Posts by doublelayer

New tool gives CLIs a warm and GUI feeling instead

Re: Why an AI?

"it gets extremely tedious to be in a room full of angry people endlessly and repetitively shouting at each other about something they all agree on, don't you think?"

It does, which is why we've agreed to disagree before. But since you repeated yourself, I repeated my disagreement with you.

"What whose claims say? Answer: not the people who actually develop, design and build the hardware/software;"

That's what we disagree on. I do think those people are directly and actively responsible for the mis-selling. They are often the ones making the marketing claims themselves. When they employ sales staff to do it for them, they know what claims are being made and do not protest them as they stand to gain, and if they are asked directly, they back up the claims. Using your argument, it is completely impossible for anything to do anything other than what it was designed to do, which I consider a tautology and an incorrect one as the only information we have for what the design goals are are the claims of the designers, so whenever those claims and what the thing does disagree, it doesn't do what it was designed to.

Re: Why an AI?

We've discussed this before, but I think you'll find that most of us are not willing to separate the mis-selling from your pedantic and debatable "designed to do". A thing that's being sold is designed to do what they're claiming it does. If it doesn't do what the claims say, that's a design problem and they can't get away from that by pretending the marketers and the developers just didn't know what each other was thinking and doing, especially when it is clear that they absolutely did know and continue to follow the pattern.

Bug in top AI coding agents shows that Unix-era security headaches never really die

Re: If that works it seems like an ssh security flaw

How are you going to prevent it? Symlinks don't ask the destination file if it accepts the link. They don't even check if the destination exists. They just provide a string which the filesystem follows and a label allowing the caller to know that first.

In that example, yes, the ~ will expand to the attacker's username and that's the link that the git repo will contain. However, there are ways around that. There are several predictable absolute file paths you might want to mess with.

Another way you could manage this is to use backward paths by making repeated symlink calls going up several directories and adding a simple directory existence check, like this:

ln -s ../.ssh/authorized_keys config1.json

ln -s ../../.ssh/authorized_keys config2.json

...

As long as this is somewhere in the user's home directory, one of those will find it.

Microsoft intros tech that rebuilds dead PCs without requiring local copies of Windows

Re: Raspberry Pi and Raspberry OS have had this

You're mixing up a lot of things. PXE is not a Windows or Unix/Linux thing. The "P" should make that clear (it stands for "preboot"). Computers running Windows have had PXE for the same time because, if you ever used it on a Linux machine, it was the same PXE that would have been there had it been running Windows instead because neither OS brought it with them. This is not the same. This is a Windows-specific environment which is less resilient but more user-friendly than using PXE to retrieve an installation.

Re: Johnny come lately ?

Windows RE currently does boot from the Windows partition, not the UEFI partition. If the computer is so broken that the Windows partition is gone, then WinRE will not start by default unless someone, the manufacturer or the user, has put a separate WinRE partition on the disk. Admittedly, I have seen more of those on recent machines. Without either of those, you would have to netboot to it or bring a disk with it. This can reinstall Windows from a very broken Windows, but not from an intentionally removed one.

That makes it much less powerful for recovery than Mac OS recovery. However, I must correct you on the disk thing. It used to be true that Macs included that recovery environment on separate storage, and that made it available even when the disk had failed or been removed. That's no longer the case. Modern Macs not only have the recovery environment on the internal storage, they have other parts of firmware on it too. If that storage fails, the Mac is very dead until it is replaced by suitably imaged storage. Only Mac Minis theoretically can have that storage replaced, whereas everything else has soldered chips that Apple does not replace individually.

Re: you’ll need a Windows 11 machine that’s already running Windows Recovery Environment

You don't appear to know what WSL is and on what it is installed or what systemd has to do with this (hint: nothing). These and other errors suggest you are missing other important facts. Please check everything and try again.

MFA-optional banks leave safe doors (and accounts) wide open for thieves to pillage

Re: How the crims got into accounts :o

Now you're making my point as if it disagrees with me making the same one. A digital signature proves that the email came from where it says it came from. It doesn't prove that where it says it came from is a person you should trust. A digital signature mostly can't do that. And yet that was what you were certain we didn't have and needed, both of which were incorrect assumptions.

"The problem being that the nefarious types can't read your emails or sell your confidential information on to the business sector."

No, that's a different problem. Encryption helps with that problem, but if your emails are being sold, it's probably not interception of unencrypted data that's doing it. But the problem you originally complained about and that the article and all these comments is talking about is that criminals can phish people for bank details, and the ideal solution is either to make it impossible for them to phish (which is exceedingly unlikely) or to prevent them from being as successful even if their phishing messages work. I'm not convinced you understand the elements of the new problem you've switched to, but it's also not relevant to what you or anyone else was talking about earlier.

Re: Passkeys

"Now, if the banks can implement that sort of system for their own staff, why can they not implement it for us plebs who keep money in them?"

They can. But check the existing comments to see the reaction to much simpler methods of security and what some of us tech people, assuming every commenter in these forums is one, think of that. If people refuse to use simple MFA methods, how do you think they'd react to better but more complex ones? Extend that to most customers of a bank who are even less technical. If too many people prefer convenience to security, then convenience is what they'll get.

If you support forcing all customers to use the more secure method, I agree with you in principle but it's unpopular and they don't want to lose customers. That means the best we can hope for is that higher level of security as an optional feature, and some banks do offer that. If you want a challenge-response MFA token login system as separate hardware, you can get it, but you probably have to shop around until you find a bank you like which offers it. More do that via mobile app than do it with custom hardware.

Re: How the crims got into accounts :o

Surely, if those problems are as easy to solve as you claim, you could solve them for us? If you try, one problem you'll run into is that the things you've identified as the problem are not the problem. Digital signature on email? It almost certainly had that; it's called DKIM. It proves the email came from the server that it did come from, not that the server was trustworthy. E2E encryption isn't on email by default, though we could probably extend the CA process to make it easier, but once again, that would only prevent interception, not prove trustworthiness.

As for safely navigating the web, you're asking for the technical equivalent of the entire world not to have anything dangerous in it. It didn't work for the physical world, where hazards and crime continue to exist, and you can't manage it on the web perfectly, nor even do much of an imperfect job without lots of consequences.

We can do plenty to try to improve this. We can write filters to try to catch impersonation and warn users more actively, for example, though it will definitely alert incorrectly sometimes and users will still have to handle that. If you think it's possible for someone to make email perfectly safe and they're just not bothering, you don't understand the problem and won't be able to make those improvements that are possible until you do.

Re: Educate me please

Some of your questions have clear answers, whereas others depend on the procedures at the organization. Taking them in order:

"A passkey is tied to a physical device.": It doesn't have to be. Passkeys are portable and you can export them. You have to remember to do it and this only helps against device failure, not theft, but you can copy passkeys for that situation. Ideally, the service allows you to create multiple ones when you set up so you can have individual ones and revoke any, but there is no guarantee whether they will allow that or only let you have one.

"Isn’t that [replacing a passkey] just “forgot your password?” in another form? [...] If I’ve been socially engineered to give away my first pet’s name etc, is there basically no more protection?": This depends on their procedures, but it is indeed a weak point. They could require you to show up in person with identification to do it, which would make it more secure but significantly less convenient.

"If my device is stolen, how do I revoke that device’s passkey quickly?": The ideal way is to have a second passkey on that account but not on the same device, log in with that, and revoke the previous one. I have some passkeys stored in a secure location for that reason. Unfortunately, that's more thinking ahead which makes passkeys more difficult for others to use. If you only have one, then you probably have to contact the organization and ask them to revoke.

"If the device is snatched from my hand whilst unlocked, is there ever a situation where the passkey can be accessed without further secret knowledge?": This depends how you store them. Those passkeys I can access from my phone require me to reauthenticate to open the app, so someone who steals my phone when unlocked but doesn't know the unlock code (in my case, a different one, though the normal unlock code is more often the requirement) won't be able to get at them. That's the default on some applications, and on others you can use OS features to make it happen anyway.

Re: Educate me please

I think they were talking about passkeys as suggested by the article, user-generated cryptographic tokens.

Re: Passkey issue

A passkey isn't just another password because the private part doesn't have to be known by the external service, only by you. You've probably used SSH keys before, no? It's like that.

Some risks are the same. If someone can copy the key content off your computer, then they've got it too. Other risks are not, if they make a fake page and convince you it's real, the passkey won't work on their page and wouldn't provide a replayable mechanism anyway. They have many problems, but not the one you're suggesting they do.

Software engineers can still rake in big bucks by working for fast-growing companies

Re: Thumb

I'm not sure I got all of this argument, but the main part is a common misconception that has led and will likely continue to lead people to dissatisfaction but is never going to change. The theory holds that, if you are generating something valuable which would not have existed if you didn't do what you did, that you are worth as much as the value you generated. This is incorrect and has two harmful effects.

It is incorrect for two reasons. Had you not done what you did, it's possible someone else would have. This is especially true in a company situation, where someone else decided to hire for a role and set the responsibilities. That is obvious when we consider how much a company can fail even when they have competent employees by assigning them the wrong jobs. Though it's unpleasant, if many others could have done what you did, then you are replaceable and most of the value accrues to whatever was not. The other part is that it's easy to overestimate how much of a job is done singlehanded. Everyone involved thinks they did basically everything, but they're mostly wrong. Joel Spolsky named this the development abstraction layer, but it's far from unique to programming.

This attitude causes two problems. The first is devaluing people when what they do doesn't have an obvious numeric value. What's the value in currency of making sure the printer isn't broken? The other is unbalanced responsibilities. If you think you deserve lots when the thing you worked on was a commercial success, then what do you deserve if it's a commercial failure and the company loses money? Should they retrieve the money they paid to you since you didn't create value? Clearly, they should not; they agreed to pay you for a job and you did it, and whether the lack of value was due to their mismanagement or your failure, it is their problem. But risks and rewards are correlated for a reason, and if you aren't accepting that risk, you also agree that if they make more out of what you built, you were also paid to do a job and you did it.

AMD’s Ryzen AI Halo makes local AI look easy, but at $4K, easy doesn't come cheap

Re: Is it worth it?

OK, how about you collect some prices and compare them here?

I'm guessing it wasn't compared because those are quite variable and depend on usage information they can't estimate, so they'd have to compare a single price for this hardware, or set of a few for different RAM configurations, against a large table of possible costs of hosting depending on provider, model, use case, and use frequency.

Insert token to continue, says AI. Yeah, about that...

Re: "Elon Musk is a big Adams fan."

A lot of tech people are fans of sci-fi, including most of the famous ones. In my experience, many of them also don't understand what they read. Metaphors, context, world building, and other important ways to understand why some plot or setting point happened seem to fly over their heads. Examples of this are all over the place:

* AI promoters describing how AI might take over jump straight to AI control theories seemingly lifted straight from Ellison and Asimov, not considering that their AI works in a completely different way and that they were often using it as a metaphor for human sociology.

* More extremely, a worry that AI might control nuclear weapons or something similarly destructive and decide to kill people with them, seemingly not considering that the science fiction pioneers in the 1950s and 1960s might be thinking a lot about what humans would do with those but that there are many other things a theoretically independent AGI might want to do instead.

* People obsessed with leaving Earth to colonize other planets whose colonies look suspiciously like those envisioned by Bradbury or Clark, not considering that those were mostly made up because nobody knew what it would be like to try to live on Mars and that they often explained how much damage humans were causing by doing it that way.

* People intent on finding aliens whose imagination of what they'd do is remarkably like those from Le Guin's works, not considering that she had a lot of political and philosophical points she was using those to make.

* "Futurists" who, when they decide to imagine the future, grab concepts from every science fiction author that already did that as scenery and pick their favorites, not considering that the people using nanotech surgery machines, fusion power, or immersive virtual reality were either doing that to investigate the consequences of the tech or had it as background whereas the futurist's job is to consider whether it's actually practical or likely to be when they're predicting it, not just if they think it would be cool.

I'm not surprised that Musk considers himself a Hitchhikers fan. It doesn't mean he knows why any of what he likes was written there.

NASA says it will isolate volunteers from the outside world for a year

That depends where the hypothetical settlement or mission is going. On or near the moon, you can probably manage it, but on Mars, radio has a minimum of three minutes latency (one-way) and requires more than a normal transmitter. That's in the ideal case. When Mars and Earth are farther apart with the sun in the middle, latency stretches to over twenty minutes and the sun often gets in the way. Anyone going further than the moon should expect substantial delays and drop-outs, and even those on the moon should expect it to not be perfect.

Re: The psychology of isolation

They probably don't want to put it anywhere dangerous or expensive, but how about the arctic, probably somewhere in Alaska, in a place where help can easily get to them but they couldn't easily get anywhere. It would accentuate the isolation without involving much risk.

If it's just to satisfy my curiosity, I suggest they have two groups, one in that arctic or other remote location, and one back in Houston, to measure how big a difference the knowledge that they're not really isolated causes. The rest of the experiment should and probably already is designed to ensure they are isolated outside of emergencies in all physical cases*, and I'm curious if the psychological factor is as big as this thread supposes.

* Whether they're denied any communication or whether that communication is restricted and delayed, I assume they aren't being given a normal internet connection. Previous experiments managed that, so I doubt this one will go backward on realism. Most of the factors called out in the linked article would apply as much to people required to stay in isolation whether or not there are people outside the walls.

Amazon’s Mechanical Turk to stop accepting new customers – and not even AI can save it

I guess it depends on your definition of remote. If it was controlled by pulling lines from another room, would that count as remote or does remote only include wireless connection?

If the line example does count, then there's argument that the article got it right after all, just not very remote physically. The operator did not hide within the statue, seeing the chess board with their eyes and moving pieces with their hands directly. They hid below the statue, got events from the chess board through a copying mechanism, and moved the hand by moving internal levers on a different board. All that would be required to make that count as remote is to make those things longer so they could do that from another room instead of from inside the box, but though they certainly could have done it, that wouldn't have been as good an illusion.

AI search could kill the web without new quality signals and revenue models

Re: Fixed that for you

This probably depends on your definition of commercial, but there's plenty of noncommercial web that this will hurt as well. Here are several examples, from obviously noncommercial to debatable:

1. Site with information faces increased costs from constant and disguised AI scraping, admin who gets no money from this decides they can't constantly manage this and should shut the site down as they can't maintain the servers under that load while continuing not to monetize in any way.

2. Site that doesn't monetize in any way but does rely on user contributions (of information) to stay updated faces increased burden from scraping while simultaneously not getting that user flow. To stay relevant, the maintainer must collect more information themselves, which may be too much work for them to justify.

3. A site which has a donation button to help with upkeep but nobody presses it if they don't go there.

Even if you've decided that someone trying to make money from a website, and let's be clear that the websites mostly being covered here are open access (or the scrapers would need to bypass a paywall) are for some reason beneath you, there are plenty of sites which don't do that at all.

Re: It will kill content creators, not the web

Both your comments are literally true, but since you knew the original point wasn't making the literal claim, neither argues against it. The web as a technology won't end. How could it anyway? But they weren't talking about that. They were talking about the variety and openness of resources that has been and still mostly is available on it. Similarly, websites don't disappear if search engines won't link to them, but in practice the effect on those operating them can be quite similar depending on what they do. Nobody argued the other side of either of these things, so your responses appear to acknowledge all the points others were making and attach a pedantic correct but unneeded point which you rank most highly.

Oracle outlines all the ways it could lose the farm it bet on AI

Re: Oh, Yeah ... Oracle

A place I volunteered with did consider using their cloud, just for IaaS, a couple years back. They had something bandwidth heavy, Oracle Cloud's bandwidth pricing was much better than their competitors, and the charity doesn't have their own servers or a good place to install them. They probably would have gone with Oracle except for the fact that, when we created an account to test things, it wasn't approved for weeks, when we contacted Oracle to fix that, they assigned us an account manager, evidently assuming we were much larger than we were, still took a week to approve the account, and then we ran into more obstruction creating a low-cost VM. As the unofficial admin of everything, I was a little worried that every management action I was going to do from then on was not going to work until I contacted the account manager whose helpfulness was probably going to decline the first time they realized I was calling myself "volunteer at charity that's mostly other volunteers" and not "CIO of massive enterprise". Hopefully, they've done something about that.

Godot says bye bye AI, bans vibe-coded contributions

Re: Why would people even do this?

Delusion, usually. They want a feature, but the programmer friend they know* wasn't willing to write it for them, they didn't know how to write it themselves, but all it costs is a $20 monthly subscription that can do everything your friend can do, and you probably only need it in months where ideas come up. That's a small price for all the features you want added to any open source software, right?

* Personal anecdote, someone I sort of know contacted me having decided they wanted a piece of software. They told an LLM to write it, which the LLM did, but they needed someone who could compile the generated C++, giving you an idea of their level of competence in the area. I foolishly agreed to run the compiler for them, which produced the following results for each of the versions they provided:

1. Compiler error, but I took pity and fixed it, resulting CLI program didn't work.

2. No compiler error, CLI program crashed immediately.

3. No compiler error, program now mutated into a GUI did launch but didn't do anything.

4. Compiler error, I wouldn't fix it and just sent them the error messages.

It was about this time that they decided the LLM coding wasn't great. It was also about this time they decided to get irritating and treat me like an LLM, because they then asked me to write the code myself. It is not the first time I've been asked to write software for people as a favor, but it was one of the ones I refused most quickly. Some people do not understand what programming, or probably most things, involves and that will just cause chaos if they get involved.

Boffins peg narcissistic leadership as the real driver behind 'return to office' demands

Re: As a non boffin (here under threat of expulsion if I say something stupid)....

Most of the arguments I've seen for work location quality have been mostly or entirely without evidence and take the form of deciding what their preferred work location is then stating that it is better and there's no questioning it. When managers do this, they generally have more power to force people to follow them, but I've seen plenty of that from the remote work supporters as well. Unfortunately, most of the attempts to study productivity have a hard time measuring it, not a surprise if jobs like ours are included where it's almost impossible to decide whether I, writing code, am more or less productive than you, writing code for a completely different kind of thing in a different environment.

Anecdotally, I think there are advantages to being in an office, and people who don't consciously act to facilitate them can easily destroy them and make the office much worse than working remotely. Some of the simple ways that this has been done is to put people in an office where the people they work with are in a different one, thus obtaining the same separation as remote working with the downsides of a different working environment. Another one is designing the office to make things needed for productivity difficult, for instance having no control of noise and not having enough space or equipment. If they're not going to have an office properly, I think it's better not to have one at all, and I expect many who prefer remote work all the time are comparing it to that kind of environment.

Re: @author > error?

I think Ken's suggestion is more likely, because most of the companies are not just not delivering, they can't. Google doesn't have startup-style workers because they don't provide startup-style rewards because they're not a startup. Most of those who join startups do so because they're willing to take a lot more work in return for a chance at a high reward from the success of that startup. If the startup goes from a tiny company nobody's heard of to a household name, and I own 0.5% of it, that will suddenly become very lucrative. Google is not going to have that kind of stock movement no matter how successful the product I've been assigned to is, so that kind of reward will never show up.

Can't is not exactly correct. Google could simulate that if they thought it was important enough. They could, for example, announce that, if the new AI product got X million weekly active users by Y date, the workers would get bonuses of Z thousand shares of Google. However, they won't do that because this is generally a bad idea, being potentially very expensive whether or not the product had commercial success. Working like the stereotypical startup is stressful, can only be done for so long, and only works on projects with specific features. It causes enough problems for workers and companies when they have those things. It only works when managers, sales, etc are doing it as well; startup-style engineering and big company-style everything else will not work. When someone tries that without the reasons people accept the pain, it works even less well.

Where there's a will, AI still has work to do

Re: How hard did they try?

You're doing the same thing you're accusing them of doing, asking the LLM to give you a bunch of questions and counting it as a success because it managed that. Since it only matters if it can take those answers and make a legally valid document afterward, you too have not tried hard enough to know whether it can. While neither of you tried all the things you would need to, the lawyers got far closer than you did. They got a will out of it and analyzed it for validity and content. Theirs is also the test that has some meaning to actual users, since, unless the person who wants a will knows to prompt engineer their way to the right answer, they'll get what the LLM gave the lawyers here.

You're mistating how lawyers work. They don't work like LLMs, where they take the request and generate a document. They work like humans, where they clarify the request, fill in blanks, and then write the document. This is an important difference in many areas, where you have to do a lot of prompting to get LLMs to simulate the planning procedure required to write a document and hope that they can keep track of all those things when writing. Lawyers, programmers, and most other professions which work in this way are so used to having to clarify and add details that they can and often do find all the information purely by asking questions and tracking the answers. LLMs don't by default, and showing that you can get them to do one part doesn't matter unless they can do all the parts.

Re: Do you really need one?

Wills always struck me as similar to software which people should buy off the shelf but still try to reimplement each time. For very complex situations, leaving controlling interest in a business to one child, partial but smaller ownership to another one, cash but no business to a third, contingent on some actions of the children, I can see why you'd need a custom-written one. For most of the circumstances people seem to want to use, it would seem that it should be possible to build one out of simple predefined clauses without an expensive lawyer needed to write the part where you add a non-relative and allocate them something.

Microsoft builds a bouncer to keep bots out of Teams meetings

Re: Explain like I'm five :o

Integrations. By default, they can't, but you can automatically invite bots to things quite easily if you change the right settings, and the bot is probably charged per use and has no reason not to join. Most of those integrations also have ways to indicate that this meeting is private so the bot won't be informed that it exists and not able to join without approval even if it did, but you have to know that exists, how to use it, why to use it, and then do so. Not everybody does.

Re: transcription bots

I can imagine a few reasons:

1. You're having a meeting with some people, and you'll note or remember the important things, but your manager who wasn't in the meeting wants to be able to check the full details.

2. You're having a meeting, and you will try to write everything down, but there's going to be a lot of tiny details and you want to be able to get them all exactly as delivered without spending most of the meeting producing a near-transcript by hand.

3. You have a legal requirement to preserve something, hence a recording, and the transcript makes it easier, if it's at least mostly accurate, to find things that recording contains.

4. There is a person with some or total hearing difficulties who can read transcripts but will have trouble without them.

5. You're having a meeting where you'll need to nail down a bunch of small details which there could be later disagreement about, so just in case there's disagreement later, it could be useful to document what you did decide and why.

6. You're talking to someone who you don't trust to remember or acknowledge what happened and you want external evidence to avoid getting into arguments about whether you agreed to something or not.

Re: Teams Architecture...

Citation needed. $employer, for instance, uses Google Meet, and they have had at least one bot which decided to join more meetings than we wanted it in. Fortunately, it didn't cause a problem because the bot needed manual admittance whenever it was wanted so we didn't push that button, but it still tried. I'm not sure the platform in either case is responsible for what meetings the bot's been informed about (it can't join if it doesn't know the meeting is scheduled) and which of those it decides to join.

Mageia 10 keeps the 32-bit Linux flame alive

Re: old fashioned

I'm afraid I can't remember what thing was doing this out of the box. I'm almost certain this was during the period where I had started using Linux but hadn't yet learned the distro lessons so was still trying new ones frequently. There were many little differences like that, some of them even good ideas, but of course most of the distros probably don't exist anymore.

Re: old fashioned

I've seen that from time to time, including before systemd. The first time I saw it, reboot and shutdown were defined as suids and would check if you were in a group, then restart for you. It matches the rest of the environment because you wouldn't be prompted for your password to hit the shut down button on the GUI, so they make the terminal match it. I don't have a strong opinion in favor of either method. To fix this the way you suggest, I suggest just adding

alias reboot='sudo shutdown -r 1'

to your shell, which will make you enter a password anyway and will automatically put a one-minute cancelable timer on it.

I don't think they have any need to stick with an older 6.12 kernel since 486 support was only very recently dropped. It would take a very long time for I686 to be dropped and all the machines you've named support that, so they can easily go to a newer LTS kernel and still expect to support 32-bit machines.

It's looking like a hot, messy summer for security teams as AI finds countless previously hidden vulns

Re: Patterns in the Noise

"the general consensus *seems* to be that they have become extremely good working with e.g. software, scripting languages and technology [product] configurations"

No, that's your consensus. You've said that in many ways on a lot of topics recently, but as many times as you say they're great at something, it doesn't make them any greater or remove the situations where they're wrong. Talk to other people and you'll find that consensus isn't as general as you think.

While the context would provide a bit of data, one of your questions makes it clear you don't understand how these things work in practice: "Did you get any response when you raised that as an issue with the authors?". What happened was they couldn't raise that as an issue with the authors. The authors were one of a few model makers who do not ask for or accept reports of buggy LLM output from any random person online, partly because there's so many people using it somehow and partly because LLM output does all sorts of weird things for any number of hard-to-debug reasons. Small changes in prompts can radically change whether the LLM's answer is correct or not or whether its answer looks like it answers the question or goes off on a strange tangent and doesn't come back.

Maybe they got non-working JS-style C++ because there was some JavaScript code that interacted. Or because the StackOverflow post it was getting some training data from was related to a similar one containing JS examples, or any number of other random things. The LLM authors couldn't really debug or fix that, and the user definitely couldn't. The only thing is to try a different prompt or a different model and hope something different happens the next time, which it probably will though no promises whether that new thing is useful or not.

Re: Why not make software like every other product?

Those liability-limiting provisions are probably not as legally binding as they look, but there are still problems trying to do that which are more directly applicable to the comparison to other products. Software, especially complex software, has so many functions and methods of it not going right that it's difficult to define what it's supposed to be fit for and how you're supposed to use it, and both of those things will come up in any complaint, whether or not the contract is allowed to limit liability or whether it means anything if it says that. There are cases demonstrating that serious gaps in functionality or security do result in liability regardless of contracts and that companies do have it held against them, but it's all the smaller cases that don't work as well.

Let's compare Windows to a shovel. A weird case, but I think it will make a couple points. Windows has limitations on what it can do, and there are use cases where it will fail. The same applies to the shovel; if you bought a normal kind which was built to deal with leaves or snow, but tried to move wet cement with it, the shovel would probably fail and you would be unlikely to successfully claim the shovel was unfit, even if they didn't warn about that. How does Windows successfully explain what it is fit for when it is a very generic piece of software which can do thousands of things and can't do thousands of other things?

There's also the problem of operating procedure. If I use the shovel as a hammer and it breaks something I hit with it, the manufacturer will get out of the complaint by saying that was not how it was supposed to be used. If you made liability stricter on software, that's also what Microsoft would say with Windows, but they have far more ways to claim that it wasn't their software going wrong, it was you using it wrong. Since there are hundreds of interacting components in Windows, there are far more ways for them to claim that, whether because you actually used it wrong (and many complaints I've seen are exactly that) or Microsoft wanting you to lose even though they were at fault. It's not simple, which is why problems generally have to be large to be guaranteed of victory.

Re: Here's a stupid question

Probably not for a few reasons of capacity and practice. Let's start with the more boring but bigger practice ones. The theory is we hire all these people then tell them to improve things, they look for security problems, find them, and fix them. In practice, what most developers are hired to do is to add features. Please be secure while you do that, please maintain while you do that, if you spot anything during your work toss it on the task board to work on, but still, more software is one of the major things they consider. It's only a short trip from that to deprioritizing the maintenance tasks on the board because we've got an important thing to get done, we can pay down the tech debt after that. Salaries could prevent situations where something a business is relying heavily on is about to get dropped by its solo volunteer maintainer, but the maintainer probably wouldn't have had the chance to work on any maintenance task they thought best if they were being paid.

But leaving practice, what if that's how it went? Perhaps instead of salaries, we called it sponsorship? The maintainer gets paid to maintain and decides on their own how to do that. This probably still wouldn't fix the problem unless that maintainer was focused on finding and squashing any vulnerability they could. This is rarely people's top priority, and it takes more than just having some more time. You have to know what's real and you have to sift through lots of reports from a variety of tools to find the problems. LLMs both help and hurt with this process since they can eliminate some obviously invalid reports but will also generate more detailed incorrect noise for you to search through. This is rarely people's favorite type of maintenance, which is why it's often easier to get a known vulnerability fixed than a new one proactively discovered. You would likely only get what you described if there was a concerted effort to find people who would do it and pay them to do it, and I think you'd find that you need quite a lot of gazillions to do that.

Re: infinite bugs

It probably has a finite number of bugs, but as you fix the old ones, you can make new ones, so the number of possibilities is almost unlimited. That's more true if the solution to people not having the time to fix all of these becomes to have the LLM fix the bugs. I'm not sure I get your point; a finite but large number of bugs that a lot of people need to fix and patch right now when there aren't many fixers and patchers doing it is still a problem.

Re: Patterns in the Noise

Some of what you want is not what you'd get.

Bugs by language wouldn't tell you that one programming language is just bad and you need to stop using it. It's not that simple, both because the LLM will be crap at finding bugs in languages it has little information for and because vulns-per-LOC is not a great metric. Some languages use fewer lines to express the same thing, and some vulns will be pointed out on multiple lines.

The logic of the code is a bit more promising, but you mostly already know that. If the problem's at user input sanitization or validation, it is in user-facing code, but if there's a useful lesson about where that's more likely, you'd have to subdivide that into much more tenuous categories which would get into pointless definitional questions rather quickly.

The general approach is a good one, but it's just as annoying and painstaking as it always is on far more findings. Analyzing each found vulnerability to try to learn why people didn't find it from the start is great, but people often decide to stop doing it the eighth time the answer is "XSS vulnerability slipped through because the creator wasn't thinking about XSS at all and the reviewer thought the output thing was doing autoescaping but it wasn't" or "buffer overflow because there's twelve functions that directly manipulate this memory and one of them reset one of the values incorrectly and the other one assumed it was correct and used it". You have to be willing to keep doing the same thing until you get results that tell you something, then apply those results. A lot of people do this some of the time, and I often help them do it, but I wouldn't expect it to become much more common.

And that is the core of why the "can't fix it themselves" comment was used. It's not literally true, it is possible for someone other than the author to fix it, but when they say it, they usually mean they don't have the experience needed to do it, they don't have the bandwidth to do it to everything they found, they don't have the history to quickly upstream the fix to the project so it would need to be retrofitted into every subsequent version until they got that (which takes more dev time to try to manage), and sometimes also that they don't have the programming skill required to modify the library, only that needed to use it. Whether you consider these arguments valid will probably depend on what they're using, how heavily, and what resources they have, because most of them probably can fix some things that they're choosing not to. But, in the same way, you could pick up some programming guides, learn what's changed, and get to work too, but you probably have some reasons why you don't think that's the best option.

Re: Hidden in plain sight

There are existing standards, some mandatory, out there. The EU's CRA requirements are pretty good for what they cover. The problem is that they tell you what good things you must do, not what stupid things not to do. It's really tricky to legislate the latter, since there are a very large number of possible stupid things, most people would never think of doing most of them so going through the list is pointless, and the people who do them wouldn't understand or care about the list.

The suggestion to subject everything to testing is possible and does match good practice in other areas. However, thorough security testing tends to be expensive in itself and more so when all the fixes have to be implemented and the testing repeated to check anything that got in during the fixing. I've seen security scanners whose main purpose appears to be running just enough scans that you can claim to have tested without risking finding anything too costly to fix. I have a theory that these include a bunch of people who don't know about security rather than having planned that, but either way the outcome is the same. Therefore, anyone building a product gets to choose between proper, but lengthy and costly security testing, or quick but bad security testing, but if their competitors choose the bad version, the competitors get to launch first. I'm afraid that will lead companies to also do bad testing and tell themselves they'll fix it later.

Australia investigating five social media giants for not enforcing ban on kids

Re: Social Media

Good methods might not really exist. We should consider some options, but I think one of the most important things we must admit first is that, if we fail to find good methods, that still doesn't make bad methods good. Even if we can't make social media stop various things we'd like them to stop, we still have reasons not to put an ID check in front of any site some politician wants to control or make it possible for anyone to sue a website to remove any user post they dislike.

The things I most want social media to stop actually are things we have ways to prohibit. Privacy abuses can be detected and they can be punished. The GDPR is an excellent start for a law that would do that, but we'd need to extend it either so that the data protection authorities aren't just for cosmetic reasons or that individuals can bring legal action when regulators have made it clear they're unwilling to enforce the law.

The problem of unhinged content is trickier, but one method I think would be easier than strict liability for anything they leave up is more limited liability about what they promote. Failed to spot a weird post proposing murder, unfortunate. Spotted that post and chose to show it to thousands of people who had no previous connection to it even though 2.3% of them reported it? That was a publishing decision and it can be used against them more easily.

Perseverance rover finds even more signs of extinct life on Mars

Re: The question is not so much was (is) there life on Mars.

It seems to me that you can't ask your question until you've answered the question in the title, since if there is and was not life on Mars, then you have no information about how unusual life on Earth is.

Re: Not sure need more

Quite likely. Sadly, if you want to know whether there was life on Mars, that's the only way to get the correct answer. We can easily skip that process if we decide we don't care, or as some like to do, we can just assume whichever answer we prefer is correct and declare it proven.

If we do either of those, we then need to move to the next question about what we do with Mars, leading to even more situations where someone wants to jump to their preferred option (usually "fly there, land a bunch of people there, build a city which I rule as king, everyone survives because that's how it went in my favorite sci-fi books". Of course, any attempt that wouldn't result in almost immediate and painful death would need a lot of repeated testing and planning too.

Re: What would happen if ...

They could try setting that up as a joint project. I think they'd prefer collecting their own samples to starting an argument over taking NASA's samples without permission, but taking NASA's samples with permission might be easier. However, they have a bunch of other things they plan to launch at the same time, and if they want to run those missions anywhere except where Perseverance already is, it would be much harder to manage that because it would require two landings and returns.

Re: It is almost certain that life once existed on Mars

"so the tomatoes got heavy watered. Which then got me thinking about cheating on yields, or plant growing competitions.)"

How would that work? Too much heavy water and the tomatoes won't like it either. What's the goal? If you want to make tomatoes heavier, then you probably need the tomatoes to grow in the first place, and if you're going to cheat, there are probably easier ways to sneakily increase weight without going to radioactive things that aren't that much heavier in practice. If the goal was to kill someone else's tomatoes, there are easier ways to do that too.

"where there's water, there's often life. Or possibly organic building blocks that might be life-adjacent"

That is very wrong. Where there's water, there's water. So far, it's unlikely there's life if there's no water, but a very simple compound doesn't say anything about whether much more complex ones are there.

Microsoft extends extended updates for Windows 10 in the most muted way imaginable

Probably. This adds to my already not very complimentary view of the unvetted refurbisher. Unfortunately, most machines I've seen sold as refurbished don't seem to have had much done to improve them from whatever state they were already in. I see "used" as meaning that I'd better investigate everything carefully and "refurbished" as basically the same except I should expect someone might be intentionally trying to hide the problems. I only relax that policy if I know the organization selling the machine and have reason to trust them, and I don't buy used machines often enough to have much of a trust database on that.

No, that's not what most people here are asking for. You can build an OS efficiently without all the backwards compatibility stuff. It will use less resources. It won't run on old hardware, because that's the backwards you removed compatibility for. Since people want to run it on their old equipment, that's not what they want.

As it is, the RAM requirements for Windows 11 is not the problem people have with it. The official requirement is 4 GB, and that's giving them space to run applications because if they said 2 GB, some manufacturer would build a computer with 2 GB in it which would run Windows perfectly well but wouldn't run Windows plus programs the buyers wanted to use well at all. Most machines being discussed have at least 4 GB, so capacity is not the primary problem. While some will complain about that requirement and a few will have an actual reason, the bigger problems are mandating certain hardware such as TPM 2.0 hardware and processors from a specific list which excludes hardware, no matter fast, if it's older than about 2017.

If you want to remove things which use up resources at the cost of losing that functionality and having to do something else to replace what's missing, you have alternative operating systems which will do it. People who want Windows want it because they need something in it, and cutting out compatibility is not going to help them.

Even the Secret Service won't use company-issued phones

Re: Apple, Tree...

That's an interesting interpretation of my post and a couple assumptions you're using. I admit that I do not monitor Trump's social media posts, so I cannot say how fluent they tend to be. However, I do remember a few times when they were covered in media, examples which frequently included typos, sometimes severe ones. Another thing I remember being a problem on occasion was multi-part tweets coming very slowly, perhaps because someone was not very fast at typing accurately? It is confirmed that some of those social media posts are written by other people as one thing I do know from experience is that, whether or not your defense of his typing capability is correct, one thing he often isn't capable of is writing a sentence that consistently stays on a topic or acknowledges facts he can't be bothered with.

Irrespective of whether my or your assumptions is accurate, it appears to be you who is making excuses to defend your supposition. Whether or not Trump is one of them, you are surely aware of people who refuse to type for the reasons I said. The examples appear with regularity on this paper, more often if anecdotes from comments are included (the boss whose PA is tasked with printing out all the emails, then typing all the replies, is a perennial tale). If you interpret any suggestion that there's a possibility other than what you said as a defense, you will leap to incorrect conclusions far more often than you likely want to and end up using weird arguments to turn possibility into certainty even though you weren't certain when you began.

Re: Apple, Tree...

There's another plausible explanation for Trump to prefer phone calls: he's 80. He's far from the only person I know who dislikes written communication, biased towards older people and those who were higher in companies at the time. I think part of the reason is that it's now common to be taught to type, but in his day, it was less common and mostly taught to administrative staff who would take dictation. If you can't communicate by text quickly or accurately because you spent the first 40-50 years of your life either writing longhand or speaking, it is logical to prefer talking. If you do prefer that and you run the place, you can usually make people go along with your preference. That doesn't mean this is the reason, but it probably is one of the options.

Re: Porn. The answer is always porn.

You're assuming the sites on the list were put there for a reason. That is not always the case with filter lists. For example, at $employer, we use Google services, GSuite for documents, Chrome as the browser, unsurprisingly, Google as the search engine. A couple years ago, I got a reminder that Google search has really gotten worse. When I started using DuckDuckGo over a decade ago, it was worse than Google but I put up with that for the privacy benefits and continued to use it from then on, so I hadn't seen the changes very much until I found myself repeatedly failing to find things that shouldn't be difficult on work searches. So when I needed information and couldn't get Google to cough it up, I decided to go to DuckDuckGo for that search, and found that it had been blocked by my employer for reasons unexplained.

I don't know what happened to put that on the block list. It wasn't all search engines other than Google, just that one. I didn't raise it as a problem, but it did disappear from the blocked list almost a year later, equally unexplained. Sometimes, lists are not created with good reasoning or contain weird errors.