Posts by doublelayer

US House mulls forcing AI makers to reveal use of copyrighted training data

"Secondly, it is not always obvious that any given material is subject to copyright, or the version thereof that the bill would apply to."

This is not new. If I gather code, I have to know who owns the copyright to it and what license terms apply. This is something that any software company has done hundreds of times. It's not hard to know that the GPLed thing isn't to be pasted into the Windows source. Microsoft can do that and does. OpenAI probably has the same thing for any of their source code. They can do it with training data as well. It would involve more work, but the work is not the tricky part; they could hire people and train them to track this down. The tricky part is that they know full well that a lot of that was obtained illegally, and if they admit its presence, they're going to get sued. They knew this from the start, hence the various attempts to hide it.

Re: License fees should be due

Yes, which is as it should be. I've written a book. Do you want to train your LLM on it? Here's the price. You may well feel that what I'm asking for is not worth the value of using that book in the training data. This gives you two options: negotiate to lower the fee or leave the book out of the training data. Both are completely viable. A lot of creators will likely accept the use at a relatively low license fee. Those who do not won't be so crucial that developing an LLM is impossible without their books in the training set.

If you disagree, then we should simply require that OpenAI give us full access to their model immediately when they've created it. That will conclusively prevent them from using the books in their training set, because it will then be impossible for them to make any money from their model when everyone has it for free, so they won't make one. If they deserve money for their product, the authors making the training data do too.

MPs ask: Why is it so freakin' hard to get AI giants to pay copyright holders?

Re: 'AI', another nail in the coffin of copyright?

What they were saying is that requiring creators of work to perform in order to benefit from having done so is adding an unnecessary step. This becomes more evident when we consider things where performance is less important. You may enjoy performing your music, but if someone composes a piece and you play it, is it fair that you are the only one to benefit and the composer gets nothing, even if you didn't write a note? If an author writes a book, do we just assume that people will want to attend a live reading? I've read lots of books, but I don't want to hear the author read it to me. The valuable part is the book itself, and the important work involved is writing it. Copyright exists so that work can be done even if they don't have a patron who decides to fund it, which very few creators get.

Re: Begging the question

If you have a memory that can accurately record copyrighted works, and you use it to reproduce them, that's not allowed and they can take you to court and win.

Re: Begging the question

"Well, does AI training?"

Yes.

"the ultimate end product, that is, the ML model, doesn't store of the ingested data"

Yes, it does. Hence why verbatim copies tend to get spit back out, and why they've had to build rules to look for and deliberately prevent it from showing it to you. It's in there.

"(barring effects like overfitting, which are not intended to begin with)."

Why their production models contain the data isn't really the important part. Whether they wanted that or got it by mistake, they obtained it without permission and despite it being illegal, used it without permission and despite it being unauthorized, and store it without permission and over the protests of those who could give them that right.

"Does a browsers cache (which can store images for days or even weeks depending on what the header says) count as an illicit copy of copyrighted material? What about the caching mechanisms of proxies, VPNs, ...?"

If it is being used for a commercial purpose, which the LLMs are and the caches aren't, then it becomes much more obvious. I think the law could be improved to clarify that caches don't qualify as infringement, but it's a completely different issue than this. The data isn't being stored temporarily in the service of some other operation. It is being stored permanently in a lot of locations with the deliberate goal of having access to use it. They are not similar. I think you knew this already. I wonder why you tried making that comparison.

Ex-Microsoft engineer gets seven years after trying to hire hitman for double murder

Re: Child Protective Services

It sounds like they've been involved from the start given that's what caused the guy to want to organize some murders. Even if they hadn't been, that's the kind of thing the police would do after arresting someone with children, although if there is another person taking care of them, they might have delayed calling them. I'm pretty confident that someone is already trying to do something, though I don't know what they're doing or if it's the right thing.

Re: use of interstate commerce facilities in the commission of a murder-for-hire

If everything was in one state, the interstate charge would not apply and it would just be a murder case. This is a federal charge that adds to, not replaces, any other charges at the state level. In addition, if he was in New York at the time but the exchange or bank involved wasn't, the interstate charge still applies.

Cloud vendor lock-in is shocking, but there's a get out of jail card

Re: Second Sourcing

In production, having a feature cut off is rarely the lock in concern. Cloud providers do discontinue things, but they usually start by cutting them off for new customers, then a few months to a year delay, then they prevent existing customers from starting new instances, then another year or two, then maybe they'll do something to existing instances. That maybe is truly a maybe; I've seen cloud providers offering services that have been discontinued for ten years because someone is still paying for them. This kind of lock in is not that different from a software provider that has ceased offering a certain feature in their next version. It is troubling, but it's the kind of thing that IT departments have to deal with anyway.

The things that create greater lock in risk are services which cannot be simply deployed somewhere else. If I build something using what they sometimes call "cloud native design", for example using a providers serverless functions system for computing and message passing system, then I cannot simply pick it up and put it somewhere else. A different provider probably has both of those, but they don't work the same way, so I can't remove and replace like I can if it's a binary on top of an OS. Another lock in mechanism is data transfer costs. If I stored a ton of archival data in one cloud, it will cost quite a lot to transfer it out to another one. Another is integrated features. If I have linked all my systems together using a virtual network, it requires a lot of changes to get it running over the open internet instead, especially as any data-intensive features will now start to cost me significantly in bandwidth charges. These things make moving cloud providers costly.

Re: Why not have cloud.gov.uk ?

Again, I don't know how useful that point of contact is. I do know, from experience, that they do have those points of contact and that initial messages get responses. Fortunately, as a programmer, I've rarely had to get any more connected than that. I am responsible for making sure that the cloud bills shouldn't be very high. Once I've done that, making sure they send us the right bill is someone else's job, so if any interaction is needed, they do it. Maybe the communication will still be fragmentary, but it won't be a forum topic alone.

Re: Terraform

When it became popular, Terraform was open source, so you couldn't get that locked in, and now you'd probably use OpenTofu instead. In both cases, the software runs on your equipment by default, meaning that you're not locked in to any particular external provider to keep information about your system state. Most deployments I've seen store that data in the cloud somewhere, but that is a cloud location of your choosing, under your control, and not under Hashicorp's control (maybe they have a managed version, but I've never seen it).

Re: Why stop at cloud?

I think my view is based on a narrower definition of lock in. Some of those, including licensing, sunk investment, and integration I file under lock in. Feature parity, on the other hand, doesn't really count for me. If you use a program because it has a feature you want and others don't, that's not lock in, that's a product being better for your use case. I count something as lock in if you would prefer to use something else but it is either impossible or impractical because of your previous use of the first option.

Re: Why not have cloud.gov.uk ?

If you buy enough stuff from them, you move from the basic customer to one who does get specific contacts and priority support. I can't promise that those things are as good as they sound, but I can virtually guarantee that, if the UK government buys a lot of services from AWS, they have someone at AWS they can complain to and get responses from quickly.

Re: Why stop at cloud?

I don't think all of those have the same lock-in potential.

Operating system: I'll grant there is a tendency to rely on software which doesn't support all ones, but that's more on the writers of software who choose not to make builds for other OSes than on Microsoft or Apple. You can always install another one, and they don't prevent it from doing what you want.

Office: Not really. The file formats are understood by other applications. When I stopped having Microsoft Office and started having LibreOffice, there was little change for me and no change for anyone I interacted with because I could still open their Office-generated files and send them ones they could open. I know that complex spreadsheets can be an exception to this, but that affects a smaller proportion of users and is something they can try to resolve by considering other programs, one of which probably supports them better than LibreOffice Calc.

Email: Moving email suppliers can be tricky, and it's one that fits somewhat better, but it's also where the protocol should make it straightforward if you control the important things like the domain and the configuration. Porting from one supplier becomes more work, but not one that will cause chaos for users if you do it right.

Teams: There are lots of videoconference programs out there. Many of my employers have picked a non-Teams option. It doesn't have that much lock-in potential, especially as multiple such programs can be installed simultaneously, making it possible to gradually switch over.

What can be done to protect open source devs from next xz backdoor drama?

Re: The victimzed linux releases were loading opaque tarballs instead of cimping from source

"So the victims were not compiling from the original Github open source version, but from some tarballs instead? This surprised me - maybe it's wrong to call it "open source"?"

Open source refers to the licensing. Both copies used the same license. It was definitely open source.

The distinction is just where people who needed the code went to get it. They had multiple options, and the exploit was added to a subset of them. Someone who chose to get the code by cloning the repository evidently would have missed it, whereas someone who used the alternative would end up picking it up. That's a problem already, because we'd probably want to make sure that the two sources are in sync, but it doesn't stop the project from being open source or indicate that the people getting the source were necessarily doing something obviously wrong.

I do this myself with some projects. You can clone my git repo and get a copy, or you can download copies of the source from a different site. If you make sure you're on the same release with both, the operative files will be identical. The git repo has more files in it because the source archives just contain the code and build scripts, not irrelevant things like the .gitignore file.

Re: Maybe follow the well trod road ...

"And make sure that some of that 'paid for' goes back to the original developer/s, although they would not be responsible for maintaining the software at 'ISO' level (or whatever it's called)."

If they're not responsible for doing that, I'm not sure who will be. Maybe you can get enough people to pay them so they agree to be responsible for it, but if you can't, then it likely won't get done. A separate group of people certifying software is not likely to have the knowledge necessary to actually know whether the code has been compromised. This is especially true if they have to certify every package on a Linux system, as they would have to if they're going to catch things like this. That is a lot of packages.

The logic for having them be one set of people is that the developers know what the system needs to have on it since it's running their code, so they can make changes faster. The logic for having them be separate groups is that those who specialized in administration know things developers don't know which turn out to be important to the health of the system. Both arguments have some good points, but taken to their extremes, don't produce the obvious better results their adherents hope for.

Take this as an example. Sysadmins wouldn't, just by being sysadmins, recognize this vulnerability in XZ. The people who spotted it were programmers reading its code, not admins installing the thing. Alleging that having a sysadmin running the server instead of combining that role with a developer would prevent the class of problems is overoptimism.

Google sues app devs, claims they're Play Store crypto scammers with 100k+ victims

Re: PlayStore

I would generally agree, but that's what both Apple and Google say they do every time someone suggests that maybe they shouldn't have a monopoly (Apple) or near monopoly (Google) on app distribution. They say they're inspecting apps for dodgy content, and I'm not just talking about a scan for known malware files. We know that, to the extent they're doing it, it's a minor automated scan, but if they're promising to catch things they won't, it's fair to point out when they fail to keep that promise. They can switch to telling the truth: "We run a few programs over the package and if they pass, the app goes up, but those scans are better than nothing which is what you get if you download from some site." whenever they want. They'll probably start to lose the monopoly cases if they do, but that doesn't stop their version from being dishonest.

Local councils struggle with ill-fitting software despite spending billions with suppliers

Re: That's air gapping

It did if that internal system was disconnected from the internet. If that server already had a network connection, then it isn't an airgap and it's just an inefficient manual step with no security benefits at all.

Re: All the above suggestions about standardising council software are good, but

"Whatever happened to the old way of doing things? - I'll pay the bill when it works."

Some people realized that it was a recipe for not being paid at all because the software did what you asked for, not what you actually needed. Those people put in a contract saying you'd pay when they implemented your design, whether you decided changes were needed or not was being a separate matter. Then someone else realized that, if people signed that, they could make the contract even more lax and get paid in a lot of situations. The first is logical. The second could use some people pushing back against it.

Re: Problems and solutions not welcome

I do, and it's a problem, but I also see the opposite which is also a problem. For example, having a computer take a paper form and transfer it between different mailboxes, just like the original paper forms did. You could probably do things a lot more efficiently by having the computer read the form and use the contained information to decide how to direct it, but the original process says that Dave does that, so we just send everything to Dave and wait for him to send them. If we automated that part of the job, Dave could probably do a lot more of the tasks that actually require some thinking, but by not touching the process, we're not saving the time we could. The best approach is to frequently consider changing the process, and keep in mind all available tools when you do, but only actually change it when the change will or is believed to make a real improvement, then check whether it has. That's a lot more work than assuming that someone, whether it's the software writers or the people running the original process, will be much better if only the other group conforms exactly to what they want to do, so people don't always want to do it.

Re: Problems and solutions not welcome

A lot of those customized machines are really just customized machines with wheels. The casing and the engine may be trucklike, but the important part that makes them different are the machines in the middle. There's a reason why you don't just buy a harvester and plop it on a truck.

Their point was that, when you want a vehicle to move something, you often choose between the general purpose options on offer rather than trying to make a custom one. If you succeed, the custom one might be a bit more efficient and maintainable, but it will be more expensive because it's only customized for you and you will have waited a long time for it to come around. Unless you need something that the general purpose options don't do, you will probably be better off with one of those instead. At times, it might be necessary to change a process so that you don't have to spend a lot of resources making tools that are otherwise useless.

Re: Problems and solutions not welcome

Those companies mainly exist because they have the ability to provide something based on a design that sort of looks acceptable and technically isn't broken, then charge for each change so that it actually becomes a little useful. Their business is based on those who need the software not being able to plan out exactly what they need and describe it accurately enough that they get what they need, and from having frequent enough changes that there's always someone around who needs them to build a new one. Some of the tools they have could be handy, but they'll still need to design something that's likely to do a lot of things for a long time, which current projects sometimes say they're doing but don't always accomplish because the design doesn't allow for it and neither the seller nor the buyer makes sure it happens.

How HashiCorp's license shakeup seeded a new open source rebel

Re: The Hyperscalers are forcing this

There's a reason I have mostly used Terraform or the fork. I've used ARM for Azure and Cloud Formation for AWS, and neither was great and both were pretty useless on any other system. Terraform is also kind of painful* and I don't much like it, but learning it can at least be useful in multiple types of deployments.

* Terraform is a functional language without being able to write functions. It supports complex data types, including nesting, but the code to untangle it ends up getting very large and ungainly if you ever find that you need them. Some of its competitors don't even support those types at all. IaC doesn't have the best tools.

Re: The Hyperscalers are forcing this

Of course. Who can forget evil AWS taking all of Terraform to -- sorry, what, they use Cloud Formation instead and want people to use that, grudgingly accepting Terraform? I meant it's evil Microsoft with their -- they have one too? Well, where's my evil company I can point at and say that everything is your fault? The people who ignore all of open source in the search for money? I think the best candidate in this situation is... Hashicorp. They're the ones that took the work of contributors, without paying them, and incorporated it in a version that they sell for money, then blocked those contributors from using their own code* if they competed with Hashicorp, as determined by Hashicorp's lawyers.

* Unless they forked before the license change, which effectively means using OpenTofu because they don't want to maintain a ton of forks.

Malicious xz backdoor reveals fragility of open source

Re: “… reveals fragility of open source”

They mean that it wouldn't be discovered, since both of those are instances where poison code was added to the binaries produced by those companies. I don't think they're correct about that, because the exploits in both of them were eventually discovered, though after they were released and caused havoc. Proprietary software is no guarantee that poison code won't get in, and open source code is no guarantee that poison code will be noticed before it is released. Viewing either as certainly better almost guarantees that you're not thinking the way you need to to prevent it happening.

Re: Run linux they said...

I think you're both wrong. They're wrong when they claim that easy modification makes open source worse. You're wrong when you say this:

"Oh please. Ever hear of Hex-Rays and similar tools? Any person or team with the level of skill needed to pull this off could just as easily change a small bit of assembler in some commercial binary and try to poison the well, in fact it would probably be easier since white hats in general aren't decompiling gigabytes of commercial binaries on a regular basis."

No, that wouldn't be enough. That gets your exploit in. It is not as easy as putting it in as source code, but you can definitely do it. Now you have a poisoned binary and you do what with it? Unless you somehow manage to replace the canonical one with yours, it's not getting installed everywhere. I can make a poisoned version of Windows, but if I can't put it on Microsoft's servers, it's not getting installed for the general public. This attack had the chance of working because and only because they got their backdoor into the canonical version of the xz source, the one that gets compiled and put into repositories. Putting it into a fork and then waiting for someone to install that fork would do very little. Doing the same to proprietary software isn't any more effective.

Re: Would This Have Been Caught Sooner In Proprietary Software?

"No problem in this case. It was a well organised long term con."

Yes, sort of, but it was an organized one on a small tool like XZ. The attacker wasn't writing code full time to do that. They could spend a bit of time writing something useful on occasion to keep their name in everyone's head as someone who knows what they're doing while spending more time on other things. Working at a company takes more time and thus makes an attack more expensive. You also can't divide effort. Jia Tan could have been a bunch of people. One wrote some modifications, one just worked on the malware, one did the pressure campaign, and they just used the same set of GitHub accounts. You can't do that as an employee of a company because your accomplices don't have access to the internal code and giving it to them is a detectable crime which businesses already try to prevent. Not so expensive that you can't do it, but it reduces the number of attempts.

"Are you impyling some sort of QA? That's what Microsoft's customers are for."

I don't think they were implying that. If you're writing code on a team with a lot of people, you have a lot of code reviews and a lot of changes. It makes it harder to slip something in than if you only have to slip it past one person. This is especially the case if you insert your backdoor and I, your colleague, have a feature change to the same area and end up breaking your backdoor while merging your feature with mine.

The main reason why it's hard is that you don't get to choose your project as closely when you're working for a company. If you get a job at Apple, maybe you end up working on some part of Safari, the iMessage or Facetime protocols, or some core OS component. You can probably put a backdoor in those. Maybe you end up working on the new headline feature they're going to announce next conference: yet another emoji thing that's not actual emoji, the sixth version now. Have fun doing anything malicious when you're writing code for a feature nobody ever uses. It's probably possible, but you don't get to pick a target and specifically add code to that, whereas targeting XZ is as simple as finding where the source for that is and sending a pull request.

404 Day celebrates the internet's most infamous no-show

I think it's meant to sound like what you might say if you were searching a physical location. For example, I looked under the bed for the page, but I only found the phone someone dropped there.

Re: Its worse than you could imagine....

It's efficient for programming time, so implementations can be made quickly. The same reason why we use text-based formats like XML or JSON frequently rather than making a custom binary format. Sure, an HTTP response code could look like "\x02\x04" (one byte for version number, one byte for status code), but that wouldn't do all that much for efficiency and makes the protocol harder to extend. It also has little to do with datagrams. If you use UDP for the protocol, you still have to encode the protocol data somehow. UDP can't send a single page as a packet in most cases, and it shouldn't be expected to. Somehow, HTTP has been a viable transmission mechanism for a long time. As we increase network speeds, the overhead from the protocol becomes less and less important, yet a small device with little memory and a slow connection can implement and use HTTP well enough as well. Leave even more efficient protocols to places where you need them.

Iowa sysadmin pleads guilty to 33-year identity theft of former coworker

They use a few methods to guess how likely you are to be able to pay it back, and you can quite easily get a credit card while having a lot of debt, especially if that is typically large types of debt like mortgages. Cautious banks may start someone with a lot of debt with a low limit and increase it. People are most likely to be rejected if they have no history with the identity or if they have previously failed to pay a debt. If you have borrowed tons of money but never missed a payment, they usually don't mind giving you some more. Even if you have missed a payment, if it was long enough ago, they may still accept you. They're in the business of lending out money, and sometimes it goes badly for them, but they lend to so many people that they can lose some of it without trouble.

This is why I assume they're asking a religious question, not a legal one. The legal answer in many countries is that the marriage can be dissolved. Whether it happens automatically, requires an annulment form, or if you actually have to go through the divorce process probably varies from place to place, but the union does not need to continue. I think they are asking based on religious authorities that do not acknowledge a divorce as legitimate, and there are a lot of them who do everything differently and their reasons for what counts and what doesn't are based on subjective interpretations of religious texts, so I don't think you'll find consensus between their opinions.

The social security card isn't as obviously acceptable as you say:

The card on which an SSN is issued is still not suitable for primary identification as it has no photograph, no physical description, and no birth date. All it does is confirm that a particular number has been issued to a particular name. Instead, a driver's license or state ID card is used as an identification for adults.

Nothing associates a card with its true owner. He did also have an ID with a picture, but of a type that can be faked or obtained fraudulently (by providing documents without pictures). The other person using the same name almost certainly also had an ID card with the same information and his picture on it. So they can't assume that someone with a card with the correct SSN and an ID with the person's picture mean the presenter controls this account. If you're the only person presenting them, they'll probably accept them. If you're presenting them while someone else, also with documents, says you're lying, they'll either require more or bring in the police to determine which of you is the true one, since law enforcement can validate documents with more accuracy than can a bank.

I can pretty much guarantee that nobody knows. If you ask enough people, you will get every possible answer. Each of those answers can be backed by some kind of reference to religious text if you want. People with one view who strongly object to the other view will say that the other guy's reference is misinterpreted, assuming you get them to make an argument instead of just shouting.

Re: geniuses everywhere you look

There are certainly reasons that might have happened with the person coming in being a criminal. The easy example is multiple holders of a single identity. If two people buy the same fake identity from a criminal who stole it, they may end up in an identity theft collision. Person A goes to take out the debt, person B hasn't gotten to that stage yet and is still pretending to be the person, all while the actual owner of that identity isn't doing any of the things that person A or B are doing. A bank could have decided that this was what happened in this case. This situation wasn't that, but there is a method by which a similar set of circumstances could arise.

Re: Why did he do it ?

"Something seriously wrong with USA .... this and the recent monkey torture story :("

Why is a country being blamed for a single criminal? Maybe, if I'm being generous, you could say that there is something wrong with the California police system which failed to unravel the crime*, but that wouldn't be the whole country either.

* Not knowing many details, I'm inclined not to blame them too much. With an identity theft going on for three decades, including lots of documentation, it would be hard to prove who is correct from documentation alone. If one person has a full set of documentation for an identity and another one has a partial set, one of them has clearly stolen the set. Governments are likely to believe the one with the full set who has been working under that identity for seven years at the time because that is not typical for an identity thief. This may be a reason to treat all identity theft cases with more scrutiny, maybe getting DNA testing involved in all cases of identity confusion, but that has its own potential downsides.

Re: Why did he do it ?

The first bit appears to be the typical identity theft playbook: steal someone's identity, earn some money on that identity to establish a history, borrow money, don't pay it back, if questioned, tell them it's not you. The normal method is that, once you've stolen money that way, you burn that identity and either stop committing crimes or go get another one. I'm not really sure why he kept doing things under the second identity. My only theory, and one I haven't researched, is that he may have polluted his own identity, for example getting arrested, at some point and used this as a backup.

Software engineer helped put Sam Bankman-Fried behind bars, say prosecutors

Re: And yet

No, not a classic Ponzi scheme. FTX was, although it was more of a classic "I stole your money and spent it". But cryptocurrency, while there are a lot of problems with it in general, is not, nor is the description to which you replied describing a Ponzi scheme. A zero-sum environment does not make a Ponzi scheme. It makes something where there are winners and losers, not just winners. A lot of investment either is or looks like this environment, and investing properly often involves trying to find something that escapes it, hence the focus on growth when valuing companies.

The difference is important. If you dismiss everything related to cryptocurrency as a Ponzi scheme, it makes it sound as if you understand neither cryptocurrency nor Ponzi schemes. When something like FTX comes along which actually is a Ponzi scheme, people won't believe those who call them out because they've become used to people describing things incorrectly. There are ways to express a general or total contempt and distrust of cryptocurrency without being inaccurate. Others will benefit if you use them.

Uber Eats to rid itself of pesky human drivers with food delivery by robo Waymo

Re: Much more efficient

The same logic could be applied to any technology. Spending millions so a chunk of metal that fails all the time when the vacuum tubes break so it can add up numbers, when we have banks of computers (people who perform calculations on paper) that can add just fine. Every technology can look unnecessary if you only consider its first application. Only by considering the capabilities available in the long term can you distinguish between those that are truly unnecessary with ones that may prove revolutionary.

I think you already know what the theoretical possibilities of advanced automated road travel are. We could have lots of discussion over whether this can be made safe or economically, or if they will ever be accepted by the public, or whether they will prove to be useful alternatives to automated fixed-route transportation, but I don't think we will get anywhere if we assume that the only thing they'll do is deliver lunch.

Re: I hope you know up front that's how your food is delivered

The article did cover both questions: the app lets you opt out and, if there is an automated delivery, they don't take the tip. It's true that you have to go out to retrieve the delivery, and the points raised by others about those with disabilities that make that difficult are valid problems with the idea. I have a feeling a lot of people who don't have those concerns won't have a problem with that and may approve if the deliveries are cheaper, especially in a city like Phoenix whose unpleasant weather is usually just it being really hot, where a few seconds outside probably isn't too bad.

Polish officials may face criminal charges in Pegasus spyware probe

Re: in 99 percent it was used against criminals

What is your distinction here? If they are correct that the countries buying it are largely using it for oppression, not normal law enforcement of criminals, then they have a point they can argue. If you're alleging that the tool is primarily used for more obvious criminal cases and the public cases are unusual abuses, I'd like to see your reasoning for why you think that's the case. Just calling it a "law enforcement tool" proves nothing about what it is or how legitimate its uses can be. I could call a torture machine a "law enforcement tool", but it wouldn't make it legitimate to use on anyone even if I did only sell it to police.

Re: And if any non USA backed state developed this...

Yes, it's definitely the USA's fault. That's why the US sanctioned them in 2021. I'm sure that's a long con of some sort.

Ex-White House CIO tells The Reg: TikTok ban may be diplomatic disaster

"So a foreign company operating in China chooses whether to share the tech."

Sure, in the same way that if I'm your boss and I skim some money off your wages, you choose whether to let me do that or choose to not have a job. Not a free choice by any means. That's the stupid logic that makes this unjust law sound reasonable, after all, ByteDance only has to choose whether to give up their service at a hefty deadline discount or to cease operating in a good market, they get to decide when and how they do one of those things. Neither is a choice anyone makes unless they are required to.

That might work for Facebook, but not so much for ISPs or phone store providers. I think the requirements are easy enough for Apple and Google. TikTok comes out of their stores immediately and that's basically it. However, maybe they need to consider whether the government will want them to actively remove the app from people who already have it and whether they're willing to take that action and how they'll do it without annoying users too much.

ISPs have a trickier situation to consider if the article's theories about mandated connection blocks prove true. This seems extreme to me, but I think there's a chance that the ban is simply overturned by a court, so if I'm wrong, anything could happen.

No joke: FTC boss goes on the Daily Show and is told Apple tried to block her

Re: Exit objectivity

Maybe he assumed that someone at Apple would at least try looking at his previous work. I am not very familiar with his previous work, but it sounds like he was interviewing similar people and coming to conclusions that weren't in line with the sponsors regularly. Perhaps he assumed that Apple wouldn't hire someone like that if they wanted to control him more tightly, because it's obviously not a good fit. Just like Musk hiring someone who didn't agree not to ask the interview questions like "aren't you having trouble getting advertiser revenue after you yelled at all the advertisers", they may not have paid attention to who they were hiring.

Re: USA Free Market

It was kind of both. The taxation issue certainly got a lot of people angry, to judge from how much is written about it, but they were also influenced by ideas about political philosophy which originated from people who had no taxation-based complaints against the British government. Had they somehow arrived at a resolution around the tax issue, and I'm not sure how they would have managed that, that could have ended it in the mid 1760s. By the mid 1770s, they had more complaints to do with liberty* and governance**, and a tax law change wasn't going to fix them.

* Liberty: theirs, not anyone else's.

** Governance: not democracy, at least not yet. The complaints had to do with things like law enforcement practices and chains of command, not just who gets to vote for what.

OpenAI claims its software can clone your voice from 15 seconds of you talking

Re: Just make such tools illegal too.

The option of "just don't have the technology" is always considered, suggested, superficially functional, and impossible. The same way that "don't have an internet" didn't work when the first abuses were known. The same way that, when there were ten computers in the world and people's ideas of what they could do came from science fiction stories, fear of them did not mean that we just decided to ban them and keep going with manual methods. You can try to ban developing the technology, but it won't stop people, especially as multiple open source versions already exist. They have valid uses, and anyone making one will say they're intending those, whether they actually are or not. If you ban it in one country, it will just be developed in another one.

You can only try to ban a technology when it is prohibitively difficult to develop it, and even that doesn't always work as demonstrated by the number of countries that have or could develop nuclear weapons. Those take a lot of money and things that are hard to just buy, and yet programs to do so have succeeded. Someone can build a voice cloning tool on a home computer, even though it won't be as good as an organized corporate effort. You won't be able to do very much to prevent that.

Rust developers at Google are twice as productive as C++ teams

Re: confidence

"Call it "Csafe" or something. It can compile C code but will include bounds checking and all that guff to make it a little bit slower but a lot safer. After all, C++ exists and didn't replace C..."

Most of the time, that would work, but there would be some compatibility differences. For example, if I do go out of bounds, what happens? If I can catch and report on that error, then anything I write that does that isn't compatible with C. Basically all you can do is crash the program on any out of bounds access if you want to be as compatible with C as you can, and even that won't necessarily work on everything. For example, if you have a typical string ending in \0, and I write something else over the \0, is that out of bounds? From the perspective of a string, it is, because it will break all the string functions. From the perspective of an array, it isn't. If you write your language to check for that, then someone will use it in that way and your language will not be compatible with their thing.

So yes, you can do it, but it would end up being a different language. It is hard for a language that is effectively the same as another language to get adopted, whereas building that into a new language that can introduce other changes that people think are useful has a better chance of being adopted.

The Register meets the voice of Siri Down Under

"Which has no relevance at all to there being almost no choice in voices."

It really does. Let me explain. Your idea of how complex things are is flawed in multiple ways:

"Or to there being no easy way to make the voice models - they did this in 2002. It's clearly not cutting edge, mega gpu, nuclear powered datacentre work."

If the only metric in how hard something is is how much computing power you need, you're right. Obviously, that is not the only metric in how hard this is. The article should make this plain. In order to build that model in 2002, they needed many days of hours-long recording sessions in a professional studio with a professional voice actor who can take very specific instructions, not half an hour with a laptop mic. That's not the only thing they needed. I can guarantee you that they had a lot of audio editors chopping up that source data and programmers figuring out how to stitch them back together. I know this because open source groups have been doing the same thing. When you can't afford to spend a lot of time on those details, you get robots. When you try to do it with a small amount of source data, for example for projects that have been using the technology to provide people losing their ability to speak with a computer voice that sounds like them, you get this. They have to do that work separately for each person you record.

Nowadays, there are some systems using machine learning to automate a lot of this, and quality is much improved. However, we are getting into lots of GPU territory for training, and even though you don't need that much computing to run the generated models, they are large and intensive enough that they can't run in real time on embedded devices, for instance the phones and navigation units on which you would want them. So yes, the lack of choice is because you can't make a functioning model with a little time and effort.

Now, we have the complaint about Apple denying you choice. They are truly evil for denying you voice options. Looking through a modern iPhone's speech settings, they are cruelly providing only 48 choices for English alone, covering 7 accents. Imagine being so restricted.

Because the systems today don't want to have you regenerate voice files every time a new string comes along. With a pre-built voice model, it can say, usually reasonably accurately, any set of words. If a new street name is added to a map, nobody needs to record that name for you to hear it. And if I want to build something other than navigation which speaks, I don't need to hire someone to read things into a microphone for hours or do that myself. It also means you don't have to have as many pauses in sentences as clips are spliced together. I'd say those are net benefits to anyone who uses it.

FTX crypto-crook Sam Bankman-Fried gets 25 years in prison

Re: So he sold shady investments to willing suckers

It is quite simple. If I open an exchange where you can buy things, you are still in control. You give me your money, and you decide what to buy. If you choose to buy 2 bitcoin at the price I offer them, then you now own 2 bitcoin and whatever money is left after you purchased them. I don't get to decide that I'm going to sell you a different cryptocurrency instead, because I'm running an exchange. My job is to buy the stuff you said to buy. If you lose money because you bought something that went down in value, that's on you. If I choose to ignore what you said and spend on something else, it's on me and it is a crime.

Your description of what happened is just wrong.

"Didn't SBF say he'd hold the funds in a mix of cash and crypto-coins, and then 'sell' billions of dollars of his own crypto-coins to the exchange in return for the real money?"

Neither. He said he would hold exactly what the customers asked him to hold, whether that's just cash, just cryptocoins, or a combination, and they get to choose the proportions and which specific cryptocoins those were. As for the coin he invented, FTT, he didn't sell those to FTX, they were already the property of FTX, and they were supposed to be just one choice of things you could buy. Of course, he used that as a method to slightly hide the fraud on the balance sheet, not that it took people very long to notice even with that fiction.