Posts by doublelayer

Trump's pick to run the FCC has told us what he plans: TikTok ban, space broadband, and Section 230 reform

No problem. All of your neighbors who also have rural broadband don't read The Register. That means it's only you, so The Register should be paying some amount for each of your neighbors' connections. If they don't think that's worth it, then your ISP should refuse to send The Register's traffic to you. Is this making any sense?

The ISP's job is to sell me a connection to the internet. I decide what traffic I put down that pipe and pay per the terms of that contract. They have no right to demand payment from everyone or anyone I send or receive data from. They can demand it from me for the agreed service. Charging service providers for your connections just allows them to charge two people for the same service you already paid for and to let them mess with everyone by charging someone who never agreed to be in a contract with them.

Will passkeys ever replace passwords? Can they?

Re: Lose your device, lose your access

That helps answer the question. I didn't know most of that about iCloud's storage. Unfortunately, it doesn't really fix the problem for the average user, it just clarifies what problem they'll face. Most of them will face the problem where they didn't know they had to enable advanced data protection, and therefore they have no backups of their passkeys at all. That is a reasonable precaution on Apple's part, and I'm glad they did it because otherwise I'd be worried about anything they might be holding for me, but it doesn't help with the user-friendliness gap that passkeys have. That kind of problem can easily hamper adoption from sites that don't want to see users locked out or users who have heard horror stories of a mountain locking someone out of every account simultaneously because of those stupid security people who keep complaining about the password "password123".

Re: Lose your device, lose your access

Let's take a user who has an iPhone but no Mac. They store their passkeys on their iPhone. They're the outdoorsy type so they end up climbing a mountain and dropping their phone, which finds a path of less resistance than they will and goes down the mountain really fast. They will never find it again or if they do, it will have found a boulder which doesn't want to absorb any of that momentum and generously transferred it all into destructive force. How will they get their passkeys back?

Option 1: the data is in iCloud, and option 1A iCloud or option 1B at least the store containing the passkeys is secured with one of those passkeys. They don't have them on a non-iCloud source. They won't be able to recover them. Either Apple can (1A), with or without their consent, or Apple can't either (1B).

Option 2: Their passkeys are stored in iCloud, and iCloud is not secured with a passkey. In this case, they can recover them if they can get access to the iCloud account with their password. Great, no data loss. Also, anyone who successfully obtains their iCloud password is in a position to do the same thing. So now iCloud is an insufficiently defended valuable target.

It works if you have an iPhone and a Mac on the same account and only lose one of them, at least the best option, 1B, does. Not everyone has that.

Re: Count me in, please.

And that's an annoyance that they should be trying to improve, probably using some kind of SSO system. However, if I use your numbers and make a couple assumptions, £100,000 per year and assuming 500 staff means £200 per user per year. I think their financial department will be sort of fine with this. IT should still improve it. Unless you were working on something easily weaponized, that is too many times you have to authenticate yourself. They should reduce the frequency where reauthentication is necessary and see if they can simplify the reauthentication process.

The problem is that there are some users who will react similarly when told they have to enter a password and enter a TOTP code from another device once or twice a day when they access the account with lots of money in it. There are times when the extra delays to getting to the place you need to be are necessary and the cost of the added security is more than worth it. In that case, the user's annoyance is not something you can reduce without removing the security and their disapproval of a change in system is not sufficient reason to do anything differently.

Re: Single point of failure

To be fair, a lot of those would have applied earlier. If someone was robbed before the dominance of smartphones, they would still not have any cash and, unless the thief was considerate enough to leave them payment cards, no card to use to get a cab. The only methods left would be walking home with a better memory of how to do so or calling a friend with a memorized number, both of which are still possible* and done by a lot of people. Most of the people I know don't use navigation apps routinely when traveling near their home, and even those who do do so because the apps are reporting on traffic rather than because the users don't know the way.

* Finding a place where you can make a call is harder than when there were public phones, but there are probably a few businesses who will let you call if your phone has been stolen. Of course, you had to pay for the public phones, so it wasn't necessarily perfect then in a post-robbery situation.

Re: Count me in, please.

A non-unique user ID is not a fault of passwords. Passkeys will still do that. There are advantages to them, but don't give them credit for things they don't fix or would be fixed regardless of the authentication mechanism.

Similarly, passwords can be a pain, but passkeys can be even more of one. For work-created accounts, it is often less of a problem. IT can manage a lot of the work, they already figured out where they're stored, and if the laptop is stolen or accidentally smashed to bits by a train, IT probably has processes for revocation and regeneration, or if the keys can be proven destroyed rather than compromised, maybe even restoration from a backup. The average user does not have any of those things. By now, they've mostly figured out how to have a password and write it down. Passkeys are less convenient in every part of the process except the logging in from your computer part. This doesn't mean that we don't use passkeys. It means we have to understand why they will be unpopular so we can fix whichever of those elements we can fix and build up the experience necessary to train users in those parts that can't be improved.

Re: Count me in, please.

If they are actually unable to do their work, it might be. If they are able to do their work but they have to do something they don't feel like doing, that's theirs. Everyone's had that. Sometimes there's a good reason, like using SSH keys instead of passwords. Sometimes there's a reason that makes sense for the business even if it doesn't directly apply, like switching a software provider because they charge less money. Sometimes, the reason is bad, like switching software provider because they bribed someone to switch. However, in none of those cases would it be IT's fault that users have to learn and then do something new. If what they need to do is still possible, and equally or more feasible to do, then that's just an annoyance. They can complain about that and see if the annoyance can go away, but if they claim that they can't work even when they can, they are demonstrating their own lack of skills.

Re: I solved it

You wouldn't have to. TOTP authentication is supported by a bunch of libraries. If I'm understanding their account system, all you have to do is create a TOTP login system the normal way where it's a second factor, then remove the password field so TOTP is the only securing factor. You don't need to buy that from someone else.

Whether you should build it that way is a different question. For a lot of users, that is going to be confusing, no more secure than passwords, and more easy to lock out. Without actually collecting some contact information, the method of account recovery described will be fragile at best. If you do collect contact information, users are used to being able to reset their password without having to pay fees for it. Theoretically, it lets people who are motivated to secure their own accounts lots of room to do so by adding security to their TOTP provider, but such people can already do a lot of things even if it was just a password.

Re: I solved it

"The entire system is completely PII-less."

Except, presumably, for the payment method you use to charge them for account-related actions, which is either the PII-rich payment card or the will-drive-away-most-users cryptocurrency wallet with mandatory minimum holding so you can charge these fees.

Re: Passkeys have been destroyed by Google

Several of the points raised in that blog post are good, but there are a few that I think are missing the point.

For example, one objection in the post is that Google decided not to implement restrictions on providers of passkeys. The point that Google can effectively change the standard by not bothering to implement things they don't like is certainly valid, though it's not like they actually changed the standard and anyone else could also just ignore parts they don't like. However, the specific thing they didn't implement was so bad that I'm glad, and a bit surprised, that they didn't do it. Effectively, it was a way for sites to block key generators, meaning that they could easily restrict you to using one of their choice. That is a terrible thing. For example, if one site gets you to use their key system because it's the only one they accept, it's likely to get users who use that key system to store everything else. Privacy lost in ten lines of code. The argument for why you need that is "a business where we have policy around what devices may be acceptable". To me, this sounds like every other business who thinks that everyone's computer should be locked down so that their preferences are easy to enforce. I don't like it. Businesses can implement their own filter. For instance, they could not let me install software-based key managers other than the ones they like and could block hardware-based ones so only authorized ones work if connected, or they could just tell people that other ones are not allowed and that there will be consequences if you ignore that. Google did a lot of bad things with these, notably the comments about Android's treatment of them, but blocking the Authenticator Selection bit is welcome to me.

Most of the challenges I see with passkeys are not due to deliberate messing about by tech companies. They're challenges inherent in the model. I use a hardware token to access things. I know that, in order not to be locked out, I need to have a backup something, in my case another token. I have to pull it out and enroll it any time I enroll the first one. I have to keep it safe in the meantime. If I should ever lose both of these, there will be a bunch of annoying problems to get around. If I want to access something on a different computer, there will be friction. Maybe I left mine at home. Maybe the computer I'm connecting to doesn't have USB-C ports and I don't routinely carry a USB converter. None of that is Google's fault, and none of it is simple to explain to users. Passkeys were sold as a panacea to the problems of passwords, and they can be a massive improvement, but they aren't an improvement for every user or every use case.

iOS 18 added secret and smart security feature that reboots iThings after three days

How are those iPads locked? If someone accidentally pressed the screen lock button, do they need to call IT to fix it? If so, then yes, this could be a problem. If these aren't secured with a passcode, though, then it wouldn't affect you. They would just have to unlock it normally after the weekend.

Undergrad thought he had mastered Unix in weeks. Then he discovered rm -rf

Re: Bold move

They're not implemented in the same way, but they exist for the same reason, making it easy to return to earlier versions, and they have the same costs, lots more disk space used. Importantly to this discussion, they have to be in the same place if you're doing it in the best way, the filesystem. Now theoretically that last bit is not true. You could implement file versions somewhere other than the filesystem, and the kernel would be the second best place for it to go in the same way that, if you didn't want to put a car in the garage, right outside your front door might be the second best place for it to go.

While you could implement a lot of this with a bunch of special file names, trying to do it without the filesystem being aware of it is likely to cause lots of problems. You wouldn't do it at the application level because there are way too many tools that won't do it at all or properly. However, to do it at the kernel level would require patching so many different things to decide what they're supposed to do. For example, when you use rm and it calls unlink, is that supposed to delete all the versions of the file or just the latest one. If rm was executed knowingly, they probably don't want that file anymore because if they're planning to use the last backup, they would have executed the command to return that one instead, and if they executed it by mistake, they would want the latest version, not the second-latest. So what is correct functionality for unlink now? This is why the filesystem should manage it, which means you don't need Linus to do this for you. There are some versioning filesystems already. Some of them have problems. It is and should be up to the user to select one that works for what they want.

Re: I did rm -rf / once

A lot of the time, /bin/ls is going to get deleted before glibc does. So either way, that command isn't going to be available. A few things will still work. Fortunately, my run of this was not a result of an accident. I had a machine I used for an experiment and I was going to wipe it anyway, so I took the opportunity to run the command, let it finish, and see what could still be done.

Re: Bold move

"But then it could do that because VMS had file version numbers, lack of which in Linux still pisses me off, thirty years after I stopped using VMS. Come on, Linus, how hard can it be?"

That's not a kernel responsibility and a lot of people wouldn't want it. If you want it, that should go in the filesystem, and there are a bunch of filesystems available with features similar or possibly identical to what you're looking for. Filesystems with automatic snapshots of various kinds are available for that, and they all have the cost of a lot more disk usage, both space taken up and writes to the hardware, to manage it.

Re: Bold move

People delete old backups all the time for various reasons. I've disabled a text editor's automatic backup procedure because it created a lot of clutter and frequently didn't clean it up later. There was a cost in that I had to manually track things that I might want to return to and I had to rewrite them if I failed to do so, but I haven't suffered too much by having to do it. I've also had lots of scripts whose purpose is to clear up old backups after new ones are created to save on disk space. There are rules for how many backups there should be and which old ones should be skipped in the deletion process. I have a few programs that intentionally write temporary data, which is sort of a backup in that it lets you resume a process from halfway through, on a ramdisk so that if the computer goes down, that temporary data is cleared, because I intentionally chose to require me to start from scratch rather than have potentially wrong temporary data create a flawed product. Automatic backup removal is pretty common.

Re: what does ~* do?

It could be one of those situations where there is one more or one fewer level of escaping than you expected. I've certainly experienced it as I learned things, things which I would have to escape when I was typing them on the shell, but now that a program I wrote was doing it, the escaping was done for me. Usually, that led to one more level than I needed and the commands just didn't work, but it can go the opposite way where you assume it will do that and it doesn't. Or it could have been a path thing, where a script was running in a working directory different to where the user thought it was, which could easily turn into something too close to root if there was a "cd .." somewhere in there.

Judges not impressed by Amazon, SpaceX's attempt to have NLRB declared unconstitutional

Re: Oh, our favorite free speech proponent with so many fans and followers is again ...

Yes, both of those things are true. And yes, both of those things would extend to Musk. What people are pointing out here is that both of those things are things Musk and people with similar agendas have been complaining about whenever it goes against something they disagree with. If Alice gets mad because Bob tried to punish Carol for saying something Bob doesn't like, then it would be hypocritical for Alice to punish Dave for saying something that she didn't like. Their criticism of Musk is still valid.

The court case, of course, is not about free speech. It is about labor laws, which do apply to private companies. Employees would and should fail if they said an employer wasn't allowed to penalize them for saying something because of the first amendment, which does not apply to their private employer. They may not be wrong if they say the company wasn't allowed to penalize them for saying something because of labor protection law, which includes many explicit protections for specific conduct and a number of implicit ones that courts get to argue about.

Pirate programmer walks the plank for role in massive TV streaming operation

Re: Banks, Government

It really comes down to what the programmers knew and intended. If they were told to write a program that rips off customers, yes, they could be punished for it. If they were told to build something more normal which was then used to rip off customers, not so much. For instance, if they were told to build a system that could suggest financial products to people who logged in, then they didn't recommend fraudulent products, the people who wrote the suggestions for that system to present did. All the programmers did there was write something that's annoying.

It's almost the same for flawed systems. If the programmers intended the systems to give the wrong results, they are also guilty. If they did not intend it but did the work so badly, then they could be guilty of negligence, but not of the crime itself. And if they just did a bad job but it wasn't as egregious, then they're not guilty of anything. That is almost entirely independent of what happened elsewhere with the system. You could have a bug in a system which wasn't due to malice or incompetence and the use of that bug could still be a serious crime, or you could have a malicious addition to software which wasn't abused in a criminal way. To establish fault, you have to understand each event in the chain and how that event occurred.

Re: 15 years of experience as a programmer...

I'm guessing this piracy operation was being paid by enough customers that they could pay well for the services of this programmer. I doubt it was a choice of desperation. There are people who would do all sorts of illegal things for a multiple of their current salary, even if their current salary is pretty nice.

If the financial software was specifically designed for committing fraud, the developers should be and are punished for it. For example, the Madoff Ponzi scheme programmers were imprisoned for knowingly writing the software to automate the scheme. The programmers at FTX who knowingly built in the theft capability have been charged and pleaded guilty for that.

If you're just writing innocuous code and it is used for a malicious purpose, you usually aren't charged and I don't think you should be. For example, if someone was contracted to write a video streaming system which was used, without their knowledge, for this site, they shouldn't be charged. There is an unclear area where you're writing code that could have legitimate or illegitimate uses. In this case, it's not that hard to realize that this is category 3: he knew what he was doing it for, he knew it was illegal, and he decided to do it anyway. That kind of thing has always had the chance to land you with criminal consequences.

Re: <shrug>

Most of them do, and those that don't tend to have things that are hard to find elsewhere. For example, while I don't have it, I understand that one of those is mostly a service that people outside the UK subscribe to in order to watch stuff made in the UK. They may not have anything original, but since you can't officially watch all the BBC content without a UK address, it may end up working the same way.

Sweden's 'Doomsday Prep for Dummies' guide hits mailboxes today

I'm not sure how useful the guide would be after the emergency has happened since it's mostly a prevention guide. A reaction guide that includes only maps to places you might need to go and ways to get information or supplies could be useful post-disaster. Otherwise, if there was an attack and you were able to download the prevention guide, you'd just find yourself saying things like "oh, so that's what I should have done earlier but can't do now".

That hardware will be more reliable if you stop stabbing it all day

Re: Am i old in knowing about SSADM?

"Where in your imagined visit is the point where you stop staff watching, trying to guess what they need and how it might work, and talk to them?"

Quite near the beginning, after a little observation so you aren't immediately biased by what the users have already come up with. This fails to solve the problem once you get to the part where you don't miraculously think to ask "Are you going to tape this to our reader?" and the user doesn't magically think to say "Oh, I should tell you that I'm going to tape this to your reader." because neither side has figured this out yet. You would talk to them, and they would say that they use the cutter to open the box and then they note the contents, and now they will scan the contents. I can pretty much guarantee that they hadn't taped the cutter to the clipboard or to the pen because both of those things make for terrible cutter handles. They might have tied the cutter to something, but that would work fine because if they had tied the cutter to the scanner, the scanner wouldn't be moved very much. My guess, having not seen any of this, was that someone figured out the speed advantages of taping the two together after they were using them, not preemptively, and others saw this and decided they either could or had to do the same (had to if there was speed tracking and their colleague had gained by attaching them that way). The fastest way to figure this out is to come watch and talk to the workers after they have the scanners because it wasn't known before they had them.

On the other end of this, I was assisting a professor and marking assignments. The assignment involved taking a blank file (of a specific format) and performing several different operations to it before closing it. I was running the answers to see if they met all the requirements, and a few students did successfully do all the things they were supposed to, but only if there was an existing blank file. If there wasn't, their programs crashed. I marked them down for that. When one of them complained, we debated whether that was a legitimate way of completing the project as assigned. I still maintain that it wasn't, because the instructions said "open a blank file" and the function you call to create a blank file is open(), but we ended up returning the points I took away. Fortunately, I convinced the professor to modify the assignment to clarify that they should create one so the next time, students could be safely marked down if they didn't.

A lot of people think specs will include enough details that you don't have to think, but I've almost never actually seen such a spec. You either have to ask for instructions at unspecified behavior or you have to figure out what would be logical in the case. Of course, we also have your example of a spec that did clearly specify behavior but they didn't want it, which is quite common but at least they can recognize that when you point to the error.

Re: Natural Selection in action.

Not necessarily. Fortunately, the equipment could be built such that it didn't fail when moved violently. If that wasn't feasible, it could be a correct design to require that people not move it violently and design around something else, for example building in something so the user can quickly drop it to start using the cutter instead. Sometimes, the thing a user wants to do is not the one correct usage which must be accommodated, which is good because sometimes what the user wants isn't feasible to give them.

Re: The boxes are labelled on the outside

That works equally well no matter how you note the contents. Under the theory in the comment, when they were using paper, they only cared about the outside of the box, but with scanners, they now cared about scanning each of the contents. That theory doesn't make a lot of sense. I think it is likely wrong.

Instead, I assume that the people cut open the box, put the cutter down, and wrote down what they saw inside. Then they got scanners that looked like they'd work just fine as handles and decided they could speed this up a bit. Requiring them to put the cutters down wouldn't have decreased their speed relative to the paper method, but making them more robust would have helped with speed at least somewhat. Of course, my theory is only another one and I can't prove it either.

Re: Common-Sense Failure

And there are a number of possible solutions to that. For example, you could attach the scanner to the user so that they could drop it without it landing on the floor. Or you could give them places to put it down which are convenient for picking it up. In fact, they probably used the taping method only because this scanner was shaped conveniently for use as a handle. I've seen such devices in a variety of shapes, not all of which would work very well taped to a box cutter. There were a number of good options, and although making them more robust worked in this case, there are times where it might not be a feasible option and a different workaround is preferable.

Sometimes, especially with internal software written specifically for one set of users, that is the best approach. You can get away with the opposite under either of two conditions:

1. The people specifying what they want are very knowledgeable and have already designed something perfect. You just have to make sure your code does exactly what they said. If you're working in an environment like this, I have one piece of advice for you: don't wake up.

2. You don't care whether it works. You get paid if you build what they asked for, so you build that. If it's broken, that's their problem.

If you're not in either of those, you will need to work with users to figure out what they need, and if you can, presenting them with a partial solution and getting them to fill in some blanks is more efficient than talking to everyone and trying to distill what you need from the conversations. It doesn't always work, and trying to be Agile when you can't do that is a recipe for disaster. However, sometimes the other options also don't work, and doing Agile right can be easier to force than getting perfect requirements.

If you're building something else, this may not apply as strongly. Mass-market software still needs some user testing, but a different kind than internal use. Since you'll be selling it to a larger number of users, it needs to be more generally useful rather than narrowly targeted to your testers, even if it means that their tasks aren't as simple as they could be.

AI poetry 'out-humans' humans as readers prefer bots to bards

I don't think it's vocabulary, or at least not in that example. When reading that quite famous sonnet, it's not too hard to figure out what Shakespeare is trying to say. True, figuring out all of it will take some lookup tables. For example, figuring out what "ow'st" is in modern words. Enjoying the rhyme scheme can also lose some when we start wondering whether "temperate" and "date" used to rhyme or whether Shakespeare just liked them and did it anyway. Unless this is the first time someone's seen thou/thee/thy, they'll figure that out, and there are several languages which, if they have spoken them before, makes that quite easy.

A lot of poetry does none of these things and is still harder to understand. It could be written in 1980 and not use any unfamiliar vocabulary. By not sticking to a certain rhyme scheme, they can avoid any confusion about whether they were needed to and they can allow themselves to use colloquial grammar. By 2400, that poem might also need some extra parsing to make it as readable as it is for us today. However, it's still less understandable because the point it makes is more intentionally hidden. The line "And every fair from fair sometime declines" makes a readable point. Many poets either see this as a defect or are not very good at matching it.

WP Engine revs Automattic lawsuit with antitrust claim

Re: CMS selection

I think you are right about most users not knowing or caring about this. I sort of manage a Word Press site for an organization, my main job being to have it not break. I'm not going to try to move them to something else because I would have to do all the work involved and I would get all the complaints for anything that even slightly changed. Small Word Press sites will not be affected much by this, whereas large sites have probably put a lot of time and effort into their config and can't change CMS on a whim. I expect this will have some effect on the number of new Word Press sites, but I don't know how large or long-lasting that effect will be. That's also from someone who has been following this issue at least since the first article about it was posted to The Register, where I said it was probably a boring argument over unimportant things. I was right about nothing serious in Automattic's complaint, but very wrong about this not going very out of control. There are probably a lot of people who are not watching this who won't make any decisions about either company.

I don't know why you think this part, though:

"A lot of people who do know will side with Wordpress."

Why? I assume you mean they'll side with Automattic? If so, do you think that Automattic is in the right, and if so, why? Or do you think Automattic is in the wrong but people will side with them anyway? Those who are following this and in a position to make a decision should understand how potentially destructive each side has proven themselves to be, and Automattic has done more active damage than WP Engine has. They may side with neither, but why do you think they would support Automattic?

Re: Did you sign a contract?

Why do you see their actions as defending the community? Defending them from what? So far, the things they've done that affect the community, as opposed to just WPE and themselves are the following:

1. Forking a WPE-developed plugin without clarifying why and whether they'll keep up with fixes and improvements.

2. Broken access to updates to any customer of WPE.

3. Cut off WPE funding to community events.

4. Demanded extra control over any community event or organization to prevent them from saying nice things about WPE.

5. Released information about current and former WPE users and sites to the public to brag, information which probably but not definitely won't cause those users problems.

What has WPE done to the community that makes them worse? I have nothing so far. Their biggest "crime" is that they haven't given Automattic, not even the Word Press Foundation, but the for-profit company, lots of money. A lot of other Word Press hosts haven't done that either, but somehow it's WPE that is solely at fault.

That's why there is negativity. If this was yet another argument about money, we might decide who seems sympathetic based on opinions about private equity. Automattic have made it easier by breaking a lot of things for a lot of people, not just the company they dislike.

Google Gemini tells grad student to 'please die' while helping with his homework

Re: What Kind of Illogical Idiot ...

I think any person who thinks the computer would actually have the ability and willingness to come and kill you is also the kind of person who thinks an LLM is a reliable way of getting answers to your homework questions. Not in reverse, because there are people who are willing to use the LLM to cheat and get their answers faster but know that it isn't perfect. However, there are people who think these things are magic and their answers are always perfect, so if you think that, maybe they would also be able to take over things that can kill you.

Letting chatbots run robots ends as badly as you'd expect

Re: Asimov only wrote down some words to sell some books

Yes, science fiction often does include a lot of philosophy. Some great authors also include a lot of technological philosophy, as in understanding how a given technology might be built and used. However, they don't automatically adapt it to real technology. The stories involving the three laws show lots of interesting consequences of them using inferred definitions for "harm", "cause", or even "inaction", but I am not aware of any story where the robot programmed with the three laws ends up killing someone because the "don't harm humans" rule slipped out of the context window and the original order which had nothing to do with killing humans was badly formatted.

That story doesn't exist because it's boring. Making a story about how someone dies in a car crash because someone sabotaged their vehicle can be a fun mystery. Making a story about how someone died in a car crash because a greedy person skimped on quality during manufacture can give you a corporate intrigue story, although it usually has to go farther than that. Making a story about how someone died in a car crash because they were drunk can at least give you some emotional situations to consider. Making a story about how someone died in a car crash because of normal conditions that are unavoidable and pure bad luck is not interesting at all. Most technology failure is in that latter category, but that doesn't work as a central plot. Good stories will still use those as individual plot events around which other things occur because that adds realism, but they won't make that the topic of the story.

Apple drops soldered storage for 2024 Mac Mini

It's quite easy to wear out an SSD, especially for people who didn't specify enough because Apple charges a massive amount for any upgrade. If someone doesn't specify enough storage and runs close to the limit, and they also occasionally use enough of their RAM that it pages, it will wear the same free space over and over. They're not aware it is happening so they don't do the things that would extend the disk's life. Or they're just unlucky; not all SSDs last as long as specified. I've seen it happen to me and to others. Fortunately, on many computers it's a cheap fix. Apple is one of the exceptions to that.

In my experience, storage is both the most commonly damaged component in a desktop, only exceeded by a laptop battery which doesn't apply to this, and the most common spec where users want to increase it before there is a problem with the rest of the computer. I might agree a little more if we were talking about RAM upgrades, because a lot of people don't know when they're doing something RAM-intensive and therefore don't bother to upgrade it. Running out of storage space and not wanting to delete the files there is something that a lot of users can understand and some of them want to do something about it.

Lenovo China clones the ThinkPad X1 Carbon with an old, slow, local x86

Re: Desktops and oranges

There isn't a lot of information about the chip, but a report suggests that it is less powerful than The Register claims but has a 15 W TDP. A couple samples have been benchmarked, though only four so it is possible these numbers aren't the best. If these are correct, a comparable 15 W chip with similar figures would be the laptop-class AMD PRO A8-8600B if I try to match multi-thread and single-thread figures although the AMD is 20% higher on single-thread.

As with most processors, there are people who can work with rather little performance, including many of us, who can make this work. Others are going to find this less speedy than they're used to and can't get around it.

Re: inferior to Intel and AMD desktop chips released three to five years ago.

Of course it runs Linux. They've intentionally matched as much of the X64 interface as possible, including typical firmware. Compatibility is the point of Zhaoxin, which is partially why their efficiency is lower. Drivers are always a possible problem, but most of them are probably the same as the Intel and AMD-equipped X1s and I'm guessing there are Linux drivers for anything else in there because at least some of the people who are willing to buy a Zhaoxin-equipped laptop are going to run Kylin on it and those drivers would work on other distros.

If they were going to do that, it probably would be a little more hidden than that. A firmware component that connects to the internet is possible, but shouting out that it exists would break the intent. Also, if they were going to do that, they wouldn't only do it for the Zhaoxin model unless they're trying to spy on Chinese government users, who are the only people who will buy it. You are welcome to try. In fact, I'm happy to try, although I'm not going to buy one, but I would do the analysis if someone asked. But I doubt you'll find it as interesting as you expect.

Headscratcher?

It doesn't seem that confusing to me. $1500 per government employee is a lot of money and, for anyone told to buy local*, it's not like this has a lot of competition. Maybe the Huawei Qingyun line, but that isn't really designed to run the same OS that they're already running, and it doesn't matter whether they were running Windows or Kylin or Ubuntu. The Zhaoxin model would run any of those and the Qingyun would require some hacking. Meanwhile, Lenovo doesn't have to spend much money if they can use as much of the X1 production line as possible with just a different board. Producing one such model seems a reasonable commercial choice to me.

* Buy local, or at least just don't buy from a few easily identified massive corporations. If there are a bunch of Korean components in there, it's fine as long as nobody really talks about it.

Qualcomm's Windows on Arm push would be great – if only it ran all your software

Re: Microsoft remains its own worst enemy

I also have to wonder a few things about that observation. The author was unaware that Adobe software had native builds, so I have to question what they actually did. I'm not sure whether they ran AutoCAD through emulation at all, let alone enough to estimate its performance. I would also note that many of the Windows on ARM machines are laptops with mid-range CPUs. The Microsoft SQ3 and Snapdragon 8cx Gen 3, for instance, benchmark about the same as the Intel Core i7-1250U or the AMD Ryzen 3 5425U. I wonder how well either of those would do against an AutoCAD system requirements page which suggests "Recommended: 3+ GHz processor (base), 4+ GHz (turbo) Basic: 2 GB GPU with 29 GB/s Bandwidth and DirectX 11 compliant

Recommended: 8 GB GPU with 106 GB/s Bandwidth and DirectX 12 compliant". Maybe this kind of software wasn't really intended for the market segment where these laptops are being sold.

Re: Microsoft remains its own worst enemy

You can buy a retail version easily. It isn't distinct from X86 versions, and the license key process is basically the same. What isn't as easy is making it actually install where you want it, and that's because ARM isn't standardized in the same way X86 is. So for example, you can buy a license key and run it in a virtual machine host on an ARM Mac, and you've been able to do that for quite a long time. If you want to install it directly on the Mac concerned, it's not going to work, but you are welcome to try without any guarantee that anything will stay the same.

Re: Value proposition

I think the main value proposition for users is better battery life, which is something people comment on quite frequently with ARM Macs. Most of the other advantages of current ARM-powered laptops are things you could get elsewhere. For instance, although they can often come with 5G support or an NPU, if you need one or both of those, you could get them on an X64 machine or add them externally. Still, some users may want an integrated unit and choose this anyway, so access to that market could be a good reason to do some level of development.

For a lot of software, it can be as simple as changing a compiler target and building two binaries. There are always exceptions and things for which ARM won't work without a lot of effort, but a lot of basic software isn't using anything complex enough that a direct cross-compile wouldn't be good enough.

They've said quite clearly that they think it doesn't exist, because they say "Adobe Photoshop can technically run on Arm through emulation" even though it can also technically run on ARM using the native binary. I think this author is behind the times.

The problem with that is it makes it hard to know whether the author understands what they're talking about. I don't have a clue whether Photoshop's native ARM build runs properly, and I neither have a Windows on ARM machine nor use Photoshop, so I'm not going to find out. With an author who isn't aware that it's an option that they should have included in their analysis, I also have to question whether their judgements on other aspects are correct either. So far, I have not considered a Windows on ARM machine because I don't know how good the emulation is. I have software which doesn't and isn't going to have an ARM build, so that could be a limitation if the emulation isn't good enough. I'm also hoping that Linux support will get more thorough; even if a user runs Windows most of the time, I appreciate having options.

Australia tells tots: No TikTok till you're 16... or X, Instagram and Facebook

Re: who's responsibility?

I think this demonstrates what I expected, but you did allege that I'm assuming something that doesn't represent you, so let's give it a try. We can limit ourselves to the talking on the phone bit, because it perfectly demonstrates what I was talking about. I see your post as assuming why people don't talk on the phone: "fear of talking on the phone rather than some form of texting (thus taking away their "shield from emotional vulnerability")". That would appear to me to be a rather clear generalization, even though there are lots of reasons why people avoid talking on the phone.

Here's one. A change in attitudes, not because of any "emotional vulnerability". One change in attitude has come along because the phone is no longer the only way of contacting someone. A while ago, if you wanted to talk with someone, the phone was the best way of doing it, but now, an email or chat message will arrive just as quickly. Some people have grown less eager to use the phone because it means they have to have a conversation when the call happens rather than an asynchronous one at a time of their choosing. And that is recipients of calls. I have certainly noticed this. There are people I want to talk to who just don't answer the phone and don't listen to or respond to voicemails. If you need their attention, you have to send them an email and schedule a call if needed. That applies to many older people as well, and there's at least some logic in it because it is less disruptive to whatever else they were doing that day. That, in turn, means I'm less likely to call people because there's at least some chance that I am wasting my time because they won't answer or respond, so although I quite like calling people to communicate with them, I still generally start with an email.

That set of people are not doing that for anything related to "emotional vulnerability". Incidentally, what is your theory for why there is more emotional vulnerability on the phone? It's pretty easy to insult someone or to be insulted over text chat. There's more direct vulnerability on a video call, but those are rather popular.

However, just because that or other non-emotional reasons exist doesn't mean everyone is as I describe. There are indeed some people who dislike talking on the phone for some different reason. However, by making a statement like you have, you've ignored many alternatives, applied your own assumption for why people do things differently to how others did them decades ago, and then used your assumptions as evidence of a different problem with a tenuous connection. Even if we were limiting this to those who feel anxiety about making a phone call, we'd still have to figure out why before we could blame it on any particular change in activity, but we didn't get that far because I saw you lumping all sorts of things in.

Re: who's responsibility?

Some of that is true of a significant subset, and a lot of that is just the typical intergenerational stereotypes that always crop up. For example, teachers annoyed that their adolescent students aren't paying attention and don't put the dedication into their homework that they should... nobody's ever said that before. It simply didn't happen before 2010.

Another one I can explain is the office environment. Yes, people wear headphones. They wear those because there are no walls and they want to reduce noise pollution so they can work with less distraction. Some of them might be playing music which they think helps them work. That's not antisocial, it's attempting to improve productivity. People of all ages can get annoyed at interruptions. Unless they called you there, there's a chance that they were working on something and don't particularly want to talk about your thing, hence the negative reaction, and one I think you're likely overestimating because most people have learned not to show their annoyance at interruptions that they can't prevent.

Other ones are less clear. I could try to explain the changes in etiquette that has reduced the acceptance of just calling someone when you want to speak with them. However, there are some people who dislike calls even outside of that. However, I'm not sure you would care about those different subsets as you've already decided what the explanation for all these things must be.

Apple hit with £3 billion claim of ripping off 40 million UK iCloud users

Re: Apple? Locking customers in?

An IOS app can request access to photos and then back up those photos. There are probably quite a few that do. However, they are not really able to back up anything else. Android is not a lot better. While there is a storage location for general files which could conceivably contain app data you care about and be easy to back up, Android has been designed to lock up most app data in unreadable directories. Of course, system apps can read those at will, so Google's backup system can fully back up your app data, but using another app to do it won't work. You used to be able to back up some of that over ADB, but that has been deprecated. So now, if you have root, you can back up all of that, and if you don't, you can only back up what your app developers have bothered to make readable to you. It's just your phone and your data, why should you have access to it?

Academic papers yanked after authors found to have used unlicensed software

Re: The connection is copyright

The point was not that they were compensating peer review in a deserved way or that they weren't making massive profits off others' work. The point was that, in comparison to one that doesn't do those things at all, they can still be more respected. Reputation can be an important thing to researchers and those looking for other research to build from. Although a lot of journals have a long history of allowing bad papers in and taking too long to remove them, the reputation of those who filter a lot of them out at source and do retract them when they're found faulty is higher than ones that don't filter much at all and retract only after something egregious.

EU irate about geo-locked Apple IDs

Or it was literal, pasting the fifteen-step process would be kind of ridiculous because anyone who cares would click the link. And yes, it's fifteen. The six points are just what you do before switching your country, and the process on an IOS device involves nine more steps, although all of those are pretty simple steps. So yes, I'd rather not have to find fifteen steps copied and pasted in here when it's irrelevant to everything else.

I'm not sure why you chose that comparison. The complexity of a process is not the number of steps, but the sum of the complexities of those steps. A two step process of 1) deactivate the safety systems on the nuclear reactor, manually preventing anything from going wrong and 2) rearrange the parts so it works on a different type of fuel is a lot more complex than a forty-step process for cooking instructions where a single step might read "remove bag of flour from cupboard" and the next one "place it onto a work surface". We're not going to get anywhere by counting list items.

Nor are we going to get anywhere by debating about the complexity of pushing the "change country" button. The EU's complaint is not about the user interface and how hard or easy it is to find that option. It is about other problems, for example the problems of what happened to the stuff you had in your previous country, which seems to divide itself into two big categories: 1) you have to buy it again and 2) you can't even buy it again. That, of course, is merely one list item. You've repeatedly suggested that you disagree with Apple's choices, so the entire debate in this thread seems a little weird. Having discussed with you before, I know you tend to defend Apple on most things, but since you disagree with them on this one, what is the objection you are raising?

The NPU: Neural processing unit or needless pricey upsell?

Re: What does "upsell" (noun) mean?

If you know the verb upsell, then the noun is the same. To upsell something, you try to add on extra things that cost more money or to replace the cheap thing with an expensive alternative after the customer has decided what they actually want. An upsell is the thing you add on to do that or, alternatively, the act of upselling itself. In this case, it's not really an upsell because it's just put there and you don't really get a choice about it; if you want a certain type of CPU and it only comes with an NPU, then you'll have to buy an NPU to get the rest of it. To be a more traditional upsell, you would have to persuade the customer to add it on or to choose a more expensive board by marketing the included NPU.

I've heard people in the UK use both words. I don't know if it was an American term when it started, and it could easily have come from any country to begin with, but it's pretty global now.