Posts by doublelayer

Busybox 1.37 is tiny but capable, the way we like Linux tools to be

Two things, neither completely justified. The first was that, until version 1.3.0, its license was GPL 2 or later. As of 1.3.0, it became GPL 2 only, same as the kernel. Before that, people didn't like the ambiguity involved in letting whatever might show up in GPL version 3 (then unreleased) to be a core part of their system. This was only partially justified because the clarification came in 2006, so it's not like there was much need to deal with it.

The other reason was even less justified, namely that Busybox was a project well-known for pursuing their license rights. If you used Busybox, they would demand the source be released and sue you if you didn't. This rarely if ever gave the community useful code because anyone using Busybox didn't have much of a need to improve it, but it did certainly penalize people who don't comply with a really easy license. This shouldn't really be a problem, and it really wasn't, but some companies can't be bothered to release the source code they haven't changed and contains no secrets. I'm not sure why they find this so difficult, but having tried to get source code from them, I know they exist.

In general, one of the maintainers of Busybox got annoyed at another one and went off to create Toybox. This was in 2006, so before Android really went anywhere. Android had to choose between the BSD-licensed Toybox, run by someone who had added a lot of stuff to Busybox, or the GPL2 Busybox which had lost a maintainer but still had more people working on it. There wasn't an obvious good and bad answer, and it probably isn't that surprising that they went with Toybox. Having done so, Toybox has focused on keeping itself functional for Android, so it's not surprising that they're still using it.

159 Automattic staff take severance offer and walk out over WP Engine feud

I'm not sure. At the start, this seemed like the old classic "I made something open source [with lots of others' help] and I want to be paid by the people who make money off it. Why can't I force them to do that?". To add a bit of extra spice, there was something a little legally dubious about trademarks thrown in. However, the way it's played out isn't following the normal pattern. There are lots of people who host Word Press for profit. They all say "Word Press" on their websites. Some of them use it in advertising that I'd rather not see anymore. None of those have been sued or had their access to update servers cut. Either this is really about the name of the company, in which case it's not going to go well for Automattic because "WP" is not the same thing as "Word Press", or it's about something else but I'm not sure what it is.

If there's an actual legal thing in here, I don't get it. I'm currently operating on the theory that it's really just a personal whim that's going to go badly, mostly because that's the only explanation that gets even close to explaining most of the events. Maybe Mullenweg hates someone who works at WP Engine. It would make more sense than most of the rest of this.

There are always some tricky aspects to something that was formerly entirely charitable switching to a partially charitable and partially for-profit enterprise. In the case of the Raspberry Pi, not even this happened as the foundation set up a for-profit manufacturing company back in 2012. However, it is not the same as this case. The private company was majority owned by the foundation until it was taken public, and is still 49% owned by the foundation. If it was entirely owned by Eben Upton, this would be a different situation.

Re: Well...

If Wikipedia can be trusted, they had 1733 employees at some point in 2024, so this is about 9% of them who left. That doesn't explain how many of them were working in each area, though. It's still not a good look.

I'm also curious why he offered an exit package like this in the first place. There's something a little weird about the speed of that and the terms provided. The person who worked for two days and is getting six months of salary is a particularly odd example, because he certainly didn't have to do that by law.

Ryanair faces GDPR turbulence over customer ID checks

The identity of the traveler can be and is checked when they arrive. If it wasn't, I could find someone else's ticket purchased directly through Ryanair and impersonate them, since if the ticket was purchased using their site, this process gets skipped. They are doing additional checks on a subset of their passengers that are not required for other travelers.

Maybe they have another reason for doing it, but in the absence of an explanation and the presence of many airlines who don't do this and have no legal problems about it, I have to fill in the gaps. It seems like they're trying to make the process more difficult for sites that allow passengers to book tickets through a third party, and there's a clear reason why they might. Those sites make it easy (easier) to compare prices across airlines and see all the various options for traveling between some locations. If Ryanair's options are sometimes preferable but not always, a passenger who used such a service would only buy Ryanair tickets some of the time. If they can get those passengers to go to the Ryanair site first, they might always buy a Ryanair ticket even when another airline is providing a better option or a better price just because the effort of price comparison is much harder and if the traveler spends too much time doing it, the price could increase.

Harvard duo hacks Meta Ray-Bans to dox strangers on sight in seconds

Re: Bet it is wrong at least half the time

It depends who is using it and to what purpose. In many of the cases where I've seen the technology used or calls to do so, I am not reassured by it being wrong. Law enforcement use is probably the most obvious example, where being falsely identified as a suspect can still be a rather bad event for you. In fact, in that case, accurate recognition would seem marginally less dangerous, though in reality it's just dangerous in a different way.

It doesn't dox the wearer. It doxes the person the wearer looks at, glasses or no glasses, in fact probably more accurately if they're not wearing glasses.

Cloudflare beats patent troll so badly it basically gives up

Re: Patent trolls

In ARM's case, it's pretty easy. Those core designs they make are products. Those products are sold to other chip designers alone and those designers have to make the physical thing, but nothing says that a product must be physical in order to count. ARM has plenty of provable use of their patents in something they sell.

There can be a trickier side where a company does really exist to license out IP. They can buy it from the inventor because the inventor doesn't want to go into the business of manufacturing the thing they invented, then find someone who does. In this case, the question can be rephrased as "when did someone last build a product based on this patent", thereby including any customers of the company who licensed the thing. In both cases, you would also need to consider that someone might be in the process of developing a product but hasn't released it yet.

It's not a good enough test to stand on its own. A no to this question does not conclusively prove that the patent is invalid. It does suggest that it might be, though.

Re: It depends on your definition

They don't have to directly use the patent in order to make money off it.

Step 1: buy some real patents.

Step 2: Find someone who wants to build something using the IP.

Step 3: Sell them a license or negotiate an outright sale of the patent.

Did these guys do that? I'm guessing not. This suggests that they couldn't. In principle, you're correct that maybe one of those patents was valid and they have an actual infringement case. I can't disprove that just because they never used it or allowed others to. However, I consider it reasonable to doubt them when they don't offer such a thing, and the outcome in court is further reason to believe that they did not hold any justified patents.

Latest in WordPress war: Automattic says it wanted 8% cut of WP Engine revenue

Re: I'm sorry for sounding like an idiot, but…

Probably not, in that WP isn't Word Press's trademark and the trademarks they do have are owned by the foundation rather than the company doing the suing. If they sue about the letters WP, they're going to lose. So they're probably trying to make a case on use of a trademark somewhere else.

Maybe it's their current headline: "Most Trusted WordPress Platform 2024 | WP Engine®" and similar things. I still think the trademark wouldn't apply because they are hosting Word Press, but that line actually includes a trademarked phrase while their company name doesn't. Either way, it seems clear that trademarks are not the actual issue here and is just the way that the fight is currently described.

Re: I wonder if those servers are being run for and by Automattic...

That may be the case for the domain name, but the relevant question is who is paying for whichever servers are used to distribute updates, or if it's cloud, who gets the bandwidth bill? Is that him personally? Somehow, I doubt he's personally operating them, which makes me think it's likely that the same organization is probably doing the admin and paying the bill.

Bank of America app glitch zeroes out people's balances

Re: Emptying Bank Accounts

Probably the latter. Like most other glitches, this one will end and everyone will have the same amount of money they had before. Glitches don't always go that way. It was about a year ago when a different bank had a glitch allowing people to take more money than they had. Those people didn't get to keep that money, and these people aren't going to have their money taken.

Another OpenAI founder moves to arch-rival Anthropic

Re: "the Microsoft-backed AI house"

It has nothing to do with open source. Claude isn't open source either. Not in real terms, nor in the sort of open but not fully terms that Facebook used for LLAMA. These people didn't do this for open source. Why they did it is harder to answer. In some ways, though, you can still blame Microsoft for part of it. When OpenAI tried to get rid of Altman, Microsoft was one of the reasons why they failed and he stayed on. Probably not the largest of the reasons, though you're free to think otherwise. If you actually want to know this, try to interpret the vague pronouncements made by all involved in that event. It has more to do with it than open source does.

Average North American CISO pay now $565K, mainly thanks to one weird trick

Re: CISO?

Chief Information Security Officer. It's sometimes also CSO (Chief Security Officer). When you already have a CTO (Chief Technology Officer) but they don't know about security, you need another person. What they actually do varies a lot. Sometimes, the C?O people are actually doing some task related to the company. Sometimes, they're just management, so the CISO doesn't actually know about security, they're just the person to whom the security managers report. So while I can expand the acronym for you, I can't actually explain what these people are doing because they're probably doing different and mostly incomparable things for their salaries. Generally the only commonality is that if they get hacked very badly, that's the person who gets fired. Whether that makes sense is also highly variable.

AI agent promotes itself to sysadmin, trashes boot sequence

Re: How?

Not that surprising given the original prompt, which basically required it to run some command, in this case nmap, to find the machine in the first place. It had already been told to figure out what command to execute to move down the path, then read the output in order to create the next command, and keep doing that until the job was complete. It seems like it needed some coaching to actually do it, but they were testing a multi-command setup. I'm therefore not surprised about reading output and sending more commands.

If this was a test computer or one with a backup, why not experiment to see how badly it could go. The same way that, when I had already decided to wipe and do a clean reinstall of a system as a child, I finally chose to execute rm -rf / to see if the command that nobody would actually run would be interesting (not really, but that's not a surprise). As long as he can live with the need to reinstall from scratch, go ahead and break it further. If he can't live with that, he probably shouldn't have experimented with it in the first place. There are VMs and Raspberry Pis for that.

Re: AI agents have been the source of much enthusiasm in the technical community

There is a lot of enthusiasm about. It's just limited to some groups and not shared equally. I know quite a few people who are enthusiastic about LLMs. Some of those people are IT employees or programmers. Others are just technophiles, and maybe they can be excluded from the technical community but if they ever find out that I said that, they'll be quite indignant.

I've been curious about the capabilities of LLMs and done experiments from time to time, but I've almost always been disappointed by how badly it could mess up simple tasks. This tends to surprise me when I see people who theoretically know how to write software who nonetheless are impressed by them. I currently have only two logical theories about why: they are somehow able to prevent LLMs from generating the many errors that they always generate for me, or they're not interested in the quality of work and don't mind that the results are shoddy. I don't know whether I'm missing another explanation, nor have I seen any evidence that the first one exists.

Re: Not so sure about this....

"Would be interesting to know why it carried on. Some cumulative product of previously assigned tasks?"

I wonder if it might have been the login message printed to the shell when the connection completes. Depending on what distro was set up, that message can sometimes print information about available updates. The LLM shoves that text into it and finds something that mentioned something about updates, then starts executing that.

Then it takes a bunch of text emitted by apt, which often talks about the boot system, and it looks for text related to that. If it hadn't broken things by rebooting, it probably would have kept going even longer.

After 3 years, Windows 11 has more than half Windows 10's market share

Re: Support

Of course you can, often using the same methods that work for Windows 10. Whether that's a good idea is a different question, and one I'm willing to leave to your judgement.

The statistics don't say anything about that. If you're referring to the article, it only says who is running Windows 11 or Windows 10, not how many of the people running Windows 10 have not upgraded because they don't want to or can't be bothered but would be able to quite easily. For example, among machines operated by my family and thus at least sometimes supported by me, there are at least two that are running Windows 10 but can run Windows 11 as soon as someone selects to upgrade it. At an employer, it was a similar story: all the Windows user machines were running Windows 10, but most if not all of them met the requirements and could be upgraded when IT decided to do so. I don't know how many businesses are in that camp, but although I don't see the 5-year refresh as necessary, I have seen it enough times to know that it does happen somewhat often.

Satellite phones are coming, but users not happy to pay much extra for the capability

Maybe they should tell you what you're buying

I'm not very interested in satellite connectivity at all, but my interest level will change a lot depending on what I can do with it if I had it. So far, that has not been very clear. Is it that I can send an SMS if I position my phone just right? If so, that's great for emergencies, but as I'm rarely in the middle of nowhere getting into emergencies, and if I was I might bring something more powerful to resolve that situation. Is it unlimited data at speeds sufficient for me to send and receive email? Then I can do a lot more stuff outside of coverage range and would be willing to pay more.

Somehow, I think the feature set is somewhere in between these, probably closer to the first one. Without knowing what it is that they want me to buy, I can't possibly know how much I'm willing to have added to my bill to have the feature.

World Wide Web Foundation closes so Tim Berners-Lee can spend more time with his protocol

Re: Wrong

How about your pictures. The ones that a lot of social media users like to share? What do you think that will do to your connection, especially considering that users will likely not save them so if they see them multiple times, they'll download them multiple times.

Bandwidth is far from the only problem with this system. Among other things, it doesn't really protect your privacy very much as soon as someone starts to build services around it. Are we using a public model where anyone who wants can follow you? Then everyone who wants can download your data. Fine then, we'll make it private. Some small subset of the data is public and you have to approve anyone who wants access. In that case, it will be slightly harder, but a company could offer a service that will run on the data, then access the data of anyone the user follows. For instance, my company will offer a new program that will scan through your friends' images and run facial recognition on them to show you the ones that you appear in. That needs to run on our servers because the facial recognition models are too big to run on your phone (note to marketing, don't admit that it's really so we can copy all the data). Just give it access to all the pods you connect to, and it will generate those results and send them back to you.

There is also a feasibility problem. So you're going to host this on your computer on your home network. That won't work well for any people who don't have a desktop that's on most or all of the time. I'm guessing you have at least one of those. Now consider the people you know. How many people do you know who have only laptops and mobile devices? The laptops could do it if they were never moved and always kept on, but that's not the most common. I think we can agree that this is probably not being hosted off a smartphone. This will either mean that it's not really feasible to run it for many users or they will outsource it to an online provider. In other words, the way that these social networks started in the first place, because although anyone who wanted could host a website, it took maintenance and infrastructure and having a page on a social media site didn't.

That sounds like the theory, but if you put anything in the pod that someone actually wants, I wouldn't be that sure that it's easy to keep people out. Sites that you actually want to use will likely require access to everything in the pod. A lot of users will allow that. That site will then copy everything in the pod for local storage and perpetual access, meaning that you can at most cut them off from further updates, not continued access and abuse of old data. Those sites can coordinate to continue distributing your pod data. For example, it would be pretty easy for an advertising network to say that they'll target ads best if you send them the pod ID, and if they don't already have the pod data, they ask for that from the site on which the adverts are placed.

It also sounds like it will have the risks that any decentralized, sometimes self-hosted service does. All these systems end up having the risk that, if you make it properly secure, the average user has trouble working with it because it requires key management, so they either don't bother having it, get locked out of it, or leave it in an insecure state. Meanwhile, if you simplify things to try to prevent that, then you often make it easier to attack, for example authenticating it with an SMS which is costly and vulnerable to SIM swapping. I haven't looked into this project, so maybe they've actually fixed this problem, but I wouldn't want to bet on it.

AI code helpers just can't stop inventing package names

Re: The mark of true intelligence

Sometimes it does, but not enough, and only if your prompt takes a few forms. If you ask it a question, it might say it doesn't know, then tack on some suggestions, often not so useful, for things you could try. It's still a lot more common that it will try to answer your question with incorrect or irrelevant information. Sometimes, it even gets it correct. It isn't reliably wrong, just reliably unreliable. With substantial effort, you can get it to do some things frequently, but having seen how easy it is to get it to completely mess up, I would always be worried about the quality of anything it produced.

Personalized pop-up was funny for about a second, until it felt like stalking

Re: but ... how ?

It depends on the operating system in question, but you could open the task manager, select a new process, and invoke something that will open a box on the screen with your message in it. I would suggest msg, which can send a message box to another logged in user, but that would say who it came from so it doesn't sound like what was used here.

Extracting vendor promises won't fix cybersecurity. Extracting teeth might

Re: give them boring long numbers and watch their egos wither

This is simplistic. Sure, the worst vulnerabilities are in kernels or kernel-adjacent things. But when was the last vulnerability that comes to mind that let someone exploit that when they weren't already running, often at root, on the computer concerned? Most incidents started by exploiting a bug that was even sloppier in something not kernel adjacent to get onto the computer in the first place or tricking a user into running something for them. For the former case, you can blame developers of lots of other applications that do not run at the kernel level and probably don't run as root/admin. For the latter, you can blame the users themselves, but you could also blame the IT guys. After all, there are ways you can prevent someone from downloading and executing a binary, but a lot of administrators do not set them.

Before you pick your favorite and start blaming, know that there are reasons for each of these and they're not always applicable. IT could stop people from certain classes of problems, but only by slowing down their work, sometimes so much that it can't be permitted. Other times, they could add a protection and just don't care to do it. The same is often true about redesigning software; anyone can do a ground-up rewrite specifically intending to secure everything they can, but if nobody will buy it, then they're not likely to. Meanwhile, lots of developers have bugs that could be quickly fixed but they just don't bother. Trying to put this on one company or type of company is wrong in at least two ways: it lets some people off the hook for their own problems and it ignores the reasons why your targets have done what they have which prevents you from fixing even the part you're acknowledging.

Musk's Starlink rockets to 4 million subscribers

Re: Can bots be subscribers?

Probably true, but right alongside a major road is one of the more likely locations to have a wire going to it. Not guaranteed, but it's not the same kind of situation as some machinery that's well off any major road and away from any network cables. Some of those places don't even have grid power. Chances are that, if there is a cable going to it, some people are going to opt for the cheaper service even if it is an old one and the service is slow. If it's a faster line, that will be pretty much everyone.

Re: While the company has taken steps to reduce the visible brightness of the satellites

The problem with the analogy is that the largest risk isn't hitting something during launch. The greatest risk is hitting something some time during its life. Orbital changes to avoid collisions are already necessary from time to time with the number of things we have in orbit. The need to do that will only increase as tens of thousands more satellites are placed in orbit, and the risk grows that it might be necessary but not actually possible to do so, for example if more satellites suffer failures and no longer respond to commands to change orbit or begin reentry. As it becomes cheaper and more popular to operate large LEO constellations, this risk will increase and our attention to preventing or responding to it should as well.

Re: Did you know...

I'm not sure you're missing anything. There are two hydrogen atoms and only one star, so there are more hydrogen atoms. I think that's all the things to get.

Re: Can bots be subscribers?

Probably, in the sense that there are probably some industrial users who purchased Starlink connections to connect machinery that's not near a residence and may not be constantly managed. If you mean that the numbers have been exaggerated, it's always possible but I doubt they have been. Given Starlink's multinational coverage, four million doesn't sound like an implausible number to me.

Re: Did you know...

Molecules in a breath can be estimated by measuring a bunch of different people for their breath volume and humidity, then calculate the amount of gasses based on volume and pressure and assume that the non-gasses are mostly water.

As for estimating how many stars there are, I'll defer to the ESA on that one.

OS/2 expert channeled a higher power to dispel digital doom vortex

Re: been there..

In my example I posited a Mac, and when I managed to confuse someone into executing rm * it was Linux, but it makes very little difference to me what operating system I'm talking them through. Either way, there's a chance that they could badly misunderstand a CLI command if they're not familiar with the CLI on their own, and as the rm * guy should have been familiar enough not to run that, I'm cautious about that as well.

Re: been there..

If I had my way, I'd prefer to do any repartitioning myself. However, if that is not an option and I really have to choose between talking someone through a repartition task using CLI or GUI tools, I'm going with the GUI. This is despite the fact that if I was doing it myself, I'd probably use the CLI tools.

The GUI has more convenience functions for slightly less tech-literate people. Instead of device identifiers, you get disk model numbers and volume names. That removes one step, the one where I try to get them to properly associate a name with an identifier and can only guess whether they've done it right. There are a few more sanity tests built into many GUI tools. This may identify a mistake before its made, and even if it doesn't, getting some warning messages might cause the user to be more deliberate than the no warning messages generated by the CLI tools (yes, there is one but I'm not sure they'll remember that fdisk told them to "Be careful before using the write command." at the beginning of the process).

Maybe this is due to bad experiences I've had reading things out. Only recently, I was reading a password over the phone and had to stop the user several times from capitalizing random letters for no good reason. I've gotten someone else to execute an rm * by reciting a command, though I was pretty clear that there was not supposed to be a space between the * and the rest of the pattern. After that occasion, I started being very specific about whitespace, which makes reciting commands slower "d d, space, i f equals sign slash d e v--no, there is not supposed to be a space between the i and the f, I spelled it out because it doesn't actually mean if. Hang on what does your command look like right now? Let's start over.". I don't know whether this is due to a failing on my part or just general confusion that everyone will encounter from time to time, but I tend to provide written instructions first and talk them through executing them rather than speaking the commands.

Re: been there..

And where it gets frustrating:

Me: I want you to type c d, then space, then slash t m p.

Them: Okay.

Me: Did it do anything?

Them: No, it didn't.

Me: Do you have a new line at the bottom of your window?

Them: Yes, it's different.

Me: Type pwd and tell me what it says.

Them: It doesn't say anything.

Me: What does the bottom line of your window say?

Them: It says user@macbook:~% cd/tmppwd

Yes, part of that is on me for not being explicit about pressing enter. However, it makes me dubious about dictating commands that could do any damage. Okay, just execute the command df -h and tell me what disks you have before we repartition one of them. No, I think I want to be doing that one myself.

Re: You actually trust ChatGPT?

I generally don't trust it, nor do I use it. However, one of the reason why some people do trust it is that, if it's something that people asked often enough while it was being trained, it will generally get it correct. So if they're trying to figure out something they should be easily able to remember anyway, then the answer they get is likely correct. This will work until they ask something that's actually tricky or is related to something small or new. Then they'll get equally plausible-looking instructions that probably don't work.

That doomsday critical Linux bug: It's CUPS. May lead to remote hijacking of devices

Re: Why would anyone want this?

Because printers are somehow still awful to connect to, and to try to help this which sometimes works, they've included lots of hacks to make them automatically discoverable and usable. Otherwise, people who haven't gotten the full printer setup from IT tend to have a hard time using the printers at all unless they're still able to just plug in a USB cable, and sometimes not even then if the operating system can't find or doesn't agree about the driver required. When you consider offices where there is no real IT, or the IT person is not concerned with printers because they got lucky, this automatic setup is often the simplest way to get most of the people printing. That doesn't mean it's the right way, but printers mostly gave up on doing things the right way.

Re: What a fucking moron

And if someone nasty gets on your local network? For example, getting one device in your home or office network with malware on it which can now spread to any computer with this installed and run as root, you're fine with this? It only becomes a problem when the attacker can skip the first part?

The pervasiveness of the vulnerable component was overstated. The badness of the bug was not. I don't want that running on my machines. Fortunately for me, it wasn't. That is not the same thing as this not being important at all.

Re: Report to full disclosure in three weeks??

The general policy is to release the patch, but not talk about it except in release notes. Attackers have to monitor for code changes to see that a bug exists if they hadn't already found it themselves. Once it is available, then you tell people about the vulnerability and tell them to patch. Once people who see advisories and patch have had a bit to do that, then you release the proof of concept code. There are times when being ignored for long enough justifies announcing anyway, but three weeks while discussions on Github occur is not the same thing.

Re: this better be in the kernel

There are a few services that I would accept as included in "every linux system in the past decade" even if they're not the kernel. It wouldn't be literally every system, but if it was something that ran on most of them, I'd still accept it. In that list I might include SSH, iptables (related services rather than the binary that iptables typically refers to), Systemd, or the very common core libraries. If, for example, someone managed to get a bug into glibc which somehow attached to any network stream established by a program that used glibc, then that would be pretty bad even though there are some Linux systems that don't use it. To qualify as every one in the last decade, though, it couldn't have been a recent regression.

CUPS is not in that list.

WordPress.org denies service to WP Engine, potentially putting sites at risk

They can't prohibit WPE from using their software without changing their license and making it no longer the GPL and no longer free or open. That doesn't extend to using their website. There is nothing in the terms that forbids them from doing what they have done. As long as WPE can get the source to the software they already have, which they have already because it's PHP, the license is not violated. The spirit is in many ways, but the letter of the license has been followed. Depending on the market, that could be illegal for other reasons. For instance, if Word Press were large enough, this could be considered anticompetitive action that is prohibited. I doubt this applies either, but if it does, it is unrelated to the code license.

Word Press or any other project can put their code under whatever license they want. If, at the beginning, they wanted to put their software under a license that demanded payment from everyone, or demanded payment from some people while not to others, they could do that. They can, though I would dislike, change their license now. They chose not to and benefited by doing so. They can hardly blame anyone else when people use the terms they chose to apply to their code.

As for the FUTO license, it's a perfectly valid choice for FUTO or others to use. It's their code. They can do whatever they want. It will likely restrict development in some ways because it makes reproduction and modification harder. If I get the code to one of their products and modify it, I may not be allowed to use my own code in something commercial without paying them, whereas they may not be able to use my code in their version without paying me. We'd have to have a separate agreement assigning copyright or giving each other dispensations from the license terms in order to accomplish that. That kind of term can add a lot of friction to an open source community. I respect FUTO a lot for trying to thread that needle, whereas a lot of faux-open licenses have taken the freedoms that free software has entailed and trampled on them while pretending they didn't. I think the people who came up with this have the best of intentions, unlike some others, and I think they're motivated to fix problems. However, I'm not confident that their license succeeds at that and would act with caution if someone else owned code under that license.

Re: Stupid people….

There are a lot of managed hosting companies out there. Companies that will update their own servers, or at least you can't, so they had better be doing so. Many of them will also automatically update Word Press for you. Hopefully that is a good thing. The prices for such things are all over the place, including some who have a low-storage option below the cost of the typical entry-level VPS, usually because you're not getting your own VM but have to share with other users. I wouldn't be surprised that both of the hosting services mentioned aren't doing that and are quite expensive. I won't do a full comparison because I prefer to self-host and self-manage.

91% of polled Amazon staff unhappy with return-to-office, 3-in-4 want to jump ship

I have a feeling they think they can work around this. I.E. if someone is really important but will leave without remote working, they'll tell their manager, their manager will tell their manager, and eventually that person will get an exception and stay on. Of course, that doesn't actually happen because, even if exceptions are permitted, it's unofficial and quiet. Every time someone goes one level up in the tree, they have a chance for the manager they're talking to to decide it's not worth pursuing or to not know that such an option exists in the first place. The same way that Twitter fired everyone who wouldn't agree to ludicrous terms with almost no notice, then realized that they didn't want to fire some of those people, companies trying a blanket policy will lose people who assume they won't be listened to, aren't listened to, or can't get the company to respond quickly enough for their confidence.

Re: not again

It's not a very useful comment in most cases, and it doesn't really work here because who is supposed to stop whining? Is it the worker whining about not wanting to go in, or is it Amazon whining about the people who don't want to come in? There are some people who could come in easily and just don't want to, but there are others who have reasonably expected that they can work from a different location, having either been hired there or given permission to be there for whom the new policy requires significant changes. If this is your blanket policy for any policy change, it isn't a very useful one.

OpenAI to reveal secret training data in copyright case – for lawyers' eyes only

Re: Reproduction is prohibited

I was speaking sarcastically. I think those works should be protected and OpenAI and any other company that wants a license should pay for that license. That will expire at some point. If you've actually been building the dictionary for over a century, then the oldest versions will be in the public domain and deserve no protection. The stuff you did recently does.

Reproduction is prohibited

So when OpenAI has already gathered it, it must be protected at all costs because it's their sensitive property. When other people created it, it's free for anyone to use, even over the protests of those who actually wrote it. Seems fair.

If their code ever gets leaked, I hope they use the same terms: I can do whatever I like with it with no restrictions whatsoever, but anyone proving whether I did must never tell the world that I did it.

US Army drafts AI to combat recruitment shortfall

I think they're trying to find people who are more likely to listen to the recruiting message and eliminate people they wouldn't accept. Theoretically, if you could find people who are more likely to agree and who you would accept if they did, then you could spend more time convincing those people rather than going for mass campaigns. That could lead to hiring more people with the same recruiting budget. I doubt the AI they've got will actually give them that though.

Campaigners claim 'Privacy Preserving Attribution' in Firefox does the opposite

Blog post missing an important detail

The blog post from Mozilla, which most people wouldn't have known to read in the first place, provides some useful details about how this system works. I'm inclined to trust them on that part. What it doesn't say is why it was worth doing this. They describe the technology they've built and just stop, as if we already understand why such a thing was needed. Since I don't think such a thing is needed, because advertisers can already track the success of their ads by looking at their server logs for which links someone clicked on, and because I don't care about whether they have the tools they want or not, I am still in the dark about why this was worth Mozilla's time.

Musk dreams of launching five Starships to Mars in two years

Re: Just reality

The question is not whether it is theoretically possible to manufacture five Starships and fire them at Mars. People who have watched these more might have some idea how possible it would be to attempt and what would happen if you tried. It can be interesting to discuss. It is not the right response to this. The reason is that they're not going to manufacture five Starships and fire them at Mars. That would cost a lot of money and get you nothing at all. Not only are they not going to do it that quickly, they probably won't try to do it at all. They'll do actual tests on Starship, tests that don't involve going anywhere near Mars, because those have some conceivable benefit. Thus, promising to do something that is not going to be tried will get the cynicism because we know it's not an honest expression of expected actions, and we know that because we've seen it over and over again from the same source.

How to spot a North Korean agent before they get comfy inside payroll

In a lot of cases, they're applying to companies that are strongly remote. They might not have an office in the first place. In any case, I think most companies have stopped getting candidates to come interview in person. It's expensive for the company if it involves a flight and accommodations, it's hard for the candidate if they're working elsewhere, and therefore it restricts the number of candidates you can actually interview. Bringing them somewhere for an in person onboarding could be quite useful, though, as you only have one person you have to do that with. Refusing to turn on a camera, while I can see a few possible valid reasons, would raise a lot of red flags I'd want addressed before hiring someone.

Most of your other points would work well, although you could get around the traceroute by using a KVM instead of remote access software installed on the laptop. The article suggests checking for ones explicitly intended to route signals over the internet, but I could easily hide that so it looks like a simple local KVM with cheap commodity hardware (if North Korea is reading this, let me know, I'm sure we can work something out and there definitely won't be anything sneaky in the hardware you buy from me). Biometrics would probably lock the laptop to a person and require the person to be nearby, but they might be unpopular. Although fingerprint authentication has been an option on work laptops I've had, I've opted for non-biometric keys and prefer to do so.