Posts by doublelayer

The Canon Cat – remembering the computer that tried to banish mice

Re: A Pebble is Not a Raindrop

This is where I think it is good to make a distinction between a computer system and an application. By computer system, I mean not only the hardware, but the kernel, the UI(s), the tools available for developers, and all the things that, as a non-developer, you don't want to have to deal with. Computers should not be designed for a single purpose, because for everyone who has slightly different priorities to you, it won't be worthwhile. So they won't buy it. So the company making it will have to increase the price so that only those with your priorities can support their development efforts. So you won't buy another one and people like you won't either. So your version won't get updates or support. So the entire thing will be seen as a failure and dumped into the dustbin of computing history.

The computer system should be designed in such a way that as many applications are possible, and then the applications can be written to fit your requirements. What you appear to want is a really full-featured word processor. If you had that, you could stay in it for almost all your time. The problem with making something only that word processor is that there might come a time when you need to do something that it can't, and then you'll want some other application and you probably don't want to buy new hardware to get it.

That's why you need general purpose tools like a mouse. You may not need it very often in your word processor, but other applications will, and the computer will only be useful to anyone, including you, if those other use cases are possible with someone else's applications. If you don't want to use the mouse, you can always unplug it. Removing those things won't help you even if you don't use them.

That's also why ditching the filesystem doesn't work, because in order to move data around in an organized way, you have to be able to find the specific chunk of data you're looking for. The highest-profile attempt to hide that recently was Apple's IOS, and it kind of worked for a while because you can't create that many things on an iPhone and, in the early days, Dropbox was a de facto filesystem for a lot of IOS apps. Of course, it didn't work forever and there's now a partially available file system and a client on every IOS device.

Tesla slams advisors for not loving Musk's $44.9B payout

Re: Any agreement should be terminated if it works out differently than my expectation.

As I'm sure you're aware, this has only been raised for review because a court rejected it, because, according to the court, the original award was given to Musk by biased parties. So it's more that I decide to give you an award to be paid for by someone else, you meet my terms, and you therefore get to take their money. They didn't get to vote on it then, so they get to now.

Why RISC-V must get its messaging right on open standard vs open source

Re: What in the world are we teaching children in school.

The statement you're disagreeing with and the statement they made don't appear to be the same statement. They didn't say that it was irrelevant because it was old. They said it wasn't perfect, and one of the reasons was that it was old. It wasn't perfect at the time, which many contemporaneous documents will demonstrate, so we shouldn't expect it to be perfect now.

All your other examples are subject to the same critiques. None of them were perfect, and many of them are less relevant now than they were at the time, if only because the things they talked about are different, and their discussion of them only considers the past situation. That doesn't make any of them worthless. Putting a document on a pedestal will not help because you need to rigorously consider which parts are still relevant and which ones could do with an update, and neither dismissing it as obsolete nor extolling it as perfect will help do that.

Re: We've been down this road before

It can be changed back, but their points usually include the following:

1. You can't just pass a law, because it will be invalid. If you want to change something, you have to pass an amendment first.

2. It is hard to pass an amendment, so you need to plan for how you're going to accomplish that.

When people argue on that basis, they aren't saying that it is impossible to change it, but that you cannot act as if that change has already occurred.

Re: Sanctionable

They are legal to buy. They are readily available on sites like Aliexpress and Amazon. People don't buy them because it involves spending more money to use more electricity to get the same performance. Usually, low-end things either go for cheapness or power efficiency, so to buy Zhaoxin and get neither is not a popular decision. You can, though.

Windows 11 24H2 might call time on that old NAS under the stairs

Re: Arrogant?

I recently tried to access a Linux device that's quite old (about twenty years old), only for my SSH client to refuse to connect because it did not support any modern encryption algorithms. Is it arrogant and dictatorial for OpenSSH to have decided not to include encryption that can be easily broken, exposing my connection to the vulnerability that someone could break in and impersonate me with a little effort?

Unlike Windows and SMB1, that wasn't a setting. If I wanted it to connect, I was going to have to recompile OpenSSH. OpenSSH was right to remove that. Microsoft is right to disable this.

Re: Security

Except that the billions of devices referred to include the following:

1. Windows computers that don't need SMB1, and therefore are no longer vulnerable to problems with it.

2. Devices which weren't updated from SMB1, but their manufacturers fixed this because they didn't want to deal with user complaints.

It does not include these, which were not referred to by the statement:

3. Devices whose manufacturers can't be bothered to use a secure version of the protocol.

4. People who re-enable SMB1 to continue using devices in section 3.

So yes, if you look at the devices he wasn't talking about, you're quite correct that they're no more secure.

Quite true, but that's not something that should decide how something is designed. Someone can't be bothered to do a simple Google search and, even with Google's reduced quality, the instructions will be the first result if it's not printed right there on Google's page, so therefore we should leave the insecure protocol enabled by default on everyone else's machines? Come on, that's exactly the kind of thing for which Microsoft would be blamed any time someone used that to do something malicious. Insecure protocols get disabled. Manufacturers should stop using them. People should override this if they need to after actually checking if they need to and what other actions they should take, but that shouldn't and doesn't stop us from disabling them when we do not.

The workaround that will consist of the following complicated steps:

1. Turn it off.

Changing the default setting doesn't make something obsolete if the previous setting is still there. You can use any insecure thing you want, and it's not anyone's responsibility to leave everything else insecure so you can do it without effort. There are times when something is really intended to make you have to buy new stuff. This isn't one of them.

Two big computer vision papers boost prospect of safer self-driving vehicles

Re: "Safer" is a vehicle option?

If playing the piano badly caused people to die, I'd seriously have to consider whether it was worth it. There are many things that have been automated because they have safety implications. In some cases, the older machines are so dangerous that they are no longer considered legal to operate in the way that they once were.

This is far from saying that cars have reached that point or that the replacements are sufficient, because so far the replacements are not good enough. Comparing deaths caused by human drivers to bad pianists is a faulty comparison, and I think you already know it.

Multi-day DDoS storm batters Internet Archive

Re: Copyright infringement

It may be worth noting that, while they lend out one copy per paper book now, they haven't always done that. In 2020, when the lawsuit was filed, they had removed that limitation and were lending out unlimited copies. They had a reason they wanted to do that, but they probably should have known that this was almost certainly illegal. Unfortunately, their decision to do that has landed them with a lawsuit that might be used to deny them lending out even the limited copies. I can't know whether they would have had the same attention if they hadn't tried that, but I think it might affect their current legal situation.

Chinese national cuffed on charges of running 'likely the world's largest botnet ever'

Re: So it's a falsely-advertised paid version of Tor?

No, it's nothing like that. It's a paid VPN, which presumably actually functioned like a VPN, not Tor, because all the VPN endpoints were controlled by the same organization. The malware giving them access to the victim's computers has no parallel in Tor. It was what the article described it as: a botnet attached to a VPN program.

Tape is so dead, 152.9 EB of LTO media shipped last year

Re: Long-lived contracts

If they're in 1980s Word Perfect format, they don't contain that much that can't be handled in plain text. Nowadays, PDF is a more expected format, and that will likely be easily read years from now. As much as I dislike it as a format, it's a format that, due to our powerful computers, puts a lot of weight on backwards compatibility and one for which lots of software exists. That is if they use the typical, unencrypted subset of PDF. If they insist on putting in the weird Adobe additions that only Adobe software* understands, then it's less likely to work.

* Well, one piece of Adobe software. Everything else will break. Well, a subset of versions of one piece of Adobe software.

Re: Long-lived contracts

Or converting them to plain text, in the case of most legal contracts where there is no data in images, diagrams, or font styles. That would be easily read today.

Re: Magna Carta.....and related topics about "lifetime"..........

"By comparison Microsoft Word documents I wrote in 1990 can't be opened in M$ software today!!"

But, as I'm sure you know and your comment suggests, you can easily get software that can read them, for free, which runs on your computer in a free VM program, which can convert them to something else which can be opened. We haven't lost that data. Not only could you have easily converted them at the time as people do with their backup media, but unlike that media, it's also easy to recover them on demand today. Recovery taking minutes instead of seconds is not the same as the permanent loss of the data.

OpenAI sets up safety group in wake of high-profile exits

Re: Excuse me what?

Not as much a conflict of interest as just useless. Safety isn't a regulated thing like some governance issues. Whatever they set up, the board was always going to have final control. All this means is that they don't care enough to have someone else look at things before they ignore them, which should already have been obvious, but they think having a named group will assuage fears that they aren't going to do anything. Maybe they think that some employees are truly worried about safety issues but will be dumb enough to trust that, because a committee exists, it does something.

AWS leads UK cloud market while Microsoft dominates growth and new customers

"Do any of their customers cite the risk of price-hikes by third parties and the cost of extrication in their annual reports? Surely they ought to."

Whether they aught to is one thing, but I can virtually guarantee that they don't for the same reason that they don't report the extrication from anything else: they don't know it until they need to. How costly would it be to, for example, get rid of VMWare products following the licensing and price changes? It's not a simple calculation because you have to know what you're switching to to know the license costs and you have to estimate the work required, but the IT department is kind of busy doing work they know they need to do.

Now do the same calculation for every other heavily-used piece of technology. What would it cost to change out Red Hat if IBM chose to do something intolerable to it? That's a long research plan for something that's speculative at best, but could be pretty cheap or extremely expensive depending on how much you rely on it and if you can change to something similar or not. In some situations, the likelihood of wanting or needing to change is high enough that you would calculate that cost in preparation, but doing it routinely is not an easy or cheap process, whether you're talking about a cloud provider or any other piece of technology.

Where do Terraform and OpenTofu go from here?

Re: For what it's worth...

You will end up having to build a lot of things yourself, for example the way to let multiple users continue to deploy things without stepping on each other. Tools built into or around Terraform already exist to do some of this. When I've used it, I often have thought about building some of this myself, but I am a programmer and I deploy infrastructure when needed, not as my primary job. There are plenty of people who can use these things that would not be able to write the management components, either to an acceptable quality or at all, but are perfectly good at knowing what needs deploying and may know more than programmers do about managing it.

No matter how tightly they couple the devops role, most people I know tend to be better at one or the other. I am stronger on the dev side, although I flatter myself that my ops skills aren't too bad, but I know devs who are bad at admin and admins who can't write software, and prebuilt software can help with both. Terraform isn't great, but it is an established tool in that area and probably won't go away.

Re: Language evolves...

Now you're fighting against making nouns into verbs, but that's not going to stop. Do you ever phone or email someone? What, you don't always say "use a phone to talk with someone" or "use email to send a message to" someone? You don't have to because those verbs are easy to understand. Thus, if you agree that there is a difference between an incentive and a motive, then it shouldn't be very surprising that people who frequently use the concept of "offer an incentive for the following behavior" would shorten it.

There are lots of invented words that fit into your category. The one I've heard more often (in complaints anyway, I don't hear that many people actually say it in real conversation) is "burglarize", which wouldn't appear to say anything that "burgle" doesn't. I don't think that "incentivize" hits the same mark. Not to mention that English also has plenty of synonyms, and we don't need to channel the Newspeak dictionary and start eliminating them.

Re: Language evolves...

Incentivize and motivate mean different things. A motive is a reason to do something. An incentive is a specific reward for doing something. You can be motivated to do something by wanting the incentive you'll get if you do it, but you might also be motivated just because that's what you enjoy doing, because you'll feel good at the end, because having the thing on your list of tasks is getting annoying, all without an incentive being present. Therefore, when we talk about incentivizing a behavior, we mean that there is a specific, external thing motivating someone to take an action. This could be intended (let's incentivize people to do this task because motivating them without one is not working) or a problem (people are incentivized to lie about their progress because we give bonuses if you say you're done but we don't check, and we could try to fix that problem by removing the incentive).

The agnostic line doesn't mean that you don't care what cloud, although if you're using a sufficiently restrictive set of services there are things you can do to make it help you shift infrastructure to another cloud automatically. However, that's not what they meant by saying it. The point is that you can use this tool for almost any cloud provider or some local systems in the same way. If you learned CloudFormation (sorry, I'm sure that wasn't fun), and now you want to deploy on something other than AWS, you will need to learn a different language, to have a different backend storing state, and to rebuild all your non-resource code. If you're using Terraform, you have to change only those things specifically identifying resources, but your infrastructure can be the same and your non-resource components can remain unchanged.

Man behind deepfake Biden robocall indicted on felony charges, faces $6M fine

The article indicates that there is a misdemeanor against impersonating a candidate, so depending on how that works, he could be charged with that. I don't think he will though. My comment was less that he definitely has legal culpability but that he at least knew or should have known that there was a plan to do something like this. After all, making a fake version of a candidate say something that they definitely wouldn't suggests that someone is going to try to use it. Compared to other links in the chain, the creator of the audio had a reason to suspect that something would be tried, whereas various other service providers didn't have that and would be even harder to charge.

Not all of those parties have to know what's going on. The guy making the fake audio had to know that was dodgy, so you can make a case for them, but the intermediaries in the phone system didn't know what message was going to be sent, so they can't be as responsible as the one doing the spoofing.

"I find it amazing that they found and fined the guy that was doing something political but can’t stop the ones calling me about a car warranty."

One guy versus about a thousand shell companies in multiple countries. I'm not surprised that they can manage the former but can't the latter because they seem to get bored after finding one of those companies, fining it, and letting it file for bankruptcy. A new company will take over within hours, but they'll spend a while before they start to track that one down. This goes for lots of countries' authorities.

"How about stopping ALL the political text they are sending me. Let’s see some fines for that. Most political notifications are misleading if not outright lies. What is the difference here?"

If you're referring to political spam sent by actual campaigns, the difference is that they're explicitly excluded from laws about spam, they identified the true source, and that's basically it. Both of those mean they're not going to be fined for doing it. Sorry. Maybe you can get yourself off the lists, but I don't know how.

Google guru roasts useless phishing tests, calls for fire drill-style overhaul

Re: Still useful

Probably it doesn't have that much of an effect, but that's not enough to justify doing it. The point of a zero-day is that IT having antivirus up to date won't stop it. There are other possible problems with it as well, and of course clicking the link informs the attacker at the very least that your address exists and you sometimes click links in them.

The rules are pretty simple and there is a reason for each one. Phishing email: don't reply, don't click links, don't enter information, don't open attachments, send it to the reporting mechanism provided. I think we would both agree that someone saying "How much harm did it really do when I entered my username and password on the phisher's form" is not making a convincing argument. Yours is not that convincing either. The response to you doing it was probably larger and more annoying than it needed to be, but still, don't click the links unless you have a specific reason why you need to.

Re: Still useful

"real phishing messages are more obvious."

No, the phishing messages you have gotten are more obvious. Phishing messages can take a lot of forms. Just because you've seen plenty of spam sent out in bulk doesn't mean it all looks like that. That's spam sent to millions of email addresses. They have to use broken English for at least one and possibly both of the following reasons:

1. They are sending out millions, so they can't afford the time to filter out lots of people who will eventually smell a rat. They want all the people who get that this looks scammy to ignore them on the first message so they can focus their attention on those that appear the most gullible.

2. They don't have the time or money to make their messages look convincing and don't have that ability themselves either.

Swap both around. If they're targeting your company, which probably has plenty of money, and are using you to get to that, they are no longer sending out millions and losing you at the start is no longer acceptable because you only have so many colleagues for them to try. They need you to respond a lot more. If they can write convincingly, they will. If they cannot, they may well get someone to help them. I've been sent phishing messages, and not only did they have the grammar worked out and the visual design matching, they went to the effort of figuring out who in the company I was likely to know and impersonating them.

Re: Not sure if it's possible

If you're going into this with the theory that "for most people that's [the URL] not helpful information", then plain text email will do you no good. They will still need to be referred to a page, so all plain text email does is make sure they don't have to take another step to see the URL. If they're unable to tell the difference between a legitimate and malicious URL, what good is making the URL more visible?

In my experience, nontechnical users who are trying are perfectly capable of recognizing dodgy URLs. These primarily aren't morons, and it is a bad idea for us to treat them like that. Many of them are either unaware of the risks, unaware of the methods, or don't apply the steps to check on them. The first two are why there is training. The third is why there is testing.

Suggested solution is insufficient

The problem with the four suggested points is that none of them replace what phishing testing is supposed to do. That's not to say that any of the suggestions are wrong, and some of them are required along with phishing testing, but if you don't test and do these instead, you'll still have a gap. Going through them:

"Make it difficult for attackers to reach your users"

Great idea, but you can never count on that. Sure, authenticate the servers sending mail to you and reject it, but phishers can put DKIM on their sending server too. There is only so much you can do to prevent someone who needs to receive emails from the public from receiving emails from dangerous parts of the public.

"Help users identify and report suspected phishing emails"

Everyone has training. The phishing tests are there to check whether the training worked, and where it didn't, provide more training. Someone who clicked a link has not learned some lesson that should either be taught to them directly or put in the training for more general consumption. The tests are there to improve this goal. Not having them means your training probably has holes, but you don't know where they are until it causes a problem.

"Protect your organization from the effects of 'successful' phishing emails"

Of course, but this is now cure rather than prevention, and we all know the saying that links those. You'll have to spend less time cleaning up if you can minimize the number of messes that are created.

"Respond quickly to incidents"

Not much different from the third point, and a point where prevention is more important. If, for some reason, you don't have the ability to respond as quickly to incidents as you would want to, for example the main security person is busy cleaning up from a successful phishing attack that happened yesterday, the second security person is off sick, and the third security person doesn't exist because this isn't Google with probably a couple buildings full of them, then it would be best to have fewer incidents. Phishing training and testing is designed to make that happen so that the security teams can respond quickly when ones do happen. By the way, having a Google-sized IT security team doesn't necessarily make this easier if the number of incidents scales with that, because a hundred people chasing ten thousand incidents is still going to be slow, even if they acknowledge the alarm quickly. I've worked with large incident response teams who look speedy and efficient, but the incident load can make that productivity theater if you're not careful.

Re: Not sure if it's possible

They definitely could in a variety of ways. Rewriting the email is easy. Configuring the clients to show links is usually an option depending on whether they let you choose the client. One company I have worked let me do this which was nice because I don't like GMail webmail and that's what everyone else was using, but it also didn't give me any integration with their systems. The capability to do that is available to them.

Elon Musk says he doesn’t want 100% tariff on China-made electric vehicles

Re: Hostage

I don't know why I'm arguing someone else's point for them, and one I don't necessarily agree with, but your evidence against it is not actually arguing against some of their points. For example:

"Tesla's share price will have little effect on its ability to do business as long as it doesn't have to raise finance."

Correct. However, they referred to Musk's personal loans, and they suggested that the thing that collapsed first would be X. Their theory would appear to involve banks requesting more collateral that Musk did not have, then presumably either the banks trying to take Twitter away from him or Musk trying to extract funds from it to pay the loans, either of which could have an effect on that being able to conduct business. In turn, Musk might do various things to Tesla to attempt to get more funds from them which could have a deleterious effect on that business.

Would any of this happen? I don't know. I have no way to know what the banks would do or how Musk would respond. However, if I intend to disprove it, I have to do more than say that the stock price has been lower, it didn't happen then, therefore it won't happen now.

Re: Hostage

No, they have not just been given that evidence. They didn't say that, at any time, if the price of Tesla stock fell to 50% of the value it had then, that it would collapse. They said that, if it fell to 50% of what it is today, they think something, Tesla or X, would collapse. Presumably, if they were making the same prediction when the price was double what it is today, they would have said that if it fell to 25% of its value, things would collapse. I don't have any reason to think that they're correct, but you can't disprove it based on something that wasn't the same and happened at a different time. Proving something like that would work best if you knew how many shares were pledged as collateral, what value they would need to have for a lender to demand more, and what actions Musk might take, but they can speculate without having that information just as you and I can.

OpenAI tells employees it won't claw back their vested equity

Re: off-boarding agreement?

Usually they have a carrot involved. We will pay you [time period] worth of salary and you will agree to these terms. If you don't agree, fine, but no payment. Those terms can be quite simple or very complex and overbearing, and some of them could already be illegal, but the general concept isn't.

iFixit divorces Samsung over lack of real commitment to DIY repair program

Re: User details

Your first argument, maybe, but that should be opt in. This one: "Also to ensure parts are going to real end-users.", why should they care and why should I care that they care? I want to buy something. They have a price for that thing. I buy that thing. Whether I've got one phone I'm putting the thing in, am providing them to others, or just love having a neat stack of spare batteries for a phone I don't have on my shelf, it's none of their business.

In Debian, APT 3 gains features – but KeepassXC loses them

Ah, so the answer to how granular you can be is not at all. That changes the calculus a little. If you can't have some but not all of the features without building from source, then people will probably expect the package to have all of the features. That also means the maintainers do not have the choice of splitting it into a core package and another package and users just have to pick between the two offered versions.

It probably depends how granular you can be when putting them back. If you can reasonably easily install the basic versions and just the plugins you are going to use, then you can have the password manager, U2F support, and automatic typing without all the other things, and then you're only open to the vulnerabilities in things you're deliberately using. However, the more complex this gets, the more users will either install all the plugins, thereby giving them the same set of vulnerabilities, or getting confused and not using it at all, making their situation worse.

How Apple Wi-Fi Positioning System can be abused to track people around the globe

Re: This :-

You can't change BSSID while things are connected without having a brief drop. However, you could write something to check when there are no WiFi devices connected, then change and bring the interfaces back up without rebooting. How useful that would be depends on the frequency of having no WiFi connections on your network.

However, BSSID randomization is more important for access points that move, because your SSID won't be changing, so if your hardware never moves, it wouldn't be hard to use those instead to establish your location. In the case of travel routers, they're probably powered down each time you move them, so randomizing on boot could be quite helpful without having to try to randomize them during operation as well. The same would apply to mobile hotspots, mobile terminals like Starlink ones, etc.

It looks a lot like VMware just lost a 24,000-VM customer

Re: 24,000 VMs

Are we talking about the same company? I don't know the company, but when I looked up the name I got this Wikipedia article. It only talks about financial market services, not rentable cloud boxes. Either we have two different companies, and the one I found seems to fit what the article says, or someone should update the services offered section of that page.

Re: 24,000 VMs

Since their business appears to mostly involve moving financial instruments around, and they run that in a lot of different countries, maybe they're used to do that? I'm not sure where your number comes from, but a company whose primary product is a service that a lot of servers are needed to implement is going to have a lot more servers than a company whose product doesn't involve servers at all and the servers are just there so that people can do their jobs correctly. There will not be a single PC-to-server ratio that applies to anything, and I already don't know where yours came from.

Big Tech is not much help when fighting a junta, and FOSS doesn't ride to the rescue

Re: Mesh networks

Not really, because that would be very easily overwhelmed. One simplex channel means that most devices set to broadcast on it will not broadcast if someone else is, so you'd never get to talk, and even if your set does, you won't be heard because your signal will interfere with everyone else's. A mesh network may have a problem with high message volumes making it difficult to actually read all of them, but at least the messages would get through.

Re: There are options.

"The problem is that Western governments will ban all of this, anonymity, P2P, ad hoc, distributed and E2EE, because they are control freaks."

That is not the problem. It might not even happen, but even assuming it does, it isn't Myanmar's problem because to do what you suggest, you still need most of the internet and your new protocol will be pretty obvious. You may have your own version of DNS running, but your servers still need IP addresses for you to be able to contact them over the normal internet infrastructure. If your traffic is at all unusual, you can still be profiled. Myanmar can hire in surveillance support to do that or they can cut off large areas of the internet, so an internet-based P2P system is, while better than what people use now, similarly vulnerable to disruption.

The other problem is the one pointed out in the article. We have most of that already on easily-found Git repositories which we can clone and build. People aren't using it very much because it's not simple. You may have to do something like manage some keys, and people don't know how to do that. We either have to teach people or we have to make something simpler, and whichever we do we have to be careful that our system doesn't have new vulnerabilities. That is the problem.

Re: Mesh networks

I'm less worried about these elements, though they will certainly play a part.

"Surely a repressive regime has control over its ports and won't allow unapproved imports of any type so they'd have to be smuggled in."

They don't seem to have any problem shipping plenty of stuff that doesn't comply with local regulations. I'm banking on Myanmar's customs agency not being great at their jobs or people actually smuggling them in, but they are small, light, and relatively cheap, so this can happen and already does frequently.

"Cellular providers know what kind of device is trying to connect to their towers and could whitelist the approved devices so anything imported would be useless as a phone if that's how the government wants it."

I had that in my original comment. They would not be usable as phones, just as mesh nodes with access to WiFi and Bluetooth. This would have to be taken into account, but if a mesh network pops up (I don't think so for the reasons in your original comment and the additional ones in my reply) and Myanmar prevents people's phones from being able to run it, you could build one out of these.

"If they did that, possession of an unapproved phone would be a quick route to jail. [...] It would have to be something that's part of an app/OS so that ordinary citizens would be part of the mesh. The government couldn't track that because seeing data sent to/from a given phone doesn't tell you that person is a dissident, they could be an ordinary citizen who was unwittingly part of the mesh just passing things along."

I don't think those are as different as you suggest. They've already banned Facebook and VPNs. They can ban more apps. People just use them anyway. If they put the mesh part in WhatsApp, it would be as identifiable and as criminal as having an unapproved phone. All the police have to do is "Now unlock this for me. If you don't, I'll hurt you. You have WhatsApp installed. Off to jail." People already take that risk.

Re: Mesh networks

I'm not talking about a Chinese government-backed enterprise. I'm talking about the kind of company that exists to take some chips that nobody else wants, install Android 9 on them even though we're about to have Android 15, install random APKs that someone paid them to install, then sell the resultant device. They don't care about any regulations or really about their customers. People who import them will often find that they're rather disappointing. However, the software on such things tends not to be one centralized set controlled by the CCP but rather whatever adware or malware that particular OEM got paid to install, and otherwise they're fairly capable Android devices. You can find hundreds of these on Aliexpress. They would be fine as mesh nodes since they all have WiFi and Bluetooth, support APK installation, in some cases are relatively easy to root, and often have some attempt to localize them into lots of languages, albeit not well, so they can be sold to many countries.

Starlink offers 'unusually hostile environment' to TCP

Hostile isn't referring to bandwidth, but to the challenges that are unusual to Starlink-style services. It isn't a judgement on the service, more an observation of how TCP isn't working well enough under those challenges and could be improved.

Re: What's his definition of hostile

It seems clear from the article: hostile means that the environment involves dropping packets and jitter that are atypical of other connections, and since TCP was mostly designed with terrestrial or geosynchronous connections, it doesn't handle it well yet. Certain versions of TCP will not make good use of that bandwidth because they'll constantly be in the slow AI cycle, hitting an MD every time your satellite changes, so your speed for each socket won't be as high as the link theoretically could make it. You have plenty of bandwidth, but your software isn't using it. The solution is to improve the protocol so it can handle that hostile environment and not get degraded.

AMD's baby Epycs are nothing more than Ryzens in disguise

Re: “…These are still consumer chips”

This is probably why they're talking about I/O speed, because the server from 2015 with 16 cores was less performant than a 16-core Ryzen, but it might have been able to access RAM faster. If that server was good enough from a CPU perspective, this one will be too. If, however, you needed something really RAM-intensive and you bought a server board to do it, you still have to check whether this one can do the same thing. RAM speeds have increased a lot since then, which is good, but you're still limited to two channels. Hence, as usual when picking a server, you need to consider more than CPU speed.

ASML could brick Taiwan's chipmaking machines in case of uninvited guests

Re: They never learn

That's why they're paying TSMC and really anyone who's willing to set up more fabs on American soil. Mostly in the desert, which seems weird, but I'm sure they have a reason. They have recognized the risk you describe and are hoping to reduce it.

Alleged $100M dark-web drug kingpin, 23, arrested

That won't fix that problem. The jury doesn't have to decide the sentence for them to know the possible sentence. The defense attorney can easily make this point and usually do anyway:

"Do you really think that [x] deserves to die for [gross understatement of the actions]?"

That puts the thought in the minds of the jurors: "if you say guilty here, the judges might decide to kill them".

So even without considering the other problems the concept has, your separation won't prevent some jurors from possibly considering an acquittal to avoid it.

Taiwan's new president wants to upgrade from 'silicon island' to 'AI island'

I'm not sure the hype bubble is going to pop, but I think the financial one will and that will have some effect. There's only so many funders willing to put billions into an AI company for them to churn GPUs for a few months. Most of those companies are not making any money. If they keep building models that you can't sell, it won't take long before we have more collapses like Stability AI. That will probably eventually lead to lack of funding for more startups. Microsoft will probably keep hammering on it because we won't be done until they have a full thousand Copilot products that nobody uses.

This will go faster if AI companies are told they have to pay for the copyrighted content they use as training data and will stretch on for longer if they continue to get away with that. However, I doubt the news will get tired of more AI stories, and politicians and business leaders will only stop once the news has stopped covering, not just average AI stuff, but their own announcements on the topic, so they will continue even longer than that.

NYC Comptroller and hedge funds urge Tesla shareholders to deny Musk $50B windfall

"If there was a conflict, like he set the task and it was trivial (e.g. Musk himself set the terms as $50Bn if the stock price rises $0.000001 while no-one else was present), then investigate that."

That's exactly what they're saying. Or rather, that's almost exactly what they're saying which is that he had some friends set the terms and the award and it was trivial. They can fight that out, but the thing you say would be an exception is the thing they said happened.

An attorney says she saw her library reading habits reflected in mobile ads. That's not supposed to happen

"What part about "separate accounts" did you not understand?"

The part where that's supposed to prevent Google from tracking. The devices were in the same place. They were probably on the same WiFi network. Tracking point 1: same IP address. The Android device had a game installed, probably obtained from the Play Store, point 2: probably had a Google account. There are several ways that this could make a Google search identifiable:

1. Google saw a search from the IOS device which has no Google accounts, but they came from the same IP address, so they got associated.

2. Google saw a search from the IOS device, which did have a Google account attached, but it wasn't the same one as the Android device, but the names on the accounts were the same and they were at the same IP address, so they got associated.

3. The user was listening to something on the IOS device so chose to use the Android device to search, so they were attached to the same account when they searched.

Having multiple accounts is not proof that a Google search couldn't be used to associate advertisements with the search term. That a search occurred at all is not known, but if one did happen, it wouldn't be hard for Google to use the tools we already know they have to associate that search with another device.