Posts by doublelayer

How malware vaccines could stop ransomware's rampage

Re: How ransomware gets into a Windows machine :o

"Because windows can't tell the difference between OPEN or RUN!"

How does that work? Because Windows does seem to understand that executables can be risky and warns when running new ones. The problem comes when you run executables you shouldn't or you have a vulnerability allowing someone else to. I'm not sure what problem you're alleging, but from the words you're using, you're not alleging it very clearly. Maybe that's because you don't actually have one you can refer to clearly?

Labor unions sue Trump administration over social media surveillance

Re: Does freedom of speech work both ways?

"The article is talking about non-US citizens who openly support Hamas, so not covered by the 1st amendment."

We all know you read the article. There are a lot of things being covered, most of which are not even available to us. We do not get a full list of things that deport people, and yet we already have plenty of evidence that your statement is false and you knew it was. The article mentions that criticism of Charlie Kirk was sufficient. While there are probably lesser quotes that also earn that punishment, they collected some. Those quotes are not pleasant, stating that they are not unhappy about his death and openly calling him racist. Failure to mourn and applaud someone is not support for a designated terrorist group. Nor do you have any proof that the comments deemed antisemitic all took the form "The October 7th attack was great and I want to see more of it", yet you suggest as much. That got at least six and probably a lot more people deported since we all know the most severe examples are the ones that would be quoted in the message.

You have decided that, if you agree with the deportations, it's acceptable, which breaks your free speech absolutism argument into very small pieces. You have also decided that, to support that argument, you will decide what was said and what was not in direct contradiction to what we all read in the article. Neither is useful.

Re: Does freedom of speech work both ways?

Depending on the quality and degree of that pressure, you might have a case. Might; I'm not fully agreeing and you'd have to do a lot to prove that there was pressure and that it was a sufficient thing. That's because the ultimate decision was by a private party and led to private consequences (removal from a private platform) which can be done totally legally without any constitutional restraint. This case is a lot clearer because it involves a government decision and consequences (deportation). Maybe both count, but if only one does, it's not your one.

Re: Does freedom of speech work both ways?

Ah, so his opinion is opinion, but theirs is libel. I wonder what your opinion is. Do I get to decide?

Tribunal wonders if Microsoft has found a legal hero after pivot to copyright gambit

Re: "Is Office an artistic work"

From my perspective, it shouldn't matter. Yes, Office is and should be copyrighted. Yet, I can sell a book which is mostly the copyrighted content when I want, and I should be able to sell my license as long as I no longer use it, therefore transferring it rather than trying to duplicate it, and I have not signed an agreement saying I won't. If Microsoft wants me not to, they can put it in an agreement which prohibits me from using that power which they apply to subsequent purchases with clear warnings that they have done so at the point of sale, and their problem is solved. Laws don't build that for them for their convenience, nor can they write that agreement and apply it retroactively.

Benioff backs off: Salesforce chief says sorry for Trump troop talk

Exactly. Relatively few individuals get to be famous by being tech people, but if you wanted to be one of them, you have to do something consumer-facing and be really successful. You can be a Steve Jobs if you make a smartphone that lots of people have or a Clive Sinclair if you sell a lot of things with your name on them, and even he is probably a lot more famous here than he would be anywhere else. At a second level, you can be unrecognized but, when people ask who that is, they understand the result. People don't know who Evan Spiegel is, but if you say he's one of the founders and still runs Snapchat, they'll at least recognize that. This guy is in category three, where not only do they mostly not know who he is, they also mostly don't know what SalesForce makes. His legacy will not be political statements. If he wants a legacy, he's going to have to do something notably beneficial or evil with his money or mere force of will.

Ruby Central tries to make peace after 'hostile takeover'

Re: R

I kind of like R itself. Does that count? Or does "start with" exclude "and then immediately stops"?

'Fax virus' panicked a manager and sparked job-killing Reply-All incident

Re: The FAX is not dead yet.

Indeed. A place I've volunteered with had a copier which has a fax function, although I don't know if they ever bother to use that part. It failed twice. Fortunately, they did not call me to fix it because I hate on principle any machine that prints on paper because I know it's going to break sometime for a non-hardware reason and be much harder to fix than it should be. They had a repair contract, so a technician came and fixed it. Whenever the technician left, they left them a hard drive that used to be in the copier because evidently it was storing copies of things which it didn't need to which might still be present on the disk.

My main question was what the copier could possibly be doing to kill disks if replacing them was the way to fix the copier*, but my secondary question was why they had configured it to store all that data when they could have managed this with a RAM buffer alone.

* I still don't know. The first disk to be removed was a small spinning rust affair and I just erased and junked it, but the second was a 500 GB SSD so I put it to work. It's still running now with not a SMART error after three years of post-copier use.

Literal crossed wires sent cops after innocent neighbors in child abuse case

Re: Shutting Up

"The US system assume you're guilty, and it's up to you to prove you're innocent."

Incorrect. All the countries you name have the same presumption of innocence as legal doctrine. They have different protection, some of which will be stronger and some weaker. Let's take those rights suspects get read on arrest. The statement in England and Wales includes "You do not have to say anything, but it may harm your defence if you do not mention when questioned something which you later rely on in court.", but the version from the US is more similar to that in Scotland which does not. What's the difference? The difference is that you're not required to state your defense up front in either location. That's a stronger protection. Part of the reason is that the England and Wales requirements on police procedure include some restrictions the US does not have, which is a stronger protection there. The differences are smaller details and nothing so obviously wrong as what you've claimed.

Chamber of Commerce sues over Trump's $100K H-1B paywall

Yes, that is how the visa process works, but I think the person you replied to was making a different point. They allege that, when they've seen these people hired, the job description was aimed at either one predefined person in particular or only people from certain backgrounds. I'm not sure how easily you can do that, how you'd identify your one target beforehand, or why you would bother to if you could just select your preferred candidate during interviews anyway, but that's what they're suggesting which isn't incompatible with the visa process.

Chinese gang used ArcGIS as a backdoor for a year – and no one noticed

Re: Proprietary software and its consequences.

Software of all kinds often implements the multi-server approach where users can access one server which can compute on another one. It's totally normal in software from all licenses, perhaps the most common example being the web server and database server being different boxes but having a connection that allows computation on and extracting data from the latter even though it's probably not available from the internet directly. Just like this example, the important part is hardening the connection between those things so that disruption of one doesn't immediately conquer the other, not generally done for or doable for you by the software author, and securing the outward facing server, which the operators of that server did not do properly.

You're using a chain of arguments, and most if not all links in that chain are flawed. Servers operating in a cluster is not insecure by default, and yes, that involves "remote code execution", although since they're supposed to be executing code for each other, the term can be misleading. Free software has, fortunately for us, often recognized the utility of clusters and therefore does often support it, including running code on other machines. This was insecure configuration, and insecure user configuration at that (they did not need to run this as root, but they did, they didn't need to have an easily-broken-into admin account, they did). Neither free software nor proprietary software can be relied upon not to have an insecure default config, but when you let users at it, either can be degraded if they choose to set too easy entrance methods. False credit does not help your preferred people.

Re: Misleading summary

The article didn't make it very clear, hence my clarification. Here's the relevant part of the report:

Initial Access

Working with ArcGIS, we found the attackers compromised a portal administrator account and deployed a malicious SOE.

They note that they mostly can't tell the details because it was present for long enough that they didn't have detailed logs. This wasn't a supply chain attack, not that those would be particularly new either. This was just implementing malware as a component of something that was supposed to be there so it's harder to find. Since it was new code, a typical scan for known bad files wouldn't have found it anyway, and it wasn't particularly sneaky in operation because it created its own secret directory for storing incremental data which could be later retrieved. It was clever hiding, but the article acts like this was a compromise of ArcGIS or something similarly pervasive. It wasn't.

Misleading summary

The article acts like this attack is a novel technique or somehow different, using sentences like these:

"It also highlights how attacker sophistication increasingly lies less in weaponization and more in subverting trust – turning the target’s own system into the attack vector."

"These latest findings underline how even legitimate, widely used software can become a long-term espionage tool when misused. For defenders, it’s another reminder that persistence doesn’t always come from exotic malware – sometimes it’s hiding in the apps you trust most."

Let's simplify the talks about SoEs and backups for a minute. Here's what happened. The attacker broke into an admin account that was inappropriately configured, wrote some malicious code, and installed it on the server. Exactly the same way that they would if it was running as a separate process, but they wrote theirs as a plugin to something already running on the server. It's still custom malware; this was not embedded into ArcGIS. It was not part of something public installed by the admins themselves. It was written and installed by the attacker. This is not so new.

AI is the flying car of the mind: An irresistible idea nobody knows how to land or manage

Re: ok, but what do you mean by “artificial intelligence”?

It is a difficult problem, we spent at least four hours discussing it and only managed a small amount. However, I think some of your points were covered in our just for fun definition. I don't think the halting problem counts as emergent behavior. That demonstrates a lack of provability of what a program will do, but only from the perspective of an analyzing program. We were allowing the definition to include the intentions of its developers. The halting problem is a lot easier to answer when you can ask the programmer "is this thing supposed to run infinitely, terminate every time, or do so conditionally". We also removed bugs, because you can make the argument that any behavior is emergent if it was the result of programmer error. So if it was supposed to terminate every time but there's something that causes a loop, we allow the notional programmer to fix that and we consider again. Because we focused on the goal of a program from the perspective of its designer who was central to our case, a large part of computation theory fell away because it didn't matter how that program was executed.

I think we all thought that rules engines and mathematical solvers should be out. It's following a very specific set of rules that were manually installed by the programmer. That's exactly the kind of thing that, when sales calls it AI, we immediately rejected. If you run a specifically chosen graph algorithm on explicitly written logical operations, that just sounds like normal programming to me. I'd be interested in hearing counterarguments if you disagree, but so far, I'm content for that to be a clear exclusion from AI.

Inevitably, I don't think we can ever get a definition that we can agree with, and if we did, it might be more frustrating than not doing so as we watch marketers stomp all over it. It's fun to discuss, though.

Re: Equality and opportunity

It can be whatever type of utopia you want it to be, assuming you can get there, which is the hard part. It is very expensive to provide anything like that. Governments provide subsets of that to subsets of the population and are already in debt. If we're only looking at what happens afterward, we're missing most of the problems.

But on the topic of what kind of utopia it ends up being, there are serious problems with many of the theories. Let's take the "right-wing" one you described: everyone gets some money which can cover lodging, health, food, all the necessities and some minor comforts, the money coming from...somewhere, but it exists as an axiom. Most people use it that way. Some people decide to waste it and end up with problems with their necessities. What do we do? I have a feeling there are many people who aren't quite on board with the "let them starve to death; they got plenty of money for food" plan.

In addition to it being a lot harder to build, there are many problems which promoters of the plan assume it will eliminate, most of which won't decrease to zero and some of which won't decrease at all. As long as it keeps getting sold as a utopia, those problems will remain. Only by acknowledging them can we hope to fix them, and we have to consider whether that fix can be a patch along with the UBI plan or whether it's a bigger problem which threatens the functionality of the plan.

What we would do in a world with a functioning human-level AGI is an interesting philosophical experiment, but before jumping to putting that experiment into policy, remember that we don't have any AGI. There are lots of machines that can stack things and they do, but people are needed because the machines can't handle all sorts of unusual situations. We've had robot vacuums for some time, but there's sometimes more work required to clean the floor and that's the only part they're attempting; there's no general cleaning robots available right now. Tax returns can be filled out automatically by software if you can just get all the data organized, but it takes human intelligence if you want to find the ways to pay less without it being illegal.

More importantly, there are a lot of things that people are paid to do which don't have any automation yet. I could imagine a better cleaning robot that could scrub more surfaces than a nice, flat floor, but the part of cleaning up where you go through the items on a surface, decide which ones get discarded, which should be put back in some other place, and which get temporarily moved while you clean then get moved back, that one will not be so easy to automate but it's an intrinsic part of cleaning. We do not have the technology that would get us to your premise. We can discuss the what if, but we don't know when if ever that what if might happen.

Re: ok, but what do you mean by “artificial intelligence”?

At one point as a student, some friends and I discussed how we should define AI. We were trying to be descriptivist, coming up with a definition which would apply to stuff where we or our fellows would use or accept the term AI but exclude anything where we'd dismiss it as marketing nonsense. At that time, we decided the important difference was emergent behavior being desirable. In a compiler, a bunch of input produces a bunch of output but all using rules. If it does something you didn't expect, that's a bug or at best a happy accident, not the goal. If a bot trained on a bunch of chess records starts doing something new, that could be a successful strategy that nobody programmed into it and the programmers wanted, and if it wasn't successful, then different training methods could eventually find one. Whether "artificial intelligence" was the best term for that wasn't certain, but it seemed to be what people were using it for and some of the things it could do required a lot of intelligence in a human, so we went with that.

Then marketers got even stronger and the entire point of defining AI failed. If AI is supposed to mean human-level, then nothing is simply because nothing has the breadth of a typical human mind even though many programs can do individual tasks much better than a human. If it means simulating a human, then we get into all sorts of arguments about what qualifies as a sufficient imitation which leads to arguments about Turing tests and, having gotten into a really pointless argument about those last week, I'm not doing that again. And the people who used to use the term AI for anything with an if statement are still doing it and, because of the bubble, so are most other people because they think they need to to keep selling software. We were never going to get people to apply our definition, but it's a lot more fruitless now.

British govt agents demand action after UK mega-cyberattacks surge 50%

Re: Anything of substance?

Right, them. Or in other words, the people who wrote this report. The criticism was that this report did not give suggestions, hence why pointing out that the same people did, in fact produce suggestions elsewhere was relevant.

You can submit your complaints about their choice of JS to them directly. If you are willing to dismiss anything they say on the basis that they use JS in their website's CMS, then you don't need to read articles like this one in the future.

Re: Anything of substance?

I think the story is a very good parallel to the suggestion in a different way. As you noted, it's an urban legend (or perhaps more correctly just complete falsehood) because both parts are not true: NASA did not spend the money on the R&D for that pen, and pencils were quickly rejected because graphite scratching off + everything in free fall = fire risk. When the space pen company came up with their design, both the US and the USSR bought some, but they had other writing methods they used.

The parallel to the work on paper suggestion is that, although it seems like it's simple, it really isn't. There are a lot of things that work quickly and efficiently now because we're not doing things on paper, and even if we eliminated anything that was not done when paper was the used tool, most systems using it are at a much higher scale and most of the things you need to make it work are a lot more expensive. Businesses used to have tons of clerical staff to deal with all the paper. We have substantially reduced the level of clerical employment. Scaling it back up requires finding people to do it, which is not so easy with relatively low unemployment (4.8% in the UK as of two days ago). Paper storage and organization is a lot more expensive. So many things won't work if you try to do them that way, but because we once did things that way, it seems like it should be a lot more feasible than it is.

Re: Anything of substance?

The NCSC has a lot of generic suggestions, mostly not in this statement but they're around on their website and previous announcements. However, any meaningful response is going to be particular to the organization involved. You can't just buy and bolt on security. You have to think about it. The generic things like have backups and don't let a user execute whatever only go so far. Sometimes, you have to do actual hardening and preparedness planning and exercise. It's not easy, and some places decide to try not bothering, but if that doesn't work, the results are less pleasant.

OpenAI's ChatGPT is so popular that almost no one will pay for it

Re: the sums are insane

I can't really agree with you there. I think there are a lot of problems, both moral and pragmatic, caused by famine, and what little effect it has on population growth is better handled in ways that don't involve starvation.

My problem with the suggestion is that I don't believe it's true. I would still be pleased if it turned out to be. Problems you can solve permanently with a bit more effort now are one of my favorite types of problems (the ones you don't have to do anything to fix are the best, of course). I just don't think famine is one of those because it's often caused by recurring factors that keep happening, a less pleasant type of problems. It's as if I was told that, if I washed a hundred dishes today, I wouldn't have to do it ever again. If that was true, I'll get started, but I know that there's no way that would actually work. As I said in my last comment, if the suggestion was true, then although I do not have $150 billion to put into it, I would support doing so because, in fifteen years, we'd break even and we would have stopped starvation, both intensely positive in my mind.

I dislike when people promise things they know won't happen. If someone knowledgeable actually thinks that can happen, I'm interested to see their long-term plan and I am hoping it to be convincing. Otherwise, it reminds me of the people who low-bid a contract, knowing that people will be more amenable to increasing the costs and dragging things out once part of the thing has been built. I've seen it done with positive goals, for example during a charity fund raiser when they claimed that, if people donated a million pounds, they could fix a major problem. They couldn't have, but the expected revenue of this appeal was around £20k, so they never had to try. Probably, making that case got more donations and they used these for valuable causes I deeply support. I still felt uncomfortable with their rhetoric.

Re: the sums are insane

"apparently $30 billion a year for 5 years could cure world hunger..."

How? Because I see pronouncements like that every so often, usually with completely random numbers, whether that was someone shaming Musk for being stingy and selfish (correct on both counts) but who told us that hunger could be eliminated for $6 billion once or various fund raising efforts which, in my opinion, are harming themselves by making these promises because they know they're not going to raise that much.

The World Food Program of the United Nations spends less than $30 billion a year, but they do have billions each year to work with. Even if I assume that this is an additional payment on top of that, it suggests that, if we tripled their funding for five years, we could terminate the program, breaking even in fifteen years. That's a convincing argument if there was any reason to believe that somehow we could fix the future by doing something today, which might be true for climate but probably isn't for famine because there are a lot of causes and they're not going to be permanently removable.

Re: The Freemium pricing problem

I don't know what people are thinking most of the time, but the only times I've been in the room when someone was deciding something like this, the reason has been cannibalization. A lot of companies and individuals* have decided that five currency units** is a small enough price for a month of something. Once they've decided that, providing a subset of that for two is mostly considered a loss because they expect a lot of people who would have been willing to pay five to go for the two plan, only a few people who wouldn't agree to the five plan moving from free to two, and thus less revenue in the long term. They also couldn't introduce that cheaper plan and eliminate it without annoying customers who liked it, whereas they can always consider adding it after trying the more expensive introductory plan for a while and getting people used to it. If they do reconsider, they have the same conversation again and decide not to.

* It doesn't really matter what you are subscribing to. Is it an application? A creative product that takes lots of people working painstakingly? A newsletter that probably was written by the author for half an hour before hitting publish? The price is almost always five units per month. Things that have significantly more expenses will be higher, but almost nothing is lower. Offer a little discount for people buying by the year.

** The unit concerned tends to be the default one for the platform or, if it's their own platform, the local currency. On Proton, for example, they've set their prices in euros, francs, or dollars, and each one is five of those per month. The dollars are the smallest ones, so that's the cheapest option. If you're less lucky, the person setting the prices is in the UK so it's £5, and if you're luckier they might be in Australia because AUD 5 is less. As long as it's in one of the countries whose currency unit is around the same order of magnitude, that's the number. Different things apply for rupees, yen, or RNB where one of those is a lot smaller.

Re: If it worked I'd pay!

The clue's in your error message. Violation of policies means they've got a prompt looking for stuff where they might get in trouble, and they have decided that prompt includes enough stuff to qualify. It's not breaking their software. It's avoiding something copyrighted and/or misunderstanding the prompt. Just because you've found another prompt that generates the copyrighted character doesn't change either of those because most of their limits are similarly fragile; I can break policies of all kinds if I work a little at it, but they do block the most obvious ones. They don't have a similar policy against describing an image. No where in their specification did they state that output from image recognition should comply with policies for image generation, so finding out that it doesn't shouldn't surprise.

Re: The Freemium pricing problem

The motivation is that it's expensive to run these queries, but they think they have to have a free plan to get people using it. They could have a $1 per month plan, probably by charging you $12 for a year to get around payment fees on a tiny purchase, but I'm guessing you could work with that, but it wouldn't provide much money to cover their massive costs which is why they don't, especially if you used it a lot more after moving to that tier. They have managed to lose money on people paying $200 per month, so they would almost certainly lose more on the $1/month people and there would be more of them.

Re: One day...

Or if you have to deal with others submitting LLM-generated text to you. Or if you find it on sites often when you're looking for actual data. Or if you use software which builds it in. You can avoid a lot by not using it yourself, but I see a lot more LLM output than I enter LLM input.

Re: If it worked I'd pay!

That should not be a surprise. They can recognize a copyrighted character without earning the ire of a massive company with lots of lawyers that know a lot more about copyright law than OpenAI's lawyers do, but generating a picture with that copyrighted character is very different. That is why they have a restriction against generating images of copyrighted characters unless you change the prompt a little to get around their relatively basic attempts to stop you. You're deliberately submitting a prompt that they're explicitly trying to reject. It's not a surprise they block it. Describe the character instead of naming it and you have a better chance.

Schleswig-Holstein waves auf Wiedersehen to Microsoft stack

"I'm not sure why nobody ever did a dead easy mass-market-friendly Linux thin client that just turned a low-end PC into an X terminal, but it I've never seen such a thing."

Probably because what's the benefit? Any IT department can take a distro of their choice and have it start into an unprivileged user session running an X connection or any other connection of their choice. What would be the point of making a custom distribution that does that? It's like asking for a distro that's prebuilt for web servers, saving me the difficult work of deciding whether to start with Nginx or Apache and install it from the repositories, but not saving me from the work of configuring and populating it. The part this can save me from is the easiest one.

AI startup Augment scraps 'unsustainable' pricing, users say new model is 10x worse

The cost of something is not determined by the number of bytes in the output. It is determined by the amount of energy needed to run the computer to compute it. The model that is storing kilobytes of text and writing a similar or less amount, probably less since it's code, is very big and involves loading gigabytes of stuff into memory and doing a lot of calculations on it. The work involved in serving a 1 MB file off a webserver is...a little different.

Also, your obvious numbers are actually wrong. A one million character text file is not 1,048,576 bytes. If it's ASCII as you're clearly implying, it's 1,000,000 bytes. If it's Unicode, it's anywhere between 1,000,000 and 4,000,000 depending on which encoding method was used and which characters are in the file.

Re: 35k ante

It's not just the hardware cost. It's scaling where it's more convenient to run on two, it's writing and modifying the software, it's training new models to provide which takes a lot more than one of those, lots of extra costs. If you actually find this useful somehow, there's a lot more required to equal it than buying a box with a lot of VRAM in it.

Everyone wants a fancy phone – even the folk buying them second-hand

Re: I must be a weirdo

I have an instinctual feeling that screens aren't meant to fold and therefore that folding screens have to break quickly, but I can't say I have any evidence backing up that instinct. I don't know many people with folding phones, but the one I've seen regularly has lasted plenty of time without breaking and its user seems happy enough. Multiple manufacturers have been building these for five years or so, and maybe they have improved.

And, if it turns out that these aren't as fragile as instinct and reading the situation with Samsung's first one has led me to assume, I can see the advantage. A lot of comments have bemoaned the loss of small phones. Me too. I don't want the sizes that manufacturers think everyone does. A smaller rectangle would be best, but if they're not going to make it, a square that unfolds into a long rectangle might be better than the same sized rigid long rectangle. Similarly, some people like tablets, and although I don't, I can understand why there would be an appeal to a phone-sized thing which you can turn into a tablet, although it probably requires Huawei's triptych to get a natural aspect ratio.

What do we want? Windows 10 support! When do we want it? Until 2030!

Re: [Shrug]

Manufacturers of computers pay Microsoft for the Windows licenses they include with them. The typical theory is that Microsoft wants more licenses, and more hardware means more licenses. They may have had other reasons, for example that mandating newer machines means fewer low-end ones that can't run whatever they're going to add in next, or requiring certain hardware means they can stop bothering with the dev requirements. For example, they now require TPM 2.0 chips, meaning they could at some point (they haven't yet) drop the code that worked with previous versions of TPM, which aren't backward-compatible. Or it could be hardware OEMs who convinced Microsoft to do it.

Another common theory is that it was an attempt to get people renting cloud desktops from Microsoft. I don't believe that one. They definitely are trying to get people to do that, not so successfully from what I've seen, but they're aiming those at businesses and charging a lot for them. The kind of people who have old computers are unlikely to be eager customers for that, Microsoft hasn't done much to make it work with their old machines, and they haven't pushed cloud desktops at people with Windows 10 machines. I therefore conclude that these are two different things Microsoft is doing at the same time but they're not very linked. Everyone has different theories, mostly depending on their personal opinion of Microsoft with little information to back up any of it because most Microsoft employees on Windows probably don't know what the management decision was either.

Re: Lil' Help for the switchover?

The disks that don't have Windows on them can be used the same way on the Linux install as on the Windows one. The only one you're likely to need to back up is the one with Windows on it in case repartitioning breaks something, and since you were talking about installing Linux on a new disk, you could even skip that step. If you want to be extra careful, disconnect the data disks until Linux is installed, then plug them back in. It's almost certain that the disks you were using with Windows will connect to Linux natively now because there is now native NTFS support. In previous years, that might have required reformatting and copying, but you're probably good now. That doesn't necessarily apply to Apple filesystems (APFS support is still kind of patchy as of the last time I tried it).

In general, any format that's understood by multiple pieces of software won't need any changes to be usable with Linux software. I think all the stuff you listed should be openable without changing things with the possible exception of the game saves. People do run games on Linux using Proton to emulate Windows, and that might work, but to be sure, you would either have to try each one to verify it or look them up and find reports from others who have done the same thing. If any of your media has DRM on it, that might also be a problem. Otherwise, I think you should be ready to run it and can sort out things by trial and error without the risk of damaging anything permanently.

Researchers intercept unencrypted satellite traffic from space blabbermouths

That comment is technically true, but we were specifically talking about avoiding having clear traffic on the unencrypted satellite ISP while still using it, and a VPN does that. Try to avoid the dodgy ones, possibly by implementing your own. Pointing out other problems doesn't prevent the solution from solving the one we're doing, and as those problems exist no matter what you do with the public internet, bringing them up doesn't really provide any more information.

That's how the internet works. IP traffic isn't encrypted, which is why we have so many encrypted protocols at higher layers. VPN users should already be aware of this. If it's something I control, I can have the VPN endpoint on a private network on both sides so it's only unencrypted on networks I control.

But as for verifying how my traffic is routed after the VPN, there are a lot of things I can do. For one thing, if the primary goal is avoiding satellite links, I'm almost certainly fine because commercial VPNs don't put endpoints on satellite networks. Satellite introduces latency, especially geosync which is the easiest to eavesdrop on. VPNs don't want latency. That's why they put their endpoints near big cities and have big fiber links, because that is easier, cheaper, and gets more customers.

But what if I want to check that? Simple, I can measure the ping time or any other indicator of latency between me and something else. The latency effect of geosync is so large that it is quite easy to measure, so if I'm already using it once, I can quickly determine with a latency test whether my endpoint is now doing two satellite hops. That handles everything except a situation where the thing I'm connecting to also uses a satellite link, which is rare because a lot of servers are also avoiding the high latency links but I handled the what if in my last post.

And your point is? The article and T-Mobile's response clarifies that your experience isn't universal because some are satellite-linked. How many rural towers have you used and how many did you actually check to identify their method of connection?

Re: Visitors

That wouldn't make any sense. Anyone connecting via one of those satellite links could be eavesdropped on by anyone, but people connecting any other way wouldn't. Anyone with government-level access would insist that they do encrypt all their satellite communications and their wire communications, but using a key given them by and sending a copy to the official eavesdropper. That way, only they can access the data and it doesn't matter where their target happened to be at the time.

I don't, but if I know they're going to be this shoddy, I might find out and take action. For example, if I was on an ISP that routinely did this and was now confirmed as not bothering to encrypt, maybe that would convince me to use a VPN to something with a cabled connection so that the traffic was encrypted during the satellite part. If I determine that something I'm connecting to uses a satellite connection, that's going to be harder but there are still some things I could try. It's not easy and satellite operators shouldn't require their users to do it themselves, but the users aren't powerless.

The article already clarifies that your supposition is wrong. The unencrypted phone traffic was going to or from local towers on a local network (T-Mobile) where those towers did not have cables for the traffic. So if you're in a remote location and make a traditional voice call, then it was probably sent unencrypted. That's all PSTN voice calls, not just international ones. More sensitive messages do tend to use VOIP platforms which are generally encrypted at least between server and client, but that's not certain at any level and I'm sure there are plenty of businesses still using normal voice calls for something important.

Mozilla is recruiting beta testers for a free, baked-in Firefox VPN

Re: Architecture? That's houses, isn't it?

Until someone with a few hundred thousand followers posts something and their home network is stalled and mailserver is blocked for sending a few hundred thousand individual emails and, if it works like a lot of social media with people being able to see replies, multiply that few hundred thousand by everyone who sends a reply. Of course, why social media has anything to do with this is the more important point, because we're talking about browser features and specifically a VPN.

Re: Plethora

I don't agree with their statement as written, but I think they might have been saying something slightly different which is that you shouldn't be surprised that the government is trying to prevent people from breaking the rule they created. You can disagree with it, you can complain about it, you can fight to overturn it, but that they're trying to enforce it is exactly what you would expect once they passed it. True, sometimes they don't bother, usually when the law would be nice if enforced like GDPR, but usually when they forbid something, they do put some barriers or penalties in place for people who do it anyway.

When the UK and Australia passed their age-based bans, two resultant changes became likely. One was identity verification because almost every other suggested age verification mechanism doesn't work reliably; guessing age from a photo or video has lots of bypass methods and is wrong a lot of the time. The other is VPN limits because VPNs allow circumvention of most of this. Both of those effects are highly negative and each individually is enough to make the law a clearly bad one in my opinion, although I didn't support the original one even without these so that wasn't hard. However, both were and are obvious outcomes so, when they add them in order for their previous laws to function, we shouldn't be surprised that they do.

Techies tossed appliance that had no power cord, but turned out to power their company

Re: Data Center Access

There are datacenter rules and there are client rules. The datacenter's manager is only responsible for the former. In a lot of cases, that rule is something like "The people entering have a card for access, are on the list of approved people, and have identification as being those people". Whether or not the company wants them to enter today is the company's problem. Each datacenter has its own requirements, sometimes more severe, especially for critical ones, and sometimes even less.

For example, long ago I worked at a place which had access to various servers. In their case, the requirement for access was just the first part, having a card that opened the door. If someone misused one, they'd find out and deal with it later. The reason is that they didn't run anything critical at all on servers they managed and they didn't house those servers next to others that did. The cards were limited and could only give access to locations they managed, but otherwise, there was little security, in my opinion insufficient security. That was not the fault of the datacenter manager. If fault was involved, it was that of the client who didn't request more and who handed out credentials very freely. For context, I was a programmer there, so I didn't need access credentials and didn't get them until I helped fix something once. They decided that was good enough reason to give me access credentials, credentials I used a grand total of zero times.

Re: Bah!

Someone can enjoy working from home and still chafe a little at never leaving it. I'm guessing you are now or at least have experienced remote working, but do you spend every minute there? I did during the pandemic because that was the point of isolation, but on occasion I would have enjoyed if I could have done something, not necessarily work, outside of there, especially after it had dragged on for some time. When I was remote working after those restrictions ended (I'm now in a hybrid schedule by company command), I didn't spend all my time at home. I still went out to forestall cabin fever.

And, if they planned to use the heavy metal bits to bash people over the head, they might be existing or aspiring murderers. There's no suggestion that they did, but it's not technically contradicted by the article so we can accuse them of it. Going down the list of criminal offenses, I think I can accuse them of any number of crimes if I get to invent and then assume any facts required.

Re: Data Center Access

So that proves it is a critical infrastructure-level facility, does it? Which part of the sentence says that? That's a statement of a corporate policy, no more and no less. It does not tell you anything about what precautions the datacenter concerned should or did have. Nor does it indicate that the people who entered didn't have the needed credentials to do so; with approval, they were allowed to go there, so they would need the means to enter under those cases. True, a company could implement that by locking up the credentials and only handing them out when the visit was approved, but we have no evidence saying they did. If they were trusted not to misuse the credentials but did so, that's not on the datacenter's operators. I have credentials to access plenty of systems that I am not supposed to access except in case of emergency, but I nonetheless have them because I might need them at short notice in that emergency. I am trusted not to misuse them and, if I do so anyway, I will face consequences. If I did misuse them, nobody's going to wonder how I possibly came by them.

You're trying to use that sentence as evidence against the datacenter's manager. It's flimsy enough against Steve given the lack of detail. It's entirely useless against that manager. You have no evidence that they simply walked in and no evidence that the security protocols you've used for one DC should apply to this unidentified other DC. Datacenter managers are not responsible for enforcing client internal policies. Unless you can demonstrate that they failed to follow datacenter policies, your accusation is without merit. The sentence you quoted proves none of that.

I'm still not entirely certain what that actually means, because my first reading, admittedly one I'm not very certain of, was that this was a new policy after the failure rather than the status quo beforehand. If that was the rule all the way through, that just brings up more questions, questions like why did they have access if they were explicitly not allowed to go there, who was informed or approved the cost-saving plan, and all sorts of other things the article doesn't say. Sure, if we assume that the answer was they were explicitly forbidden from entering it, nobody asked for permission, they cheerfully ignored the rule, then yes, the firing decision was completely right, but that's assuming an unlikely set of circumstances based on no evidence at all, the same way that it would be justified to fire them if they entered the datacenter by breaking the window but we have no reason to think they did.

If, for example, the rule that you're not allowed to go in there was not stated beforehand but someone hastily added it later, then I do not think it is justified to fire someone for breaking it. If this plan had been run by others who had approved, it wouldn't be justified. I don't know whether any of those happened, but neither do you have proof of any of the conditions that justify your opinion.

Re: Data Center Access

Why do you assume any of the following:

1. that this facility was anything like those. There are lots of colos that don't have critical infrastructure security levels where the client provides people with credentials to access their area. There's still security, but generally not make an appointment weeks in advance level.

2. that the people entering didn't have the required credentials. They hosted servers there, these people can recognize and probably installed them, this sounds like the kind of people who would have access.

3. that they didn't follow the procedures. Even if assumption 1 is correct and thus that they couldn't have had general access credentials, they clearly planned to visit and decommission. They would have had the time to make that appointment. If they were not allowed to do that, it's equally if not more likely that the person who has to answer for it is the one who signed off their appointment or the one who didn't need to but should have been gating that access. Assuming, of course, that there was any policy requiring that be gated.

I assume you've got a set of assumptions about the circumstances here. We all must to some extent because the only facts are those in the article, and theoretically any of those could be lies too. However, the defenses and attacks I'm seeing are fundamentally differences in accepted facts like did anyone above the boss authorize this decommissioning operation? I've seen comments deciding that's a clear yes and a clear no, and my own defense is a more moderate I don't know on the boss, but the employee covered in the article had sufficient reason to believe that it was because his boss said so and would be the path by which the information would be delivered.

When you confidently assert what you would have done, consider whether your answer would be different if the unstated circumstances were the opposite of what you're assuming. If you would fire both of them no matter whether there was authorization from above, whether anything was documented, whether there was system monitoring, whether there was a logical purpose for that equipment, fair enough. I would not agree, because people decommissioning equipment with permission and on orders removing something that shouldn't have been there is enough for me to take their side if that's how the facts ended up. If you're making that decision based on guesses, you should at least tell us what guesses you're basing it on.

Ofcom fines 4chan £20K and counting for pretending UK's Online Safety Act doesn't exist

Re: The Online Safety Act is not just law, It's state censorship.

Your comparison is invalid. There are two types of regulation. The one you're positing is making some types of content illegal. The OSA is not making content illegal, it is restricting access to content which remains legal. Someone can support making some types of content illegal, restricting access to legal content, both, or neither.

If you would like to argue that analogy, your point of comparison should be whether everybody should be allowed to access any content, as long as it is legal, without government restriction. If people say no to that, then the OSA's categories can be argued, but I think you'll find more people answering yes than with your perpendicular argument.

The general response available is going after whatever mechanism is used to make money. I do not use 4chan, so I don't know how it works, but simple searches suggest they have ads. If they run advertisements in the UK, paid for by UK advertisers, that is money that can be taken by UK authorities before it can be transferred away. As long as they either are or are willing to operate without any revenue from UK users, they can mostly ignore complaints and let the UK handle it.