Posts by doublelayer

UK's Investigatory Powers Bill to become law despite tech world opposition

Re: Harvest Away......Avoidance Is Possible.........

If they're looking, they would just run a query on the history: SELECT phone_number FROM calls WHERE name_known=false ORDER BY call_frequency;

There is your list of people who use burner phones. At the beginning, that's a lot of unknown callers and the query isn't useful. If they start attaching names to numbers, the list gets smaller and only consists of people who are intentionally preventing them from making those links. That is your list of people of interest.

And yes, there are ways to fight against that, just as there are for every other abuse. Those methods are more difficult, easier to mess up if you think you know more than you do, and more easily made illegal when only a small, easily scapegoated subset are doing them. For example, if the search is for numbers without names linked to them, you could get a phone under someone else's name, but that requires more effort and could become challenging to keep up, not to mention that another query could identify people with multiple numbers that behave in completely different ways (calling different people from different locations). Turning something like this into a 1984-esque infallible surveillance regime is nearly impossible, but turning it into something pretty bad is much easier.

Re: Harvest Away......Avoidance Is Possible.........

If enough people do that, they can always come back and ask for another law. You can use a burner phone now, but there are lots of countries that forbid them and require you present identification to have a phone number. They're not universally dictatorships either, though many dictatorships do it. Of course, that doesn't mean that every phone in the country has done that, but it does make it harder. They cannot make it impossible to get around some of this, but they can make it difficult unless you have plenty of knowledge and a lot of determination. The other problem is that if you think you have plenty of knowledge and don't, you could end up standing out like a spotlight. Just because circumvention is possible doesn't stop this from being a bad law.

Encrypted email service files DMA complaint claiming it vanished from Google Search

Re: Talking of blocking emails…

That is the challenge of running your own mail server. You have to be careful not to have even the smallest misconfiguration from unofficial standards, or you will end up on spam lists that are difficult to get out of. Still, you probably have a chance of doing that. The other problem is that many of those lists will still list you if someone from an IP range even slightly similar to yours does anything dodgy, including if they are hacked. It doesn't matter that their IP address is different from yours, attached to a different account, and your addresses have been operating under your control and without issue for years. Someone will still block first and ask questions later.

I have operated my own mail server before, and with relatively good results*, but nowadays, I let someone else do that hard work and just point my MX records to them. I don't like having to do this, given that I self-run all the other services attached to my domains, but if I need the emails to definitely arrive all the time, I don't have much of a choice. It might be different if I had a dedicated IP range for my services which I could keep clean, but I don't. I do wonder how aggressive this will be when IPV6-only servers eventually happen, because I am able to get my own IPV6 block more easily than my own IPV4 one.

* To my knowledge, my self-run server didn't get added to any spam lists. I was certainly able to send from it to Office365 and GMail. However, there were some smaller lists that included massive IP blocks which included my host. I had limited success applying to have my IP removed from the blocks. I knew it was only a matter of time before those seemingly unused blocklists would end up affecting something I cared about.

Ring dinged for $5.6M after, among other claims, rogue insider spied on 'pretty girls'

Yes, I mean the customers. I was replying to this sentiment:

"It astounds me how anyone (never mind that it is so many) thinks that cloud-connected CCTV on/in their home is a good idea..."

Sometimes, I feel the same thing. I don't want to use a thing and I just think that everyone who does must be wrong in some way. Telling people that they're wrong won't get anything done whether they are or not, and in most cases, the people who want a thing I don't have a reason why they wouldn't prefer the alternative that I do. If I want to change their minds or even understand why we have this difference in opinion, I have to look at it from their perspective.

The company's perspective is much easier to understand: they want money. Adding security to the code costs developer time, which means money. Adding security precautions to collected data slows down the work of anyone who has to access it, which costs money. Reviewing those who abused it would take time and might result in firings, and then they'd have to hire someone else, and that costs money. So they do as little of those things as they can.

If we start with the idea that they want cameras at all, and some people clearly do or the open source and private options mentioned in the first comment wouldn't exist, it isn't that surprising that a lot of users ended up with proprietary cloud-based versions. I don't want any cameras, and I'm fortunate not to need any, but let's consider this from the perspective of a nontechnical person who does want or need them.

You can build a surveillance camera on your own from available parts. So can I. The average user, on the other hand, finds that kind of effort difficult and does not see the benefits from the hardware. They are right; the version you build from a Raspberry Pi is likely to cost more, require more maintenance, and have fewer features than finding a company that mass-manufactures millions of dedicated devices. Even if they got one or used a prebuilt camera that only uses local network traffic to collect information, the server portion is inconvenient. If they have a camera on their house, they probably want to see through it when they are away from their house. The typical solutions to this challenge include making a VPN to your home network or renting a server and configuring it to allow remote access. Neither is convenient for someone who does not have servers already and doesn't know how to configure, secure, and maintain them.

Even if they did both of those things, some users may want certain information. For example, something to look for people approaching their house which notifies them, the ability to talk to a person at their door even if they're not home, and the ability to quickly share data from the camera with others if needed. A lot of that is difficult from a web app and would work better with native ones. Now we're into an area where it's not that quick for us to make that from scratch either and we'd likely look for an open source option, but the open source versions can't work with every device in existence because they don't have standard interfaces.

It is not surprising that people who want cameras end up buying the cheap products with software that can do what they want. It is disappointing that they do so from companies that have thoroughly violated their users' and everyone else's privacy. I hope that this is mostly down to ignorance of how bad companies like Ring have been for their users rather than failing to understand the consequences of Ring's actions. Still, we have to look at things from their perspective if we're going to fix things or even just correctly explain why they're doing the things we wouldn't.

TikTok ban could escalate US-China trade war, ex-White House CIO tells The Reg

Re: Who will actually lose out

People have lots of theories. They say it's about social media not wanting competition. They say it's about some content moderation decision. They say it's an attempt to affect the election. They say there is a real propaganda or privacy risk. I don't think any of these really do it.

Politicians have decided that China is dangerous, and this is a thing that a lot of people use which was created in China, so it must be dangerous. Exactly how it is dangerous and what you could do about it that would best reduce the danger are problems politicians don't want to bother with. Whether this law is legal is another one they didn't spend much time on. In their minds, it is a threat and they've done their duty in responding to it, and that's the level of detail they care about. It could actually be a serious threat, it could be completely harmless, or it could have potential problems that are being exaggerated, and it wouldn't matter to the people passing the law. They probably are thinking about whether they can use this as an argument when campaigning, but even this is not their primary concern.

BOFH: Smells like Teams spirit

Not really. Enter will nearly always send a message, and you use shift+enter to add a new line. There is an exception when it decided to make a list for you, but then you have to press enter to get out and again to send it. So basically, users probably aren't doing the multiple message thing by accident. I think they do it because, if you have to write a large paragraph, sending it in pieces means the recipient doesn't have to wait for you to type the whole thing to read it, but that's only of use if they're already in the conversation. Otherwise, it makes them want to avoid helping you instead.

Australia’s spies and cops want ‘accountable encryption’ - aka access to backdoors

Re: Given that---

We don't expect perfection, but we limit the powers because they aren't perfect. I am not perfect, so it would be a bad idea to let me do whatever I want without limit. A police organization is expected to do two things to try to improve how good they are:

1. Check on the people they hire and try to remove those who are consistently worse. People will have different ideas about how well they do this, but they clearly do not do it perfectly.

2. Limit themselves to conduct, reviewed by others afterward and, when important enough, before actions are taken. That way, bad ideas can be prevented and abuses can be detected.

Unlimited surveillance goes against the goals of point number 2.

Re: Assumptions -- No -- Never heard of them!!

what about "Innocent Until Proven Guilty"

Not a problem from the point of view of police calling for real encryption to be banned. They simply get the local government to pass a law saying that only a certain encryption algorithm (the one that doesn't work) is permitted. Now the people who use something else are guilty and can be treated as such. Various countries go through a cycle of proposing this every few years. Australia and the UK are frequent culprits. The US seems to ignore this particular pathway, having tried it back in the 1990s, and instead just allow their law enforcement to do whatever they want with people's data with very few limits. Either way, they don't see this as a big hurdle.

Re: Given that---

It's not only about killing people. It is also about imprisoning them. Or even charging them if they haven't actually done anything worth charging. Moreover, it's about accessing the communications they shouldn't need, whether that results in imprisonment or charges or not. For example, if a police officer with access chooses to look up someone they know just because they're curious, that person is not likely to be charged or imprisoned, but they have been harmed.

If the police don't kill innocent people ever, that is not sufficient. What you need to be certain of to make this in any way justifiable is that the police are infallible and will never commit any abuse, no matter how small, and will never commit any error that permits someone else to commit an abuse. Are you that certain of them? I'm not that certain of anything.

US government reportedly ponders crimping China's use of RISC-V

Re: Why Only Two

The sentence was referring to this earlier one from the same paragraph:

"At most, they could prevent US-Chinese joint efforts to develop a chip."

In a US-Chinese joint effort, there are at least two countries and no guarantee that there is a third, and if there was a third, it would be unaffected. The venture would simply have to remove either its American or Chinese participant. Other countries would not change this.

Some of those bodies are American, but it won't do much good. The stuff China needs to develop chips around an ISA are public, as in I can just download them from the internet and they already have. I don't think China would respect or even acknowledge a legal term saying they're not to do that. Politicians, as expected, have no understanding of what actions are possible or even what the things they say mean. I'm pretty sure that this request came from politicians reading an article that said something along the lines that "China may turn to instruction sets like RISC-V" and just assumed that they could do something to prevent that from happening, not bothering to understand what any of those big words mean.

At most, they could prevent US-Chinese joint efforts to develop a chip. There probably are some, but it's not going to have a big effect if they move all their operations to one of the two countries.

Huawei wants to take homegrown HarmonyOS phone platform worldwide

Re: I can't help but think I already know how this story will end ....

"I think last time they took one of the daughters of the CEO or something in custody for contravening regulations against selling stuff to Iran"

Your views aside, it could be worth explaining that, while she was the daughter of the CEO, her arrest was a bit more connected to the fact that she was the CFO of the company at the time of the alleged offense and at the time of her arrest. Your implication that this was punishing the family member for the actions of the company is misleading, even if you think the charges were unjust.

Re: Disappointing

They don't want an open source OS that their competitors could sell to Chinese users and people outside China still wouldn't buy. With one of their own, they can try to keep any additions to themselves, which means more buyers of their devices inside China. By the way, there's nothing unusual with that in the "Chinese mentality" area; Chinese companies are not well-known for universally caring about open source or trying to team up with one another, and that's true in nearly every industry. They can say all they like about wanting to export Harmony OS outside China, but I wouldn't expect it to work. Lots of companies have tried that, a couple of them putting plenty of money into the idea. They all failed.

There are only two ways that Harmony OS will catch on outside China:

1. Huawei just releases the current version of Harmony OS. That is to say, they release a standard Android phone and make sure it says "Harmony OS" on the start screen and settings app. Sure, it will have a Huawei app store and HMS running on it, but it's still Android. Even with this, I don't think it will work well, but there's a bit of a chance.

2. They seriously subsidize the devices to make them cheaper than all the competition, then aim for developing markets. If they don't get developers on board, they'll have to subsidize even more to get them below the KaiOS devices, and that's saying a lot.

I don't think they're going to do either of these, and therefore I think this attempt, if they're even serious about it, will go nowhere.

Shouldn't Teams, Zoom, Slack all interoperate securely for the Feds? Wyden is asking

This is Wyden. He is the one legislator who consistently pushes against such things and tries to get privacy respected. He's not the hypocrite here. This is probably not a good thing for the likelihood of this bill being passed, though, as his fellows have been ignoring his suggestions for decades.

Re: Interoperability

I think you're correct in general but incorrect about this. In this case, the bill simply requires that the government use an open standard instead of a proprietary thing. That makes it necessary for a standard to be created and encourages its use, but people are free to create an incompatible version and make it available. It just won't be purchased for U.S. government use. This bill will promote the existence of a standard, hopefully a good one, without enforcing it on everyone. I would support it.

Where I agree with you is when laws are passed mandating that nothing may exist that isn't interoperable with a standard. That prevents someone from choosing to give up interoperability in order to get some feature not supported by the standard. This is important to me because, for many of the things that have done this, the thing they wanted to include that wasn't in the standard was encryption, which is a feature I value quite a bit. It's also the most likely place where encryption will be limited by legislation. I think we should have the choice to build incompatible things, but I have no problem with the government refusing to buy them.

Samsung shows off battery tech it says will see you gone in nine minutes

There still might be a size or density problem. You can get massive batteries in phones now, but they make the phones bulky and heavy. This kind of battery may not change that, even though it would be more reliable. In fact, there's also a possibility that the low voltage and draw of a phone would make the benefits less noticeable.

Musk moves Tesla's goalposts, investors happily move shares higher

Re: "and people can add their private Teslas to the available pool"

In fairness, there could be a sort of insurance program to deal with some of that, where if something happens to your car, you can swap it out for one of the other cars in the network while they organize a cleaning, and you pay for this by collecting a lower amount when your car is rented out. I don't think they'd actually do this, but it's a problem to which a solution is conceivable. Compared to the other problems with the idea, this one looks kind of small.

The major problem as I see it is that the cars can't drive themselves at all, have not been able to since the first time Musk said they could, and aren't improving. Most likely, even if they got a bunch of really smart programmers, they'd need new hardware to get anywhere close, which means all the existing models wouldn't fit into the network. That makes getting tens of millions of them in 5.5 years hard to imagine. Then again, Musk has been promising self-driving for a long time and people still talk as if they believe him, despite that Tesla has never been the leader in self-driving cars and the companies that actually do it don't look great at this point either, so maybe the problems that we see are still being ignored by some people who clearly have a bunch of money to throw at their delusions.

Misconfigured cloud server leaked clues of North Korean animation scam

Re: Follow the money

"At this point it's in China's interest to have the Koreas reunited as this would end the USA mandate to be on the peninsula and China's no longer desperately poor compared to SK"

The assumption is logical, but there are other reasons why China might not want that to happen. For one thing, if North Korea ceases to exist, nothing says the US would definitely take their forces away or that Seoul would ask them to. In fact, if they continue to have an alliance, it could mean that US forces end up moving to the north instead, putting them even closer to China's borders.

China does not have full control over what North Korea does, but it can encourage some activities and motivate Pyongyang to do what it says. This may be useful in a variety of ways. The typical example, and one that is plausible but only relevant if China changes their plans for Taiwan, is using North Korea as a distraction if they conduct a military operation. For instance, if they can get North Korea to start something when they invade Taiwan, then US, Korean, and Japanese forces would be divided, possibly diluting their ability to counter an invasion of Taiwan. There is also the fact that North Korea and Russia have closer diplomatic ties and that Russia doesn't really want to see North Korea cease to exist. North Korea has been playing Russia/Soviet Union and China off each other since it was founded, being sort of friendly to both while seeing who would give them the most, and they're likely to continue doing so.

Re: A DPRK IP address, you say?

What do you think they'd be allocating that space to? Internal stuff gets internal IPs in the 10/8 block. The small block also means it's really easy to do intensive portscans of it at all times.

A quarter of 5-7 year olds now use smartphones, says regulator

Re: How the great rewiring of childhood is causing an epidemic of mental illness

"Is my life better today because I played rough sports and my goto tech in high school was a pocket slide rule? Yep."

The problem is that you don't have any real way to know that. Your experience is that you played those games and didn't have a computer and you wound up fine (I'm guessing), but that doesn't tell you what would have happened if you didn't play them and did have a computer, and you still could have been fine. Parents of children these days may use the same logic when they say "my child had a phone when young and they're fine". For many of them, this will be correct, and proving that they would have been better without it is not going to be easy. I had a computer when I was young. I think my life is fine. The parts that are worse are difficult to blame on the existence of computers or my access to them.

As with both examples, there are cases where someone doing those would not be fine. People have played rough sports, as you call them, and come out of it with serious injuries. I know someone, for instance, who through a combination of a medical problem and injuries sustained while playing a sport uses a wheelchair. They may be looking back at their lives and regretting that. Many others will use technology in a dangerous way and suffer some bad consequences as a result, and they'll likely also have regrets they can do nothing about. We have to have more reliable data before pronouncing something as definitely good or bad for a child. Anecdotes will be there for both directions on almost every experience a child can have.

Tesla Cybertruck turns into world's most expensive brick after car wash

It strikes me that an item that's supposed to be used outside should be able to handle water without creating an electrical hazard. I suggest keeping the high current stuff away from the part the water hits. If your desktop computer was advertised for outdoor use, it should handle the same.

EU tells Meta it can't paywall privacy

Re: And how would that work?

"#1 Falls at the most basic function: how do you ever find accounts to follow in the first place."

How do you find sites like El Reg to read? You look around, find someone who recommended them or a link going there, take a look, and decide it's worth your time. Your friends could say "Just saw an interesting post about [topic] on the feed of [user]". You think that sounds nice, so you read the post, and liking that, you follow [user].

"But also, people want to follow what’s fashionable. Insta, by definition, finds people who are “like” them, and suggests them fashions they want to follow."

See options 3 and 4.

"#2 You are just outsourcing the discovery mechanism to “a trusted influencer”. We used to call these “TV channels”."

No, I'm outsourcing it to everyone. All of your friends would be used to create the thing. You could then control certain thresholds. Remarkably like now, but you're only using public information to do it.

"#3 “Asking you to suggest what you’d like”. I think you’ve just reinvented the search box….we used to call that Google."

Automatic searches based on voluntarily given information. Predicted results rather than results tailored to a search term. If I use the search box, I only want to see things relevant to this query I've just entered, not earlier ones. With a predictive algorithm based on content I've marked over many previous days, it's very different than a search box. In fact, nowhere in my proposal was a search box. You could have one, but you could leave it out and still follow my suggestion.

Re: And how would that work?

"what would “your Instagram feed” look like without tracking?"

I have some ideas they could try:

1. A list of posts from the list of accounts you selected to follow with a sort box on the top so you can pick between various methods of ordering them (newest, most positively reviewed, most positively reviewed by a lot of people, most reviewed by people in any direction, any other sorters you might find useful).

2. A list like that, but in addition to those posts, you see posts from other accounts that are linked to the accounts you chose to follow. This would use public information like which accounts those people chose to follow.

3. A personalized feed of posts picked by asking you to voluntarily give them some information about what you like so they can search for it. You could push some buttons instructing their algorithm what you like and what you don't like, and various programs could scan for patterns in those then predict whether you'll like certain other posts. They don't need to base that information on what someone else liked if they can use an algorithm on the content. You could deliberately indicate these things instead of collecting and using other pieces of information like how long they think you looked at a thing.

4. An anonymized collection linking views and followed posts, but without including user IDs. It doesn't help when you want to see the full history of someone's actions, but the point is that we don't want them to see a full, or partial, history of someone's actions, nor do we want anyone who breaks in to have the ability to retrieve one.

I don't use Instagram. Do any of these look workable to you?

Unintended acceleration leads to recall of every Cybertruck produced so far

Re: "press the brake pedal if the accelerator ever gets stuck"

I think they're just making sure the obvious is said because they don't have anything more confident to say. Not that pressing the brake means you're necessarily out of danger from the situation it got you in, but it's more likely than anything else to result in the outcome with fewer fires.

Software glitch saw Aussie casino give away millions in cash

Theoretically, he could have found some unclaimed winnings certificates, gone in to redeem them, and then got some free money and decided to give up. While possible, it doesn't strike me as the most likely way this could happen.

Google fires 28 staff after sit-in protest against Israeli cloud deal ends in arrests

Re: > punishing people for their political beliefs

That's not exactly what they were saying there. Their point was that resigning in protest is a way of demonstrating how much you value a certain opinion. If my employer does something I slightly oppose, I won't resign, but they can do something egregious enough that I would. Of course it comes with costs, because that's kind of the point. If standing up for my views was free and everyone did what I talked loudly enough about, we'd live in a very different world. If only my views worked that way, I think it would be a better world. If other people's, probably not. Choosing to obstruct work, whatever level of disruption it was, also comes with costs. I don't think the people who did it are surprised that Google reacted negatively to the actions, even if they disagree with it.

The point of the protest was to get the attention of the company, which succeeded, but it evidently didn't convince the company that they should change plans the way that others have. I'm guessing that is because this protest had a smaller number of people and likely, given that police were called, involved more active disruption (some other protests have been walk outs instead, for instance). They can try disputing their firing, and whether it is ruled legitimate or not will come down to exactly what they were doing in the buildings. I only read this article, so I have very few details about what that was. Google's statement alleges facts that won't be good for them if proven true, whereas theirs just says "peaceful" which is great, but not exactly the only requirement for a legally protected labor action.

Debian spices up APT package manager with a dash of color, squishes ancient bug

Re: Is it just me...

We probably all read acronyms differently. DNF doesn't read as anything to me. I just see three random letters. In fact, though I've been using it for years, I had to look up where they got the name. Wikipedia says it comes from "Dandified YUM". It also tells me that YUM came from "Yellowdog Updater, Modified". Maybe I was correct to assume that they didn't stand for anything useful and I could continue to view them as random letters. So many terminal commands are randomly chosen and just have to be memorized that I've stopped looking for patterns. For example, in Arch, the package manager has rather a good name, Pacman, but the update command is pacman -Syu. I could try to remember that -S means sync (which in English means install), that -y means refresh (I guess they ran out of letters), and that -u actually does stand for update, but I mostly just memorize what the letters do and ignore what unmemorable mnemonics they're supposed to have.

Novelty flip phone strips out almost every feature possible to be as boring as possible

Re: Next up....

That would be pretty easy to build. Run it all through the USB connection as a keyboard and audio device and you're looking at a pretty basic case and electronics. The only part I don't know about is whether the RJ11 connection needs any custom controllers, but given how old it is, I somehow doubt it. Now all you have to do is find enough people who want one to make funding it worthwhile. I don't want one, so maybe croudfunding could find people who do.

A lot of modern flip phones have WiFi. Yes, they also usually have a basic web browser, but you are free not to use it, and if I remember correctly from when my friends showed me the experience of using a flip phone to browse, you wouldn't want to use it anyway. There are many phones more capable than this one but without the interfaces of a normal smartphone, so they can often let you opt out of smartphone activities because they either can't install apps or can install them but you wouldn't be able to use them well.

MPs ask: Why is it so freakin' hard to get AI giants to pay copyright holders?

Re: Begging the question

That's not getting back to the original point. That's getting your original point back out and just starting over. I and others have explained, at length that:

1. The issue is more than the LLM "remembering" the work. It started before any training was run.

2. There is a massive difference between an LLM remembering something and your brain doing it.

3. There is another issue between the LLM's later use of the work and you simply remembering it. Some of the problem is about this later reproduction which is what they're using LLMs for.

4. You do need to pay the copyright holders either directly or by proxy (buying a secondhand book for instance) if you do anything remotely similar to what they did, even if only using your brain.

5. All these points have been explained to you.

Re: Begging the question

Both of those adverts are intentionally shown to you. There is no infringement. What I'm referring to is intentionally finding and reading an unauthorized version of a work. If you go to a site that distributes unlicensed video, and all you do is watch the video, you've done something illegal. In practice, you'll generally be safe from consequences because people don't really care and those who do are too busy with those who distribute those copies.

There are, of course, exceptions to this. If someone else obtains a copy of media illegally but you don't know that, you'd be able to correctly say that you didn't have mens rea. There are plenty of reasons why you could end up seeing something you weren't supposed to but it isn't a crime. None of them apply to AI companies who wanted to use some content and deliberately obtained copies of that work. Nor would you be off the hook if you deliberately downloaded work, knowing that the copies were unauthorized.

Official: EU users can swerve App Store and download iOS apps from the web

"IBM earned more than $1.7bn last year from technology framework subscriptions, which is essentially the same thing as a Core Technology Fee."

No, it's not. I can use a language of my choice, compile for IBM's or Microsoft's operating systems, get a binary that runs on them, run it, distribute it, and sell it, all without having to pay them. Apple's not charging for technology. They're charging for the right to let their users obtain and run it. I have been an Apple user. I am not Apple's to sell.

Re: If people want to side load crap onto their phone, they can buy an Android

From the point of view of an individual consumer, Apple's market is a monopoly or irrelevant. It is not the same as a single store. When someone buys an iPhone, they become unable to choose another store unless they replace it. If one store offers something, they generally don't get to lock me in there and tell me that, even though there is another store selling the same thing across the road, I can't use any products from their store with any products from that store.

As for the smartphone market as a whole, while it's not the one the law is talking about, Apple have an oligopoly position. Market regulators usually also regulate those. The laws are usually written specifically to let them. The reason is that, when a market has two real competitors in it and they start to adopt suspiciously similar terms (Apple and Google have a lot of the same terms in their store agreements), then there's not much difference from a normal monopoly. So they also get to regulate the phone operating system market under those rules, such as, for one example I'm just randomly picking out of the air, rules on app distribution that apply to all OSes for mobile phones.

Re: If people want to side load crap onto their phone, they can buy an Android

Governments are supposed to have monopolies on some things, like making laws or sentencing people to prison. That's what we're going for. So yes, well spotted, they tend to be one. Of course, when we see a government trying to have a monopoly or even get involved in something we don't want them to, we complain and try to prevent that from happening, just like we complain when Apple tries to. I'd say our track record on getting results is higher for governments than it is for Apple, though not dramatically.

Re: Time ticking also for

Yes, not being able to remove something is exactly the same kind of issue as not being able to install any competitor to that thing. There's a minor difference in scale involved. As long as I can still install Firefox, set it as default, and ignore Edge, it's not a big deal to me. Yes, the links in the settings will still open Edge, which is annoying. However, I have a recommendation to you. Don't click them. Even if they open in Firefox, they don't send you anywhere remotely useful.

IOS's lack of choice is actually a lack of choice. Microsoft's preinstallation doesn't prevent you from choosing something else freely, nor does it make it harder to do so.

Open sourcerers say suspected xz-style attacks continue to target maintainers

Re: New maintainer criteria

I think that meant to say that the maintainer, before being added, had submitted clean code and was therefore accepted. You still need to review the changes they make after being added as a maintainer to see if they switch. It's easy to write cleanly when you're not hiding something and just getting yourself into the position to be able to submit something dangerous, and it's impossible to determine between someone doing that or someone just trying to submit good code until the time they submit something bad.

Re: Dependency

I note that you didn't answer my first and larger question: which of Apache or the Linux Foundation are you also blaming and why?

I also note that I said nothing about my opinions of systemd, but you have jumped to conclusions that I have no objections, then jumped to another conclusion that I "seem blind to appalling defects and fundamental flaws". I may oppose systemd's use as well, but by deciding based on no evidence, you confirm that we cannot actually discuss the related but not identical issue of whether choosing to use it should be a blight on an entire organization rather than, for example, the group that chose it alone (many Debian developers work on something unrelated). If you insist on seeing any questions as opposing points you didn't even make, a discussion seems precluded. You would still be capable of answering question number 1, though.

Re: Dependency

Just checking, I see why you blame Debian for adopting systemd. I can even see why you include Canonical, even though their use of systemd is mostly based on Debian doing so. But which of the other two are you blaming for it and why?

There's another question of why choosing to use systemd makes them ineligible to do anything else in your opinion, but I'm not sure it's a discussion for which we'll find a common starting point.

It's not even just the other developers. End users can be pretty demanding as well. It doesn't take that many of them for those doing the work to start getting annoyed at their users and withdrawing from user-focused channels. Nor is it at all unique to open source software, but there's a bit better of an argument for customers of a company to feel they deserve the attention of that company's staff. I don't think we'll ever find a solution to that, but I'm all ears if someone else has one.

Open source versus Microsoft: The new rebellion begins

Re: The 3 assistants with fantastic people skills who effing hate computers

"This is not IT changing everyone to Linux. This is the state government changing everyone to Linux."

True in this case, although it's state government IT changing state government everything to Linux, so they'll probably be involved. In this case, the large change is likely being run from higher levels, so their IT offices will probably not need to do all the training. My training-specific comments were more relevant to individual companies switching over which I was referring to because comments here have referred to the general case.

"BTW, who trains your users when Windows upgrades change things?"

IT does. Fortunately, working on a programming team means they don't have to do much for me or those I interact with. IT trusts us to do all sorts of things and rarely has to get involved in anything. When people who know less, especially seen in less technical companies, get confused by interface changes, it is an unfortunate IT employee who is usually sent to clear it up. This may be one reason why IT doesn't really like to update things with UI changes.

As it happens, I don't. I develop software on Linux servers. There are times when it gets tested on Windows, but often, running on Windows is not required and I am free to use Linux-only interfaces.

If you understand what I'm saying, you may find out that I'm not saying "switching to Linux is bad" or "you can't switch to Linux". I am saying that switching to Linux is hard, and that if you want to do it, you will have to have answers for them. Dismissing those hard things will only lead to wondering why nobody accepted your change request.

"I'd be asking more questions about what they produce that can't be replicated with a good program."

Usually, the answer is nothing. However, hiring a programmer and giving them the information necessary to make a good program seems expensive, often more expensive than it really would be, and the Excel guy is trusted and more obviously needed. Sure, if they hired a programmer they could automate this and be on their way, but then the business asks what they'll do if the process implemented by that program changes. They're used to calling on the Excel guy who can change the spreadsheet quickly enough, and they're worried about how long it will take a new programmer to understand the code, understand the process, and implement any changes they need. The Excel guy is also capable of doing other jobs in between maintaining and operating those spreadsheets, so they probably can't be entirely replaced by a programmer.

This does produce inefficiencies, but businesses don't necessarily know how much they could improve unless we tell them. This was the point of my original comment. I didn't say or mean that there are no benefits to adopting Linux or retiring spreadsheets. I didn't say or mean that the costs definitely outweighed the benefits. I did mean that, if we want that to happen, we will have to explain why our option is better, how they can benefit, what they will have to do that will hurt in the short term and why our version is worth doing it, and using business-focused examples rather than saying "Microsoft is just bad" because they don't necessarily agree and don't really care.

Original: "The 3 people who live in Excel all day for whom replacing it would be a stupid waste of time and money."

Reply: "First 3 - make them redundant."

By definition, those people are doing something useful. If you make them redundant and easily hire three new people who can use other tools as well or better, have the institutional knowledge, and take over, great, do that. You don't have those conditions. The people who live in Excel may not understand a lot about computers, but they usually understand a lot about whatever is in those Excel spreadsheets. If those spreadsheets are pointless, then they're not the people asked about in the original question.

So the original question, what do you do about people who are productive and necessary using Excel but either unwilling or unable to become as productive using LibreOffice, what are you going to do about it? If the answer isn't cheap or simple, it's unlikely to get past management when the relatively cheap and simple option of "buy some Excel licenses" is on the table. I've seen a lot of people who seem confused about why businesses aren't switching to Linux where the answer is that they've not even tried explaining the benefits and costs from the company's perspective. If you can't do that, it won't happen. If you can do it and don't, it usually still won't happen. "Benefits" in this case does not include things like the ideals of open source. We care, they don't. They're interested in time, money, productivity, all that stuff. If your costs are going to include firing three people with a lot of institutional knowledge and finding and training three new ones, you'll have to have a big benefit to balance that out.

Re: The 3 assistants with fantastic people skills who effing hate computers

It depends on the desktop in use, and I don't have a full list of which ones can do it and which ones can't. However, I was attempting to make a point about how very small details can end up being ridiculously important to some users. Perhaps it will turn out that any desktop environment on Linux can do keyboard shortcuts just like Windows has, but there are a hundred more tiny things that a stubborn user can complain about. One of two situations will occur:

1. You spend 5 minutes * 100 UI things to painstakingly customize it to look exactly like the machine they used before.

2. You spend probably a few hours training them to use something else, then another hour when they break something, and you hope it ends there.

Either way, change is painful. I'm perfectly happy changing anyway, but as a programmer, I get to hide in my text editor while some unfortunate IT person has to make sure that people understand how to use their machines and that reduced productivity is not being blamed on them. My comment was in response to someone who said that switching from Windows to Linux shouldn't hurt for someone who hates computers. Yes, it absolutely will hurt, as would changing the other way, or changing basically anything else. That's what is not fun about people who hate computers and have to use them anyway.

Re: The 3 assistants with fantastic people skills who effing hate computers

"Assuming you worked in IT it wasn't your job to train them - that's the responsibility of the functional manager."

I wasn't in IT at the time. I was a programmer, working for a different company. I was volunteering some programming work for a charity, and while I was there, an employee of the charity ended up drafting me to look at the machine concerned. So you are absolutely right that it wasn't my job, as it wouldn't be the job of IT. Yet, when IT makes a change, they will be expected to train people, whether it's logical or not, as proven by the times when IT didn't make a change and they're still expected to train people. Pointing out that it shouldn't happen doesn't prevent it from happening nonetheless.

If IT switches everyone to Linux, they'll undoubtedly be doing some training. A lot of people will have questions and confusion that they won't figure out instantly. IT decided to make this change, so they'll have to handle it. It's not that illogical to expect it. The trouble is that, even if that initial training deals with many of the users and they can carry on without more help, there will be some who need a lot more help, and IT has already demonstrated that they can train people on this new system. The work will end up on their list. They should plan for how they will handle it because they don't really have a realistic way to choose not to.

Judge refuses to Ctrl-Z divorce order made by a misclick

Re: Presumably they were already 'getting' divorced

I am not familiar with British marriage law (or really marriage law anywhere) and the article doesn't make this clear. If there is no effect on monetary or family matters, why does anyone want this undone in the first place? If this judgement was already a certainty and it was just a matter of time, what was the result of it being submitted early and what would be the benefit of having it reversed if it would only be repeated? If the answer is nothing, why not just consider it done early?

Torvalds intentionally complicates his use of indentation in Linux Kconfig

Re: Semicolons and curly braces, forever.

Indentation is many things, but invisible is not one of them. If you can't recognize whether a line belongs in the statement, then it won't help if the statement has a curly bracket at the end or not. The problem isn't knowing where the statement ends, but knowing whether an expression should be inside it. There are lots of reasons why syntactic whitespace is annoying, and I would not include that feature in a language I designed*, but you cannot file it under "something that you can’t see can be syntactically significant".

* I might warn about it in my compiler because I've seen some truly horribly indented code in languages where it is unnecessary, but I wouldn't make indentation control flow. Brackets help prevent people from making mistakes that they have to catch later because a compiler cannot know what structure is appropriate. I'm confident that programmers can do that without brackets, but having them makes it less likely that they'll get into that situation in the first place.

Roku makes 2FA mandatory for all after nearly 600K accounts pwned

Re: Credential stuffing and password spraying

"Hmmm... If only someone could develop a sign in that makes you wait half an hour if you put in the wrong password 3 times in a row. Hmmm...."

That helps with spraying, but not so much with credential stuffing. If people reuse passwords and they get found, it's one try per account. Your rule has to count attempts on any account fast enough to realistically block IPs in a worldwide distributed system, and they will IP hop if you do it. Taking some steps to detect it is useful, but it will never be as effective as a user not reusing passwords, or at least not on accounts with sensitive things like active payment methods.

Re: Credential stuffing and password spraying

They didn't mean denial of the site's service, but of the account's service. Let's say that I manage to get your email address used to sign in to these forums. I deliberately enter it on the login page with three random passwords. Now you can't log in for the next half an hour. If I wait and do it again, then you're locked out again.

Fine, so to solve that problem, we do it per IP address. Only my IP is blocked for half an hour. So if I'm password spraying, I get a lot of IPs and try three from each of the nodes, then cycle onto another one. If I rent a rather small thousand-node network, I can test an average of 100 passwords a minute. The spraying attacks most likely to work aren't trying to brute force every set, but using a set of common passwords or ones they already know you use.