Posts by doublelayer

As AI booms, land near nuclear power plants becomes hot real estate

Re: Anticipating grid failure is more like it..

I haven't worked in the electric power industry, but I would guess that they get two advantages by being close. First, they get to avoid paying transmission costs, including any cost for adding more grid capacity for their large set of usage. If the existing grid couldn't handle their relatively large load being added, they'd probably have to pay most or all of the costs to upgrade it. Second, if there is a grid problem, their datacenter would continue operating. That failure doesn't have to be long-lasting. If they've sold their capacity on an SLA that becomes costly if the systems lose power, then they might want to avoid what, to a residential user, might be an annoying but acceptable outage. By locating close to a plant, they can probably get away with a lot less generator capacity than a normal grid-fed DC.

Good news: HMRC offers a Linux version of Basic PAYE Tools. Bad news: It broke

Re: It's 2024

Of course it is, but the reason we use compilers is to somewhat limit the number of stupid things we can do. We could go back to times where nearly anything you typed was valid code and the computer would run it, and if it didn't do what you wanted then that was your business to find out and fix. Powerful languages get their power by making it easy to explain what you want and difficult or impossible to do certain classes of preventable errors. Having enough memory that you don't have to think about type storage doesn't change all the other things that a good type checker can do.

I like Python, and it is one of my more commonly used languages both for prototyping and for some types of production software, but if I had one complaint about it, it would be that it makes some things which, in another language, would be compile-time errors into runtime errors. Testing is often insufficient and we don't make that easier by having to write pointless manual tests that a compiler would already do.

Re: "for businesses with fewer than 10 employees."

The print as a function thing has confused me for years. I came to Python after a number of other languages where print was a function, so I never understood why it shouldn't be a function there either. It's the only imperative keyword, and without the parentheses, it still works exactly like a function would. Maybe someone who minds the change could explain why it's such a problem.

Uncle Sam's had it up to here with 'unforgivable' SQL injection flaws

Re: Coders vs Developers

Effectively, this requires them to completely change their interfaces in a way that makes them less flexible. Libraries that make it easy for you to parameterize a query are still turning it into a string when they send it to the engine, they're just doing it better than you would on your own. There are three reasons why database engines won't make that change:

1. Writing parsers becomes much harder. Consider all the possible parameters to a statement as simple as select. You can sort in a variety of ways, you can select from multiple things and combine them, you can use one statement to filter them. Now write a function contract in C that can do all the same things. What parameters do you need to take if the query might reference multiple tables. What parameters do you need to take to expose all of the internal functions of the database and construct a function that can be used to sort them? Your function is going to be huge. It is easy enough to handle this in the database because it can be split into subcommands with temporary storage for intermediate results, but the point of the database is that your users shouldn't have to do it themselves.

2. If you don't take a string or some other portable query syntax, then you have to write programmatic interfaces in every language. Most popular database engines have libraries for many popular languages already, but we also know that, if it really comes down to it, we can write a basic communication method to get bytes into the database server process and use a database in any language we like. If you use a more complex expression syntax, the library that executes queries becomes much more complex. A user who uses a language that isn't supported no longer has a hope of quickly writing one, and unofficial libraries are likely to have trouble keeping up with additions to the syntax.

3. The method has existed for a long time and inertia is hard to fight. There are newer database engines that do what you say, but it won't be easy to convince everyone to dump SQL and adopt one of them with its unfamiliar syntax and incompatible behavior as the new standard, porting all applications that used it over.

Re: Coders vs Developers

"How does SQL injection work with modern code?"

Nothing will ever stop you from submitting just one string. They don't parse to see if you're passing something that looks like a value and insist you parameterize it. This means that, if someone either doesn't know or doesn't think to parameterize, they can still build an expression as a string and that expression is still vulnerable. Most likely, you're just not seeing as much of it because the number of databases out there is massive and a lot of programmers were told not to build expressions that way and remembered it. Sadly, that doesn't mean everyone was taught that, so it still happens year after year.

Over 170K users caught up in poisoned Python package ruse

Re: Python, eh?

In this example, it wasn't PyPi that had a problem. It was the package that was instructed to retrieve code from somewhere else, download it, and run it. Nobody broke into PyPi to submit a poisoned package; they broke into someone's GitHub to make a real package poisoned. The important part is that, unlike previous attacks which have indeed used PyPi, this could have been done to any project using any language as long as somewhere in the build system accepted a dependency's URL. They picked a Python package in this case, but that wasn't required for this to work.

That Asian meal you eat on holidays could launder money for North Korea

I can't back which claims with evidence? That they threaten anyone they let out of the country? Does testimony from escaped ambassadors and tech workers count? You can find that. But if you will dismiss this all as state department propaganda, then there's nothing I can do. Do you want to try convincing us with evidence of your own? If I can't back up anything I say with evidence, then surely that means you can? You could, for example, find me an interview with a North Korean who didn't either escape their country which wants to imprison them or is working for them right now? I can find you interviews with plenty of migrants, with legal documentation or not, from almost every country, but you tend not to find North Koreans who voluntarily left their country, were allowed to do so, and are willing to talk about it.

Re: Wait, who sells them the weapons?

True, and it already works that way. However, if most countries and companies will not sell you the parts, it means the markup on those parts is pretty high, which means that there is an incentive for the person who is willing to break those sanctions and find the parts anyway. If I make chips that could be used in missiles for $10 apiece but refuse to sell them, and North Korea is willing to buy them for $60 each, then a company has a $50 per unit ability to cover any costs involved in getting them out of my control and into North Korea's. If they are general purpose chips, this can be pretty easy. If they're restricted technology that has to be obtained from one of a few people I'm willing to sell to, then it's harder, which increases the price even further.

The more cash North Korea has on them, the more their ability to pay those increased margins. You'd hope that, at some point, they would decide that more nuclear weapons they don't really need isn't worth the price, but if they thought that way, they probably would have stopped making them at least a decade ago. For other weapons systems, they have plenty of people who want to pay them to manufacture them. North Korea has been making and selling weapons as one of their major export industries for decades, and they've been making some advancements. Russia wants a bunch of cheap and modern missiles, and North Korea has a bunch of really cheap labor and factories built for missile manufacture, so if they can connect Russia's money and modern missile components, they can get them.

"The world is full of workers from the global south working, possibly undocumented, in the global north and sending remittances home."

The difference, as you well know, is that people sending remittances home to other countries are sending it to their families or friends. North Koreans abroad are working for their government and passing the money to them directly, and their families will get little or none of it (none by official policy, but they probably find some ways to sneak in a bit). We also know that North Korea's government budgets are a bit slanted toward the military expenditures and against everything else, in fact they've put a nice name on it. The people working in other countries are not individual agents taking a risk for economic reward. They are slaves held in check by actions North Korea has been using for decades: threatening and punishing families and friends for any infraction and closely monitoring everybody. There is a difference, and we all know it.

Re: A waste of time syndicating that here.

"You can take any regime down for less than $20m in a couple of months."

I'll take that recipe, please. How much more to put up a regime that I like, not a chaotic wasteland of suffering people?

I think they're more likely intended for North Korean agents who get cash so they can claim the cash as business income, not for the lucrative market of people who want lunch, but you have to give someone lunch or you can't convincingly claim to be a restaurant.

Woz calls out US lawmakers for TikTok ban: 'I don’t like the hypocrisy'

That is not what I said. What I said was that, in my limited experience, I don't know people who would. It is like asking "Why do people complain about others eating meat but then go hunting?". I know some people who do happily kill and eat animals, and I know some people that disapprove of people eating meat and will complain about it to anyone who does, but those are not the same people. In order to demonstrate hypocrisy, they have to be the same people. Otherwise, it's just different people doing different things. In my experience, the people who complain about any access by the government are not the same people who will post anything on social media. Maybe your experience differs from mine, but what I am saying is more complex than "I wouldn't post that, so they don't".

Re: Risk/Reward.

Thank you. I think I better understand what you're saying now. The reason why I was talking about the ease or difficulty in looking up a phone number is that it affects how I feel about having to give it to somebody. For example, I don't have a problem giving my phone number on a government form, nor do I know many who would. I was trying to find out a type of data that someone would provide easily but would complain a lot about providing to the government, which is central to the question you brought up. In my experience, people who readily give that information don't have a problem readily giving it to the government, and those who complain most vociferously when it's the government asking tend to complain when others ask for it as well, but this appears not to match your experience. Yes, there are people who are ridiculously conspiracy-minded whenever the government does anything and people who will give away any private information, but they tend to be different people, not one person doing both of them.

I have, and I've seen two categories that fit with the idea, but don't work with the question:

Group 1: Are happy to give out any piece of personal information, no matter how much I wince when they've done it. These are people who would post a live view out of their doorbell camera and, if I ask why, they will say something stupid like "it'll help make sure my house is safe". These people will definitely put lots of personal information on social media, but they'll also give it to the government. Point out that the police have extra access to that camera and they'll say "I have nothing to hide".

Group 2: Paranoid, kind of like me or even worse. They'll keep lots of data private. If they're asked for it, even when it has a purpose, they'll think for a while about whether they have to or if they can find a way around providing it. This applies to the government, but it also applies to social media.

What I don't see too much of is group 3, the one that happily puts data on social media but refuses to give it to the government. Now I have seen a similar group of people who are avid users of social media and weirdly panicky about the government doing ... something (if they explain it, it sounds crazy, so often they go for vague). But those people don't tend to dump tons of data up there, at least not intentionally, because they think the NSA is collecting it (which they probably are because hard drives are cheap) and using it against them (which they're definitely not doing because these people are not interesting). The question asked in the original comment relies on people being angry about giving a certain piece of information to the government but accepting giving the same piece to social media. General attitudes being more positive to social media than the government don't fit that question unless the information being provided is the same.

Re: Risk/Reward.

You're eventually going to have to explain the things instead of saying "whoosh". Because one of two things are going on here:

1. I'm an idiot, and I'm going to continue being annoying until you explain your meaning in simple words that my walnut-sized brain can understand, even though your original comment was rather clear already.

2. We actually do understand what you're saying, but our responses are not to your liking and you choose not to make meaningful response.

In many cases where I see "whoosh", it means that the original comment was sarcastic, and someone missed it. So If I try to interpret your comment in that way, then maybe you were saying that a phone number isn't sensitive information because phone directories exist, so it doesn't matter that people willingly post it on social media? That doesn't sound like what you were saying, but your comment didn't seem that sarcastic. Otherwise, their point about how public a phone number is is relevant to the discussion. You can tell us what you meant. My walnut is ready.

Sorry, but I'm not sure you read or understood my comment. For example, the "muh freedumb" thing you talked about: I didn't say anything about freedoms, lack of freedoms, or governmental overreach. Not one single thing. What I said was that I don't know what information people would be angry about giving to the government but happy about giving to Facebook. If you see an argument about freedoms in my comment, I'd be very curious to see what led you there, because I didn't intend it.

I asked for examples, and you've provided one. Let's consider it. I don't know people who would be angry to put their phone number on a government form, assuming they're not already angry about having to fill out the form itself. I know a lot of people who would not put it on social media, exactly for the reasons you say: it's public when they have it, it's not when the government has it, and the government already knows it. However, as data goes, this is one of the less sensitive pieces of it. I've had my phone number for many years now, and since I'm able to port it around to different providers, it's likely to be mine for the rest of my life. I've had plenty of places who I've given it to, either because they actually needed it to contact me or because they demanded it and I couldn't do what I wanted or needed to do without them having it. This includes various government services, and I didn't mind them having it. This means that, almost certainly, my phone number and name are associated in nearly any dataset that can be purchased and likely in plenty of free ones to be found online. I have little hope of my phone number remaining truly anonymous, so I must factor that into how sensitively I'm going to protect it. I still wouldn't hand it out to anyone who asks, but I don't protect it the way I do more sensitive pieces of information.

The kind of thing that I don't want to give to governments are things like passwords to online accounts, private keys, and the like. Mostly, they are things I don't have to, although various ones suggest collecting them from time to time. I would not give any of those to social media either, and I think that, although there are a few people who would be stupid enough to fill in the form "The password to your email account here", it's a rather small set compared to those who are willing to give their phone number except for authentication and communication, which is a small set compared to those who use the services at all. Maybe you think of phone numbers differently than I do, but if you agree about its sensitivity, is that your only example?

That might be convincing if I could think of anyone who actually would. Yes, I know that some people are stupid enough to put some kinds of semisensitive information in a form, but I don't think there are many, if any, who will put something like their passport number into a form just because there's a box for it. Probably the most sensitive thing I can see someone actually putting there is their mailing address, which I wouldn't do and will probably lead to spam, but it's not as bad as some things. What specific information do you think people will be angry about telling the government but willing to put into a Facebook form? I can't think of anything.

Time to examine the anatomy of the British Library ransomware nightmare

Re: "Too old to be safe, too expensive in time and money to replace"

You will never prevent vulnerabilities from existing. You can reduce their number by spending more time (remember that it will increase the time and slow the pace of updates, including those you want to have), but it will never be zero. But let's try this thought experiment. What was the last zero-day or vulnerability that caused a zero-click attack, I.E. one that would have happened without any user interaction and was all due to the software. How many attacks like that do you know? Many attacks aren't that simple. They often rely on a user to activate the initial vector or to leave it insecure (basic SSH or RDP access to the internet is popular), the configuration to allow them to brute force passwords or access methods, the configuration to allow their compromised tokens to access things for a long time, profiling systems to not exist. None of that is down to programmers shipping too fast, and all of it can be blamed on the administrators who could have configured it and didn't.

There are times when programmers are really at fault, but from your comment, I think you and the OP have overestimated how often this is. I am asking you again to consider how you would feel if it turns out that no vulnerability was found to be very important in this attack, but the administrator could have detected this and didn't with a different configuration, so they're the one bankrupted with penalties. If your response is "Fine with me. Let them suffer", then fair enough, we just disagree. If you think the administrators shouldn't face those consequences, then you should consider whether it's fair to have programmers face them in an analogous situation.

Re: No change

You learn who to say things to. I also work in security, and that's what I say to people who work in IT or programming. They assume that I'm also doing some kind of technology security, and if they know that I'm a programmer, they can draw the lines. Say that to someone who doesn't work in tech and they either don't get it or assume you're a security guard and try to figure out why a programmer is doing that. The term they use for the entire information or technology security area is "cybersecurity". We're lucky that shortening that to "cyber" hasn't entirely caught on. Now I could try to adopt something that's really no better and get everyone to call it "computer security", educate them on why we sometimes call it infosec and try to make them do that, or use the term they know. I often choose the low-effort method that still gets communication going.

Re: "Too old to be safe, too expensive in time and money to replace"

If you do that, you will certainly sometimes get the writers of the software to pay for damage caused while running their software, but you will also get a lot of something else: IT people raked over the coals and punished severely. Because if you're going to pin the blame on the writers, those writers are going to have a need to pin the blame on someone else, and there is usually something the administrators could have, and in many cases should have, done which makes it their fault. For example, maybe we blame a software writer if their code has a zero-day in it, but who gets the blame if the software had a vulnerability in it patched two months ago but the administrator didn't install the update? If you're willing to charge the programmers for any financial cost, are you willing to charge the administrator that could have but didn't install the update with the same thing? After all, if the coffee machine was not defective but the plumber installed the water line in such a way that it flooded the machine, heating the water, and collapsed in a wonderful fountain of steam, you would be blaming that plumber.

There are many situations where it's less clear, for example the programmers say the configuration was insecure, the administrators say the defaults were insecure, and they fight because neither wants to get stuck with the blame when it comes with that large a bill. So also budget for some lawyers to be involved, especially if the company who wrote the thing is large enough. They'll have a good incentive to make sure the court thinks it's your fault. Before you get too eager about finding someone who isn't you and blaming it all on them, think for a bit about whether it would be fair for someone to do the same to you. If it wouldn't, let's factor that in to the solution we propose.

What personnel? Because if you try to answer that question, you will instead start up the blame game. Is it the IT person's fault because they didn't put in some security method? Is it a finance person's fault because they didn't budget for it? Is it a manager's fault because they said not to bother because that's not a priority? Or do we track down the person whose password allowed the initial access and put it all on them? In reality, most situations can be blamed partially on all of those people: the manager said it wasn't a priority, but because the IT person explained it badly to them and because the finance person wouldn't pay for the staff or systems required, the finance person couldn't pay for that because the budget was set by senior management who didn't allocate anything because they didn't get told about the issue from the first manager, the IT person didn't build something out of the pieces available to them but because they weren't given the time, and the user entered their password on a phishing site, but wouldn't have done so if the IT people had put in a better email filter or more phishing training, and anyway that initial password wouldn't have allowed the attacker full access if the IT people had more inter-system security methods, which they didn't have because the finance person wouldn't pay for hardware, and they didn't build in software because the manager didn't give them enough time, because ...

No, it really wasn't. It was a a major failure of systemic accuracy. Integrity and accuracy are completely different aspects of a system and have different effects when lost.

Twitter's lawsuit against anti-hate-speech crusaders gets SLAPPed out of court

Re: Careful here.

They don't have a master control panel that can shut off ad revenue, not that I have any ad revenue to be cut off anyway. Still, they can only cut it off by going to advertisers and telling them things that make them want to cut it off voluntarily, and they individually have to be convinced. Twitter still has some advertisers. The important part here is that, if they don't have anything convincing to tell them, then the advertisers don't have any reason to stop advertising. It only worked because what they were able to show advertisers is something the advertisers didn't want to see enough that they choose to stop buying advertising space. The organization may have helped to shine a light on that, but without that light, it would still have been going on, and advertisers were already leaving as a result anyway.

Debate is not stifled by someone pointing out facts. If you want to accuse someone, accuse the advertisers; they made the actual decision not to spend when they were free to ignore any reports written, and if they had, nobody would notice much. Those advertisers have free speech, including the right not to advertise. No debate stifled, nothing untoward happening. There are some forms of harassment that do occur and are dangerous. This isn't it.

Beijing issues list of approved CPUs – with no Intel or AMD

Re: We should be worried

I don't think that will be the conversation. Windows licenses are pretty cheap. It will take a lot of changes before that answer is anything along the lines of the real one:

"Why are China so much cheaper?" "They can pay people really low and work them for 72 hours a week on normal weeks. Ah, can we do that too? Maybe open up a Chinese office and do work there? What other countries can we do that in?"

Uncle Sam, 15 US states launch antitrust war on Apple

"As for "makes it tough to dump iOS for rivals", isn't that pretty much how MS operates with their Office suite?"

Not really. I had Word and Excel, I generated documents with both of them. I then decided that I didn't really need them, so my next computer didn't get them. I installed LibreOffice instead. I simply open the same files with that and used that software instead. It handled them fine.

And no, if you find a file that opens correctly in Office and doesn't in LibreOffice, that doesn't mean that it's Microsoft's fault, because I do have one file that didn't work correctly in LibreOffice. That particular file had been generated by a different version of LibreOffice. Sometimes, it's not Microsoft's fault.

If you have a different kind of lock in in mind, I'm willing to hear what you're thinking.

Re: Freedoms?

No, you can have a closed OS. You start with either OS, and you don't flip any of the switches that open it up. You'll know them because they're the ones buried at least two levels deep in the settings where, if you try to flip them, you get a warning screen. Voila, closed OS for you. If you don't want to install something from outside the manufacturer's store, then don't install anything from outside the manufacturer's store. It's really quite easy.

Redis tightens its license terms, pleasing basically no one

Re: So why the controversy

I don't think it is. Patents are applicable to any industry, and encrypted code is a technique that can be used in anything. The SSPL's fields of endeavor thing is more obvious, because it specifically mentions SaaS providers as having different terms to anyone else, but the GPL doesn't have different rules for encrypted code depending on what you're using it for, so the same terms apply to all people.

Re: So why the controversy

Mostly because linking into GPL is something programmers choose to do. There are two important elements to this which I will take separately:

1. Programmers, not users. The SSPL comes into effect when you run the software on a computer if you use it for a certain purpose. The GPL does not care when you run it or why you did it. In fact, you are perfectly free to include the GPL software in your software as long as you don't distribute it, I.E. to use internally. You don't need to educate anyone putting the software to use on what the license means. You only need programmers that might modify or use it in their own software what it means. They have probably seen open source before, so they already understand what restrictions apply to them.

2. Choose to do, rather than find that they've done: If you choose a GPLed dependency, you know you did that. When you pick something off of GitHub, you know that you'll have to read the license because it can be something proprietary that you are not allowed to use, so you know when the terms apply. You can understand the conditions on what this applies to, because it's anything you're linking this with, so you know what you have to put under GPL if you go ahead. With SSPL, neither applies. You may not know whether you are in the set of users that have to put software under a certain source, especially because all you did was install it on a server. If you decide that you are one of the group that has to do that, you don't know what comprises all the software the SSPL is demanding, and it's mostly going to be unrelated stuff written by other people (which you couldn't put under the SSPL anyway). Unlike the programmer and their own code base, it's the user trying to list all the pieces of software that come under a nonspecific category, which the average nontechnical person, even a Linux user, has no hope of doing. Even the most familiar person will have to spend a long time sorting things in and out of the list.

Many of us who care put some importance on the Open Source Definition. The GPL meets this definition. The SSPL specifically violates this part of it:

9. License Must Not Restrict Other Software

The license must not place restrictions on other software that is distributed along with the licensed software. For example, the license must not insist that all other programs distributed on the same medium must be open source software.

It also violates, both in letter and in spirit, this part:

6. No Discrimination Against Fields of Endeavor

The license must not restrict anyone from making use of the program in a specific field of endeavor. For example, it may not restrict the program from being used in a business, or from being used for genetic research.

This is what I care about and the reason why the SSPL is not open source.

Re: So why the controversy

The GPL requires you to distribute your modifications to the software under the same terms. The SSPL requires you to distribute basically every bit of software you run on the same computer under the same terms. The GPL can be complied with, you just might not want to. The SSPL is intentionally written to be essentially impossible to comply with. It's not just that your entire cloud service software stack has to be SSPL-licensed. That would be bad enough, but it is theoretically possible. The dependencies, the software you got from other sources, and depending on where someone tries to draw the line, system firmware, would have to be licensed as well. It is intentionally written so that buying the proprietary alternative is the only choice that is feasible.

Re: Guess they spotted their mistake

No, I don't expect people to understand that, especially when they react as if free speech is somehow a lesser thing. The freedoms available with free software are more than just not paying for the software. Yes, you can make me pay for a copy, but the freedoms that Stallman advocated for, and he was the one who popularized that phrase, mean that I am within my rights to give copies to anyone I like, I can do it for free, or I can charge them and not give you any of the money. That's a core part of the freedoms: the freedom to distribute. He often made the distinction to clear up the situation for people who understood it as "software for free" and got it mixed up with what we call "freeware" (I.E. here's a binary, you pay me nothing, what do you mean source code). Requiring people to buy it from you so you're compensated for the work is not what he was talking about there.

Re: "Software is only open source if the OSI says it is"

We need licenses that say "use this if you will keep it free but if you make money you must give us a percentage."

There are many and you can easily write another one. Don't be surprised when it doesn't count as open source. I'm not just referring to the OSI, because I don't see the OSI as a perfect judge of such things. I value their <a href="https://opensource.org/osd>definition</a> more highly, and I can evaluate by reading the license whether it meets the definition, kind of might meet the definition, or definitely doesn't meet the definition. The "pay us if you make money" bit is very contrary to parts 1 and 6 and can be and likely is contrary to parts 3, 7, and 8. Specific licenses, such as the SSPL, also are contrary to part 9, intentionally so so they can claim not to be proprietary.

This is important to me and may be to others. If you don't want to be free or open, don't be. There is nothing morally wrong with proprietary software. Many proprietary databases exist, and there is no harm in making your business on selling another one. Oracle seems to make plenty of money doing it. The reason I use an open database, most of the time anyway, is because I want to avoid having to deal with the licensing disaster. For instance, I have many Postgres installations. Sometimes, it's because I really want to use one of the many features that Postgres has and other databases don't, but sometimes, I just want a database where nobody will ask to audit my licenses or exactly what I'm using it for and if that's commercial or not. When I write code, I decide when I've done that whether I want to sell it, in which case I don't release it or I put restrictions on the license, or whether I'm comfortable giving it away with the knowledge that I will likely not be able to sell it. I can try to sell support, and that will work on larger projects, but it is not guaranteed. If you want to sell it, go and sell it. Just don't pretend you're not.

Apple iPhone AI to be powered by Baidu in China, maybe

Re: I assume because Chinese law

"At least China is smart enough to regulate its own AIs,"

If China's regulation actually did anything useful, that might be a convincing argument. It accomplishes two things:

1. The AIs are less likely to tell you anything the government wanted you not to hear enough to check for it.

2. It means the Chinese government gets to approve or deny AI models for any reason or no reason, so they can control any company trying to make them.

Crucially, it doesn't ensure that the models are accurate, or good at their jobs, or not dangerous to the user, or not going to make certain crimes very easy, or anything that we actually want to prevent. Whether you can do that at all is not a certain question, but China's regulation is not doing it.

I also don't think it's fair to say that countries other than China are not smart enough to regulate; the EU, UN, US, and various individual countries have talked about or actually passed regulations, but they don't know what exactly those regulations should be and what they've done tends to be nearly or entirely useless. If you can come up with a regulatory idea that would work, they already have an appetite for regulating it, so it would be pretty easy to get them to adopt your better set of rules. If you've got one, I'm all ears, because I don't have one.

Garlic chicken without garlic? Critics think Amazon recipe book was cooked up by AI

Re: I wonder if they are tasty?

"if somehow an AI could be trained for deliciousness and generate the optimally delicious recipes based on a set of ingredients."

That's going to be one of the harder things to automate. There's a lot of subjectiveness with whether a given collection of ingredients are delicious or noxious, and some people will fall into either group. A lot of successful recipes use trial and error. For example, I decided to make a certain dish and just improvised a recipe. The result was...edible, and it didn't taste terrible, but it was clearly not going to win any awards. Still, I could see that there was promise in it, so I started to adjust the amounts of some ingredients and some times. I wasn't going back to the drawing board, I wasn't putting in completely different things, just trying what would happen if I used different proportions and more heat. I think it helped. I might serve it to you and get a negative response though, so all I've proven so far is that I like what I eventually came up with.

The AI can't do any of that. It can probably suggest a possible recipe, but perfecting it will require some people who can explain what they like and don't like, and if it's supposed to appeal to a large group, you need a lot of them.

UN: E-waste is growing 5x faster than it can be recycled

Re: Perspective

"It is certainly being less wasted than doing nothing in the landfill..."

That depends on your perspective. The hardware is in use, but that isn't really any better or worse, and it is using power, which is slightly worse. Whether it evens out depends on what you would have done otherwise. If you would have bought new hardware to do the same job, it's probably better. If you would have opened it with existing tools, probably slightly worse.

Exposed: Chinese smartphone farms that run thousands of barebones mobes to do crime

The harder it is to fake, the harder it is for you to determine whether a real person is real. If you're looking for entropy, I can replace the tilt sensor chip with one that fires off random numbers from a certain formula. You have to develop increasingly complex hueristics to detect that, and my chip can advance as well. In the meantime, your real users will be doing all sorts of stuff with their phones which will generate different levels of tilt action. If you're not careful, you'll eventually refuse some of them for not moving enough or moving so much that you think it's a fake chip.

There are some methods that can work a little better, but the more reliable they are, the more likely they are to be invasive and annoying to your users. For example, you could use the phone's camera, have them scan their face, and have them perform a series of actions you print on the screen using graphics that change a lot so they're not easily scripted but the human eye can easily distinguish. This will keep out a lot of bots, but it will also keep out a lot of users who cannot (E.G. movement problems, vision problems) or don't want to perform an odd validation dance to use your app. The simpler you make the methods, the more likely someone is to be able to automate it.

What I meant was if the phone needs to act as a phone, I.E. sending or receiving calls or SMS messages, which can't be done without a valid number. That is an obvious reason to use phones themselves. If you're just sending calls, VOIP services seem to work well enough, but if you're doing something that uses SMS 2FA and requires unique phone numbers, that could be one reason why you would need a bunch of SIMs and a bunch of devices capable of using one. This is only one possibility, and for the reasons in my first comment there's reason to wonder if they're actually doing it, but that would not work just with a network connection over USB.

That's the subject of most of the discussion in other threads, and for a lot of possible tasks, yes it really does seem inefficient. However, if there is a task that requires a phone, there can be a few reasons why this would be the most efficient option. The obvious reason is if you need to use cellular connections. If you need active phone numbers, you can't do that with a typical server, and the hardware that allows you to connect one SIM, let alone many SIMs, to something that's not a phone tends to be more expensive than just getting the motherboards out of the cheapest phones that aren't selling and using them. The theory is that Chinese dictatorship-linked tracking of phone numbers would make that difficult, but their repression might have some bugs that allow an organized criminal to get phone connections easier than we think.

The other option is that they're using some app that doesn't make it very easy to do anything outside the app. I'm imagining something that has no web interface available, no desktop access method, and actually secures the network communication so you can't inspect the traffic, reverse-engineer their protocol, and poke their API directly. The discussion has considered the ways you could virtualize Android, but in my experience, many of those are limited in some crucial ways, such as being easily detected by applications running in it, missing important system services, or just unstable in the first place. That could make buying cheap boards more reliable than trying to virtualize it, especially if they end up being as expensive as the server you're using. The article's quoted prices are about that of a mid-range desktop, so if you know a good Android VM, how many do you think you could run simultaneously on that machine before running out of CPU or RAM (I'm thinking RAM is probably the worse one, but it's also the cheaper one to fix). If you do know a good Android VM, I'd be interested to hear which one it is, because I've been relatively disappointed with the ones I've seen.

It's tax season, and scammers are a step ahead of filers, Microsoft says

Re: US Only

Both you and your first reply have the facts wrong. Just like everywhere else, typical wages have tax deducted when paid, not just at tax time. That's done because otherwise, it's very easy for someone to either spend more money than they should because they have to pay in taxes or to run away with their money and refuse to pay the taxes. The authorities there do exactly the same thing as they do elsewhere. This article demonstrates that. The reason why criminals have taken to finding information on taxpayers and completing their tax paperwork for them is that many people have overpaid their taxes and will be receiving refunds, and the criminals can, by doing the paperwork before the real people, divert that refund to them. Of course, if they aren't getting a refund, the information can just be sold to someone who wants it, so being in the set of people with income that doesn't have automatic taxation* is no defense against this.

* Normal wages have taxes paid before the person receives it. Depending on the status, other types of income either might not (investment income) or definitely don't (business income). Another set of people are reporting that income and paying more taxes on it.

London Clinic probes claim staffer tried to peek at Princess Kate's records

Re: Don't dignify the tabloids

"saying someone has photoshopped something was much easier than trying to explain a relatively new feature on Apple phones and bringing AI into the equation."

However, the metadata indicates that Photoshop, that specific product, was used to edit it and iPhones were not. This gives us two options:

1. It is what you say, but someone removed anything indicating that an iPhone was involved at all in the image taking process and substituted some mangled data pointing to a standalone camera and Photoshop just to mess with us.

2. It wasn't an iPhone, so it wasn't iPhone AI. Something else did it.

Which seems more likely to you?

Re: Don't dignify the tabloids

"The "doctored" photo in question was a matter of minor touch-ups"

I have long considered that my not being a UK citizen gives me the opportunity to gladly not know anything about the royal family, including at times who is related to whom. Still, I have heard more about this photo than I'd like to and you are understating the degree of editing involved. A post by a person who enjoys analyzing photos, not someone who tracks the royal family, notes many edits involving all the people depicted and many parts of them. This isn't a minor edit for some aesthetic purpose. What actually was intended is something I don't have to care about, but understating it as "minor touch-ups" is no better than overstating it as "definitely indicates that she died in February" or any other unproven nonsense someone might be trying.

Brits blissfully unbothered by snail-paced mobile network speeds

Re: Facebook isn't used as much by the younger genertation(s)

"basically, it seems a podcast is just a name for an audio file you can download and listen too offline"

Yes, you have it right. There's an RSS feed around it, so it is a feed of audio or video files that you can download and monitor for new ones. That's really all there is to it. And yes, Apple did start a lot of it so they got to get the "pod" in the name, but they don't make iPods anymore, it's a very open standard that doesn't give any power to Apple, and the one thing they still have (a popular but optional database making it easy to find podcasts) is open to everyone on all platforms, so can't we give them the name thing?

Whether you like that or not is up to you, but the concept is not complicated. Podcasts are just another way to listen, and there are quite good ones and a large number of crap ones, just like everything else on the internet.

Judge demands social media sites prove they didn't help radicalize mass shooter

Re: It’s the algorithms on trial [Hold Up Here, Chief]

Laws are written to enforce moral things. Maybe your philosophy is that they shouldn't, and I certainly can point to laws that enforce morals I don't share and would like to see change. If you're trying to pretend that laws are not written to make some forms of morality required with penalties if you don't act in the way they consider moral, you may have a weird idea of what makes a politician promote one or a voter demand one.

"Trying to claim that their product is defective, when it was operating as designed is like holding a car manufacturer responsible for a driver intentionally running down pedestrians."

You have made this argument before, but it does not represent what the case is about. The defect they're talking about is that the recommendation engines promoted violent material, and if you ask the companies that make the algorithms, they will tell you that they don't intend to recommend that stuff. They will say that because the alternative "yes, we definitely build our engine to recommend violent media when we think that'll make us money", sounds evil. The reality may be that they don't intentionally try to promote it and they may put a little effort into trying to detect it, but so little that it doesn't actually get removed from the recommendations list unless it's extreme and obvious. If this is behavior that the producer says they don't intend and behavior that the plaintiff says is harmful, then you can make a case that it's a defect. It's not a perfect one that's obviously going to win, but that's not the only legal problem these lawyers have.

The analogy to a car or a scalpel is wrong. When talking about the moral responsibility, they can be valid arguments to suggest certain views, but when arguing the legal one, they are not because they don't represent the argument being made. The scalpel example, in particular, is very far from the situation because using a scalpel as a screwdriver is ridiculously far from intended use, whereas using a car to move forward or a social media algorithm to see content is exactly what they were built for.

Re: IANAL

The question is not about common carrier. They are not common carriers, but they don't have to be. The protections of section 230 apply to "information service provider[s]". The distinction is that information service allows them to make the information public and show it to many people, including those who were not deliberately targeted. In order to prove this case, they'll have to do one of the following:

1. either prove or form a distinction between "information service provider" and something else,

2. demonstrate that the law itself contradicts some other law or right,

3. demonstrate that the platforms do not have to be deemed a publisher to have liability for this case.

I think they're kind of going for option 3, but I'm not their lawyer or a lawyer, so I can't say that for sure. They're already close to the already decided cases using 230 in a related way, so they'll have to have a new argument or they'll lose from that precedent.

Re: IANAL

Without 230 or something similar, there might be a lot less everything. If I could be sued for literally any comment someone chose to post, I might be a lot more cautious about letting people post anything that was slightly negative on one of my sites. If I write a post about a product existing and someone comments that the company's build quality, security practices, value for money, or anything else was bad, do I want to take the risk that the company concerned gets angry about that comment existing and try to threaten me into taking it down? We all know that some companies are that irritating and quick to use the threatening legal letter.

Yes, that would also significantly reduce the junk out there, including the really unpleasant junk. It is useful to know what the downsides are when considering it, however.

Re: IANAL

"where is TikTok?"

My best guess is that they're focusing on services this specific attacker used and he didn't use TikTok? It's a long list as it is, but maybe he did list all of those as places he found material that made him want to commit mass murder. That restriction is the only reason why TikTok couldn't fit into the list. Whether this suit will prove viable is a separate question.

How to run an LLM on your PC, not in the cloud, in less than 10 minutes

Re: curl -fsSL someurl | sh

My point is that, if you're building from source, you probably aren't reading the (quick check) 110 files containing 18002 lines of Go, not counting anything retrieved when running the build scripts, or the build scripts, or the frontend stuff written in TypeScript and some JavaScript. Then, you download a massive model which probably just has an input and output stream, but you can't be sure, and I have a feeling you're not building that from source because that is training and it's quite expensive. Treating the installation script as the dangerous part when there are tons of other parts where something dangerous could be is not very helpful. The script can be very straightforward, and it is, and that proves nothing about whether this could be malicious (yes) and whether it is (probably not, but how would I know).

Re: curl -fsSL someurl | sh

Not if that exe was basically running its own curl to get the real code. A lot of installers work that way, and although they're not my favorite, they think there is a reason because it lets people install the subset of components without, for example, including the translations and fonts for a bunch of languages the user doesn't want in the initial file. Malware can easily use a basic downloader which won't look dodgy until the specific sample has been reported, and it just downloads the more suspicious code and executes it from memory.

Installing this program on Linux (or anything else) will involve one of two things:

1. Downloading a binary from someone else's server and executing it.

2. Downloading a rather large chunk of code and compiling it.

And running it involves one more:

3. Downloading a model, either from their server or another one, and running it.

That's three methods to run malicious code if they are malicious. Saving the script and reading through it won't help you when this line from the real script

curl --fail --show-error --location --progress-bar -o $TEMP_DIR/ollama "https://ollama.com/download/ollama-linux-${ARCH}${VER_PARAM}"

Can download any binary. If they're doing something malicious, the malicious part would be in that file, not this script which I can read in a minute. If you don't trust them, you can try to build from source instead, but I somehow doubt you're reading every file to make sure you don't think anything in it is malicious.

Reddit gets a call from Nokia about patent infringement ahead of going public

Re: We don't have details of the dispute.

That won't work for long. They can try to hide it between themselves and Reddit, but if Reddit doesn't come to an agreement with them, they'll have to make it public in a court filing which specifically lists the violations they allege.

Re: 2 years may not be long enough

"if they "infringed" upon the patent before you started selling anything that uses it, too bad, it's considered two entities arriving at the same conclusion independently of one another."

That's a recipe for invalidating a patent by watching for it to be filed then quickly making something crappy that can be argued to use the patent. I don't object to the idea, but that detail is open to a lot of abuse if the patent is real, so it may need some more tuning.

When life gives you Lemon, sack him

Re: All seems pretty sensible from my echo chamber.

I don't know the person, but those questions, while hard, are the kind of thing you expect from an interview. If you have had problems, very public ones, getting advertising for your social media platform, and advertising is the primary revenue source for the thing which has been running at a loss for basically its entire life as a company and a big loss since you took over, that is likely to come up when someone is interviewing you. You should expect that it will come up, have a PR person come up with a nice answer that makes you sound confident and the business sound successful, and have it ready for that point in the interview. Having someone ask those questions when you control the situation means you have the power to respond exactly how you'd like. Clearly, he didn't plan for that and took offense at the questions, but they're not outlandish or offensive questions.

If you are hiring a reporter to interview you, expect to be asked questions. If you don't want that, hire the reporter and don't have them interview you, or hire someone who will ask you only questions you wrote. Musk didn't plan this out, but it would have been a perfectly workable way for him to learn what the questions would be and have good* answers for the lot.

* Well, not all of them would be good, but they would be the ones that sound best in his situation. For instance, his answer about drug use may not have been great in our opinion, but it was confident which is probably the best that one could hope for with that situation.