vanilla OS 2 'Orchid' is rewriting how Linux works

Re: chicken come home to roost

So your answer to what better thing that USB replaced is...USB? I don't think they were talking about the port shape, and nothing about USB limits how many of them the laptop manufacturers put on their devices. That's a separate issue which doesn't depend on what ports they've provided not enough of.

Re: Dual Root.

For updates, it's not exactly a new concept. It's not often done on computers nowadays, but mostly that's due to the long period where disk space was at a premium and reserving lots of it for the image you're not using wasn't considered worth it. For instance, when people did an in-place update from Windows 7 or 8 to 10, the process included moving all the old Windows files, installing the new ones, and if you didn't like the update, you could revert by moving the old files back. In the meantime, many gigabytes of disk space would be used, and I remember some unhappy people talking about that.

However, from your other suggestion: "Antivirus should also embrace this, because as soon one of the roots gets screwed (some honeypot techniques), it should raise an exception and get the virus/malware on the act." That is less likely to work out well. There are only so many techniques that can be used that reliably. It could easily turn into a CroudStrike-esque situation where some program gets updated and starts doing something which is incorrectly identified as malware. Using the previous methods, antivirus software would block that program from running and quarantine its files, and someone would have to go tell it to stop doing that. With this behavior, the antivirus program would force the computer to the old disk image, possibly damaging the user's work, rebooting to apply it, and then the program would install the update and start the loop all over again. If the antivirus was less sensitive, then it might only do this after malware tried to elevate, meaning that the old disk to which it is resetting would still have the malware on it anyway.

US border cops really must get a warrant in NY before searching your phones, devices

Re: Unfortunately

I agree that this is what should happen. I am less confident than you appear to be that this is what will happen. Partially, this is because the court does not have to reverse any precedents to confirm the CBP's exception to warrants, an exception that would appear illegal to me. It is also because today's court is quite different from the 2014 court that ruled in the Riley case. There are three judges now that weren't there before, the political situation is very different, and those judges and others have proven more willing to overturn precedents when they disagree with them.

In particular, the US has become more hostile to migrants, and it would be easy for CBP to be seen as a migrant-specific enforcement body even though it is not. A ruling indicating that noncitizens are not protected during entry would not surprise me. Unfortunately, neither would a more expansive version including citizens and extending the situations where it applies. I do not believe that judgement is legally correct, but I am less confident that this is the basis on which it will be decided.

Re: Unfortunately

Their previous decision, as explained in the article, did not consider the border police. This judge has extended it to include them. Since other courts have permitted their warrantless searches in the past, they can easily argue, if they want, that they are merely upholding the previous status quo where being near a border or in an airport invalidates those rights. They've done that before. That is not the same as reversing their other rulings. Whether that argument has any legal validity doesn't matter. If they prefer it, they do not have to reverse anything to uphold it, and in fact supporting this ruling will result in more changes as CBP authority in other locations would be ruled illegal.

How deliciously binary: AI has yet to pay off – or is transforming business

Re: Snake oil

This is the problem when you assume that what you don't need is also unnecessary for everyone else.

"Self driving cars are a particularly good example. We don't really need self driving cars."

Let's see your arguments:

"For occassions when we don't want to drive, there's taxis."

Unless you're traveling in a way that taxis don't want to. For instance, a long distance that isn't already covered by public transportation. Taxis work in cities, not so well in suburbs, and may not be available at all in rural places. From your comment, I'm guessing you've got access to taxis at convenient prices and wait times, but not everyone does.

"The "work whilst your travel" argument has been lost, because if you can work in the car on the way to the office one can also never leave home in the first place and acocmplish the same thing."

Unless, that is, you might have to travel somewhere and still want to work. You don't have to work while commuting to an office, but what if you have to drive out to a variety of locations during the day and could work while doing that? Or what if you want to travel to somewhere else and to do something, work or leisure, while you're doing that? I'm guessing from your comment that you mostly drive to commute or used to do so, but that doesn't apply to everyone.

The many other purposes of automatic driving weren't considered. There are many companies that want to have those for automated cargo delivery. The human drivers don't like this idea, but the people paying for deliveries would like it if it can be done more cheaply. People who cannot drive may like the idea because it gives them independence in transportation that they now lack. People who like to go on road trips may appreciate doing something else while still using their preferred mode of transportation. Families with only one car may appreciate the ability to send the vehicle unattended to pick someone up rather than having to do that work manually. From your comment, I'm guessing that none of these situations apply to you.

Be careful when you say that something is a pointless waste of time that nobody needs. Sometimes, people have different circumstances to you which is why someone is spending money trying to solve their problem. If all the things I don't like and would never buy did not exist, your life would likely be less pleasant than it is, because it is quite likely that some of those things are things you use frequently.

To be fair, there are lots of things where calculating the ROI is impractical and sometimes dangerous. For example, calculate the ROI on a new backup system. They can be very expensive, especially if you have a good one, meaning a system that hooks into everything that needs to be backed up, has lots of data capacity, has many tiers of storage accessibility and security, and has been developed thoroughly by the staff so that there's no running around when a backup needs to be restored because they've already developed the restore processes and tested them. Now the finance department wants to see the report on how much we've got for all that time and money.

The answer: either something really bad happened in the meantime and you have a good number to tell them after analyzing all their reports on the event to get the numbers, or it's really simple because the return thus far has been zero, if not negative counting the running costs. However, not having it is still worse than having it, and excessive zeal to calculate a return can cause more problems than it solves.

That doesn't mean that AI is something to spend any money on, but just because it's difficult or impractical to calculate the ROI on something isn't enough to disqualify it. Whether it makes any sense as a business model might be a better reason.

Re: It'll still be the source of useless trash

Admittedly, those filter boxes rarely work unless this is one manufacturer's set of products, and sometimes not even then. Many sites either lack the filters that we care about or someone fills them in with garbage. I'm thinking of spec lists, lists which go into the filters, which look like this:

Size: 120*58*20mm

Internal memory: included

Memory card: supported

Waterproof: Water resistant design (translation: no)

Material: metal+plastic

However, I don't expect that their bot will be much better at sorting through descriptions or reviews to figure out the real answer. True, if it were a human reading them, it might be more obvious which parts are correct. For instance, for the device above, the disclaimer in the description that indicates that it's not waterproof could be used to cancel out the meaningless stuff in the spec list and they probably have an actual number for internal memory and a specific type of storage card. However, when faced with conflicting information, I am not confident that the bot will figure this out.

Malaysia is working on an internet 'kill switch', says minister

Re: Kill switch?

The great thing about it is that you don't actually have to know what it can do. Maybe it will be like India's, where it kills all the mobile internet connections because that's what the average person has, but keeps the wired ones so that businesses can still operate. Maybe it will be like China's where individual sites get blocked and attempts to visit get reported. Maybe it will be like the one China uses in Xinjiang which actually turns off all network traffic (presumably except for government and companies that are working with them). Maybe it will be less effective, as with many DNS-based blocking attempts. You don't need to know which one it is, because the entire point of having any of the above is that, if you're unhappy, this can be used to make sure that your unhappiness wouldn't result in any change.

Automation needed to fight army of AI content harvesters stalking the web

Re: re: remove GoogleBot restrictions?

So that people can find it later on, and so that visitors can actually find things despite the rudimentary and usually nonfunctional search boxes, if the site has one at all. I frequently find something on large, disorganized websites by doing a DDG search with the site: filter. There is one site I've done that with that blocks something needed for that to work, so I can't. Thanks to that decision, they've changed some bot accesses of the text pages to my manually clicking through their blog pages to find the post from seven years ago that I was looking for. Since I was still retrieving the many images in the way because I was using a normal browser, I probably equaled the bandwidth usage for a bot for some time just for that one search.

No, really, please ban Chinese DJI drones from America's skies, senators are urged

That comment was not serious, and your response to it, in addition to missing that important fact, is also wrong.

Let's consider a theoretical world where DJI drones are linked in with Huawei-built towers, which to be clear, is not happening. No, uploading video taken during a ten minute flight does not take as much power as flying for ten minutes. Flying around takes lots of power. Transmitting data has nowhere near the power requirements. Also, in our theoretical world, it doesn't have to fly to the tower. It can send to the tower while standing comfortably on the ground, perhaps on the charging station on which the user places it after flight.

In your zeal to disprove something that nobody believes, you've invented several problems with the concept that are not real. The drones are refraining from sending video, but not because it wouldn't be possible. They are refraining from sending the video because A) it would be expensive in time and money to get the infrastructure to transmit it, B) it would be expensive in time and money to get the infrastructure to store it, C) it would be detectable unless they spend even more time and money hiding it, D) if discovered, they'd probably lose customers, and perhaps most importantly E) nobody wants the data that would be collected by so doing anyway. If you can find a way round those five things, I can build you a transmission system that will have few power-related problems.

Google DeepMind's latest models kinda sorta take silver at Math Olympiad

Re: might make sense

For most real world programming problems, explaining the whole system is the problem that makes the rest of these unimportant. When I have program design meetings, the two major challenges before us are the following:

1. Getting sufficient description of the parts of the problem that the user understands so we know what we need to do.

2. Making sure that the parts of the problem the user doesn't understand* are sufficiently clear that we can still do what we need to.

* For example, security or efficiency. Even the most detailed of nontechnical program descriptions might say something like "a secure user login system with multifactor authentication". It is our responsibility to provide that and ensure that it is in fact secure. That filling in of gaps is not something the user should be expected to do, but it is still required for the program to work.

Any statement of the problem that is detailed enough to have a mathematical proof of correctness or security could be converted into code automatically. That isn't necessarily proof that it would be adequate for the job. For instance, I'm reminded of some pieces of code that researchers at my university were very proud of because they could be proven correct, but I could write some code in about five minutes that ran a hundred times faster and produced identical results. The proofs would be harder or impossible, but the result for anyone wanting the results in production would favor mine.

Video game actors strike because they fear an attack of the AI clones

Re: How to detect a clone

I don't care if they make AI-generated images and use them as characters. I do care if they decide they have the right to duplicate people without asking and with no limitation on what they do with them. This doesn't matter whether those people are recognizable, famous, well-paid, or anything else. If they want to do that, they can write a contract that says "We want to record video of you and use it to generate more video of a fake character that will look exactly like you, and that generated video will show you doing anything we want", then ask people how much they have to be paid to agree to it. I don't mind if people do agree to it, and I suspect that you'll find many who don't mind at all. However, don't hide that's what you're doing, don't assume that something else automatically grants you the right to do it, and if you have problems getting people you want to agree to this, consider adding on some extra restrictions.

Re: Do the work, get paid, move on

They don't have to do it that way. They could easily pay actors the same way they pay many other people who do jobs, creative or not. Mine, for instance. I get paid to write some software. They don't pay me each time they run it. We negotiated how much they had to pay to get the software when I was hired. If they do that with an actor, no problem. The reason they don't is usually that they don't have enough money to do that, so they offer to continue paying the actor from money that comes in later instead of paying up front. You could also do software that way: I'll get paid less while writing it, then you give me a portion of the license fees.

Neither has any connection to the AI work. If they buy the software writing from me, they get that piece of software. They don't get other pieces of software I write. They don't even get fixes to that one unless I am still employed. When hiring an actor, you don't get rights to everything about them forever, you get the rights to the performance they just did for you. You want to keep showing that video of them following the script? Great. You want to use their picture in a big machine learning training thing? Get permission to do that or you don't get to.

FYI: Data from deleted GitHub repos may not actually be deleted

Re: "this is expected and documented behavior inherent to how fork networks work"

I don't know how many people this applies to, but there are many who don't know much about Git and use it anyway. When someone first picks up the tool, it looks pretty easy. You add a file, you commit the changes, you push. The code goes up. When someone else has made changes, you pull. Great, I understand Git.

They think that right up until their first merge conflict. Oh, I can't just push while someone else might be doing the same thing. So they learn branches. I push to my branch, you push to your branch, then we merge them. Great, I understand Git.

They think that until they need to get code back. How do I find the code after someone's merged over it? None of my commands do that. So they learn some other ones that work with the history, and they learn some blunt tools for returning to the head. Great, I understand Git.

They think that until a branch merge conflict. Okay, it's time to learn rebase, and rebase isn't a simple command. But they read about it and do some experiments, but now, they know they don't understand Git, at least not fully.

I can't say I do either. I have a relatively good understanding of some of the internals. I know enough to know that you can't simply delete a commit and expect it to become invisible. I can describe some of the internal structures accurately, and I can sound confident when I do it as long as people only ask about the ones I've actually looked at. But since I have not written code inside Git, nor have I memorized every manual page in it, I do not know everything there is to know about Git. Nor am I the least knowledgeable person on my team. We know enough about Git that we get what we need and don't break things. That doesn't make us experts. And we're professional users. There are lots of beginners who know less because they've used it less.

Re: Yes and no

Yes, rotating the key is equivalent to changing the password. You can even leave it public. Anyone on the planet can know that "a83dc027b9a62170" used to unlock something, but it doesn't now. The data is now worthless as long as you can make sure it is no longer usable.

If you can't or don't choose to do that, then deleting the repo looks like a second-best solution. The problem is that it's far too weak and people who think that's good enough are failing a necessary security step. Once it's been committed to the public once, there is a chance that someone has seen it and you can neither reliably detect whether they have nor prevent them from having done so. At that point, you have a risk. Deleting a repo does not eliminate that risk. That credential is compromised and absolutely must be revoked as soon as possible. One of the examples from the article was from a user that wanted to keep using the credential after it had been posted, and that is not a good idea.

Oracle's Java pricing brews bitter taste, subscribers spill over to OpenJDK

Re: Java Business

"SUN could easily have transformed herself into a Software Business IF they had demanded, from 2003 onwards, moderate license fees for the Java Compiler, the VM, the JRE and so on. Think of 30 Euros per core per year."

Or they could find that people didn't want to and were getting rather tired of being charged. So they stop developing their software in Java, so their customers stop buying JRE licenses. Now they've lost some JDK and JRE licenses. This, in turn, means that the businesses get less value from the licenses they retain, and they start migrating away from Java-based tools. That could happen as well.

It should be rather obvious that it's a possibility if we consider other prices. Had it been €30k per core per year, that would happen almost immediately. Lower the prices and the number of customers you lose decreases and the time between the price change and the loss lengthens. You assume that €30/core/year would be low enough that people wouldn't switch, but Sun's assumptions could easily have been different based on better information about who they would be asking to pay and how much benefit they were already receiving. Pricing is hard, and it can be far too easy to assume that what you would be willing to pay will work for the rest of the market. Oracle is trying this today, but that's no more guarantee that it will work for them.

Sun also had to work around licensing issues meaning they couldn't just apply a unilateral change in terms to every customer overnight. They had to do that because, earlier on, they gave terms that caused people to use the language and they had to. Otherwise, a SaaS business that runs lots of servers and therefore would bear the license increase you describe themselves would have seen Java as too risky a solution and wouldn't use it in the first place. That means fewer developers being paid to learn Sun's language, fewer libraries being made available, which means fewer people choosing to start by learning Java, which means fewer people choosing it in new builds and more people choosing competitors, and all of that means fewer customers for any commercial products Sun did want people to buy. They chose to provide free access, not because they were convinced by an ideological point, but to quickly build up a customer base.

Re: FALSE

While I can't claim to have counts, I know several pieces of Java code that have been maintenance problems. I'm thinking of a set of three programs from the same source, written in Java without any other languages or dependencies, which ran on Windows, but not Mac OS or Linux. I can blame the developers for that oversight. What I find it harder to blame them for is that you still need Windows 7 or earlier to run them. For some reason, Windows 10 and 11 won't allow them to run. Newer JREs refuse to run them at all. JREs from the same era try to run them, but then crash without usable error messages. These aren't programs from 1998 that happen to still run under Windows 7. They were originally released in 2012 and had updates until 2017.

I don't have the source for these, so patching them is not an option for me. The original authors might have the source and are still in business, but I've given up on them doing anything. Occasionally the idea has come along to reimplement them. If that idea is executed, Java isn't the tool that comes to mind for doing it. I don't think the language is entirely to blame for this course of events, but neither can I pretend that Java is great from a backwards-compatibility perspective.

Re: Not Really

They had the choice to demand payment for commercial use. If they had done that, they would have gotten some short-term cash, but they might have lost users who didn't want to deal with annoying license audits so they used something else. That limits the ability of Sun to sell other services to those people. As with every other company that has ever existed, they have to decide between these alternatives.

Since this seems to be a big issue in your comments, there's a word for this: capitalism. The company chooses its prices in order to compete with alternatives. Oracle is being no less capitalistic than Sun was. Sun made a decision to get lots of people using Java. Oracle's making a decision to get more money out of those people using Java, taking the risk that people will either use the free alternatives or a different language.

Re: Guess What ?

You might also want to stop misstating your facts. Sun had a serious decline. That's a point in your favor. Why make your argument weaker by stating incorrectly that they went bankrupt?

Of course, it's also suggesting that Sun's problems were due primarily to Java, rather than any of their other products that didn't go well, but that's not something you've bothered to mention in your comments.

Musk deflects sluggish Tesla car sales with Optimus optimism

Re: Optimus optimism

I could think of things that I would do with one if I had it, but those things are not going to be important enough to justify anything near what the most basic of robots might cost. If I had one, I would likely consider automating some tasks that don't interest me, but it would take a lot of hours freed from such chores to equal the price of the machine and the, admittedly more enjoyable, hours programming it to do those things.

There's also a market problem. If I earn a normal amount of money, which I do, then a robot is likely to be out of my price range in any case. If I'm a very wealthy person, I can try hiring someone to do things that I want done and they're likely to make fewer and less damaging mistakes when starting. I'm not sure the first generations of humanoid robots will have enough demand to sell except to people who like having the latest expensive gadgets, and I don't think that's a big enough market to fund development of the second generation.

I can answer that one. You absolutely need an LLM running in a car when the company that makes the LLM will supply it for $5 billion in up-front "investment", will charge per use, and you own that company. Free money is wonderful. You just add it onto the price of each car, and when people don't buy as many of them, you make some other promise of what other wonderful feature they'll have and wait for people to bid up the stock again. Eventually, this won't work in the long term, but you'll have extracted plenty of actual money in the meantime.

CrowdStrike blames a test software bug for that giant global mess it made

Re: Secure boot?

That doesn't necessarily preclude signing. Step 1 makes a file. Somehow, the output was corrupted during or after step 1. The file is then passed to step 2, which signs it. The result is a file that is properly signed, verifies just fine, and once the signed content is extracted, it's still invalid. Steps 1 and 2 don't even have to be separate processes, though they probably are.

Re: It worked on my machine!

"If this were agile, it would be easy to rollback to the previous version."

And from their side, it was. It didn't take them very long to release the version that patched this. The only trouble was that the buggy version damaged things so badly that the users couldn't revert as quickly as the release process could.

Re: It worked on my machine!

It really doesn't matter. They should test their releases, no matter what those releases contain, before going public with them. Whether that is code, or configuration, or some other category of data doesn't really matter. If the behavior of the system has changed slightly, testing is required.

Yes, depending on our definitions, we can argue that it's not code. After all, if someone's counting lines of code from me, they usually wouldn't count the lines of the json file I've just written. But when my program will do something different when the json file is different, it can have the same damaging effects as if I changed what we typically call code, and it therefore needs the same kind of testing.

I'm guessing there was a difference between the version that was tested and the version that got released. That could happen in a lot of ways. Maybe two changes were merged into this file and building them together makes the bad file. Maybe it had to do with some additional content in the production build which isn't present in the debug build. There are plenty more.

I've seen the latter example from time to time. For instance, a task where two people wrote code. First, my coworker wrote one unit, then sent it to me. I wrote the second unit. In my testing, these units worked just fine together. Correct results, no crashes, positive and negative results handled as expected. Build it for production and the automated tests freak out instantly. The reason: my debug build was writing more to the log file in case anything went wrong. That slowed things down slightly, which was enough to prevent the race condition in the two processes from going wrong. Take out the logging and the processes might have a concurrency problem and fail. But it worked just fine on my machine. Probably it would have failed eventually if I ran it with the extra logging enough times, but it didn't in the maybe thirty runs I actually did.

Sam Altman's basic income experiment finds that money can indeed buy happiness

That is calculable. Of course, depending on how you implement it, different numbers and methods would have to be used, but it isn't difficult to get approximate numbers.

For instance, this experiment took place in the US. The current US population is 335 million. We'll also use the same payment amount of this study, $1k per month or $12k per year. This makes a total annual payment of $4.020 trillion. You've asked to have this paid by the top 0.1%, which would be 335,000 people. This makes for an annual payment from them of $12 million if it were divided equally, which it probably wouldn't be. The wealth required to get you into the top 0.1% is $62 million (source). You would need a wealth tax on the order of 20% annually to get that much, and if you did it, it might work for a decade, depending on the return on investment we assume for the funds they retain.

If you try to implement that, expect several consequences, including lots of wealthy people trying to prevent you from doing that. You should also expect that people will search for or create loopholes to get out of it, because you can hire a lot of lawyers and accountants for less than 20% of a 0.1% level wealth. But also remember that it is not going to work forever even if you can get exactly what you asked for. You will need a plan for what you will do after that. Lowering the wealth cap is the most likely solution, but it too won't last very long.

Re: Nice to see these tech types...

This is definitely true, although some of those jobs didn't disappear but went to other people. But many definitely did disappear. However, we didn't decrease the number of jobs needed altogether; if the people who lost their jobs were not doing any job at all, there would be a shortage of labor. This means that we have not reduced the need for labor, but we have changed what labor we have a need for, and depending on what jobs are available in your area, we may have made the types of labor we want much worse.

This is why I think focusing on the futuristic theory of labor elimination is the wrong approach. Right now, we have people who have or will lose the jobs they have done for a long time. We need to figure out what is right for them right now, not what would be right for them in a theorized world of complete automation, because neither of us lives in that world. If we promise them things that would make sense in that scenario, we will give them false hope. If we require things of them that would make sense in that scenario, we may unfairly burden them for not living in an unattainable future. By considering a speculative future rather than the reality we're in now, we're making things worse for the people who have lost their jobs today.

Re: Nice to see these tech types...

The reason they're expensive is because of the resources it takes to make them. Not just the metal, motors, and chips, but the labor to manufacture them, the work to design and program them, the expense of maintaining the stocks, workers, and expertise needed to repair them. Because they often need to be customized for each task, a lot of that isn't done at scale, making it more expensive (yes, in money, but also in the sense of how many engineers you hire to do the work or how many different sets of plans you have).

Security biz KnowBe4 hired fake North Korean techie, who got straight to work ... on evil

Re: Where can I get more of that scam?

They could modify the picture on the identification documents instead, but if they did that, the picture would no longer match any other pictures of the victim that might be found online. I wouldn't search out pictures of people to check them against the documents, but if someone did, that might make it difficult to get away with an ID that's just had someone else's picture swapped in. Meanwhile, if they have good enough software that they can appear in a video as the person whose real face is on the ID, then that might be less likely to be caught by the employer before someone is hired. This is especially true for differences in age, because if I change out the picture on an identification document for someone aged 23 and they claim to have ten years professional experience and a birth date in line with that, it might be more obvious that they're not who they say they are.

Re: Where can I get more of that scam?

Maybe the identity they used didn't look much like them, but they didn't have an unlimited supply of fake identities that all look like Koreans of the right age (I think this is mostly young males as North Korea hasn't prioritized computer skills until the last fifteen years and at least one of the technology-focused schools is male only). If they're using stolen US identity documents, they may have to take steps to appear to be the person pictured in them.

Re: Real location

There are two really easy ways to get around that.

1. The laptop was delivered to an address in the US. The person at that address has been told to get the package and send it to Hong Kong. The person in Hong Kong has been told to send it to Shenyang. Someone in Shenyang gets it and brings it to wherever they want it.

2. The laptop was sent to an address in the US. There, it was set up with a local internet connection and the IP sent to China or North Korea, where someone set up a remote connection to it.

Philadelphia tree trimmers fail to nip FTC noncompete ban in the bud

Re: Josh Robbins of libertarian law group

I've found that "libertarian" usually translates to "those regulations I like and no others". So they'll probably argue here that they don't want people to lose the right to choose whether to accept a non-compete contract, a choice that should come with a compensatory increase in wages. The argument doesn't make a lot of sense in context, but if you find someone and get them to answer, I can pretty much guarantee that's what you'll hear. If you find someone who says they're a libertarian, however, there's a good chance they'll completely disagree with these guys on what is fair and what should be done to make that happen. That's why I don't call myself a libertarian; there are too many people who are using the term who I disagree with and using it would only confuse everything.

Forget security – Google's reCAPTCHA v2 is exploiting users for profit

Re: tracking cookies?

I think some version of it, which might not be the same one they're using now, would use cookies set by other Google products as a way to bypass the check. If you identified yourself to Google and they could track you onto the page, then you're allowed through. Otherwise, do a test.

CrowdStrike fiasco highlights growing Sino-Russian tech independence

Re: @Doctor Syntax - If Russia gets away with destroying Ukraine :o

Hmm. What countries might be on the borders of Russia and recently joined NATO? Starts with F. What countries aren't on the border but would be if Russia takes Ukraine? Starts with R. What country has moved closer to NATO membership and is in the latter position? Starts with M.

Maybe, if you went with countries that joined in 2023 rather than ones that joined in 2009, you might have already figured this out.

How did a CrowdStrike file crash millions of Windows computers? We take a closer look at the code

Yes, they could have implemented a two-stage process where they still have a kernel-level program and it provides data out to something else. There might have been an efficiency drop by doing that, but it would probably be fine enough. The critical point, however, is that this change, while it might have prevented this problem, still involves their being code running at kernel level which, if it broke, would break the kernel. The attempts to blame Microsoft often take the form of explaining that CrowdStrike shouldn't have run anything at kernel level at all, which would not work, and then finding a reason why it's Microsoft's fault that they could, which it isn't.

Re: RE: examples that have done better

You mean that one mentioned in the article. It might have read something like this:

"The way that it works is that drivers can set a flag called boot-start," he said.

"So normally, if you've got a driver that's acting kind of buggy and causes a failure like this, Windows can auto resume by simply not loading the driver the next time. But if it is set as boot-start, which is supposed to be reserved for critical drivers, like one for your hard drive, Windows will not eliminate that from the startup sequence and will continue to fail over and over and over and over again, which is what we saw with the CrowdStrike failure."

So they have that by default, and it would have done exactly what you describe except that a flag was set specifically to bypass that safety feature. As it says, there's a good reason to allow something to set itself that way, in case this is required for the system to boot correctly anyway.