Posts by doublelayer

A license to trust: Can you rely on 'open source' companies?

Re: This will be really unpopular, but

I can't say I agree with your suggestions. Open source software means you are intentionally forgoing a lot of the nice options that come with proprietary software you own and can use as you like. It has always meant that, it should always mean it. In turn, it also excuses you from a lot of the problems that proprietary software tends to have, like your customers thinking you owe them support and having consumer protection law to use against you, and it also tends to bring in a lot of users who appreciate the software and contributors who improve it. I'll respond to a few of your points in particular:

"From what I remember of Elastic's licencing model change it was basically "We're not getting enough on the premium / managed service, and AWS is riding on our coat tails taking alot of this business without any financial compensation coming our way" Granted that there was no obligation for AWS to give Elastic anything, but elastic still has to survive."

The article addressed this. Elastic was worth about $14B. This is not the picture of a company that just can't survive because mean cloud providers weren't handing over more cash. AWS didn't give them money, at least as far as I can tell, but they did contribute code changes which are expensive for Elastic to make. They did get value from the relationship, and as you correctly said, they chose a license where nobody had to give them anything and still managed to be successful. Of course, they have a right to do what they did, but it's not going to make me think well of them.

"Perhaps some of the open source projects should have non-mandatory suggested licencing costs to bring social pressure on some companies to pay a fair amount for open source projects."

Sure, they can and do suggest donation amounts. It doesn't really change what I choose to donate. I donate based on my interpretation of the work they do and the value I receive, and one of the great things about open source is that I don't have a responsibility to pay their costs just because they feel like it. They can't claim to be surprised, since this has been clear since the 1980s with tons of examples in the past. Oh, and one other thing I tend to consider before donating to an open source project is how well they're doing already. I have limited funds, so if I have a choice to donate to projects with a small budget or ones that have billions, it's usually the small one that gets my cash. This isn't hypothetical. I have a few regular donations to open source projects, and they tend to be projects where the contributors do a lot of poorly-paid work which my donation can help with. Projects where the official organization doesn't do the complex work because some other contributor is doing it or organizations that already make a large chunk of money from their commercial operations don't need it as much, so I donate less or nothing.

Re: Puzzled....

There are a lot of methods you can use to try to find your library in someone else's program. This ranges from the easy to check for and resolve: do they include a copy of the library in their program's folder as a .so, .dll, or similar format. Some of them are a bit harder: if they have statically linked something and removed names, do they have similar or identical messages, function names, etc. Some of them are difficult to check for and hide: do their code have machine code that would be produced by a compiler running on your code, indicating that they're using either the same or similar instructions. In most situations, you don't have to do the hard part; if you already have reason to suspect that your code is in there, you can probably find out quickly.

The reason that this doesn't happen often is that we rarely get told about it. If I have something public under a GPL license and someone violates it, I will probably not be told that they're doing so, so proving that they do will fail at the first step of knowing anything about them. That works for a company that wants to avoid license requirements or more frequently a company that doesn't bother thinking about license requirements, but anything big enough will consider their obligations and at least have a legal argument if they're not going to be following that license.

In this license situation, people could always just ignore the new license and use it as before. The problem is that many of these are using software that is popular among large companies, either for their own use or because they rent hardware and people like to run it. In either of these situations, you don't have to look too far for a list of places to check because providers will have to use the name of the software so people know what is available. If you had done this license swap with a program called ExampleDB, you could probably just do a search for "cloud provider ExampleDB" and get a list of targets.

Re: This will be really unpopular, but

Nothing stops you, and sometimes that happens. However, when it does, it tends to result in stupid fights between different groups. For example, when Amazon started a project to fork Elastic into OpenSearch. Some people assumed that Amazon was being malicious, a lot of people attacked them for making money on renting out hardware on which that software ran, and Elastic took as many steps as they could to make sure the new version of Elastic Stack wouldn't work with that version. This meant that people who used either version was now dealing with a bunch of people who had strong opinions about what should be used and a company intentionally trying to break things for one side (doing so by breaking things for their side as well because changes to one program will always affect its users). So yes, it can be done, but there is a reason why people aren't always pleased about the opportunity.

Stalking victims sue Tile and Amazon for negligence over tracking tech

Re: The greatest concern

The attempts to continue running were intentional, because one of the features their system has is having phones look for trackers that have been lost, including yours, so they can point out their location to you if you ask later. I don't mean that you have to like that or even use the product. I don't have Tile, Apple, or any trackers myself. However, if your complaint is about the app trying to continue running, it's useful to know why it is and it is also useful to know that AirTags are exactly the same. The service running them doesn't have to do any tricks to continue running because Apple baked it into the device, but everyone who has AirTags or hasn't specifically opted out of the Find My network has a service on their IOS device that is running at all times, exactly the same way that Tile's app would.

LG's $1,000 TV-in-a-briefcase is unlikely to travel much further than the garden

Re: What next?

If you can manage it, I'll consider it. At least with that, it would enable someone to take something that's quite large and ungainly and make it smaller. With a television, you take a screen and make it about the same size, so nothing gained. A screen and a battery are not that many things, so it wouldn't be that hard to get those things and put them into a box yourself.

Western Digital sued over claims of data-trashing SanDisk, My Passport SSDs

Re: Western Dataloss

Since you mentioned it, when you've opened them up and retrieved the magnets, what do you do with them? I have a few of them sitting around, and while they're a bit handy if I ever need a magnet that's relatively strong and I don't mind having a really ungainly shape, that kind of situation doesn't happen very often.

Re: There's an opportunity there

Admittedly, these portable SSDs are a way, if an expensive one, for people to make backups. When I've gotten people to start backing up, it would be more convenient to get them using a RAID array and automatic backup software like I've got, but it's also a lot of work, expense, and network configuration. Buying an external hard drive and remembering to copy stuff to it periodically and leave it in a safe place is easier and still counts as a backup. If their complaints are correct, then someone doing a simple backup might find that their backup has failed at the time they're trying to use it to restore. It's a bit badly targeted to complain about users not backing up when the problem is failure of backup drives.

Re: Cue the litany of complaints

I definitely commiserate about those reviews. They make judging the quality of any storage device nearly impossible, because you'll be inundated with confirmation bias of people who only ever bought $manufacturer drives (all three of them) and they all worked great, or they bought two other drives from $other_manufacturer and they both failed (possibly in reasonable failure cases because there are no details provided). At some point, you might end up just buying whatever device is the cheapest made by a manufacturer you're confident is a real one and not someone selling refurbished drives as new.

However, I have seen this particular problem noted in a number of places recently. I can't throw any anecdotes in myself as I don't have this or any other portable SSD, but if anecdote frequency means anything, there may be something more to this malfunction.

Boffins reckon Mars colony could survive with fewer than two dozen people

That's a safety limit, not a safe background level. Long-term exposure to radiation can expose you to health risks even if the short-term exposures weren't high enough. For example, the daily limit for a member of the public is 1 mSv/day, but for radiation workers, who are more frequently scanned for problems, it is only 50 mSv/year, and at 100 mSv/year, there is at least some statistically significant increase in cancer risk. 1 mSv in a day is safe, but 1 mSv every day is less safe.

If you were experiencing that level of radiation unshielded routinely, you would be exposed to the equivalent of a couple hundred dental X-ray scans each day. It is also about three times as much as a nuclear power plant is allowed to release in a year, which is why they're so safe to be around. You wouldn't want to go unshielded routinely.

Re: Why do people call a small outpost a colony ?

Admittedly, so would equipping the airlock with safety systems to prevent that from working, for example by not allowing multiple people to fit and requiring that the person inside the airlock activate the open out function. Old fashioned methods of murder like stabbing or striking are still available though.

Re: Why do people call a small outpost a colony ?

I think your approach is very good, but I disagree with this bit:

"The Norwegian resupply voyages were probably on the same order of time, cost and difficulty as a routiine supply by spacecraft today."

Somewhat expensive, yes. Also a chance it might fail to arrive and be lost entirely, yes. Similar difficulty, I don't think so. They already had ships which they used to sail around a lot, and they had at least a few places where they could stop mid-journey to make repairs. I don't know how long such a voyage took either, but voyages from Iceland to Greenland at the time appear to be rather short, although quite dangerous. Clearly, supply from Norway itself would take longer, but not anywhere near the time requirement of a supply run to Mars. One of the possibilities of other problems causing the collapse of settlements on Greenland were pirates operating from more southerly parts of Europe, and if people can make that journey without owning that colony just for the trade and plunder, then it's not as hard as a space journey is now.

Re: "neurotic, reactive, social, or agreeable"

I think the psychopath would consider what things would be like after the killing ended and they were now stuck without anyone else, and then nobody will be sending new supplies because they'll either think that everyone died or know that the person who is there has just murdered. As with a lot of other people, there's no real reason for the psychopath to want to go.

Re: Why do people call a small outpost a colony ?

There's also the question of who wants to go through the challenges that are required to have that self-sufficiency. The first step is to survive with basically nothing on an inhospitable planet where if anything goes wrong, the chances are that you die a drawn-out death. We generally don't have to do that here. This means that any people who actually colonize will need a pretty good reason to want to go there for that first step, and I don't know what that will be. Sure, there are people who say they'd like to go because they would like the bragging rights, but these are the same people who wouldn't like to do any of the unpleasant jobs that would be required. The mission can't consist of a bunch of "captains" with no support staff. It's not like the moon where all the astronauts had to do was show up, drop some equipment, and leave, getting back to the comforts of modern society in a couple weeks. Mars colonists are going to have to deal with a lot more adversity.

Bank of Ireland outage sees customers queue for 'free' cash – or maybe any cash

No, even though it's not backed on a one-to-one basis, it is still owed, not created. For the models I referred to, where we're more interested in what the market as a whole will do, you can treat it like creation. With the banks operating in that market more actively than those models typically do, or especially if you're talking about the bank's own financials, it is still not created. Just because they can take on more loan assets than they have liabilities doesn't mean that they can create them. If they fail, they still have to deal with the loss of that asset in some way, something that would not be necessary if they were creating something out of nothing.

Yes, banks make money by charging more in interest and pocketing it. That is not money creation. That is taking more money from some people and giving it to them. The creation by leverage construct is what I was talking about in my last comment. It's a convenient model when creating some graphs, but it's not what happened. That money hasn't been created out of nothing, later to be destroyed. It has been borrowed from a depositor, later to be paid back. This is obvious when you consider the other possibilities: if it is not paid back, they don't have as much money as they started with. They have lost money that their depositors gave them and will need to deal with this in some way, whether that's making less profit, taking out an insurance contract, or going bankrupt. They have only moved money because they cannot create it.

Re: Monopoly money

Oh, that can definitely happen, but not because the bank accidentally credited you £1k. Generally, that experience will start with the bank making lots of errors with your account, locking you out, sending your money off, all for completely spurious reasons that you can prove incorrect. Then, as a way of saying "please don't sue us", they give you some compensation for the damage caused. It ends up being in your favor, but it doesn't start that way.

In some areas of economics, it is convenient to consider lending money as creating it and the paying back of a loan as destroying it. It's the same simplification that means we teach Newtonian physics even though we could start in with the changes that have been made to it even when they're not important at the scale we're teaching. However, outside that area of study, including in other parts of economics, it doesn't work like that.

Banks don't create money when they back a loan. They take on an asset with speculative value, which they can only do as they have the liabilities (deposits) to cover it. Central banks which have control over the supply of currency do have the power to create or destroy money, but individual retail banks do not have that power. The last time it worked like that, things went wrong really fast; each bank simply printed its own money, which meant that, as soon as one bank manager realized that this would go wrong, resulted in that manager printing and spending as much as they could. There's a reason we have national currencies now.

Humans stressed out by content moderation? Just use AI, says OpenAI

Re: Censorship is not the answer

That's not what will happen. That kind of thing could happen, but what is more likely is that some company that already doesn't much bother with moderation will turn on this software instead of their existing mechanisms. These companies already aren't great at catching everything unpleasant and are very good at banning someone for no reason and having no method to figure out what happened or correct a mistake, and that will be made even stronger as they start to fire all the expensive humans they used to have inspecting requests. This won't lead directly to censorship, which dictators manage pretty well by human means. This will lead to online sites randomly banning accounts while missing large categories of unpleasant material which the bot was not able to detect.

Re: Oh, that is an edge case, we'll have to retrain on that

There will be nothing but edge cases. It will eventually learn some words and get very happy about banning anyone who used them. For example, it won't be able to process language that talks about crimes. Two days ago, I wrote the following clause in a comment here: "if I want to steal something, I can scan my credentials to unlock the door, pick something up, and walk off with it". In context, I am talking about levels of physical security in order to make an analogy with computer security. Out of context, a human will recognize this as a very useless guide on how to commit theft which provides no real information. A bot won't understand either of these and will have to decide whether this is prohibited content with nothing to go on. The outcome will be close to random.

Not call: Open source gurus urge you to dump Zoom

"As mentioned, it's the metadata that's the issue: Pull requests, issues, releases, etc."

Those can be copied if you are motivated enough. They're not that complex a format, and there are various ways of packaging them up and porting them to a new server. The way is not standard since each git-based frontend will have different features.

"It's also the integrations with other systems. Github is also our identity provider for some systems."

That's just a feature that you're using. People value features, and if you decide that you don't want to use a certain system, then one tradeoff is that you may lose some of its features. I can't complain that I refuse to use Linux for some philosophical reason but now this Linux-specific program won't run. It is not Linux's fault that it doesn't happen to also run on something else, nor is it GitHub's fault if you have a feature on it that you don't like switching. In each case, you have the freedom to do the work to get a new identity provider; it's not like GitHub has a monopoly on that service.

With GitHub, you can add a new commit to your main branch which deletes all the files instead of the readme and changes the readme to point a link to somewhere else. You then take your full git history and transfer it to wherever else you decided to go. It's not that difficult. I've done it at least once. The reason I haven't done it to all my repos is that I don't care enough to bother. I think some people may be in that camp.

Re: I never get tired of say it

I'm not sure what relevance it has to this point. Zoom could self-host their infrastructure in their own buildings, and they'd have the same ability to intercept and abuse customer information. They could self-host in your building and still have that ability. How does the use of the cloud make this any better or worse? In this case, you could argue that using something proprietary made it worse, or that using something not encrypted made it worse, but cloud is not really connected to any of the problems they're pointing to.

Internet Archive sued by record labels as battle with book publishers intensifies

Yes, and in this case, the definition that is used is "restricted in size, amount, or extent". There is a restriction. It could be higher, but it isn't. Thus, there exists a limit to it somewhere. The other option is "unlimited", which could also be written into the law, but is not. Thus, since it is not unlimited, it is limited. You know this already, so I'm not sure why we're having this argument. You already understand that "limited" does not necessarily mean "with a limit that you agree with".

Here's a parallel. The EXFAT system has a limit on file sizes. You may not store a file greater than 128 PB on it without splitting it into pieces. This is not a limit I'm going to hit any time soon, because creating a 128 PB volume is infeasible. However, that's still a limit and described as such. When FAT32 was new, the 4 GB file size limit seemed similarly difficult to hit, but that is a limit that's much easier to hit these days. Whether the limit is actually causing problems, it is still a limit.

Re: and the booby prize is ...

I don't agree with the lengthened copyright terms that you're complaining about. However, that doesn't make them illegal. You're simply arguing that, because he's dead, it doesn't motivate him to create any more art? That's true, but it could have motivated him to create more art when he was alive on the basis that the profits from it can also go to his children, so if he were to produce some art right before dying, it wouldn't immediately become public domain. Some artists would care about that, and some would not. I am not convinced that we have to care about that. However, just because I don't agree with the law doesn't mean that I can use tortured arguments to try to prove that it's not the law. That's what the writers of the laws, especially the Disney corporation, intended it to say. If we don't like it, we have to change it, not argue that it never meant that or that a limit is not a limit.

Re: "artists such as Frank Sinatra .." etc

Copyright and patents have a lot more similarity than you claim. Both consist of a limited-time right, guaranteed by the government, to be the sole provider of something that's not physical, which you must prove* is original work, which can be claimed only by the creator or someone they have explicitly transferred ownership to, and after it expires, the thing it covers becomes available for anyone to use. Your comparison between a car and a cloud doesn't have anything close to that list of similarities.

* They're not great at correctly determining whether it's original or not, but your patent can be invalidated for prior art, and your copyright can be invalidated for plagiarism.

I don't know where you got either of your ideas from, but both of them are pretty clearly wrong. For example, that if you don't make a profit, you don't have a leg to stand on. That's not a thing. If you do what the law says you shouldn't, then it's illegal no matter whether you benefit. If I steal something from you and am unable to sell it, I am not innocent. If I violate copyright and don't profit, I'm also not innocent.

Also, you appear to have trouble with literal interpretation of words:

"The U.S. Constitution specifically states "limited time". 50+ years is not and never will be, limited."

Yes, that is limited, since there is a finite amount of time after which it ends. It would also be limited if they said "Copyright to consist of a time period lasting a hundred million years", because it has a definite ending point. I have opinions on how long that limit should be, on which we're more likely to agree, but arguing that it's not limited based on the clear limit is a pretty bad argument.

Re: Stay out of (realisable) USA jurisdiction

It is possible, but that doesn't automatically mean it will work in all the cases we get now. A documentary can be rather cheap to make, or it can be very expensive. If your payments have to go into getting a camera and pointing it at a guy who is talking and editing in what's effectively a PowerPoint presentation with existing video clips, it won't take many patrons to get it recorded. If it involves taking several people to a different continent where they will be filming for weeks, it will take quite a few more. For things other than a documentary, the costs grow faster than the willingness of patrons to incur them.

It is much easier for millions to pay a small amount when they want to consume the content than for a few hundred to pay really large chunks in the hope that it will be created. When those hundreds are doing so with the expectation that the millions will at least partially pay them back, they manage it. When those hundreds are doing it just for the love of the work, they probably don't see why they have to pay for the thing we will all enjoy watching without supporting.

Indian armed forces gives Windows its marching orders, but only for desktop warriors

Re: If you must drop Windows...

"nothing is actually executable by default"

Yes, there's the execution bit to be set for some files. Most likely, the first file to be sent will be a shell script, which is much easier to execute because, although the execute bit is useful, it is not required. That script can download an ELF from somewhere and call chmod on it, then run it. It's not a complex bootstrapping process if you're dealing with the kind of user who doesn't recognize that the file called "report.docx.exe" is probably dangerous and clicks through the security warning Windows will show.

"I would not say it's impossible but it's a tad harder than when using Windows and depending on settings even requires a rights escalation to install."

What escalation are you referring to? If you mean to get root privileges, yes it will need that, just as a Windows program will show a UAC warning on all machines. On a corporate machine, the general user is unlikely either to have rights to root or admin privileges and will be unable to accept that escalation request. On a home machine, it should be clear enough that this isn't normal, but not all users have the experience to know that you don't just enter your password every time a screen tells you to. To install itself with the user's permissions, however, doesn't take that. The binary simply has to copy itself somewhere and add in something to start itself. A simple method is to put itself into part of the user's home directory and add itself to their login script, but depending on what access they have, there are a number of options such as adding a job to their crontab, to intercept some other program, etc. Persistence using the user's permissions is certainly possible. Once it has that, it will have to find some way to spread or elevate permissions, but Linux and the general utilities have had plenty of privilege escalation vulnerabilities, just like Windows does.

Now, with a properly configured system, these risks are not necessary. The user's home directory could be marked in such a way that ELFs can't be executed, although shell scripts still could. Maybe it's just me, but I don't much like shell scripts and I wouldn't like the idea of trying to write complex malware in that, so that's a defense. But before we praise Linux from making that option available, remember that Windows can do that too. The reason people don't do it for nearly every Windows box in existence is the same reason that, should they switch to Linux, they probably won't there either. The systems have options to secure things that aren't often used, so while it's great that they exist, we can't assume that this will mean they will be generally used.

Re: If you must drop Windows...

"It's also a case of sensible, safe defaults. When you install a Linux desktop, the result is quite tight in that there's nothing running that would allow external access - depending on distro, even SSH needs to be enabled first before you have that path in."

Just as Windows doesn't turn on RDP unless you go into settings to enable it. It doesn't prevent someone from doing that, though, and if they do and don't focus on security, it is a wide open door.

"Secondly, you can 'just' run an executable, if it's not in the package manager it's much harder to do."

Do you use Linux? You know they have the concept of an executable as well? You can download an executable file and run it. You can download a shell script and run that. You have a few other languages that you can pretty much guarantee are present (I'm thinking of Perl and Python) and run those. None of that requires it to be in the package manager.

I use Linux often, especially for systems where security is necessary. I like it because it is easy to audit the system for security risks and to change its operation to limit them. Linux is strong from a security perspective. What I dislike is the people who seem to assume that Linux is automatically the key to security and base this off incorrect understandings of what it provides and how easy an insecure Linux system is to compromise. They appear to believe that simply replacing Windows with Linux makes everything secure, and if enough people with this attitude actually get to do it, we'll give Linux an undeserved bad name as that system that everyone's been hacking these days because inexperienced people deployed it without looking at their risks.

Re: If you must drop Windows...

"Pound for pound Linux is way more difficult to compromise than Windows. Its just a fact for life,"

This is heavily dependent on the configuration of the system. The comparison is not really viable either, as you can't enumerate the hacking potential. However, as I interpreted the original comment, we weren't talking about external penetration but the security of a box where the user has already executed an attacker's malware, in which case the initial infection stage has already passed.

A lot of the attacks that work against Windows have direct parallels on Linux. For example, one way attackers find and infect computers are unsecured RDP ports left open to the internet. This is relatively easy to prevent, extremely easy to detect, and in most configurations it doesn't happen at all. The direct parallel on Linux is the open SSH port with password authentication, which is equally easy to prevent and detect. As anyone who has a Linux machine on the internet already knows, there are lots of attackers looking for those ports who will attempt to log into any server configured as such. In a lot of infections, the writers of the malware are relying on the user to install the initial infection, rather than finding an unauthenticated remote login method. Some of the tactics that are popular for infecting Windows will not work on Linux, but that is not the same as saying that Linux doesn't have vulnerabilities of that kind or that they're more resistant to exploitation.

Re: If you must drop Windows...

"A compromised desktop is usually the vector that breaks the "hard shell/soft center" approach that most companies deploy and establishes a penetration beachhead inside the organisation to host an APT, so I'd say here too a Linux desktop would offer substantially less risk."

That substantially less risk is due to what? We're already positing an attacker that has malware running on the user's computer, so why would that computer running Linux instead of Windows do that much? In both cases, the malware can copy their files, inspect their actions, copy their passwords, intercept their mail, and access things on the section of the network their machine is on. Linux doesn't have different security policies on any of those things. It would have a different set of bugs between that machine and other things on the network, but that's no guarantee that an attacker can't find them, especially as there are plenty of successful attacks against companies that spread from Windows beachheads to Linux infrastructure, so spreading from Linux ones shouldn't be much more difficult. The largest asset is that attackers who already made a Windows loader malware will have to make a new version that targets Linux.

Re: All I'm saying is...

Probably that you should be very careful about saying something's secure before you rely on it being secure. How many times have we had a three-day gap between someone claiming unhackability and a hacker proving them wrong.

To some extent, lying will have helped them. Had this actually been a new OS, then I wouldn't have bought any security claims, whereas starting from something that people have been securing for years is a good way to get some security from the start. However, if someone told the Indian government that it was invulnerable and they believe it, they are still at risk.

80% of execs regret calling employees back to the office

Re: We have expensive real estate.

As I understood the context of those quotes, they were referring to the choice to change from assigned desks to hot desks in some of Google Cloud's offices, not requiring people to come in. Of course, by making that change so they could have fewer offices, they also made the office worse. This is the general problem that I have with people advocating the office. There are some advantages to working there, but if they try to skimp on the office so much that they destroy those advantages, then they might as well just have everyone work from home and save the spending accordingly. Requiring that everyone comes into an office that they all hate isn't going to provide any of the benefits of working from the office or from home, but making a decision either to have an office that works for the employees or not having one at all are more likely to work.

AIs can produce 'dangerous' content about eating disorders when prompted

Re: Realistic goals

Telling them is certainly easier. I have been doing it for months. So far, people haven't cared too much. Not even when I send them AI-written essays and surprised them with a fact check. I still know people, not many but they exist, who go to GPT to answer questions. For now, it's the intersection between people knowledgeable enough to use a frontend to it* and lazy enough not to use search engines, but as it becomes easier to use such models, that will likely only increase.

* Not that it is very hard to use such services, but for now, you still have to make an active decision that you want to use one of these chatbots and to pick a frontend, whether that's the official frontend for which you need an account or one of the various third-party ones which seem surprisingly popular for a program that simply takes your text, pastes it into a session, and sends some text back without changing it. There are a lot of people I know who can't answer a question as simple as "what search engine do you use", and for now they don't use GPT or its ilk. With the popularity of these models at companies that also make operating systems and browsers, I don't have confidence that this will remain the case.

Can you raise $100M+ from AI investors with no product? SEC says yes

Re: generative AI right now

I don't particularly value LMMs either and would be happy if all the companies building them all decided to stop today. I feel the need to contest you on the point that they're a "pyramid scheme". They are many things, including some possibility that they're duping investors, customers, and the public, but a pyramid scheme is a specific, structured fraud and places like OpenAI aren't doing that. They don't have people trying to recruit a lower level and passing money up to a higher level, so calling them a pyramid scheme suggests that you don't know what one is or what they're doing and distracts from the rest of your valid points.

Re: What's the difference...?

I don't think there's really much difference, but as I understand it, "pyramid scheme" is more often used for something where no product exists, whereas "MLM" is more often used when there is some product being sold to someone using the same structure where they get salespeople to work very hard to sell something useless while not paying them.

It does contain 22.2 million people, so there's a large sample size to draw from. For context, there are four times as many Floridians as there are Scots, so patterns aren't necessary to get this many fraudsters from a large set of people.

Charging your iPhone literally costs Apple millions as Batterygate saga slams shut

The suit exists because they engaged in a few deceptive practices which people didn't understand. The initial story, which isn't the whole truth but did happen, is that Apple slowed down their phones (to delay the boot problems) but didn't tell anyone. When people complained about their phones being slow, Apple told them to buy a new one rather than admitting what had been done. By the way, we aren't talking about devices that were six years old when this started happening. The batteries would reach the level of degradation where the throttling was enabled in about a year. This leads us to the next deceptive practice.

The batteries they put into affected devices were not good enough. I don't think this was deliberate, although some have alleged that it was, but I assume Apple specified batteries that couldn't provide enough additional voltage to run their boards. Had phones started failing as quickly as they did, a lot of people would have been covered by the warranty, including everyone who had the extended Apple Care. By slowing down the CPU without telling people, they were able to delay the problem until that coverage expired. I owned one of these devices and never disabled the CPU throttling. It still eventually got to the point of repeatedly crashing, rebooting, going from 60% battery to 4% battery in five minutes, etc. It just took a bit longer to reach that point. Does this happen to any old device you have? I've used laptops to the point where their batteries last very little time, but they still don't spontaneously fail like that. People have suggested that this was Apple's attempt to avoid warranty claims for another hardware failure, something that Apple has done repeatedly.

I don't think they were malicious about this or knew from the start that they were going to limit their phones in that way. However, as Louis Rossman has said, when Apple repeatedly has hardware flaws and avoids warranty requirements on them, and each of them just happens to earn them money, then it becomes reasonable to ask whether it was deliberate or if they have failed in their duty to their customers. There is consumer protection law to handle this in a lot of countries.

Veilid: A secure peer-to-peer network for apps that flips off the surveillance economy

Re: Count Me In

I still disagree with basically all of your points.

"Whereas the telephony industry has been highly successful in ensuring that any telephone can call / SMS any other telephone, anywhere on the planet, the Internet industry has been infected by greed, self promotion, and the inevitable lack of interoperability."

From my point of view, the internet industry allows me to contact any computer that agrees to take my connection and transmit to them, and if we agreed on what protocol we're using, we can communicate just fine. Yes, there isn't one single protocol that communicates with anybody, but I can, in fact, use any of the options equally well or I can build my own and it will work too. The internet industry needs interoperability between the links that allow my packets to flow, and they have it. This is why I can have a video call between me and people on two other continents, encrypted, through my own server, and I don't have to pay the prices I'm still charged if I were to make a single voice call to one of those people using the phone system which has its one standard and is much more greedy.

"You do agree with mandated standards - you depend on them entirely, just to be able to make posts here (for example)."

Not really. I use a lot of standards, but not mandated ones. I use the WiFi standards because it's convenient, but if I had implemented my own point-to-point wireless protocol, it would also work. I use the Ethernet standard because that's the ubiquitous cable, not because someone told me that other cables were forbidden. As for TCP, UDP, DNS, and HTTP, all of those are standards which are optional and maintained by people who make them available, not demanded. Should I decide to implement my own network protocol over the basic IP level (also not mandated, but it's what my ISP supports), I am free to do so, you are free to use it, and if we do, we can talk to one another over it.

"The fact that we've not been able to move on from SMS/MMS is because the companies that do this say there's (presently) no point having the costs of implementing a richer IM layer as part of the next mobile G, because the large tech companies have fragmented the market and locked people in."

I agree with them for a different reason. It's not worth adding another version because we now have network communication, so we don't need them. There are advantages to a communication system that's not tied to phones, so you could send a message from a computer that doesn't have to hand the communication part on to a phone. If I want to send you an SMS, I have to use one of the weird email-to-SMS bridges that some providers probably still have, and if you want to reply, there's a chance that the bridge doesn't go the other way. If I want to send you an email or use one of the many other chat systems that are generic, I can do it from anything with a data connection.

Oh, and on the encryption front, you're correct about the provider having the ability to damage the software you're running, which is one reason I don't use WhatsApp even though it is encrypted. Using open source software and/or decentralized clients helps with this. I have the knowledge to check that, as I'm sure you do as well. Dismissing it based on that risk isn't very convincing when the alternative is no encryption or really any security at all.

Re: Count Me In

"We all knew what IM looked like, back when BlackBerry Messenger was all the rage. Mandating a standard such functionality (not BBM itself) as a license condition for network operation should have happened years ago, just like a network operator is supposed to support phone calls..."

I disagree. It makes sense for a phone network operator because they will be given a lot of limited resources, whether that's a monopoly on providing service to the public (the wired model) or a large chunk of spectrum which only has room for a few companies (wireless). On the internet, there is no real limit and no central authority giving anything away. The great part of the internet is that I can put whatever bytes I want through it and expect them to arrive, so I don't need to apply for my protocol to be accepted before it can be used. I don't agree with a mandated standard for that reason, but there is another reason for it: feature support.

We've had IM for quite a long time, and it generally works the same, but it lacked many features we have today. For example, encryption. A lot of people want end-to-end encryption, and any attempt to create a single standard encrypted protocol would end up having to specify a key management system, which is likely to prove fragile. Meanwhile, multiple encrypted IM systems can figure out their own key management, and we can pick between the models as is useful. Even outside of encryption, there are other features that people might want, or want to avoid, in their IM. Is IM just for text, or can you send images as well? If you can send images, can you send files? Do the files go somewhere or are they streamed directly across? Does it come with video or audio communication? Should the identifiers be phone numbers, email addresses, some new address format, or a combination thereof? Is there a part of the structure which allows for per-message billing, and what data collection is needed to facilitate it? Is there a distinction between intra-country and international communication? What if Canada adopted one standard and Germany adopted another, but someone wants to communicate between countries? I prefer letting the users pick between options for one that supports the features they want and is convenient for their use.

Cumbrian Police accidentally publish all officers' details online

Re: How?

You organize your data so you avoid it, but you don't have locks on everything making it entirely impossible to upload something you shouldn't. Your success in not posting stuff that shouldn't be public is due to being careful, and the steps you take are designed to make that easier.

My problem with the calls to fix this in software is the assumption that, somehow, computers have to make careless users harmless. Somehow, if a user is physically capable of causing a problem with the system, then it's the system's fault. This is not used in a lot of other parts of the world. Take physical security. There are some people who work in extremely secure facilities where they may not take anything in or out and they're subject to lots of scans to ensure they haven't. Does everywhere you have worked do that? My offices have not; if I want to steal something, I can scan my credentials to unlock the door, pick something up, and walk off with it. This doesn't mean that, because theft was possible, the security system is at fault. If we took that attitude, you'd eventually reach the point where every employee or visitor would have to have MRI scans on entry and exit. At some point, designing the system to prevent idiots doing stupid things is worse than working a bit harder to have fewer idiots and to make sure they understand information about whether what they're doing is stupid.

My point is that people often don't like being told that they were not as good as someone else, even if it's true. What you suggest turns any performance review period into a "here's why one of your colleagues is better than you" experience including a full league table, and nobody likes those. Not to mention that, for most complex jobs, it is relatively easy to make up a lie about a non-discriminatory reason for different levels of pay, whether it's true or not, so any disparity you ask about will have one whether or not the actual reason was justifiable.

It looks like the request was for a list of names, so you are allowed to know who works for the police, just not every other detail about their jobs including their salaries. Why you want the data is another question, as it's usually pretty easy to determine either whether a certain person works for the police or which members of the police were involved with a certain situation, but it looks like you are allowed access to the full list if you find that data useful.

There are potential benefits, but I also foresee some problems. If someone deservedly gets paid better than others, will the others simply accept that their performance was better, their skills unmatched, their work ethic stronger, or will they feel they've been treated unfairly? If they do, how would you suggest handling that without either withholding what you would have given to the stronger employee or dealing with more people quitting, which places more work on everyone who stays. This is just thinking of the problems from an employee's perspective as that's my position, but there are problems from the company's as well which aren't necessarily indicative of malpractice on their part.

I'm not blind to the benefits of transparency of salary data, but I think it might cause quite a few problems. I think you probably do as well, which is why you limited it to employees of the company; some people advocate that financial information be available to everyone in the general public, but I think a lot of things would go wrong if that were attempted. I think the more limited version would produce fewer problems, but that some would still exist.

If you're Russian to the Moon, expect traffic: Moscow's Putin a lander into orbit

Re: Look at me!

I'm quite sure they will. Russia has basically nothing they can be that proud of except for the fact that they have a much larger nuclear force than even many other nuclear powers. This is how they can still count themselves as a superpower even when nobody else would. That is the kind of incentive that is needed to make sure you keep hiring people to maintain and operate the facilities even when there is basically no realistic situation in which those weapons would need to be fired.

Re: Star Trek style warp drive can never work

What, you mean that people writing science-themed entertainment shows in the 1960s weren't very good at theoretical physics as we know it today? That's a disappointment.

Of course, we have a lot of questions in physics that we don't understand yet. For example, whatever dark energy is, whether it's a single phenomenon, multiple combining ones, or a mistake in existing models, it seems to allow things to move in ways that the existing models suggest they can't. Maybe that will turn out to mean that we could also do so. Or maybe it means that we could try to do so and die in interesting new ways. Or it could be like fusion: a fun way to spend decades getting nowhere, but it will be here in about twenty years. Be careful when you say that physicists can prove for certain that something is impossible, because physicists have said that at previous times, and sometimes, physics has proved them wrong.

Hacktivists attack Japanese government over Fukushima wastewater release

To be fair, either of those can kill you. Most isotopes of uranium take a rather long time to decay, but they can also kill you with radiation (and poisoning, but you can probably more easily refrain from eating it). However, the ones with really short half-lives, while more dangerous at the start, are also the ones that will quickly turn into something else without having to be stored for a long time. Depending on what that something else is, it may not be radioactive anymore and therefore the radiation risk is eliminated.

The price of freedom turned out to be an afternoon of tech panic

Re: Spreadsheet imports

This kind of thing wouldn't surprise me, especially as a lot of software that accepts spreadsheets as input have lots of available columns. If they were importing something structured, like XML, JSON, or SQL of some sort, then those fields would have names they could check against. I've seen spreadsheets that looked like this:

<itemname>, 0, 0, 0, 0, 0, 29.99

With all the zero columns being for fields that you weren't using. When there are already columns like that, one more doesn't stand out too much. This is one of the things that caused me as a child to stop using spreadsheets to store information when it got too big and use a format that wasn't as prone to user error, although that also taught me a long-lasting fear of nulls which don't always mean the same thing.

Lacros rescues Chromebooks by extending their lifespans

Re: Limited life span?

"You are incorrect. All Chromebooks released after 2020 now have an 8 year support life from the release date. Even the £150 ones."

I stand corrected. It doesn't make me feel that much better about them, but it is a bit better than when it was less than eight years, so some points back to Google there (they're still on negatives).

"The second problem you list "no technical reason for the end of support". There isn't for Microsoft stopping providing Windows updates either. Or Apple providing MacOS or iPadOS updates. Yet, they both do?"

This wasn't always the case. For example, it wasn't the case for Windows until Windows 11 happened. You could install Windows 10 on any compatible hardware, even a Pentium from 2000. It wouldn't work well, but you could do it. Even when they did add that in Windows 11, they didn't do it very strongly, as bypassing the hardware check and installing it anyway is a quick process that still works even though people have been doing it for two years. A similar argument applies to Mac OS, where you can install new Mac OS versions on old Macs and they function. I don't approve of Apple's cutting of support, and I have complained about it frequently. The fact remains, though, that you can install modern Mac OS on Macs that don't agree to install it and all the features will work, whereas you cannot install modern Chrome OS after the AUE death date. You can, of course, install Chrome OS Flex and lose several features that they could quite easily leave in. My argument remains the same: Google is worse for no good reason.

Tinker Tailor Soldier Pi? Asus's 'NUC-sized' SBC aims to out-Pi the Raspberry

"Which it I am referring to is obvious."

To you, perhaps, but I am at the very least the second who doesn't know. At first, I assumed you were referring to the Asus model, either having found its price or having mistaken something else for it. Now, I'm not even sure of that since you indicated that you didn't have the price of that but still think it was obvious.

There are a lot of SBCs out there now, and many of them are at a similar price point to the Pi, although in my experience their specs and software support are usually not as good. For example, there are really quite a lot with quad A53 CPUs, which is getting a bit old now. The quad A55 is certainly better, but it's still a six-year-old core and intended for the little half of the cores. Of course, this isn't necessarily a problem depending on what you're doing with it, as for a lot of networking or automation, the A53s are fast enough and the machine is connected to mains power; I have a few doing that kind of task. I sometimes want higher performance or better power efficiency, though, which is why I've been waiting for better SBCs to come out eventually. The ARM-based SoCs that manufacturers have been making are really great compared to the ones we have access to.