Posts by doublelayer

Ex-CISA head thinks AI might fix code so fast we won't need security teams

Re: Bring back flowcharts

Yes, that's the lots of little flowcharts option I already mentioned. The problem being that you now have to deal with all the various ways control flow can be modified. I write software that has scheduled jobs, event-activated jobs where something notifies us to start one, pull event jobs where we need to search for triggers to start one, user-called jobs, and job pipelines. These all run in parallel with mechanisms to prevent them from stepping on each other and to keep them in the proper order of data flow. Flowcharts to define that have lots of problems representing the external sources of information that can cause the jobs, and the flowchart describing how each function operates would be very complicated if you need to get all the concurrency data in there. If you don't get all the concurrency data in there, the system is guaranteed to hopefully crash but unfortunately quite likely deliver false results in a matter of minutes which will deliver an angry person to your desk. This system is not functionally described in a form you can easily break into little self-contained units.

Re: Bring back flowcharts

Even if I accept that logic, how do you propose compiling a flowchart to a deterministic program? Programming languages have the advantage that you can run and model with the same thing which helps a lot because, as experience has shown me, any two attempts to write the same thing will have weird differences if they're big enough.

The other problem with flowcharts is that they only kind of work for a simple type of program which takes one input, runs for a while, and produces some output. If it runs multiple things in parallel, collecting some information while running other things, handling failures and potential problems without direct user interaction, a diagram of what it's doing gets a lot more complicated. You have two choices, neither of which is good. You can split it into lots of little flowcharts including arrows that come in from nowhere, or you can build a massive flowchart which covers an area the size of Wales (although I propose you use a flatter place) and still has arrows coming out of the Irish Sea to describe new events or data that weren't present when the program started.

Re: What an idiot

Based on previous things she's said which I thought were on point, I'm inclined to try to parse her statements as logical. The problem is that they aren't. If you use AI scanning before release, you need people to read and respond to those scans. You can't eliminate the industry if you need a lot of people to read scans no matter how good they are.

No, I think she's really under the impression that LLMs can do things they can't. It's not entirely on her. Lots of companies say they can automatically detect and then fix security issues without human oversight. They're usually wrong, but they exist. Some of those are companies that existed before LLMs making exactly those scanners that can make the remediation process faster. She probably hasn't used these herself and doesn't know that, while there are indeed times where they detect something real, write a fix to it, and not break anything, there are a lot more situations where one of those three things doesn't happen, meaning it tries to automatically patch something that wasn't a problem, writes a patch that leaves the problem in, or breaks the software in the process. If you assume that all these security software companies wouldn't lie, then things are looking up. Unfortunately, they often are, whether or not they know it, and most of them do know it which is why, instead of automatically adding fixes by default, they put them there for human review. They still advertise the automatic part though.

Signal president Meredith Whittaker says they had no choice but to use AWS, and that's a problem

Interesting you should ask. An article gives an interesting summary of how they used to do it, but a little blurb at the top gives us the important information:

UPDATE: Unfortunately, this post is no longer accurate with regard to Skype’s infrastructure. After the massive Skype outage in December 2010, it was expected that Skype was exploring ways to make their system more stable and resilient. In early 2012, Skype (at that point now owned by Microsoft) was reported to have replaced much of the P2P supernode infrastructure with supernodes hosted in Microsoft data centers.

So your answer is that they moved it to the cloud because their previous self-run infrastructure proved insufficient. Of course, they probably could have gotten a bunch of money and decided to build their own, and if they had built enough of that, they might have decided to rent out some of that and become a cloud provider in their own right.

Global distributed systems take a lot of work that a lot of people choose not to think about. Me too, when I can get away with it, because a lot of it is boring. I have watched people think they've done it when they really haven't, though, and they tend not to like the results. If you host in a single facility, you're not distributed. If you think that a few colos on different continents does it, you're probably not as interrelated as global communication services are.

The Chinese Box and Turing Test: AI has no intelligence at all

The thought experiment doesn't really cover what it is possible to do, since it holds that you can have a perfect simulation of intelligence without having real intelligence. At a philosophical level, those are technically different, even ignoring my earlier comment on the subject. However, at a certain level, it wouldn't matter much whether it was a simulation or the real thing when you had to interact with it. If you were faced with a robot that wanted to kill you, would it matter much if it was intelligent and wanted to do so or a dumb machine capable of creating plans and novel techniques to try against you? I doubt it; your response to save yourself would be identical.

The software we have now isn't that. We have sufficient understanding of how it does what it does to know that. It doesn't remember, it doesn't sense, it doesn't reason. Training it on some more text isn't going to change that. If we ever do get a simulation, and I think we would have to use completely different techniques to have any chance, then whether it is conscious becomes a less important factor outside of philosophy.

Re: Chinese Room counterargument

I think the counterargument is closer to accuracy than the original Chinese room argument. The original holds that a program exists that is able to simulate perfect conversation in Chinese, but if such a program did exist, why should a person manually executing it have as much consciousness as the whole system? It would be as illogical as assuming that, since the tongue and larynx produce speech, that they must have the same amount of consciousness or intelligence as the human they're a part of. In the person in the room part, the person is a mere component and would not need to have the same level of intelligence.

The program in the thought experiment is the limiting part because if instead of assuming it exists, we ask how it exists, we would have to wonder whether it is possible to simulate perfect fluency in Chinese without having enough intelligence to carry that out. We have a clear counterexample, where LLMs do simulate language and are not perfect. That some people find them acceptable doesn't change the fact that they frequently produce imperfect responses in many ways. No matter how much they try, existing LLM techniques have not succeeded in removing that imperfection nor, in my personal experience, meaningfully reducing it after a certain point. The philosophical difference between the different opinions on this issue comes down to whether there is a special thing in humans that produces consciousness or intelligence, but if they can't define what it is, it's impossible to prove whether or not it is in the program. Someone could directly oppose them by stating that, in order to create a program that perfectly understands Chinese, you would have to reproduce it and therefore the computer would be intelligent, and they could not disprove that because they have neither a program nor a thing it lacks.

Re: What happens when the drumming stops?

But what point does that make about intelligence? If we asked that question of an extremely intelligent person who had not heard the joke, they wouldn't know what that means either. Their response would be a number of things, all depending on their cultural background, for example whether they're used to music with a drum line that goes all the way through in which case what happens when the drumming stops is that the musicians take a short break and decide what to play next, or other music where the answer might be that that's when the soloist is likely to start up (would that count when they don't know the punch line), or people marching to drums in which case the people stop, or they might just say I don't know. LLMs are not intelligent, but not recognizing a joke doesn't prove anything about that. I think the first tie I heard that joke was the last time you posted about it, and the second time was now. I gather it's a reasonably common joke, but nonetheless one I had not heard before.

MPs urge government to stop Britain's phone theft wave through tech

Re: because...

When did "it's a cultural problem" become the null hypothesis? I could equally easily tell you that it's not one and you have to prove that it is. Neither will be easy to prove. There are people who commit crimes because their parents did and they learned it from them, which may not necessarily be a cultural cause but that's the closest proof you can easily get. There are people who commit crimes because their friends did and they learned it from them, which would be more of an environmental problem. There are people who commit crimes because they find they have no options, which would be the societal problem suggested by the original post. There are people who commit crimes because they decided it works well, which is an individual problem. There are a lot of people who have a combination of multiple factors, for instance they learned how to commit crimes well from people around them (environmental) who initially committed crimes because they could not get jobs (societal) and the person concerned could get one but found that crime worked well (individual) and then taught their children to do it (cultural/familial), and such a situation could occur equally well in a single neighborhood or across continents.

Just as the comment saying that it's all the societal problem are wrong, so is anything ascribing all or most of it to one of the other causes. The complexity in causes is why we can't always eliminate the problem by going after the causes since we may not know all of them or how big the ones we do know are.

Re: because...

Fixing underlying causes is always nice if we can identify the causes and solutions to them. Pretending that it's all on society is ignoring the fact that some criminals are making good decisions, decisions of the form "this crime generates more of what I want than something non-crime". If stealing phones is easy and lucrative, some will choose to do it, not out of abject poverty they cannot escape, but because that's a way for them to get the things they want. If you think that does not happen or involves some deeper societal cause, I challenge you to name that cause and explain how it leads to this outcome, how eliminating it would eliminate the outcome, and what your way of eliminating it would be. Vague "it's all society's fault" responses are not sufficient.

Re: Repairable? or Theft-Proof?

What steps do you suggest to prevent people reusing passwords? Many sites warn of this right next to the enter your password boxes, but short of testing it against a bunch of services just to see, there's no way of making people do it. Not reusing passwords is in every security training, list of simple steps to improve your security, many news articles, and generally all over the place. Financial companies in particular often present security recommendations from time to time when you log in. People don't deserve to get robbed, but neither can I blame myself for not having told people how to be more secure. Those who easily could follow instructions but didn't do it because convenience trumps all have more risk and will suffer more as a result. If someone truly hasn't seen those recommendations, that's different, but if they have and decided that following them sounded like too much work, then they have a higher chance of not enjoying the results.

Re: British Fascism

Except, at the moment, it's not really a merger of state and corporate power. It is an intensification of state power which eventually could be used by corporations. Apple and Google can already lock people out of their phones. That is something they don't need laws to do. They have serial number and purchase tracking, most devices are attached to accounts, and unless you keep them offline, that means they have the potential to lock devices. If they do that to random people, they're likely to get sued and lose, so they don't, but they can. This proposal doesn't give them extra powers to do it.

This proposal gives law enforcement extra powers to make them do it and an external method that keeps them from removing it as quickly. Those are powers of the government, not the companies they are planning to order to implement this for them. If it does empower some companies, it would probably be mobile providers whose IMEI blocklists will become more powerful. Your comments suggest that this is primarily an assistance to big smartphone, when it doesn't really give them more power and does give them more problems. That's why both Apple and Google have objected to it; they're not nice people trying to avoid doing something unjust, but since they don't get anything out of this, they aren't motivated to go along.

There are two problems with your argument. If you argue that something is being done to empower the tech-corporates, someone trying to argue against this can point to the tech-corporates arguing against this as evidence that you're mistaken. It also means that your definition of Fascism isn't working with the situation, although Italian Fascism which was a lot more government control than corporate power does fit it much better. We've spent so long on the whether this is Fascism debate that we only now got to understand why you don't like it, and although I also don't like it, I think your reasons are unbalanced toward the corporation side rather than the effects on citizens side.

Re: British Fascism

> Demanding linguistic purity before acknowledging reality is just a genteel way of saying “let’s never call it what it is”.

I am not demanding linguistic purity and I want you to call it what it is, but I want you to call it what it is in a way that means other people know what you mean.

We all have to change our communication in order to be better understood. At one point in my life, I used to use the word "systemic" to describe problems that happened throughout a program, because from my perspective it meant it was a problem with the whole system, not just this one function over here. I found that some people misunderstood this as blame to the organization and specifically them. Not only did they not understand what I meant, they reacted poorly to misunderstood attacks. Solution: I found a different word than systemic which they did understand. Alternative solution, I could provide a definition of systemic at the start which would add a paragraph then continue using it. Not a solution at all: continuing to use it and having to try to explain to offended people what I meant when I finally determined they had misunderstood me, even if I could then make a convincing case (to myself anyway) that "systemic" did make sense in that context. My job is to communicate and convince, not to win the dictionary game that nobody else wants to play.

We don't have your full definition for fascism and it would waste more time trying to provide one than to make your opinion clear by actually stating it. There are many types of state control, only some of which make sense when called fascist, but all of which could be big problems. Spare yourself and us the discussion of history and translation by stating why it's wrong rather than using a poorly defined term which we're simplifying to "bad government thing". I agree that this is a bad government thing, but if I want to explain why, I need to get into details or, if historical comparisons help, specific ones to specific programs.

We can't advise. You get to make the decision of which of these you prefer:

1. Google cannot access as much of your data because you don't use a Google account (and if you're starting down that path, you might also disable some Google apps and features).

2. You can remotely lock and erase your phone if a thief steals it.

If you're using normal Android, you cannot have both. If you are lucky, you could use a degoogled version of Android which may also have that feature, for example /E/OS. You may also be able to add this functionality using some alternative apps. However, if you would like the turnkey option that is most likely to be difficult to bypass*, then Google's is that.

* This is especially important if an important goal for you is denying the thief ongoing access to your device. App-based methods will likely work to keep them from getting your data and allowing you to destroy that data, but once they erase the device, those mechanisms stop working and they can likely use the phone again. The only way to continue to lock them out after that is if the functionality has been built into the phone's system image. From my perspective, by the time someone's gone to that effort, I won't get my device back anyway so while leaving them with a paperweight would be better, it's not as big a deal as making sure they can't get copies of things I stored there.

Re: British Fascism

If people can't agree on what a word means, then not using it doesn't mean refraining from using the word because someone might not like it. It means using a different word or group of words that better communicates what you want to communicate. I fully understand that when you or someone else calls something "fascism", it means you don't like it, but without a lot more explanation of what you think fascism means to you this time, I don't know why. The most common misconception with definitions is the misunderstanding of "corporate state", which is itself a translation issue between Italian and English. If we were trying to decide what fascism originally meant, we could get into a discussion of what they meant by that, which had to do with state enforcement over amalgamated private groups which remained technically non-government. Outside of a historical discussion of what Italy's fascist party claimed to want, though, that discussion is worthless.

If you don't like something today, whether or not your view of it would have worked with a fascist philosophy is a debate that does not help you. Instead of arguing your potentially valid point of whether the UK is doing this because they failed at law enforcement or your very valid point about the potential abuses of this system, we're having this much less important argument about a few terms that, contrary to your posts, do not have a clear definition even if we were only considering 1920-1945 Italian usage and even less of one if we're trying to be descriptivist and include the ways it has been used since then. You can explain why something is bad a lot more clearly than by trying to argue which historical group would have liked it and stating that position as fact.

That only worked because they didn't also lock it with the Google account. If they had done that, then it wouldn't just be the mobile part that wouldn't work. You would need to sign in as the former user to disable that part too. Given the many Android devices around, I wouldn't be surprised that some of them can be reset in such a way that bypasses the account login, but it's not all of them.

"the bit I can't fully figure out is why the manufacturers are against it."

They're not against locking devices, as both Apple and Google have locking methods if you've signed into their respective accounts. If you have enabled that, people are not getting into the device without a nice exploit and they become much less valuable. I think they argue against IMEI-based police-initiated locking because:

1. It's a lot harder to unlock that than the ways they already have, so users are going to find themselves unable to access a phone they lost and recovered and they're going to call Apple and Google to help, and Apple and Google are going to spend much longer trying to help them clean this up than they did before. The previous system used only information that the OS manufacturer had, so it was all under their control for better or worse. The IMEI system will be using data from the manufacturer, the carrier, and law enforcement, so that's a lot of places to clean it up.

2. There are clear possibilities for abusing this, for example locking phones from a specific area if it contained suspected criminals, people who attended a protest that law enforcement disapproves of, etc. If manufacturers enable this, they'll get the blame for breaking people's phones, certainly in public opinion and possibly even in court. They don't want that.

3. Perhaps not for everyone, but this involves collecting and storing even more user data, and while some of them (Google, I mean you) do really enjoy doing that, it's user data they can't really make any money from. It still has all the risks of user data such as others wanting to steal it and laws protecting it.

BBC probe finds AI chatbots mangle nearly half of news summaries

Research papers described what they had, but that does not answer the question of why they were researching these things in the first place. Maybe some of them were those irresponsible researchers who thought their products were useless but were willing to do nothing useful as long as there was funding, but most of those I knew or read results from had some idea of a useful thing they hoped their research would eventually lead to. Natural language processing researchers often described the benefits they hoped their research would achieve, from better parsing search queries so there was less need for people to train themselves to use search engines properly, recognizing freeform user commands, for example in voice assistants, delivering information without needing so much human-written scripts; actual use cases which current LLMs are also claiming to do. There is a lot of mis-selling because too many are willing to pretend it worked when it doesn't, but researchers were trying to take a step to that end and thought word prediction could be a useful component.

But maybe those I know were the minority and most researchers really were only interested for word prediction. If that is the case, the researchers you are referring to are useless. If all they cared about was spitting out words, then they were wasting time and money building a thing nobody wanted including them. Research is designed to either learn more about the world or to achieve a step toward a goal. The researchers I know were doing that with a goal that would actually help if they could achieve it. That this path didn't take them there is not their fault as they didn't know that and had reason to think it might help. But if other researchers were doing this on the assumption that it would do nothing, then we might as well dismiss them and replace them with researchers who have some idea of why they're researching what they are because those researchers can recognize when they're succeeding, when they're achieving a completely different but also useful goal, and when they need to change direction. Fortunately, I have yet to meet any researcher who just wanted to waste cycles building a useless toy.

We've had this argument before, so maybe this is a bad idea, but

"LLMs are very good at what they were actually designed to do, which is to generate plausibly human-like responses to queries"

This is begging the question in the original sense. You're taking the fact that the component is very good at doing the thing that it does and misconstruing that as it being good at what was intended. The thing it does is not a thing that anyone wants or wanted. People want what it's being sold as, and so did the people who started working with these things. Nobody went into this research with the goal of having a human-sounding junk generator when they were done. They just couldn't get what they were hoping for.

It's like saying that celluloid is great at starting fires. That would be good if it was originally invented to help set fires, but that's not what it was invented for. That is not what people intended, and its flammable status was a major problem with it. Don't confuse reality with intention; some people intend things they never get.

New boss took charge of project code and sent two billion unwanted emails

As I understand the article, there was one component which sent emails for errors and the Log4J component was responsible for parsing them and sending only those errors that were above a threshold. For example, that might have been responsible for filtering out warnings that were not considered worthy of an email or for turning a bunch of error statements into one error report. Without that filter, the raw log got sent to the email reporter without anything in between.

I've done this before. As a child, when I set up my first public server, I decided that receiving an email whenever someone attempted to log in too many times and got locked out would be interesting. I could see patterns in that data, find out what credentials opportunistic attackers might be interested in, and at the very least it could be useful information to help me learn security. I did not have an idea of the scale of automatic SSH spambots. That logging got changed after a few hours and thousands of emails. I didn't just disable it, though. I have a parser run over those logs and alert me to specific types of information, for example when an attacker gets a username right rather than just trying root, admin, pi, user, etc, or when there are longer-term patterns in the data. The way I implemented it, if that filter turns off, I would get no emails, but it would be very easy to configure it in the way the article suggests where the filter being turned off means I get flooded again.

Re: call the dB person

A bit of code that retrieves a record, checks it, tries to change it and fails, then continues on to the next record could generate that kind of error billions of times without breaking the database or even the data, which since the update statement failed would be exactly the same as it started. A good update script would detect the error and stop, and a person who wrote a good update script would probably have done different things.

I don't know why someone did, but if I had to guess, it might be a philosophical clash about what an admin should be doing with systems they manage. While there are those, and one of them has replied, who will block on a whim with the "I don't like Google, so GMail will get dropped because I say so" approach, it's more common for an admin to decide that their job is getting as much valid mail delivered as possible and that it's the user's decision whether they want to exclude it. Filtering out messages that impersonate a different server or contain dangerous links or attachments would be that admin's problem, but deciding whether to drop messages legitimately sent from an authorized internal account to another runs the risk that it was supposed to be delivered and your decision to drop will anger someone or break something. Without explicit rules, it's common in my experience for the admins to take a hands-off approach where they will respond if and only if the activity is causing technical problems, and since they didn't know that was going to happen, they didn't preemptively take steps to handle it.

AI investment is the only thing keeping the US out of recession

Re: Investment?

That's not fair. They're getting real things for their money. The better analogy would be spending money to build a really tall tower of bricks. True, once I'm done spending the money, there might not turn out to be anything we want to do with a solid brick pillar, but I can point to it and say that's where my money went, and if it turns out that mere elevation has uses, maybe someone will get lucky when they buy the completed thing off me for a bargain price. The analogy continues to be relevant in that, if that use case turns out not to exist, there can be some added expense in cleaning up the junk I bought.

The AI bubble wastage is not getting us as many useful things as, to use a popular example of its adherents, the cable installation bubble of the 1990s, but there are at least a few things we will have at the end of it. New nuclear power stations, for example, have their uses even without GPUs to run, and someone will find a way to get some computing they want done on all the GPUs there will be left over. The investors probably won't get much return, and we have plenty we will lose even if we didn't invest on our own, but it's not entirely gone.

UK competition cops brand Apple, Google with 'strategic market status' for mobile

Thanks for the lies, Google

"Anyone, including our competitors, can customize and build devices with the open source Android operating system – for free."

Unless they want to make any device with Google software running on it, in which case they're legally prevented from doing so, meaning that you need a separate manufacturer if you're going to do that because all the places that manufacture for someone else can't manufacture for you without breaking a Google contract intended to make sure nobody actually does what you just promised they could.

"And while Google Play helps people download apps on their devices, if you don't find the app you're looking for, you can download apps from a rival store or directly from a developer's website"

Until you complete the plan you've already announced which will still allow people to do that, just as long as Google has pre-approved the applications and developers concerned, meaning exactly the same amount of control as if going outside the Play Store was forbidden. Which means that, if "the majority of Android users actually do", you're going to be breaking something for a majority of Android users in a matter of months.

Reddit to Perplexity: Get your filthy hands off our forums

Re: Reddit stole it first

If Reddit went around copying it from elsewhere, your argument would make sense. They didn't, so it doesn't. Reddit did not steal content. People chose to post it and grant Reddit the limited rights stated in their terms.

In general, I'm a lot less concerned about Reddit being scraped than most of the other training data that LLM companies have been stealing because people did agree to make that public, whereas plenty of the remaining training data was collected with even less consent. However, that is still not enough to give people permission to use it for unlimited commercial use and Perplexity's use involves putting a lot of costs on Reddit's servers.

Re: Am I understanding this correctly?

They don't care what the content creators want. That's clear from the use of the old "information wants to be free" nonsense. While they talk about companies as the ones using copyright they disapprove of, you can count on their not having a markedly different opinion about individuals' copyrights. It just makes it easier to make the copyright should be eliminated argument if you only talk about less sympathetic copyright owners and make up facts like the allegation that Twitter and Reddit named themselves monopolies over distribution rights which neither have.

How malware vaccines could stop ransomware's rampage

Re: How ransomware gets into a Windows machine :o

No, by default, and only some of it can be turned off, and doing that much is complicated. You require one click through to run something signed, two to run something unsigned for the first time. But since that might not have been their complaint, maybe it's not necessary to belabor this point if they can explain what their objection is.

Re: Cooperation and the security industry

That's a lot of assumptions. There are a lot of open source communities that achieved something even when it meant that companies that used to charge for that got less money, sometimes so significantly that they went out of business. Depending on what it is, it can be so much more efficient that it still moves faster or so helpful across sectors that companies end up teaming up, often when it would be harder for them not to than to suffer the indignity of having to give something to a competitor. Authoritarian countries have, surprisingly enough, not been dramatically helpful in this. They tend not to be dramatically helpful in much of anything. Government support would certainly help, but you will have a hard time proving either that the project won't succeed if they don't get it or that authoritarian countries will help over populist ones* or democratic ones, which you didn't bother to list even though they do exist.

* For example, the US is populist and has been cutting things. It still funds the CVE database, though who knows whether it will still do so next year. The EU funds a database, a lot more now than they used to. China funds a vuln database. Which one is the odd one out? China's, because it's the one that keeps people from getting all the details but sends all of them to the Chinese government privately first. The history isn't going in your suggested direction.

Re: does the author actually know how a vaccine works?

The vaccine metaphor doesn't work very well with either of those things. Signatures only work for known malware, and these things are also designed for known malware with the hope that other malware will similarly decide not to bother running if they see it. A vaccine is a less direct method which is necessary because our immune systems are in that gloopy biological space where you can't just tell them what to do, but in both cases, it will react to things it hasn't seen before and, if it gets a vaccine, that response will be faster and more reliable, not instantaneous and before any effect. We either have to reject the metaphor entirely or work with the generic "it prevents some things and that prevents some things" and call it good. Arguing the minutiae won't get us anywhere.

Re: How ransomware gets into a Windows machine :o

"Because windows can't tell the difference between OPEN or RUN!"

How does that work? Because Windows does seem to understand that executables can be risky and warns when running new ones. The problem comes when you run executables you shouldn't or you have a vulnerability allowing someone else to. I'm not sure what problem you're alleging, but from the words you're using, you're not alleging it very clearly. Maybe that's because you don't actually have one you can refer to clearly?

Mobian makes Debian's latest 'Trixie' release pocket-sized

Re: if mobile Linux wants to succeed and prosper, it needs to...

Those maintaining these tend to be attracted to the phones that already make it easiest. That means phones that actually provided some useful tools or phones where those have been reverse-engineered or found at some point that are old enough that manufacturers didn't go out of their way to break them. Modern flagships are in neither category. Yes, if they could get a flagship, it would lead to a lot more users. If they could get one low-end or mid-range device that interested users could go out and buy today, that would also really help. But from their perspective, they would probably have to try with fifty candidate devices with the hope of finding a single one that works and doesn't get broken, and from the user's perspective they've already got little enough with a phone they selected for least effort required so, if we want anything runnable before we die, we have to relax our criteria repeatedly until that happens.

Sadly, this is the situation we face with phones. We had one good experience with standard firmware on desktops and laptops because Microsoft didn't choose to kill it. Manufacturers seem intent to make sure we don't get that again. Fighting that is not easy.

Many of these mobile Linux versions are intended to run on tablets. Usually, the PineTab is the only tablet that runs any subset of them. The software may be capable, in as much as it's capable of anything else, but the hardware support tends to be limited for phones and very limited for tablets. I think more effort is likely to be put to breaking protections for phones rather than tablets, so I don't think that will change any time soon.

If, on the other hand, you're trying to get a newer tablet and run Linux on it, there are X64-based tablets that started with Windows, and many of those run Linux much better. I'm not just talking about large Surface tablets; there are smaller ones out there, and although they're not as popular or thus as plentiful as they once were, you can still find such things.

Labor unions sue Trump administration over social media surveillance

Re: Does freedom of speech work both ways?

"The article is talking about non-US citizens who openly support Hamas, so not covered by the 1st amendment."

We all know you read the article. There are a lot of things being covered, most of which are not even available to us. We do not get a full list of things that deport people, and yet we already have plenty of evidence that your statement is false and you knew it was. The article mentions that criticism of Charlie Kirk was sufficient. While there are probably lesser quotes that also earn that punishment, they collected some. Those quotes are not pleasant, stating that they are not unhappy about his death and openly calling him racist. Failure to mourn and applaud someone is not support for a designated terrorist group. Nor do you have any proof that the comments deemed antisemitic all took the form "The October 7th attack was great and I want to see more of it", yet you suggest as much. That got at least six and probably a lot more people deported since we all know the most severe examples are the ones that would be quoted in the message.

You have decided that, if you agree with the deportations, it's acceptable, which breaks your free speech absolutism argument into very small pieces. You have also decided that, to support that argument, you will decide what was said and what was not in direct contradiction to what we all read in the article. Neither is useful.

Re: Does freedom of speech work both ways?

Depending on the quality and degree of that pressure, you might have a case. Might; I'm not fully agreeing and you'd have to do a lot to prove that there was pressure and that it was a sufficient thing. That's because the ultimate decision was by a private party and led to private consequences (removal from a private platform) which can be done totally legally without any constitutional restraint. This case is a lot clearer because it involves a government decision and consequences (deportation). Maybe both count, but if only one does, it's not your one.

Re: Does freedom of speech work both ways?

Ah, so his opinion is opinion, but theirs is libel. I wonder what your opinion is. Do I get to decide?

Tribunal wonders if Microsoft has found a legal hero after pivot to copyright gambit

Re: "Is Office an artistic work"

From my perspective, it shouldn't matter. Yes, Office is and should be copyrighted. Yet, I can sell a book which is mostly the copyrighted content when I want, and I should be able to sell my license as long as I no longer use it, therefore transferring it rather than trying to duplicate it, and I have not signed an agreement saying I won't. If Microsoft wants me not to, they can put it in an agreement which prohibits me from using that power which they apply to subsequent purchases with clear warnings that they have done so at the point of sale, and their problem is solved. Laws don't build that for them for their convenience, nor can they write that agreement and apply it retroactively.

Benioff backs off: Salesforce chief says sorry for Trump troop talk

Exactly. Relatively few individuals get to be famous by being tech people, but if you wanted to be one of them, you have to do something consumer-facing and be really successful. You can be a Steve Jobs if you make a smartphone that lots of people have or a Clive Sinclair if you sell a lot of things with your name on them, and even he is probably a lot more famous here than he would be anywhere else. At a second level, you can be unrecognized but, when people ask who that is, they understand the result. People don't know who Evan Spiegel is, but if you say he's one of the founders and still runs Snapchat, they'll at least recognize that. This guy is in category three, where not only do they mostly not know who he is, they also mostly don't know what SalesForce makes. His legacy will not be political statements. If he wants a legacy, he's going to have to do something notably beneficial or evil with his money or mere force of will.

Ruby Central tries to make peace after 'hostile takeover'

Re: R

I kind of like R itself. Does that count? Or does "start with" exclude "and then immediately stops"?

'Fax virus' panicked a manager and sparked job-killing Reply-All incident

Re: The FAX is not dead yet.

Indeed. A place I've volunteered with had a copier which has a fax function, although I don't know if they ever bother to use that part. It failed twice. Fortunately, they did not call me to fix it because I hate on principle any machine that prints on paper because I know it's going to break sometime for a non-hardware reason and be much harder to fix than it should be. They had a repair contract, so a technician came and fixed it. Whenever the technician left, they left them a hard drive that used to be in the copier because evidently it was storing copies of things which it didn't need to which might still be present on the disk.

My main question was what the copier could possibly be doing to kill disks if replacing them was the way to fix the copier*, but my secondary question was why they had configured it to store all that data when they could have managed this with a RAM buffer alone.

* I still don't know. The first disk to be removed was a small spinning rust affair and I just erased and junked it, but the second was a 500 GB SSD so I put it to work. It's still running now with not a SMART error after three years of post-copier use.

Literal crossed wires sent cops after innocent neighbors in child abuse case

Re: Shutting Up

"The US system assume you're guilty, and it's up to you to prove you're innocent."

Incorrect. All the countries you name have the same presumption of innocence as legal doctrine. They have different protection, some of which will be stronger and some weaker. Let's take those rights suspects get read on arrest. The statement in England and Wales includes "You do not have to say anything, but it may harm your defence if you do not mention when questioned something which you later rely on in court.", but the version from the US is more similar to that in Scotland which does not. What's the difference? The difference is that you're not required to state your defense up front in either location. That's a stronger protection. Part of the reason is that the England and Wales requirements on police procedure include some restrictions the US does not have, which is a stronger protection there. The differences are smaller details and nothing so obviously wrong as what you've claimed.

Chamber of Commerce sues over Trump's $100K H-1B paywall

Yes, that is how the visa process works, but I think the person you replied to was making a different point. They allege that, when they've seen these people hired, the job description was aimed at either one predefined person in particular or only people from certain backgrounds. I'm not sure how easily you can do that, how you'd identify your one target beforehand, or why you would bother to if you could just select your preferred candidate during interviews anyway, but that's what they're suggesting which isn't incompatible with the visa process.

Chinese gang used ArcGIS as a backdoor for a year – and no one noticed

Re: Proprietary software and its consequences.

Software of all kinds often implements the multi-server approach where users can access one server which can compute on another one. It's totally normal in software from all licenses, perhaps the most common example being the web server and database server being different boxes but having a connection that allows computation on and extracting data from the latter even though it's probably not available from the internet directly. Just like this example, the important part is hardening the connection between those things so that disruption of one doesn't immediately conquer the other, not generally done for or doable for you by the software author, and securing the outward facing server, which the operators of that server did not do properly.

You're using a chain of arguments, and most if not all links in that chain are flawed. Servers operating in a cluster is not insecure by default, and yes, that involves "remote code execution", although since they're supposed to be executing code for each other, the term can be misleading. Free software has, fortunately for us, often recognized the utility of clusters and therefore does often support it, including running code on other machines. This was insecure configuration, and insecure user configuration at that (they did not need to run this as root, but they did, they didn't need to have an easily-broken-into admin account, they did). Neither free software nor proprietary software can be relied upon not to have an insecure default config, but when you let users at it, either can be degraded if they choose to set too easy entrance methods. False credit does not help your preferred people.

AI is the flying car of the mind: An irresistible idea nobody knows how to land or manage

Re: ok, but what do you mean by “artificial intelligence”?

It is a difficult problem, we spent at least four hours discussing it and only managed a small amount. However, I think some of your points were covered in our just for fun definition. I don't think the halting problem counts as emergent behavior. That demonstrates a lack of provability of what a program will do, but only from the perspective of an analyzing program. We were allowing the definition to include the intentions of its developers. The halting problem is a lot easier to answer when you can ask the programmer "is this thing supposed to run infinitely, terminate every time, or do so conditionally". We also removed bugs, because you can make the argument that any behavior is emergent if it was the result of programmer error. So if it was supposed to terminate every time but there's something that causes a loop, we allow the notional programmer to fix that and we consider again. Because we focused on the goal of a program from the perspective of its designer who was central to our case, a large part of computation theory fell away because it didn't matter how that program was executed.

I think we all thought that rules engines and mathematical solvers should be out. It's following a very specific set of rules that were manually installed by the programmer. That's exactly the kind of thing that, when sales calls it AI, we immediately rejected. If you run a specifically chosen graph algorithm on explicitly written logical operations, that just sounds like normal programming to me. I'd be interested in hearing counterarguments if you disagree, but so far, I'm content for that to be a clear exclusion from AI.

Inevitably, I don't think we can ever get a definition that we can agree with, and if we did, it might be more frustrating than not doing so as we watch marketers stomp all over it. It's fun to discuss, though.

British govt agents demand action after UK mega-cyberattacks surge 50%

Re: Anything of substance?

Right, them. Or in other words, the people who wrote this report. The criticism was that this report did not give suggestions, hence why pointing out that the same people did, in fact produce suggestions elsewhere was relevant.

You can submit your complaints about their choice of JS to them directly. If you are willing to dismiss anything they say on the basis that they use JS in their website's CMS, then you don't need to read articles like this one in the future.

Re: Anything of substance?

I think the story is a very good parallel to the suggestion in a different way. As you noted, it's an urban legend (or perhaps more correctly just complete falsehood) because both parts are not true: NASA did not spend the money on the R&D for that pen, and pencils were quickly rejected because graphite scratching off + everything in free fall = fire risk. When the space pen company came up with their design, both the US and the USSR bought some, but they had other writing methods they used.

The parallel to the work on paper suggestion is that, although it seems like it's simple, it really isn't. There are a lot of things that work quickly and efficiently now because we're not doing things on paper, and even if we eliminated anything that was not done when paper was the used tool, most systems using it are at a much higher scale and most of the things you need to make it work are a lot more expensive. Businesses used to have tons of clerical staff to deal with all the paper. We have substantially reduced the level of clerical employment. Scaling it back up requires finding people to do it, which is not so easy with relatively low unemployment (4.8% in the UK as of two days ago). Paper storage and organization is a lot more expensive. So many things won't work if you try to do them that way, but because we once did things that way, it seems like it should be a lot more feasible than it is.

OpenAI's ChatGPT is so popular that almost no one will pay for it

Re: the sums are insane

I can't really agree with you there. I think there are a lot of problems, both moral and pragmatic, caused by famine, and what little effect it has on population growth is better handled in ways that don't involve starvation.

My problem with the suggestion is that I don't believe it's true. I would still be pleased if it turned out to be. Problems you can solve permanently with a bit more effort now are one of my favorite types of problems (the ones you don't have to do anything to fix are the best, of course). I just don't think famine is one of those because it's often caused by recurring factors that keep happening, a less pleasant type of problems. It's as if I was told that, if I washed a hundred dishes today, I wouldn't have to do it ever again. If that was true, I'll get started, but I know that there's no way that would actually work. As I said in my last comment, if the suggestion was true, then although I do not have $150 billion to put into it, I would support doing so because, in fifteen years, we'd break even and we would have stopped starvation, both intensely positive in my mind.

I dislike when people promise things they know won't happen. If someone knowledgeable actually thinks that can happen, I'm interested to see their long-term plan and I am hoping it to be convincing. Otherwise, it reminds me of the people who low-bid a contract, knowing that people will be more amenable to increasing the costs and dragging things out once part of the thing has been built. I've seen it done with positive goals, for example during a charity fund raiser when they claimed that, if people donated a million pounds, they could fix a major problem. They couldn't have, but the expected revenue of this appeal was around £20k, so they never had to try. Probably, making that case got more donations and they used these for valuable causes I deeply support. I still felt uncomfortable with their rhetoric.

Re: the sums are insane

"apparently $30 billion a year for 5 years could cure world hunger..."

How? Because I see pronouncements like that every so often, usually with completely random numbers, whether that was someone shaming Musk for being stingy and selfish (correct on both counts) but who told us that hunger could be eliminated for $6 billion once or various fund raising efforts which, in my opinion, are harming themselves by making these promises because they know they're not going to raise that much.

The World Food Program of the United Nations spends less than $30 billion a year, but they do have billions each year to work with. Even if I assume that this is an additional payment on top of that, it suggests that, if we tripled their funding for five years, we could terminate the program, breaking even in fifteen years. That's a convincing argument if there was any reason to believe that somehow we could fix the future by doing something today, which might be true for climate but probably isn't for famine because there are a lot of causes and they're not going to be permanently removable.

Re: The Freemium pricing problem

I don't know what people are thinking most of the time, but the only times I've been in the room when someone was deciding something like this, the reason has been cannibalization. A lot of companies and individuals* have decided that five currency units** is a small enough price for a month of something. Once they've decided that, providing a subset of that for two is mostly considered a loss because they expect a lot of people who would have been willing to pay five to go for the two plan, only a few people who wouldn't agree to the five plan moving from free to two, and thus less revenue in the long term. They also couldn't introduce that cheaper plan and eliminate it without annoying customers who liked it, whereas they can always consider adding it after trying the more expensive introductory plan for a while and getting people used to it. If they do reconsider, they have the same conversation again and decide not to.

* It doesn't really matter what you are subscribing to. Is it an application? A creative product that takes lots of people working painstakingly? A newsletter that probably was written by the author for half an hour before hitting publish? The price is almost always five units per month. Things that have significantly more expenses will be higher, but almost nothing is lower. Offer a little discount for people buying by the year.

** The unit concerned tends to be the default one for the platform or, if it's their own platform, the local currency. On Proton, for example, they've set their prices in euros, francs, or dollars, and each one is five of those per month. The dollars are the smallest ones, so that's the cheapest option. If you're less lucky, the person setting the prices is in the UK so it's £5, and if you're luckier they might be in Australia because AUD 5 is less. As long as it's in one of the countries whose currency unit is around the same order of magnitude, that's the number. Different things apply for rupees, yen, or RNB where one of those is a lot smaller.

Schleswig-Holstein waves auf Wiedersehen to Microsoft stack

"I'm not sure why nobody ever did a dead easy mass-market-friendly Linux thin client that just turned a low-end PC into an X terminal, but it I've never seen such a thing."

Probably because what's the benefit? Any IT department can take a distro of their choice and have it start into an unprivileged user session running an X connection or any other connection of their choice. What would be the point of making a custom distribution that does that? It's like asking for a distro that's prebuilt for web servers, saving me the difficult work of deciding whether to start with Nginx or Apache and install it from the repositories, but not saving me from the work of configuring and populating it. The part this can save me from is the easiest one.

AI startup Augment scraps 'unsustainable' pricing, users say new model is 10x worse

The cost of something is not determined by the number of bytes in the output. It is determined by the amount of energy needed to run the computer to compute it. The model that is storing kilobytes of text and writing a similar or less amount, probably less since it's code, is very big and involves loading gigabytes of stuff into memory and doing a lot of calculations on it. The work involved in serving a 1 MB file off a webserver is...a little different.

Also, your obvious numbers are actually wrong. A one million character text file is not 1,048,576 bytes. If it's ASCII as you're clearly implying, it's 1,000,000 bytes. If it's Unicode, it's anywhere between 1,000,000 and 4,000,000 depending on which encoding method was used and which characters are in the file.

Re: 35k ante

It's not just the hardware cost. It's scaling where it's more convenient to run on two, it's writing and modifying the software, it's training new models to provide which takes a lot more than one of those, lots of extra costs. If you actually find this useful somehow, there's a lot more required to equal it than buying a box with a lot of VRAM in it.