Posts by doublelayer

Ubuntu 25.10's Rusty sudo holes quickly welded shut

Re: I disagree with this statement

I still disagree, with the clearest reason being this sentence:

"When this ends up creating a potentially more insecure binary, it's a problem with all this rust stuff."

Not at all. When this ends up creating a potentially more insecure binary, it's a problem with this particular piece of code. If it was part of Rust, it would impact everything else, but if it was a bug in that one rewrite, then it's as much a problem with all the Rust stuff as sudo's insecure config file vulnerability was a problem with everything written in C (which it isn't, in case a C fan was not sure what I am saying).

If someone badly rewrites something in a language, it does not make the language or the others using it at fault. When we compare the C version of sudo with this Rust reimplementation, it's also not so clear that the rewrite was bad. Yes, the Rust version has vulnerabilities, but so does the C version, and so far, the Rust one has not had one that allows a unprivileged user shell to turn into a root one whereas C sudo has. I think I can sympathize with the negative reaction to something that has been hyped too much, and Rust has received enough hype to be annoying. When that annoyance turns into hyping any problem with the new thing more severely than the original hype, especially with inaccurate statements meant to make a problem seem worse or more unusual than it actually is, then we have another problem.

Re: ninjed me!!!

How is that the logical conclusion and what does it really tell us? What you have in doas is something that does some of what sudo does with an amount of code between that of su and that of sudo. You lose reporting and monitoring, but maybe you didn't need it, but you still have per-user command filtering, but not as many options, and it's still bigger, which we have been using though probably we shouldn't as a proxy for likelihood to contain bugs. All we have from this is the fact that yes, doas also exists and could be another option.

Re: sendmail.cf

I was surprised to see the comment about m4 not getting used precisely because it's used in autoconf and automake and I see those all over the place. I don't really like them, although I admit they are better than not having them is, but I have to use them a lot and therefore I see m4 and things relying on it with some regularity.

Re: ninjed me!!!

Since the tool has access to a lot of important stuff if it has bugs, new vulns in it are found often, sometimes those vulnerabilities have existed for twelve years before you find them, and several of those vulnerabilities like this one or this one have been memory vulnerabilities, both of which let an unauthenticated person elevate to root without special setup, maybe it's not as crazy to think that memory security could be useful. That doesn't mean they did so correctly, but the "thoroughly vetted" argument falls pretty flat, as it does for many tools that get updates frequently enough that bugs slip in. We could argue about what is the best way to prevent that from happening again. Rust is definitely not a magic no problems language. However, when I can find you two problems it would have prevented and they're both that bad, maybe we need more than "but sudo's been around a long time" as a better option.

Re: ninjed me!!!

Because sudo and su do very different things. Sudo has the functionality to allow users to perform only certain commands, to make per-user credential management possible without removing all the privileges, to have logging and monitoring of attempts, and a bunch of features that some people need and some people don't. Su lacks pretty much all of that. In situations where you don't need anything, personal machines often falling into that category, you can choose to save yourself the code and do without. You can also do without su by just allowing root to log in at the shell and no user account can switch to another. But if you include su, you do it because it does something you want, and if you include sudo, it's for the same basic reason. The benefits of sudo are often much more evident on multi-user shared servers, exactly the kind of systems for which it was first written and for which the entire Unix and Linux security model is designed.

Re: I disagree with this statement

That's a problem with rewriting, not a problem with Rust. If it was a problem with Rust, it would mean that something about the language itself made those happen, which it didn't. Rewriting anything complex is almost guaranteed to introduce some bugs, no matter what language you use, even if you use the same language. If you haven't experienced that, either doing it yourself or watching someone else do it, you haven't had much experience. Simultaneously, sometimes there's enough reasons to do a ground-up rewrite of something even when you know there will be debugging to get it to the same level of stability and functionality as the old thing. Everyone gets to decide on their own when that time has arrived and I've never seen it happen without a lot of disagreement.

Networking students need an explanation of the internet that can fit in their heads

Re: Networking students need an explanation of the internet that can fit in their heads

Funny, most of the copies I find online don't write it like that, because writing it like that is weird. Here's one:

"government of the people, by the people, for the people, shall not perish from the earth." is how they are using capitals. That's how all the search results on the first page are using capitals. That's also how most things are transcribed. To use a less US example, if we look at the famous Churchill speech, we can see that it's generally transcribed "That is the will of Parliament and the nation.", because Parliament is being referred to as a proper noun and "the nation" is a specific instance of a noun that's not a proper one.

The internet is the instance of internet we're referring to, mostly because those smaller other internets are not ones we interact with. The original comment clearly understands that there is more than one, but misunderstands what makes a noun a proper one. If there's only one instance of something, or if there's only one instance you choose to care about, that does not make nouns proper by default.

Re: Google maps for Networks !!! :)

But implementors of what, precisely, because if it's an engineer building WiFi equipment, they don't generally have to reimplement the networking part, they have to reimplement the wireless communication part which is very different, and after decoding that to supported traffic, the network equipment they're connecting to handles that part. If they're building that networking part, they're generally either writing code or connecting existing systems together and making them work correctly in a group. In the comment where I described these two groups, I did say that these were a simplification and not the only ones, but lumping everything into implementor is getting the set of students wrong. There is something the student is coming here to do first, and it's likely not poking bits down a single pipe.

Re: Google maps for Networks !!! :)

Depending on what part you are building, it can take a very long time to get from that to any part you actually do. I've seen people try to teach programming starting at the logic gate level, failing to recognize that the young students they expect to teach haven't written a single line of code, so learning about binary nand gates is not going to teach them anything they can use. If you don't teach them things they'll use, they will see the lessons as unimportant. They would be right, because until they've taken the five intermediate levels, they won't be able to solve any problems they actually have, whereas the course that started with some basic code managed to teach the students to solve some basic problems.

In another post, I posited two types of student, those who intend to be administrators and ones who intend to be programmers. Sending data down a single physical pipe helps neither of them because the admins need to connect lots of pipes together and the programmers at least want to be able to set the destination for the pipe they create and likely want more than one.

Re: Networking students need an explanation of the internet that can fit in their heads

There are a lot of nouns that refer to a single thing that aren't proper nouns and aren't capitalized. We do not need to capitalize "the World", even though when anyone says it, they only ever refer to one specific world. Nor would a correct transcription of politicians' speeches write it as "the People" or "the Country", nor environmental reports talking about the vast watery parts write that as "the Ocean". If you make up your own rules of grammar, you'll find people break them a lot because they're not actually rules, because it's not "the Grammar" either.

What's the goal?

I think the most important question when deciding to teach anything is to have an idea of who is reading this and what they intend to do at the end, then start with a high-level summary of that part. It doesn't mean you only cover the things they'll deal with most often, but it does at least change the order you cover them.

For networks specifically, there are at least two and probably more approaches which I will simplify as the administrator approach and the programmer approach. The administrator wants to use all these existing networking things from switches to software to connect their equipment to a network, that network to the internet, that network to another network over the internet without the rest of the internet getting in the middle, all of those things at the same time while consistently routing efficiently so traffic never goes over the more constrained or expensive or less secure parts unless it has to, then all the techniques you need to test that traffic does go where you want and to collect information about what it did so you can modify it. The programmer wants...exactly the same thing, but they want to do it from the perspective of writing a program that has some traffic and getting that traffic delivered, first over a network with no restrictions, then over a network that has many normal ones, then constrained ones, then from all those complex networking scenarios which means they'll also need to learn how those work in order to know what they need to include in their code. The introduction that works for one is likely to put off the other because the programmer doesn't want to start with how you configure VLANs and the administrator doesn't want to start by talking about what a socket's communication domain is.

Happy holidays: AI-enabled toys teach kids how to play with fire, sharp objects

Re: And none of them would be legal in EU

I'll tell you where I live. I live in a world where I thought GDPR was going to make lots of abuses illegal because the law said it and there were nice large penalties, large enough to keep things in line. I lived in a world where I let my optimism run wild. And I live in the world you have to live in where there has been almost no effect from what looked like a revolutionary privacy law. Where it's rarely enforced, and when it is it's against companies that did relatively little compared to the obvious abuses of larger tech companies. Where despite the law's ineffectiveness, politicians from the same countries that passed it are trying to weaken it. I need more than the confident assertions from someone to actually believe that these things get enforced. You disliked my "pseudo examples", which I wasn't really writing as examples, but I note you mentioned not a single piece of legislation that would stop these, not a single enforcement body, not a single example of these things not being available. If specificity is your objection, then why don't you cite the reasons for your confidence, since you must have them if you're not making assumptions.

Re: And none of them would be legal in EU

You assume that, but there are two points you should keep in mind:

1. Some of the laws you are probably thinking about, like the GDPR, allow you to do many things if you write them down somewhere. The report quotes many legal documents explaining what's going to happen to your data, and there's far more that GDPR allows you to do as long as the user has been informed than things it completely prohibits. Doing sketchy things can be legal if you tell people about it.

2. They're not enforcing those laws very strongly. Lots of illegal things under GDPR have happened. Not all of them have been investigated. Not all of the ones specifically reported to data protection authorities have been investigated. Not all of those reported by people with lots of money and lawyers get investigated. What makes you think these things, ostensibly basic toys, are going to get investigated? It may be illegal, but if nobody ever does anything about it, it doesn't look as if it was.

For all I know, you're including more laws than just GDPR. I could easily imagine a toy that tells children about matches being considered a product safety risk, but I could also see the laws never having been written to handle such a thing because the item itself isn't setting the fire, it's just giving more instructions about how something else could than we want. Just because something is dangerous doesn't mean the law intended to prevent dangerous things necessarily prevents it. Your confidence that the laws actually do handle this and that they'll have enough of or any effect seems optimistic to me.

Developer battled to write his own documentation, but lost the boss fight

Re: Hmm

I am fortunate enough that I have never encountered someone who did this severely. Most who I have found need to say something but don't get too unhappy if their changes don't get made. Unfortunately, I know at least one person who had to deal with someone who demanded so many changes that they went to the extent of deliberately including things for the critic to complain about because they would otherwise send round after round of mandatory feedback and force all the team members to stay late into the evening to implement those changes before deadlines. It did not do that person's mental health any good, and of course introducing deliberate confusion or errors into drafts could have had all sorts of other problematic results.

Re: Hmm

Even if we assume all the opinions in the article are wrong, if we agree to accept the facts alleged, the tech writers were not sitting down with the developers to learn the product; they were communicating by written messages volleyed back and forth. Even if the documentation produced by the programmer was complete gibberish, you couldn't make it better without understanding the software, instead getting the kind of thing you would get if you had an LLM write it: clear, well-organized, grammatically correct, and useless. So I still don't think we have enough information to turn the benefit of the doubt to favor them. And if we aren't willing to accept those facts, we might as well make up any story we like because we have no information other than that from the article.

Re: Hmm

I'm not so sure. Of course, we'll only ever have one person's description of it and they're likely to edit anything that they don't want to appear, but nothing in the description says that the problem was missing things which the writing department asked to be filled in. I've known people, and I'm guessing you have too, who could not review something without proposing changes. I wouldn't count out the combination of people trying to justify their jobs and not necessarily being good at them. Most programmers I know would be all too happy to not write documentation, sometimes so much that they don't even though we don't have any writers to do it instead, and the writers probably weren't getting any complaints if the documentation wasn't good.

Apple knits up $230 sock for your iPhone in time for Christmas

iPhone as singular proper noun

I often see people who have grammatical errors that really bother them and don't really bother me, except some cases where their complaints are what bothers me because what they think is incorrect grammar is actually normal, but I think I know what they must be feeling because, for some reason, I find it noticeable and unpleasant any time Apple talks about iPhones like this:

"Born from the idea of creating an additional pocket, its understated design fully encloses iPhone, expanding to fit more of a user's everyday items."

I don't think this is necessarily grammatically incorrect, but my brain just demands that there be a word between "encloses" and "iPhone". "Encloses an iPhone", "encloses your iPhone", "encloses the iPhone", all of those would be totally acceptable, but when they say "encloses iPhone", it somehow stands out very starkly as wrong. And in other languages I speak where articles are either absent or less often used, it is back to sounding normal again. Does anyone else have that?

Google to allow Android users with high pain tolerance to sideload unverified apps

Re: Handwave handwave, distraction distraction.

The problem is that anyone is able to look up the website that tells you how to jump through any set of hoops that involves clicking through screens. Most don't bother to because they have no reason, but those people who are willing to justify any loss of features or right to do what I want with the thing I bought in the name of security will often decide that, if it is possible for a child to manage it which it always is, that it's too easy. This works very well with the people who have a different incentive to block me from having that access.

I am worried that whatever Google's method is, it won't involve another security warning, because the method we have now already has two of those so why would a third make any difference? If it involves setting something in your Google account, getting a code from your manufacturer, or any of the many other things they've already used to lock features behind doors that may or may not agree to open for me, it will still be unacceptable.

VLC's keeper of the cone nets European free software gong

Re: Why is the register focused mostly on how VLC is gratis?

Who says they are? For example, when they quote others as saying that Kempf is the "the one who kept VLC free", they don't mean free of charge; the things he prevented wouldn't have introduced a purchase price. I admit that they also don't mean the version of free you're talking about, because you can still have a piece of software under GPL2+ that comes with unwanted additions. But not only has he maintained the code under its original license and kept it up to date and very full-featured, he has kept it free of plenty of things that could have helped him while harming users, for which we are grateful.

Is it possible your view on the article says more about your biases and preferences than anything the article actually had an opinion on?

Aviation watchdog says organized drone attacks will shut UK airports ‘sooner or later’

Re: Fight fire with fire?

If we calculate the way that people often do when there hasn't been a recent disaster, we can answer that question. It would go something like this:

The closure of Gatwick cost £50M. That has not happened again in seven years. If we only put teams at the busiest 40 airports, that's £179k per airport per year, which for a 24-hour service means an expected hourly benefit of £20.38. If it costs more than £20.38 per hour to hire staff and equipment, then it's not worth doing it.

Which is not the right way to do this calculation since it's not considering actual risk. It's a very common way to calculate it because it is much easier than calculating actual risk and the people doing it feel like they're being cautious because their calculation assumes that the disaster will happen right now when they know the next one is likely quite a way off. If the next version of this is likely to be a lot worse or if the chances of having it are higher, then the benefit goes up and the comparison changes. However, the "can we afford not to" approach is not any better. It prevents the important work of considering approaches that might work better, be more efficient, and whether we need to do this in the first place. Lots of bad policies have gone into place because a problem was scary enough that it escaped the "not my problem right now" period into the "we must do something, this is something" one.

Not only do we not have a good estimate of risk here, we have no idea what it would take or if it is even possible to build a team as described. How feasible is a drone chase squad? How hard is it for attackers to send up a lot more drones so the chasing team can't chase them all? How hard to speed up their drones so the chasing ones can't catch them? How good is the information they would use to try this. When the chasing drones catch up to the interfering drones, what can they actually do to them to stop them being around; they generally aren't equipped with high-strength butterfly nets or machine guns, and neither could be feasibly attached to anything even slightly cheap. A cool-sounding solution doesn't mean that it works or is achievable.

China hates crypto and scams, but is now outraged USA acquired bitcoin from a scammer

Re: How dare you nick that before us!

That is a possibility, but it assumes facts not in evidence, namely that China had any intention to arrest the person concerned. We don't have any information about whether they knew about, cared about, or had any plans to deal with the crimes alleged in the US indictment. One other assumption you appear to have made is that China was highly represented in the set of victims, whereas many of the scam operations specialize in other countries, especially English-speaking ones. Not all of them, and China has historically cared and done more about those that either targeted Chinese consumers or used kidnapped Chinese citizens, but plenty of them use kidnapped citizens from elsewhere and target other countries, both because they may have more money to steal and because those countries have less ability to get the camps shut down.

But both of those assumptions, while they rely on things the article didn't say, could well be true. China could ask the US to share the cash with victims they have identified there and that does sometimes work, but they may assume that the US will refuse and are preemptively complaining. They may have other reasons for complaining which are less public-spirited though, or it could be a default technique to blame whoever you're unhappy with for whatever thing recently happened.

Altman sticks a different hand out, wants tax credits instead of gov loans

Re: Workshy Layabouts

Tax credits are certainly nothing new, being a rather old way of handing money from the government to someone else, whether directly or indirectly. That still involves handing them money. Even in the most limited sense where they cannot be transferred and only count against tax due, it still means the recipients of a tax credit doesn't have to pay tax when everyone else does. In all variations, it is a benefit to the recipient at the cost of the government.

Secret setting hints haptic feedback coming to Windows 11 UI

Do you really expect this is going to be something admins have to bother themselves with? There are plenty of Windows changes that admins have a reason to care about but this, while I don't think there's any particular benefit to it, also doesn't seem to have any particular downside. Will the fact that 3% of laptops make a vibration when you move a window be such a big problem that it becomes an IT task to stop it?

Re: But

Depending on when they use it, haptic feedback can make some things easier to know when they've happened, which is one reason they're somewhat common on phones because there's less space to use visuals to do that. It's a subjective UX thing, but sometimes, people like it. Whether anyone will here will depend partially on when Microsoft expects to send any vibration feedback and mostly on who has a computer capable of delivering that, because my computers don't have any vibration hardware. I don't know how well haptic feedback works on trackpads that use it to simulate clicks because I don't know if they can also do other types of things, and if the vibration feedback feels like a click, it will probably confuse more people than it helps.

Microsoft teases agents that become ‘independent users within the workforce’

Re: Really ?

Not a salary. That would be too easy to plan for financially. They will get a random amount every month depending on what the software did, which was decided by the software, and since you already agreed to run the software, you agreed to pay for the usage and you got the "benefit" of the usage, so you can't question that bill. I wonder if I can get that deal instead of my salary. Yes, I know I didn't do anything correctly today, but you have consumed 48515931 of my thought cycles and therefore you owe me half the company.

Who's watching the watchers? This Mozilla fellow, and her Surveillance Watch map

Re: KANOTIX is a Linux distribution

How does read-only RAM work? There is such a thing as RAM-resident malware. Of course, it won't persist past a restart, but it can grab things from the session, including your access to wherever you're storing or processing things you intend to keep after the session. Nothing kills interest in something quite as thoroughly or quickly as someone claiming it's impervious to attack.

FBI prevails over convicted fraudster in $345M destroyed Bitcoin dispute

Re: I wonder why they wiped his drives

When you're being investigated for a crime, the investigators will want all of your backups to make sure they are indeed all backups rather than decoys, one of which contains the evidence they're looking for. If they succeed at getting all of them, then what happens to one copy is what happens to all copies. If they don't, it means you've hidden evidence from them which can be a separate crime. Do you see now why it's a question worth asking?

Although I do agree with you in the limited sense that the lack of backups is one reason I don't believe this particular criminal actually had any cryptocurrency. I have other reasons to think that too. That doesn't change the general case being a question we should have better answers to.

Re: I wonder why they wiped his drives

Perhaps the better question is why they aren't legally bound to return them. The only options presented according to the article were giving them access and getting wiped devices back or not giving them access and having the devices destroyed. Either way, the person wouldn't get access to the data on the drives, which makes sense if it was criminal, but most of it probably wouldn't be.

If we're only answering the question of what should happen if there's no requirement to return property, then it's a really easy question to answer, but it's easy because it's an almost entirely meaningless question because the only value lost in the case is a years-old hard drive which is relatively cheap. The important question about data which might be more valuable is one that we should consider, both from the perspective of what the current law is and what we think the law should be. I think we can both recognize that the data stored on a drive can be valuable, either objectively like cryptocurrency* or subjectively like sentimental photos, code that took a long time to write but nobody else cares about, etc. We should decide what rights suspects or criminals have to maintain access to this.

* Even though I am quite certain that the cryptocurrency claimed in this case never existed. This criminal doesn't have to be telling the truth for there to be a potentially big problem with treatment of seized storage devices.

Meta can't afford its $600B love letter to Trump

Re: By the time all this is over

The difference between deflationary and inflationary economic disasters is often a factor of what the government or central bank does in response, and we don't know what they will do and they probably don't either. Partially, that's because they don't have much control either since they take a look at what's happening, guess what it's going to do, and try to take an action to make it less bad which has the chance to succeed or just roll over to more bad but in the other direction. Support either to the investors who are losing money on the bad debts or to individuals whose savings were partially invested with those investors could easily cause inflation, whereas no support could cause a worse deflation problem. Managing the level of support that is enough to prevent the crisis getting worse but not so much that inflation is caused is very difficult even if the people doing it were knowledgeable and trustworthy.

Re: Have to have somewhere to spend all that money

Datacenters are costly to build from a lot of perspectives, but running out of materials isn't really a problem. The materials needed to build the structures would be a rather small part of them because each building is so expensive, so the quantity is not that high. We spend more on building commercial or residential real estate than would be spent on the buildings. Other resources would be more constrained but mostly in a local sense. Datacenters use tons of water, and some of the places they want to put them don't have plans for how to get that much, but that's more a problem of local access and infrastructure cost than a lack of water altogether, and if that was the biggest issue, nothing prevents a datacenter from being more efficient with water; they don't because it's cheaper to waste it, but they easily could. Power is another big problem, and probably one they don't intend to fully solve, but a lot of the money they claim to be spending is on new power generation and this they could also achieve if they allocated enough of the money to it. The really expensive part is all the stuff they're putting into the datacenters, but materials isn't the reason. A top of the line GPU isn't expensive because of the raw materials, but the manufacturing and the intellectual work needed to design them. Running it is expensive because of all the power needed to run it and cool it.

If all the promised things were to be built, materials would not be the problem. There would be lots of problems, including these:

1. All the environmental consequences of building and powering these things.

2. The costs of rushing to solutions and therefore doing something they could have done well in a worse but faster way.

3. The lack of commercial reasons to have that much of it.

4. The fact that they don't age very well unless well-maintained, so they're not even very useful a couple decades from now when someone might want them.

And because they don't have all that money just sitting around, there are a lot more problems related to the finances.

OpenAI's Altman and Friar walk back remarks about federal loan guarantees

Re: Wow, this is going quick

Indeed? Would you please name one? Since you have so many targets, pick one that was as bad or worse. I don't doubt that there are more, and I would like to see them punished as well, but your statement suggests two things I think you'd have a hard time defending: that this is happening frequently and in plain sight, when in fact fraudulent companies including Theranos go to great extents to hide it, and that the response was unfairly harsh on Holmes, when the appropriate response would be to similarly punish anyone else who was doing anything similar.

'Vibe coding' named Word of the Year. Developers everywhere faceplant

Re: Grammar pedant here

Because "architect" as a verb has been a synonym of "design" for many more decades than computers have existed, partially because the noun "architect" has referred to people who design things other than buildings. Its use in software design might be to distinguish fundamental large-scale design decisions which need to be made at the beginning of any large project from the many other design decisions that are relevant to parts or can be added on as features, which when you think about it, isn't that bad an analogy to the architecture you were contrasting it with. You can't invent new rules of English or abolish synonyms, no matter how much you want to defend the honor of architects.

Re: Garbage

I had not read about that before, and I spent far too long trying to parse the 8-stage example in that article. If that is anything like what people were actually supposed to enter, I'm surprised they bothered.

Re: Vibe

In the sense that the invoice gets chopped up into little bits that you get one by one, yes. In the total expenses sense, though, they are more similar.

Rideshare giant moves 200 Macs out of the cloud, saves $2.4 million

I totally expect they've done the calculations and are correct, especially with Macs. However, remember that these are exactly the same finance people who are getting blamed repeatedly throughout this comment section for failing to calculate the costs of the last version. Sometimes, financial decisions are not made with the complete sets of calculations you expect which often leads to having to do similar calculations later on to clean up the mess caused the first time.

In my experience, this especially applies to cloud versus non-cloud, where a lot of the decision gets made by IT and engineering and finance doesn't directly contribute to it at the start. It doesn't matter which decision they make; I've seen bad choices in both directions. Usually, finance does come in later and ask or demand for prices to drop, but they don't know or care what the choice was or try to figure out which approach is better. Maybe if finance had more tech knowledge and the other teams had more attention to financial success, but in my experience, they don't, there's often a lot of compartmentalization between the teams, and everyone wants the easiest solution for whatever they're doing, which leads to little or not-so-little problems.

Re: Yet another case..

I am saying that generic "cloud is always more expensive" arguments are wrong enough of the time that they aren't useful to make, and I don't just refer to the extreme spikiness exceptions you've mentioned. There are various situations where renting machines can be cheaper, and you have to evaluate those costs manually*.

I was also saying that Apple machines make for a very unusual price comparison. I've been saying that for some time. When AWS launched their Macs as a service, I commented that thirty days of rental equals the cost to buy the Mac concerned. That's nothing like normal cloud, where thirty days rental of a server is not enough to buy anything as powerful.

* One example which also often comes down in favor of cloud is a place with very low requirements. There's a base cost to have even one server in a colo. I've done that calculation several times, and until you reach a certain amount of hardware, you can have more capacity in the cloud, including redundancy, than running the bare minimum on your own hardware costs. Depending on the environment, that can sometimes be handled by running the one or few servers in the office of the organization involved, but places that need a few small VMs are also commonly the places that don't have a suitable facility or, in some cases, any office at all. The ones in the middle are where you often need to calculate for much longer to estimate what the equipment and facilities would cost and what the rental in the cloud would cost to compare.

Re: Yet another case..

Maybe being a little less general, though, unless you want to be wrong sometime which doesn't help. Cloud can be more expensive a lot of the time, but if you want a way to make it a lot more comparatively expensive than it otherwise would be, try to run Macs in it. Macs clearly weren't designed for this because you can't run Mac OS in a VM on commodity hardware, or custom hardware, and they don't have DC-scale hardware you can buy from Apple. Combine that with the requirement to rent them by the day, which the article and Grab's statement suggest is Apple's doing although I thought that was AWS's choice, and you've got a recipe for something that is even less connected to hardware prices than normal cloud hosting would be.

If you use this example to predict what other price comparisons would look like, you're going to be making overestimates which won't convince many people who check your calculations. Comparing prices requires creating detailed plans of what infrastructure you're going to use and what you need to set it up. People with an agenda, usually a sales commission, who decide that it can all be done from the cloud, it's definitely less expensive, and let's not bother with those boring plans, are often wrong and always annoying. Unfortunately, the people who have an agenda and say that running in the cloud is always less functional and more expensive, and you don't need to consider those boring plans to know that, are equally so.

Boffins: cloud computing's on-demand biz model is failing us

Re: Remember

Your point being that you can buy boxes with GPUs in them? Because if they can do their research on one of those, great, although depending on how long they need it, renting a similar cloud machine would probably still be cheaper. The problem being that most of the kinds of things they're running can't be run on one of those. Depending on the work, they'll either need a very large number of those or they'll need something completely different, for example something with a lot more CPU power since that is only optimized for GPU.

Or, if they're using GPUs, they might want faster performance on those. That box is as cheap as it is because it doesn't use typical VRAM with its GPUs. In order to be able to fit large models in the RAM, they've gone for cheaper but much slower LPDDR5 shared with the CPU than what you'd find on a normal GPU or on their other accelerators. The cluster I had access to had a lot of real GPUs and was no doubt very expensive to create and operate. It only made sense because the cost could be shared among the biology, physics, and astronomy departments as well as little extra users like me, and people still had to queue and negotiate for sufficient access. A $4000 box with nice GPU performance numbers if you use Nvidia's marketing with numbers for FP4 performance which most research cannot use is really not the same thing.

Re: Sounds like a good use for spot instances ..

The article covered that. They can't do their computing in little chunks that can get interrupted. They need a bunch of instances all running at the same time that stay running until they're done. With some modification of the software they're running, they could probably make it more fault-tolerant so it can restore itself when instances become unavailable, but that won't fix the biggest problem of needing a lot of capacity at once. It just means it will be stalled rather than broken.

Unfortunately, no matter how you go about getting that capacity, that is expensive. You can wait until the cloud provider you're using has that much free, you can buy the hardware for the few times you'll use it, but any way you manage it, it comes at a high price.

Re: Remember

Except for the types of projects covered in the article, it's not cheaper to use your own hardware in the long term because it would be idle for a lot of the time. Buying your own means obtaining a lot of expensive hardware and facilities to install it in just to have it powered down most of the time. Bigger universities often build a computing resource which is shared between project teams in some way where they can express the amount of compute they need and get put in a queue*, but individual teams are not going to have the funding to do that, so if they can't do it altogether, then they have fewer options.

The problems they are having are for very spiky use cases which are a strong point of the cloud but, as the article points out, not infinitely so. The cloud providers aren't too eager to have lots of idle expensive kit either, so they don't overprovision enough that lots of instances can be set up simultaneously. Nobody wants to have lots of idle expensive kit which is why it is hard no matter who you get your equipment from. Running your own hardware is not a magic solution to this unless you started with the magic massive grant, and if you did, the cloud bill might still be the cheaper option leaving more of the magic grant for other expensive things.

* The shared computer has its costs as well. When I was a student, I had access to that and the ability to run jobs. You had to schedule those well in advance and occasionally coordinate with other researchers to make sure you weren't going to cause problems for one another by running too long or interrupting something before it was done.

You'll never guess what the most common passwords are. Oh, wait, yes you will

Re: What about username?

The username is going to be stored in cleartext because they use that to identify you. If you want to have more random data, stick it onto your password to make it longer*, because that's the part that gets hashed if they're doing it correctly. Admittedly, I do kind of do this by using separate emails for different sites, but that's for spam detection and prevention, not account security.

* If they have a maximum password length, then you have a bit better of an argument and a reason to worry about what they're doing with the password you give them.

Re: leave their door key "hidden"

"I wonder how many of the passwords covered in the article were setup as a honeypot ?"

Given that the point of a honeypot is to know when someone got in and what they did, that would be none of them. Honeypots are a little more complex than having a bad password on someone else's site. In addition to being useless, deliberately trying to do that is likely a terms of service violation on that site.

Re: Where are they getting the passwords from?

Some of those will be cleartext or unsalted hashes, both of which make frequency analysis easier. Others will be salted hashes which they tried some old favorites against to make sure they're still in use. Unfortunately, good password storage is another thing that we've known how to do for some time and yet we will probably never see the end of yet another system storing them badly.

UK judge delivers a 'damp squib' in Getty AI training case, no clear precedent set

Re: Stored or not stored?

"Always relying on the law to determine right or wrong is trite logic that fails hard - as there's a lot of laws that are immoral - but magically those laws are moral because the law says so."

Read the comments again until you understand that I did not say that. There's a difference between legal and moral, and my point is that, no matter whether you think something is moral, if the law says it's a crime, you have to change the law to make it not one. If you keep using logic that you think it's moral thus it's allowed, you're going to get very surprised when you lose in court. The rest of us will either try to get the law changed or will work within it.

The arguments so far that it is moral have been...well they haven't really been arguments. You just say it. The closest things to arguments we got were that it's easy, so you might as well make it not an offense, which is a really stupid attempt. Your new one is about whether certain things count as an offense in the UK which is mostly unimportant because you have clearly stated that commercial violation of copyright is, and the people the article is talking about are very commercial indeed. This thread has clearly outlived its usefulness, but I suggest thinking about your arguments next time you want to convince people; I'm much closer to your view than you recognize, but you've used and defended a lot of clearly bad arguments which don't respond to any of my points but appear to have been picked out of a bag of cliches.

Re: Stored or not stored?

"It is an error to equate unauthorized copies to theft - as making a copy of digital data doesn't change the original by one bit, while robbing someone takes something physical from them."

1. I didn't. The robbery mentioned in the post referred to physical robbery and was an analogy pointing out the fact that the ease with which a crime can be committed is no argument at all for whether it should continue to be a crime.

2. We have lots of things equated with theft which work in exactly the same form. For an example, wage theft is a crime where I do work for someone who agreed to pay me but criminally withholds owed money. On that basis, they did not take anything I had and keep it away from me. Yet it is still theft because I am owed money and they are deliberately not giving it to me. As law stands, someone owning the copyright has the right to place terms on the distribution and use of their work, and you commit a crime if you violate those unless you and your use comply with explicitly written exceptions. Most such crimes do take the form of refusing to pay them money which they have the right to require if you obtain the covered work. Others, for example violating an open source license with specific terms, are less financial but are still criminal and can result in financial penalties.

As long as you continue to use flawed logic like this to either claim that these aren't crimes or to distract from the fact that they are crimes by quibbling with language you understand as well as anyone else, you are and will be wrong. You can argue that they should not be crimes and thus that we should consider changing laws. We would likely agree on some of that. For example, the specific exceptions where you can use copyrighted work for free without permission, I don't think there are enough of those. I also think copyrights last too long. You have not made any such argument, however.

UK agri dept spent hundreds of millions upgrading to Windows 10 – just in time for end of support

Re: Solution for low salaries in gov IT

And that life cycle is still a little shorter than Windows 10's. It was released in June 2014, a month before Windows 10 was. It entered extended support in July 2024, 15 months before Windows 10 did. It runs out of extended support in June 2028, anywhere from a year and a half to three years before Windows 10 depending on what version you're prepared to use. Everything needs either somewhat regular attention to updates*, a rigorous plan for how you're going to deal with very old stuff, or a willingness to take the risk of very old stuff. Unfortunately, a lot of people decide to go with option 3 but their reasons are bad and selfish**.

* The benefit of many open source operating systems and distros is that the attention to updates is often somewhat easy and free, but you still have to do it. Linux being free doesn't help you if you never tried running on anything after a 2.6 kernel, because 2.6 isn't supported anymore.

** Often, the reasons include things like finance not wanting to spend money on maintenance or IT not wanting to do the work to update it. Whether the users, customers, business, or whatever this thing makes possible are at risk is often treated as a much smaller factor than it should be. And yes, I do think IT is sometimes to blame. Certainly not always, as I have met many admins who know exactly how important a system is, what will go wrong if it fails, and fight a lopsided battle to make that happen. Unfortunately, I've found lots of people who don't like change or work and happily ignore it until something breaks and they don't know what to do.

Re: Ha, ha, ha

It's fun to blame Microsoft, but let's consider this. The migration we're talking about happened from 2023-2025. In other words, it happened well after Microsoft announced Windows 11 and announced the time for Windows 10 security updates to end. Unless the department went to the storehouse of used hardware, the machines they bought not only support Windows 11, but almost certainly shipped with it and had to be overwritten to return then to 10. All of this information would have been well-known from the start since all the necessary information was available from the end of 2021 with most of it announced months earlier. This is not Microsoft's fault.

Trump turnabout sees him re-nominate amateur astronaut Jared Isaacman to run NASA

Those are all true without necessarily having any effect on his qualifications for the post. So he has a lot of hours in the air, great, we will assume that this means he is a well-qualified pilot, although theoretically there are ways you could get lots of hours without having that. Being a pilot is not sufficient or even necessary for administering NASA. If someone else was chosen on the only basis of being a seasoned air force pilot, that would not be very helpful. The astronaut part is even less convincing because he did not have any of the things that distinguish actual astronauts. He paid for an interesting experience. That's no recommendation at all.

NASA has a lot of complicated responsibilities. Even if we ignore the building space stuff part on the theory that private companies, and given his friendships I think we know which, will be doing all of that, they still have lots of oversight and management of that technology and equipment to do. No, managing a business of building someone else's payment systems into someone else's point of sale hardware, no matter how successfully, is not automatically experience in managing extremely safety-critical equipment with extremely specific and rigorous certification procedures. If we assume that the private companies will handle all of that, then we're left with an organization whose primary mission is scientific, whatever their funders decide to say, since they're in the business of deciding which expensive hardware to send and exactly what they hope to get for doing it. If they want to have a village on the moon (good luck), there's a lot of knowledge gathering required unless they want to have a dead village and a contaminated moon.

None of this is an indictment of Isaacman's capabilities, but nor is any of it support for them. His statements are somewhat encouraging, because I would rather have more space research than a doomed attempt to get a human somewhere for more bragging rights (we stopped manned lunar missions, not because we had to, but because we could accomplish more with less). That may be as good as we can get. But no matter how many hours he has in the air, it's not going to make a difference to the important part of the job because never will his responsibilities require him to personally pilot a fighter to obtain a goal.

Amazon complains that Perplexity's agentic shopping bot is a terrible customer

Re: Agree with nobody

There are a lot of problems with AI that could be fixed by having the makers of the AI pay for the costs. They are very good at making sure they never have to, and as things go, this is one of the easiest ones for them to get out of. When a user decides to give Perplexity permission to spend their money, they're choosing to run software and take the risk of getting bad purchases. They take the financial cost before the return is processed. Therefore, the cost is on them. If we compare to stealing copyrighted data or even burdening servers with floods of requests, the AI company is much less culpable.

Since they have never been punished for doing illegal things in the first case or legal but harmful things in the second, there's almost no chance they'll get anything for not being great purchasing bots. Instead, the costs will likely be put on all Amazon customers, eventually all customers of anything Perplexity can buy from, as they change their return policies. Free returns was one of those things that was nice as long as most people weren't unreasonably overusing it, but like anything with a large shared potential cost, it won't last forever when it gets too expensive.

Re: Agree with nobody

I don't know that I'd count out the option that the bot orders something wrong and the user ends up having to return it. In my experience, you have to be pretty thorough at checking product descriptions, specs, and reviews whenever you have any special requirements, and AI bots tend not to be great at that. I have not allowed the bot to purchase things on my behalf and am not willing to, but I did just try making Perplexity find a specific item for me and it did not give me good results. I think both possibilities are likely, and possibly even that both are happening. I would not jump to the conclusion you appear to be that this is all Amazon; after all, I have stated that I support nobody and if Perplexity was actually doing a great job and avoiding Amazon's unilateral bad behavior, I would support them.