Posts by doublelayer

Linux kernel to drop 486 and early 586 support

Re: Hubble Telescope.......

True, but they implied that the presence of that chip inside the telescope was relevant, which it isn't because it doesn't run Linux, and it wouldn't be even if it did run Linux unless they were pushing kernel updates which, for something that's really hard to fix if it ever didn't like a kernel update, they wouldn't be doing. Nor is it relevant for any machine with one of these CPUs unless the users of that machine have actually been updating the kernel version. There are indeed a lot of old machines with these processors in them. Almost all of the ones I've seen are running old software on the old hardware. Linux 6.12's the last LTS version with support? Some of these things are still running 2.6 kernels and the more updated ones are running 4.x ones. If you're running a 486 with a 6.x kernel, I challenge you to explain why, and only then will I start to worry about dropping support for it. If people haven't updated before when they could have, then I won't be bothered about cutting off the stream of updates they didn't use anyway.

Curl project founder snaps over deluge of time-sucking AI slop bug reports

Re: Sorry to nitpick, but...

AI filters for AI text have been tried for a long time and the answer is usually no. You can make a model that takes a guess, and in many cases, that guess will be reliable, but that's all it will ever be. If people realize you're doing it, they can easily make the guess less correct. For example, comparing real bug reports to AI-generated ones, there's often a significant stylistic difference between the two* so I can assume which are which, but if I am a spammer after a bounty, I can customize my prompt to make the AI write its text less professionally and more laconically, and then it will look more like the human-written ones.

* People write bounties in a lot of forms, but they are often writing more informally, meaning more acronyms, a little less jargon, and slightly worse grammar, than the ones LLMs often produce. They are also written more formally, including the reverse of all three of those differences, than human-written ones that turn out to be crap. I can often guess based on the style how likely one is to be useful, but I have to read and test it anyway because the well-written one could be from someone who just likes to speak formally when they're sending a message to someone they don't know and the one with worse grammar might be someone who isn't a proficient speaker of the language they're writing the report in. All you could do with an AI is try to sort them so the useful ones are higher in the stack.

Commodore OS 3 is the loudest Linux yet

Re: Sell a usb stick?

Why would you pay for that? I think the optical media by mail service was mostly for people who didn't have a network connection fast enough to download those quickly, but most users can now download a normal distribution overnight or this monster in a couple days, and many can shorten that to a normal one in half an hour and this in four. Most users who would have trouble creating the USB disk themselves would also have trouble using Linux or knowing it existed. What would the convenience element be here compared to just downloading and writing it to a disk you already have?

Redis 'returns' to open source with AGPL license

Re: "People moan because it wasn't the open source license they like"

The problem is that, to know whether something is open source, we need a clear definition of what that means. The OSI is not the only place that has a definition, nor do they really get a monopoly on the term. However, I tend not to accept someone else's idea of what it means unless they can provide their own unambiguous definition and apply it consistently. Often, when someone does that, I don't find their alternate definition as convincing or persuasive as the OSI's, which I mostly agree with. This is not for any reverence for the OSI itself. I never check whether the OSI has stamped their seal of approval on a license, and I disagree with them on a lot of things, notably their AI licensing thing which I think is completely wrong. The definition they're using, however, is pretty good.

Most of the faux-open licenses use vagueness to imply that it's basically the same and rely on "it doesn't affect you" to distract from problems. I have a problem with both of those things. A lot of them have their category of people who get extra restrictions if they use the software, a category based on vague conditions like "commercial use", or, in the case of the SSPL, "as part of a service". The licenses do this because the authors want to apply it to certain people, often cloud services. However, it's easy to argue that everything is part of a service unless it's running offline and only used by me personally and everything is commercial use if there's any possibility of money being involved, for example if there's a donation button on the site, even if nobody's ever clicked it. Even if it's only against AWS and Azure today, someone who wants cash could easily change their mind about those terms tomorrow. In all the cases I'm complaining about*, there is already a precedent for this because they just changed their licensing already, so changing their interpretation of "service" is a much smaller change which could cause problems for everyone. That is not a small difference from the AGPL.

* I do not object to someone who writes something from scratch and wants to license it under one of these from the start. I object when someone made their software open source then switches to it, mostly because they are taking the contributions of others to do it, and in some cases, preventing others from using their own contributions without forking.

Re: "People moan because it wasn't the open source license they like"

The SSPL is neither free software nor open source. The SSPL license explicitly violates parts of the OSI's definition* and arguably removes one or two of the four freedoms that are core to the FSF's philosophy**. That's why we have a problem with it. Oh, and it's deliberately doing this to be impossible to comply with so that you pay the copyright owner to get out of it, meaning that they're not even doing this for ideological reasons. The other license they used, the RSAL, is even farther from open.

* The OSD is quite clear. The SSPL clearly does not qualify because it violates rule 9 and, to a lesser extent, rule 6. The text explains how with sufficient clarity that I don't have to go into more details.

** I will go into more details about the four freedoms of the FSF's definition, though. They are not as clearly defined, but the way they have been applied makes it clear that the SSPL removes freedom number zero, the freedom to run the software as you want to. Normal free software licenses impose terms on those who make derivative works from them, whether those are slight modifications or massive additions, but they don't do that on anyone who installs it. The SSPL does. Depending on exactly what you want to do with it, those terms may not be important, but unlike actual free software licenses, they're still there. The nondiscrimination element that is so explicit in the OSD may not appear to be there, but it is often included in freedom number zero, itself considered so obvious a requirement that the FSF didn't think it needed to be listed for a while. Of course, we could argue about how much this matters, I think it does, and you might not, but what's more clear is whether the organizations concerned think so. They do, which is why neither of them support the SSPL.

Re: AGPL

Instead of trying to see this as an argument and picking a side, consider the pragmatic point they're talking about. If you run a project with users and you change the license of that project, some users will face legal consequences, which may reduce your user count even among those who don't object to the new one. This is something for creators of projects to think about when deciding what they want to do with their licensing. Often, if they choose one license and stick with it, they are more popular than if they change it. That is even true for things that start out as proprietary. Many, including me, are completely fine with proprietary code but much less happy about open source code that suddenly switches to proprietary.

Re: AGPL

I am not a lawyer, so you are free to ignore me, but in case you or anyone else wants to know the answer, here it is:

You're using Redis under the AGPL3 with the conditions you described. Here's what you have to do.

1. Your code: nothing. It interacts with Redis through its normal channels. You don't need to change licenses or distribute it.

2. Redis code: if you changed it and made a custom version of Redis, you have to distribute that to anyone who wants and you have to use the AGPL3 to do so.

3. Attribution: Somewhere in an about screen or documentation, you have to say you're using Redis which is AGPL3 licensed and refer people to copies of those, but you can use Redis-hosted versions.

Feel free to get a lawyer to verify this. They cost more, though.

Re: AGPL

Because Redis was clearly looking for the most restrictive license that is open source. They think earning the open source flag back is all they need to do to get developers and customers back. I'm not sure if they're right, but I doubt it, and it's not because AGPL is a problem. Spending a long time not being open source is going to cause problems no matter what license is used when you come out of that. If they're still using a CLA, people who don't want to risk that happening again probably won't write code for them. I don't know for sure that they've killed their chances, as there are places that may pick that back up from name recognition alone, but it's a possibility.

Altman's eyeball-scanning biometric blockchain orbs officially come to America

Re: Proof-of-personhood

In almost all cases, the users' desire for anonymity is more important than other users' desire to know who everyone is or the frequent desire of companies to be able to sell that data. There are very few exceptions. Nothing you listed is among them.

Open Document Format turns 20, but Microsoft Office still reigns supreme

Re: Succes

I think the only major office suite that doesn't (as far as I know) have support for it is Apple iWork. That's not a big surprise since iWork is very insistent on not liking any format except its own; it'll let you export to formats that other software can read, but it does make sure to complain about it if you routinely use it. When I used it, DOCX and XLSX were supported formats, but ODT and ODS were not.

Re: That UK Gov Manadate thing

It's probably a lingering effect of the delay in meaningful support. Microsoft Office has had some kind of support for ODF for a very long time, but it's only since Office 2021 that it didn't come with some footnotes like Windows only or separate conversion process. Meanwhile, Office is one of those things that people don't upgrade very often because they don't see what changes they could need, and they're usually right. The combination means that someone who wanted to use Microsoft Office might still think that ODT files would not work so well if they tried, even though it has been fine and probably would be even if they're on an earlier version.

Re: That UK Gov Manadate thing

I'm sure that some universities or schools do mandate that students use Office to create their Office format documents, but most just specify that they have to be in that format. I used LibreOffice to make them, and nobody ever complained about that, probably because they had no way of knowing I had but also because, as long as it opens in whatever they chose to use, they were happy.

Open source AI hiring bots favor men, leave women hanging by the phone

Re: Now you know why LLMs are popular

No, they want to sell it. Some of them do a little hand waving to try to pretend that their model isn't biased, but as I said in my original comment, they've usually just made the bias results more random because removing bias is hard when the underlying technology is intentionally randomly generating results. VCs probably don't use AI to filter the companies they're investing in because they understand how fallible it is, but they're perfectly happy to sell it as useful to everyone else.

HR departments, meanwhile, adopt it because it saves time. Instead of doing their job, they shove all the candidates into the software. Are they trying to make sure that only some preferred group gets hired? No, they're trying to get their job done faster because it won't matter to them if they ignore a great candidate because the LLM didn't like the format of their resume. The bias in these programs is almost impossible to remove, and sadly the people who would have the best ability to reject it are the ones who benefit by using it (all the resumes reviewed in an hour, let's take the rest of the day off) and not the ones who suffer the consequences (having to work with the random choice the program spat out).

Re: Now you know why LLMs are popular

I don't think so. A deliberate bigot doesn't need AI. They can discriminate on an industrial scale, and they can ensure that their acceptance rate hits their ideal 0% rather than the AI's 10-37%. I think the AI is more likely to be used by people who are clueless and lazy, so lazy they haven't read this or the, by conservative estimate, 754 articles on this subject all of which have indicated that AI recruiting applications have every bias in the book and some that we didn't know about yet. This will perpetuate all those biases again, and when more modern data is fed back into the AI, it will amplify them, but I don't think any of that will be deliberate.

Sadly, the only other category trying to do anything to fix this are the AI writers who do read these studies who want to find a way to have their AI not discriminate. Much nicer than the original bigots, but it really means adding in some extra prompts which change what the bias is but not whether there is one.

Disney Slack attack wasn't Russian protesters, just a Cali dude with malware

Definition from 18 USC § 1030(e)(2)

the term “protected computer” means a computer— (A) exclusively for the use of a financial institution or the United States Government, or, in the case of a computer not exclusively for such use, used by or for a financial institution or the United States Government and the conduct constituting the offense affects that use by or for the financial institution or the Government; (B) which is used in or affecting interstate or foreign commerce or communication, including a computer located outside the United States that is used in a manner that affects interstate or foreign commerce or communication of the United States; or (C) that— (i) is part of a voting system; and (ii) (I) is used for the management, support, or administration of a Federal election; or (II) has moved in or otherwise affects interstate or foreign commerce;

As far as I can tell, it means any computer that is used by any business or government that operates across state lines, plus a couple more specific categories that are already included in that one. US law doesn't allow federal governments to deal with things like that that happen exclusively inside one state, so it can be simplified even further to "a computer the federal government is allowed to charge you with a crime about". None of this seems to be related to any real or notional protection, so there doesn't seem to be any such concept in the law as an "unprotected computer".

How Amazon red-teamed Alexa+ to keep your kids from ordering 50 pizzas

Re: Interesting

No, that wasn't it. It was a specific compiler whose included libraries were triggering something in the AV. Unsigned binaries coming out of GCC were just fine by it. Unfortunately, binaries from GCC wouldn't do what we needed; only that compiler was supported.

Re: A 100% way

Out of curiosity, do you mean the voice age verification thing which I spent three sentences explaining how it would a) annoy everyone and b) not fix the problem? If it was, can I suggest a rereading until you understand the core point, which was specifically that technological patches will never fix the problem, only hide it from the initial glance? It seems strange that you're critiquing the comment by assuming I said the opposite of what I said.

Re: Interesting

"I would think it would be better to have overly active fraud detection than not enough"

In most cases, you're right, but overly active fraud detection can have some significant problems too. I've had online payment systems go totally haywire when the payment wasn't even declined yet; my card simply wanted additional verification of the charge, then approved once it got it. In the meantime, the payment system gave up on me and canceled the order, so I had paid them without completing my order. I ordered a second time which worked, and the situation got cleaned up without too much chaos, but that could cause problems for some groups of people, for example if the transaction was large, they didn't have a lot of cash on hand, and the payments were on a statement before one was removed. It's probably easier to err on the side of caution when I haven't had to experience the effects of frequently incorrect caution. If it was happening to me a lot, I too might want them to dial it down a bit.

I'm reminded of a piece of antivirus software that decided that the output of a certain compiler was malware. I couldn't run any code I compiled because every time I ran it, the file would either be quarantined when it was created or deleted when I tried to execute it. I screwed with the compiler to fix the antivirus's inaccurate judgement, but it probably would have been easy to convince me to remove the antivirus software when I had been fighting with it for a while (work computer, so for better or worse, I couldn't remove the antivirus).

Re: What am I missing here?

The problem is that it's the security on the device that makes the transaction, not the card to pay for it. If I can secure my card, but that device can charge to it, which it needs to have if I'm using it to make other transactions, then the security I added to the card isn't going to help.

While we're at it, I have cards with the default level of security and there don't seem to be a lot of options to change that level. There's no interface that lets me put a cap on number of pizzas I could order at once. There's an opaque fraud detection algorithm which has fortunately never gone off by mistake but admittedly I don't spend much money and a slightly less opaque location tracking algorithm, neither of which can be turned off anyway. The next security level I have is "card locked except for recognized monthly bills". Those are the only two levels I'm aware of that let the card work at all, and since only one of them lets me buy anything I haven't purchased on a schedule for several months, on that one I must remain. I'm not sure what you're recommending is a feasible option for people who have any payment cards.

Re: Interesting

Doing that changes how long you have to retry the situation, not whether it works in the first place. If the system rejected the order out of hand, it wouldn't work a day in advance either. I assume there is a mechanism for verifying that a user is permitted to conduct the action for the ones that have been filtered, so I doubt it's as problematic as the financial fraud detection examples it's being compared to.

Re: A 100% way

Not exactly. I mean AI is dumb and can't be trusted, but this doesn't prove it. What this proves is that the interface is in a situation, to use the security term a threat landscape, where AI is unable to patch the gap. When you're worried about a child sending a command, then filtering out massive orders is important, but so is any other weird command a child might give. A child ordering fifty pizzas can be eliminated by a simple rule, but what about a child ordering a single pizza because they don't want to eat whatever was planned and they are able to correctly understand their pizza consumption potential? That's also a problem, and as long as the system will accept an unauthenticated purchase request, it is possible.

You could try to fix this with yet more AI: do voice age detection to try to eliminate certain requests from childlike voices. In a world with functioning AI that identifies users, that might be how you'd do it. Doing it here will likely lead to even more annoyances, such as the age guessing function to get it wrong and refuse an adult, or if the child is smart, the child using a voice generator to create an adult voice to make the request. Most likely, the method to solve this one is the boring old standby, for any purchase request, get a confirmation from someone with spending authority and provide that person with enough information that they know what's going to happen if they approve. Layers of AI can help to hide the gap, but unless those mechanisms exist, that gap is likely to still be there.

Your graphics card's so fat, it's got its own gravity alert

I think they were saying that you can't play many games on that spec to disagree with the previous commenter, and they were referring to the age of the PlayStation 4 which the previous commenter said was good enough for their uses. It sounds like you may be in closer agreement.

Re: It's difficult to see this...

Weirdly phrased though it was, it mostly made sense to me in that this problem happens because a large number of people, any of which could have done something about it and several of which should have been trying to, failed to fix the problem. Designers of the cards should think about how they're mounted in cases and whether this would work, then they should have tested this to see what happens. Designers of cases should have done the same and either redesigned the cases to handle it or at least provide the parts necessary for the user to manage it. The problem is such that the average buyer would wonder why nobody saw this happening before this was released and why the best solution is a sensor that, as the article notes, tells you when the problem is already bad enough that something is likely damaged now. We can blame users for a lot of this too, because when the graphics card is that heavy, you have to use some common sense about the physics it's going to have on whatever it's connected to, but that is supposed to be the job of engineers at several companies before users should mentally double-check their work.

Fortunately for me, my graphics needs are very simple, so I don't have to worry about multi-kilogram graphics cards.

Chris Krebs loses Global Entry membership amid Trump feud

Re: Too much probing

He had a security clearance before it was unjustly taken away. You get at least as much probing to get that. I suppose that, by the time he had already done it for doing security work for the government, it didn't matter so might as well get the benefits. Such things often mean that the government, and especially the military, have trouble finding all the people they want to work there. That goes for most governments, but the US one complains frequently about how they don't have enough people to do the computer work they want.

The State of Open Source in 2025? Honestly, it's a mess but you knew that already

The places I have worked have used all of these, plus SUSE, Fedora, and Arch (a little), and no one of them has used fewer than two. Sometimes, it can be nice to use a single distro on every machine, but it doesn't always work. Some machines don't change a lot, and they're often running Debian or RHEL so they don't need to be but there's still maintenance. Ubuntu has been a middle ground, now making changes moving it in a longer-term direction if you use LTS versions. Cent OS, Fedora, Ubuntu and you use all the versions, and Arch update faster, which may be useful for some situations where you want to be able to use newer tools that those older distros don't include because they weren't around at the time, and then you've used one and you want to deploy it, so instead of the existing older server images, you make a new one based on a newer version of something that'll get support and now that's one of your servers too. After a couple years of that, you don't have a monoculture anymore and it's less work in the short term to keep those running rather than migrate everything to one thing. Eventually, you have to make some maintenance decision, but that's how you get there.

Re: So . . .

There are a lot more than two camps, and the two don't necessarily hold the same points of view that adherents argue for. I assume from your comment that you're referring to the general attitude toward proprietary code, with Stallman taking a more negative attitude to its existence than Raymond does.

Except he doesn't entirely do that. There are many who think that the existence of proprietary code is unconscionable and should be forbidden by law. Stallman isn't one of them by a wide margin. There are people who think open source code is fine, but they prefer to run mostly code that is maintained by a specific company because it means there's no link in the chain where their function has a license that disclaims liability. Raymond isn't one of them. So the spectrum, if we're using a one-dimensional one for this, goes in both directions from those two guys. There's also a place between their attitudes. I'm also curious where you'd put Bruce Perens, both the original one with all the OSI connections and the new version who is all in on the Post Open (in my opinion very close to closed) license idea. Not to mention that I, who you'd probably file near Raymond, might not be easily placed on such a scale because, while I'm fine with proprietary code, I get annoyed at people who change their licenses to make something previously open source more proprietary. They have the right to do it, but I will dislike them if they do. Neither camp is well-defined, possibly because there are more than two opinions on it, more than one thing to be debated, and we don't tend to choose our opinion by picking a representative.

Arizona laptop farmer pleads guilty for funneling $17M to Kim Jong Un

Re: Norks

Hard currency is quite a big thing for North Korea. They want to import many things they don't have the capacity to make locally, but unlike Russia or other countries in that position, they don't have much they can export to earn the money to do it. If Russia wants some chips, they can sell some oil or minerals for cash and use that to buy the chips. North Korea finds stealing that money to work better because most of the things they make are either needed locally or made inefficiently compared to neighbors. For example, North Korea does make a lot of some agricultural goods, but China makes them much more efficiently, so China exports lots of those things and nobody buys North Korea's, which is actually fine because the North Koreans need to eat something and they don't import food.

So in reality, I think this is mostly about the money, and the backdoors they might install are also about going back and getting more money. Most of their major intrusions are the same thing. North Korea's known attacks are very heavily concentrated in three sectors: cryptocurrency companies, from which they steal money, banks (both retail and central), from which they steal money, and security companies, from which they steal exploits and use them on other people, again concentrated in those three areas.

808 lines of BBC BASIC and a dream: Arm architecture turns 40

Re: "RISC architecture is going to change everything"

You can do equally as much with three instructions and one register. We don't all do that because sometimes we're worried about more than what it is possible for our computer to do, but what it is efficient or feasible for our computers to do.

Re: "RISC architecture is going to change everything"

The chip is Turing complete, so it can run anything you choose to compile for it. It can run IOS if you give it enough RAM. The point is that it doesn't because it would be slow because it doesn't support those thousands of operations. When people want performance, they go to a chip that has thousands of operations. Does that make it non-RISC? Does it mean that RISC was abandoned by ARM in the quest for performance? Since RISC isn't well-defined, there isn't a clear answer to this.

Re: "RISC architecture is going to change everything"

It depends whether you give ARM credit for still being RISC, and if you don't, where you draw the line. The Cortex A-range chip in your phone likely supports a couple thousand instructions. True, they have several subsets of that, the smallest of which (Cortex M0) has only about 55), but you don't run a phone or computer with one of those as the CPU. I don't think I can call that RISC, even if it still has load/store and comes from ARM.

Trump admin freaks out over mere suggestion Amazon was going to show tariff impact on prices

Re: Dihydrogen Monoxide

You can't include that one about a profitable industry in the US. That might outweigh anything else in the list. No, to really clinch it, you have to report that nearly a billion dollars per year is used to import DHMO products and Canada is a source of the raw substance and partially regulates the US's use of it. That should be enough.

TAKE IT DOWN Act? Yes, take the act down before it's too late for online speech

Probably not at all, because these are not lawsuits. These are complaints sent to a different entity entirely, and from a court's perspective, the worst that can happen is an individual image is taken off a website you don't own. In reality, the worst that can happen is getting banned from a website because they don't want to deal with any more complaints or respond to cases where the complaints are untrue. In either example, though, it will probably not match the criteria written in anti-SLAPP laws, and you'd have to use less clear methods to try to respond to someone using these maliciously.

I don't think that means what you think it does. It doesn't mean the law doesn't have force until a year has passed, but that it is fully operational exactly one year after it has. Until then, social media can probably use the "still working on it" excuse for making the process more complicated and not immediately hopping to taking down the things they're told about, but they're still supposed to and can likely be pursued if they don't.

It is probably the most fun the politicians' staff members* get. Come on, wouldn't playing the bacronym game be a little fun if you didn't have to do it too often?

* The ones who would otherwise have to do boring work like writing and reading the tangled words of legislation so their bosses don't have to, not the ones who are preparing for their next election or their social media war. In other words, the staff who do work, not the ones who play the politics game.

Infosec pros tell Trump to quit bullying Chris Krebs – it's undermining security

I wasn't one of the three so far, but if I had to guess, I'd guess that people disagree that that's a strength even sometimes, you didn't explain why you think it is one, so they think you're at least partially wrong.

Open source text editor poisoned with malware to target Uyghur users

From the not very nice translation that Google Translate made of the Uyghur readme/changelog, this editor seems to have a few features that many text editors you could localize either don't have or are specific to Uyghur including:

OCR: I don't have this in my text editors, though you could add it.

Convert between writing systems for Uyghur.

Save to Docx: Most text editors don't bother with this. Localizing LibreOffice and trying to add these features as add-ons would be more work than the average text editor localization.

Features specific to languages that Uyghur users may also know including Kyrgyz.

You probably could bolt these onto another editor, but I'm not sure they're small enough that that's an obviously better option.

Swiss boffins admit to secretly posting AI-penned posts to Reddit in the name of science

Re: “…the risks (e.g. trauma etc.) are minimal.”

"But if you're researchers, social scientists, experimenting on people, the first thing you do is obtain informed consent."

I think you're simplifying the ethics review process to the point of inaccuracy. Testing on uninformed subjects is done frequently, whether that involves bringing in subjects, telling them you're testing one thing, then testing something else*1, or testing on the general public without telling them*2. The review process would not dismiss either type of request simply because the subjects weren't informed. They would ask questions to determine the ethical consequences of not informing the subjects up front, and they might refuse permission when it's too sensitive. If you think this study violates those ethics as well, you could argue for it and I think you'd probably have a point, but if you think it's as simple as "they weren't informed so it would obviously violate the ethics codes", you don't know the ethics codes.

*1: For example, the famous study where people were told to go to another building and watched to see if they'd ignore a person needing help on their way. The subjects were not informed that they'd be tested on that, since the purpose was to see if they'd go out of their way to help, and they weren't informed beforehand that they'd see a person in (simulated) distress.

*2: Many studies involve setting up a situation in a public space and watching what passersby do in response. It's very common.

Generative AI is not replacing jobs or hurting wages at all, economists claim

Re: When was 2024?

You're both right. The data isn't very old, especially given how long it generally takes to create new data. How many people have jobs is often on at least a month's delay as it is, and information about how companies are changing the jobs their employees do is often delayed longer than that if it's explained at all, so the data they've used is probably the latest they have access to. However, if modern LLMs had actually taken over and replaced employees, it wouldn't show up in the last set of data from 2022-2023; the LLMs of that age were much worse, struggling to string a paragraph together.

We won't get the full story until some companies actually try replacing workers with LLMs for a while. Having seen them used, I'm not expecting large changes. While there are a lot of places using them, the quality is still a problem, meaning that companies using them and expecting quality usually need to spend about as much time testing, rerunning, and correcting LLM output as they did doing the thing from scratch in the first place. Various people I know or work with have arrived at different places on the spectrum of how much LLMs are used, and I do know someone who uses LLMs frequently and nonetheless produces good code (he does complain that he has to try five times and then correct manually to get workable code, so I don't know how efficient he is). I'm still waiting to see how badly it fails when a company decides to trust LLM output more readily.

CNCF tells main NATS contributor Synadia that it's free to fork off

Yes, and you could argue that merely adopting such a strategy is already forking the software since it is now diverging from what others used to contribute to and use in such a way that they may only choose one approach: paying or being allowed to use their own work in the way they want. These people have decided to add another level of stupid to the game, though. Most companies that do this have kept the trademarks and domains, so their version gets to keep name recognition. I must admit, I've never seen a company give those away before trying this before.

Signalgate lessons learned: If creating a culture of security is the goal, America is screwed

Re: Who is to blame?

Correct, and in that case, you've moved the endpoint. That can be helpful. If, however, someone got malware onto that endpoint, malware which either takes it online without you knowing or uses one of those ways Mordechai Guri is always making for getting data out of a computer that has no standard connections, then you have the same problem. Which is not relevant to the completely unrelated issue of adding a recipient who shouldn't be on the conversation, because whether they used one terminal or two, airgapped or not, is not anything we're talking about in this article or the comment thread you've replied to.

Re: Alas, cryptography is not simple

"Little Jenny has nothing to hide. Prodding her to encrypt her e-mails only so that those of us who have good reasons to encrypt would not attract the attention of the Chief Magistrate was (a) not entirely ethical and (b) most certainly counterproductive."

I disagree on both points. In most cases, we did no prodding at all. Jenny who chose to use normal email doesn't have encryption in transit, but if Jenny decided to use iMessage because she has an iPhone and so does the person she's talking to, then she gets encryption anyway. She had to do no more work. Many nontechnical people want security and, when it's easy enough like downloading a certain app and remembering to use it, they use it. So I'm not sure there was as much prodding as you're suggesting.

As for its ethics, when we did make encryption and enforce it on people, it is in things like requiring HTTPS to access websites. In which case, enforcing security is ethical because it defends people whether they would have chosen it or not. Bob logs into his online bank account on a public WiFi network, and he doesn't understand or care why there's encryption on that connection? If that WiFi network is logging things, then that encryption prevents him from losing his money. He probably cares about this. Not only would he care if someone explained it and he listened, but since he would complain to his bank and expect them to make up the shortfall if someone did steal it, the techs working for the bank have enough personal interest in preventing it to justify requiring encryption. Once again, the heavy lifting is done by the browser writers and the server admins, not the user, so simplicity made it easy. We did make it a little too easy by advising users to look for the lock icon, meaning they sometimes trust websites as long as they have an HTTPS connection at all, but that wasn't worse than what we had before.

As for counterproductive, I don't see where you get that. Not totally effective is not the same thing. The increasingly common use of cryptography has brought significant improvements. It hasn't prevented people from unintentionally disabling it or doing something it didn't cover (most of which are reasons to increase how many things use it). Nor has it prevented people from doing stupid things they fully understood, which it never will be able to fix. I don't see what negative things it has done and so far, you haven't named a single one. Your arguments have been blaming cryptography for things it has nothing to do with and a user choice argument which, while an interesting philosophical argument, isn't very relevant to cryptography's failures.

Re: Who is to blame?

"For example, Signal users (both senders and recipients) HAVE TO HAVE PLAIN TEXT on their end point!!

And when that end point is compromised by MORE TECHNOLOGY (NSO/Pegasus malware), then the whole point of Signal is made useless."

And the alternative is? If I control your endpoint, then I have your communications. It doesn't matter if it's encrypted at rest or not (it is for Signal, incidentally, so your plaintext argument is not entirely correct), I can know what it is because it has to be decrypted to appear on the screen and I can grab it then. No cryptography can prevent that from happening. We have lots and lots of writing explaining how to try to prevent your endpoint being compromised in the first place, not that there's a simple, foolproof method of doing that.

"So....to your point......users of technology who would like privacy and security ARE FORCED to be more skilled with technology."

The point of making it simple when possible is to provide those who aren't skilled with technology with some level of protection. As with anything, those who are skilled with technology will get better results out of their technology. This is why, when an option arises to make something more user-friendly, I try to choose it so that more people can benefit from it. Once again, there is no way to simplify everything so that people who don't want to spend ten seconds can use it, but we can make incremental improvements and I suggest we do so.

Re: Who is to blame?

I think you have misunderstood what they are saying and misapplied that to this situation. This situation is not about cryptography, and the ease of cryptography has nothing to do with the problems involved.

Cryptography itself has to be simple to use or people won't use it. I'm all for teaching everyone in the world about cryptography so they can use better systems, but that wouldn't be feasible and many of the people you could get into your educational centers are going to ignore you because they are the type who don't understand why they have to care about security and intend to ignore this whenever it conflicts with convenience. For people who know and care, there are many systems where the cryptographic mechanisms are conveniently configurable and can be used to create communication channels that have the amount of security they're looking for. For those who care but don't know, there are a lot of resources online to teach them how this stuff works, though some of that might benefit by having less technical versions. For those who don't care and don't know, that's why cryptography has to be built in with little or no user interaction required, because they will not try to do anything about it.

And all of this is completely irrelevant to this situation. Nothing here became possible due to a problem with cryptography. The cryptography in Signal, as far as we know, did exactly what it was intended to do: it encrypted the traffic between participants so that only those invited to the calls could read what was being sent. That's what cryptography is for, and had we made it more manual, they would have either done the same thing manually or they would have sent the same traffic unencrypted which would have been even worse. What is happening here is not a technological problem at all. The two problems involved are:

1. Sending data to the wrong person because they manually mislabeled that person.

2. Sending data to the right person, as in the person they intended to send it to, but someone they really shouldn't have informed.

Technology could try to fix problem 1, but it would have nothing to do with cryptography and might have more downsides than benefits. Technology cannot fix problem 2. Existing human systems can try to fix problem 2, and they did. The person trying to inform people who didn't need to know about military actions was aware that they didn't need to know. He was aware that the systems in use were intended to prevent that data being shared. And that is why he bypassed them. He intended this outcome, and cryptography could not have changed his mind or prevented him from doing what he did.

What the **** did you put in that code? The client thinks it's a cyberattack

Re: Most inappropriate message

Appropriate in the sense of avoiding making customers angry, probably. Appropriate in the sense of proper user design, no, in my opinion. The problem is not the informality or even the command, but that it didn't tell the user what they did wrong or what they should do differently. In fact, I don't entirely understand what this even means. What my mind immediately jumped to is those times where what looks like a simple modal has an OK and a Cancel button, but I can't tell what differences to expect when selecting which one to press. I'm assuming your case was more complex than that, but since I don't know when it would appear, I would be wondering whether this was the equivalent of the abort/retry/fail situation where I was stuck in a loop until I terminated the program. If the users could do anything about the situation, then probably a better error message was possible.

Downward DOGE: Elon Musk keeps revising cost-trimming goals in a familiar pattern

31.72689469541619 ...

Less precise, please.

"Who would build a large wind/solar farm sans that infrastructure?"

It happens all the time. Some company finds a good place for one and thinks someone else will want that power enough to finance the power lines. The someone else either decides not to, or more likely they decide to do it but have delays the generation company didn't. Result: power plant without sufficient transmission infrastructure.

Even more frequently are the cases of intermittent situations with extra power. Generating capacity is installed somewhere and has sufficient transmission for a certain area. Then the power requirement decreases and there isn't enough transmission capacity to send the excess power elsewhere. For example, a hot area where the power generated is expected to power air conditioning systems, then a period of cool temperatures where there isn't that load, but there isn't a lot of transmission out because there wasn't expected to be that much excess frequently enough to justify the investment.

Trump’s 145% tariffs could KO tabletop game makers, other small biz, lawsuit claims

Re: Sue him directly.

The difference between civil and criminal law is not only a thing in the United States. I don't know where you live, but chances are that it's exactly the same there. There is such a thing as private prosecution in many countries, But you can't do that just because someone has done something that harmed you financially, and where it's possible, it's often rarely done because it's extremely difficult. That's when it's against another person, not when it's against someone who can bring every lawyer employed by the US government to defend him. Also, it isn't even allowed for federal crimes, so look for a state crime and hope that state allows it.

Re: Damn.

"If you were completely convinced that the US economy is going down the drain, and the only way to stop it would be to bring some self-sufficiency back, how would you bootstrap manufacturing in the united states again?"

Step 1: Focus on what, specifically, you need to be able to make there. Don't try to make everything. If you try to make everything, you're going to run out of ways to promote that capacity before you've gotten far enough. It's also a bad idea Because there are plenty of reasons why other. countries might be better at making something. Unless you need it, the place that makes it is an enemy, or there's some reason to think that you could do a lot better at it than you are right now, it might be better just to let it happen where it's already happening.

Step 2: Figure out who does make those things. Are they your friends or your enemies? Study them and figure out why they can do it there and can't where you are. The process forks after this depending on your answer, but to avoid writing too much...

Step 3: Get more of whatever they have access to and you don't. If you don't have enough skilled people, figure out how to encourage education of more. If they don't have a regulation you have that slows them down, consider whether the regulation is necessary (don't just eliminate it, consider it). If they have particularly rare people, figure out how to convince some to move to you.

Step 4: Determine whether any of those differences are unfair. If they are breaking an actual law, one that's been written down and you can point to and prove they broke in a court that doesn't already agree with you, pursue that. If it's an international trade regulation, there is the WTO to handle that, well there would be if the US hadn't been blocking it for several years, but it can do some things. Here's where you might use some tariffs, as punishments for specific and real problems.

Step 5: If the rest wasn't enough, here's where you have to hand out cash. Private companies won't do something if it's not profitable. Creating an environment may not be enough in those cases. You may need to pay them to start. After a while, it becomes expensive to move what they started, and if you were successful with the environment thing, they won't need your help anymore, so those subsidies can be temporary. Tariffs to block all the competition as an alternative to subsidies usually won't work, but they especially won't work if the environment problems are still there. Even if the environment is good enough, tariffs will make it difficult for anyone to start if they import anything. A car company could have access to people trained in engineering, a place to build factories, and regulations making it easy for them to make and sell cars. If they don't have any of the materials with which to make cars because there is a tariff on those, they still won't build that factory. This is why step 1 is so important; unless you already make a bunch of steel locally, tariffs on steel and on cars is likely to prevent you from starting a car factory.

Governments aren't great at following this process. The current attempt is worse than usual at it.

Someone could arrange it, but it's not going to make him resign, so a lot of people will probably be wondering why to bother, including many of those who would be best able to organize it.

AI training license will allow LLM builders to pay for content they consume

Re: Utter tosh

"Why would it be a single licensing charge? An ongoing monthly royalty payment for any creator whose works have been used for training would be a far fairer method. And the creator should be able to set whatever fee they wish, or have their works removed from the training data."

You have to recognize the difference between something that would be fair and what these people are trying to do. A lot of things would be fair: the company is forbidden from using your content without your permission, you can set any price you like, they have to have ongoing permission, you can withdraw permission. None of those things are planned or will happen with this method because they are hoping that AI companies will voluntarily sign on to this plan. AI companies, meanwhile, are using the system of being allowed to use anything they want without anyone's permission or a requirement to pay for it. They don't want to accept any reduction in that and will only voluntarily do so if it is cheap and results in a decrease in legal risk to them.

The reason it will be a single payment is that, if it was ongoing, AI companies wouldn't agree to pay for it. They also wouldn't agree to removing it at any time because they can't remove it from their models after creation and because they have no interest in maintaining the systems necessary to find and remove it from ongoing training data at your request. The reason it will be a non-negotiated payment is that it would take forever to negotiate with each person in a group of millions for how much they want for an individual page, and because paying a fairly-negotiated amount would be more money than they have. The organization trying to sell all this content to them will either request these things and never get anyone to agree, or they will negotiate all at once for one tiny value because it means they don't end up a complete failure.

This is why this suggested method is bad. It will not achieve any of the things we need, nor are they necessary to remedy the illegal actions of AI companies. Existing copyright laws already implement all of this; it's illegal for the content to be used without permission and compensation and negotiations for those would have to be individual. All we need to make your preferences (which are also mine) happen is for courts to confirm that AI companies are not exempt from copyright law and punish them for their illegal actions. A licensing organization will not help this happen, and they will not try to organize something that makes you happy. They will try to organize something that makes them happy which will be more advantageous to the AI companies than it would be to you.