Posts by doublelayer

Not call: Open source gurus urge you to dump Zoom

Re: I never get tired of say it

I'm not sure what relevance it has to this point. Zoom could self-host their infrastructure in their own buildings, and they'd have the same ability to intercept and abuse customer information. They could self-host in your building and still have that ability. How does the use of the cloud make this any better or worse? In this case, you could argue that using something proprietary made it worse, or that using something not encrypted made it worse, but cloud is not really connected to any of the problems they're pointing to.

Bank of Ireland outage sees customers queue for 'free' cash – or maybe any cash

Re: Monopoly money

Oh, that can definitely happen, but not because the bank accidentally credited you £1k. Generally, that experience will start with the bank making lots of errors with your account, locking you out, sending your money off, all for completely spurious reasons that you can prove incorrect. Then, as a way of saying "please don't sue us", they give you some compensation for the damage caused. It ends up being in your favor, but it doesn't start that way.

In some areas of economics, it is convenient to consider lending money as creating it and the paying back of a loan as destroying it. It's the same simplification that means we teach Newtonian physics even though we could start in with the changes that have been made to it even when they're not important at the scale we're teaching. However, outside that area of study, including in other parts of economics, it doesn't work like that.

Banks don't create money when they back a loan. They take on an asset with speculative value, which they can only do as they have the liabilities (deposits) to cover it. Central banks which have control over the supply of currency do have the power to create or destroy money, but individual retail banks do not have that power. The last time it worked like that, things went wrong really fast; each bank simply printed its own money, which meant that, as soon as one bank manager realized that this would go wrong, resulted in that manager printing and spending as much as they could. There's a reason we have national currencies now.

Internet Archive sued by record labels as battle with book publishers intensifies

Re: and the booby prize is ...

I don't agree with the lengthened copyright terms that you're complaining about. However, that doesn't make them illegal. You're simply arguing that, because he's dead, it doesn't motivate him to create any more art? That's true, but it could have motivated him to create more art when he was alive on the basis that the profits from it can also go to his children, so if he were to produce some art right before dying, it wouldn't immediately become public domain. Some artists would care about that, and some would not. I am not convinced that we have to care about that. However, just because I don't agree with the law doesn't mean that I can use tortured arguments to try to prove that it's not the law. That's what the writers of the laws, especially the Disney corporation, intended it to say. If we don't like it, we have to change it, not argue that it never meant that or that a limit is not a limit.

Re: "artists such as Frank Sinatra .." etc

Copyright and patents have a lot more similarity than you claim. Both consist of a limited-time right, guaranteed by the government, to be the sole provider of something that's not physical, which you must prove* is original work, which can be claimed only by the creator or someone they have explicitly transferred ownership to, and after it expires, the thing it covers becomes available for anyone to use. Your comparison between a car and a cloud doesn't have anything close to that list of similarities.

* They're not great at correctly determining whether it's original or not, but your patent can be invalidated for prior art, and your copyright can be invalidated for plagiarism.

I don't know where you got either of your ideas from, but both of them are pretty clearly wrong. For example, that if you don't make a profit, you don't have a leg to stand on. That's not a thing. If you do what the law says you shouldn't, then it's illegal no matter whether you benefit. If I steal something from you and am unable to sell it, I am not innocent. If I violate copyright and don't profit, I'm also not innocent.

Also, you appear to have trouble with literal interpretation of words:

"The U.S. Constitution specifically states "limited time". 50+ years is not and never will be, limited."

Yes, that is limited, since there is a finite amount of time after which it ends. It would also be limited if they said "Copyright to consist of a time period lasting a hundred million years", because it has a definite ending point. I have opinions on how long that limit should be, on which we're more likely to agree, but arguing that it's not limited based on the clear limit is a pretty bad argument.

Re: Stay out of (realisable) USA jurisdiction

It is possible, but that doesn't automatically mean it will work in all the cases we get now. A documentary can be rather cheap to make, or it can be very expensive. If your payments have to go into getting a camera and pointing it at a guy who is talking and editing in what's effectively a PowerPoint presentation with existing video clips, it won't take many patrons to get it recorded. If it involves taking several people to a different continent where they will be filming for weeks, it will take quite a few more. For things other than a documentary, the costs grow faster than the willingness of patrons to incur them.

It is much easier for millions to pay a small amount when they want to consume the content than for a few hundred to pay really large chunks in the hope that it will be created. When those hundreds are doing so with the expectation that the millions will at least partially pay them back, they manage it. When those hundreds are doing it just for the love of the work, they probably don't see why they have to pay for the thing we will all enjoy watching without supporting.

Indian armed forces gives Windows its marching orders, but only for desktop warriors

Re: If you must drop Windows...

"nothing is actually executable by default"

Yes, there's the execution bit to be set for some files. Most likely, the first file to be sent will be a shell script, which is much easier to execute because, although the execute bit is useful, it is not required. That script can download an ELF from somewhere and call chmod on it, then run it. It's not a complex bootstrapping process if you're dealing with the kind of user who doesn't recognize that the file called "report.docx.exe" is probably dangerous and clicks through the security warning Windows will show.

"I would not say it's impossible but it's a tad harder than when using Windows and depending on settings even requires a rights escalation to install."

What escalation are you referring to? If you mean to get root privileges, yes it will need that, just as a Windows program will show a UAC warning on all machines. On a corporate machine, the general user is unlikely either to have rights to root or admin privileges and will be unable to accept that escalation request. On a home machine, it should be clear enough that this isn't normal, but not all users have the experience to know that you don't just enter your password every time a screen tells you to. To install itself with the user's permissions, however, doesn't take that. The binary simply has to copy itself somewhere and add in something to start itself. A simple method is to put itself into part of the user's home directory and add itself to their login script, but depending on what access they have, there are a number of options such as adding a job to their crontab, to intercept some other program, etc. Persistence using the user's permissions is certainly possible. Once it has that, it will have to find some way to spread or elevate permissions, but Linux and the general utilities have had plenty of privilege escalation vulnerabilities, just like Windows does.

Now, with a properly configured system, these risks are not necessary. The user's home directory could be marked in such a way that ELFs can't be executed, although shell scripts still could. Maybe it's just me, but I don't much like shell scripts and I wouldn't like the idea of trying to write complex malware in that, so that's a defense. But before we praise Linux from making that option available, remember that Windows can do that too. The reason people don't do it for nearly every Windows box in existence is the same reason that, should they switch to Linux, they probably won't there either. The systems have options to secure things that aren't often used, so while it's great that they exist, we can't assume that this will mean they will be generally used.

Re: If you must drop Windows...

"It's also a case of sensible, safe defaults. When you install a Linux desktop, the result is quite tight in that there's nothing running that would allow external access - depending on distro, even SSH needs to be enabled first before you have that path in."

Just as Windows doesn't turn on RDP unless you go into settings to enable it. It doesn't prevent someone from doing that, though, and if they do and don't focus on security, it is a wide open door.

"Secondly, you can 'just' run an executable, if it's not in the package manager it's much harder to do."

Do you use Linux? You know they have the concept of an executable as well? You can download an executable file and run it. You can download a shell script and run that. You have a few other languages that you can pretty much guarantee are present (I'm thinking of Perl and Python) and run those. None of that requires it to be in the package manager.

I use Linux often, especially for systems where security is necessary. I like it because it is easy to audit the system for security risks and to change its operation to limit them. Linux is strong from a security perspective. What I dislike is the people who seem to assume that Linux is automatically the key to security and base this off incorrect understandings of what it provides and how easy an insecure Linux system is to compromise. They appear to believe that simply replacing Windows with Linux makes everything secure, and if enough people with this attitude actually get to do it, we'll give Linux an undeserved bad name as that system that everyone's been hacking these days because inexperienced people deployed it without looking at their risks.

Re: If you must drop Windows...

"Pound for pound Linux is way more difficult to compromise than Windows. Its just a fact for life,"

This is heavily dependent on the configuration of the system. The comparison is not really viable either, as you can't enumerate the hacking potential. However, as I interpreted the original comment, we weren't talking about external penetration but the security of a box where the user has already executed an attacker's malware, in which case the initial infection stage has already passed.

A lot of the attacks that work against Windows have direct parallels on Linux. For example, one way attackers find and infect computers are unsecured RDP ports left open to the internet. This is relatively easy to prevent, extremely easy to detect, and in most configurations it doesn't happen at all. The direct parallel on Linux is the open SSH port with password authentication, which is equally easy to prevent and detect. As anyone who has a Linux machine on the internet already knows, there are lots of attackers looking for those ports who will attempt to log into any server configured as such. In a lot of infections, the writers of the malware are relying on the user to install the initial infection, rather than finding an unauthenticated remote login method. Some of the tactics that are popular for infecting Windows will not work on Linux, but that is not the same as saying that Linux doesn't have vulnerabilities of that kind or that they're more resistant to exploitation.

Re: If you must drop Windows...

"A compromised desktop is usually the vector that breaks the "hard shell/soft center" approach that most companies deploy and establishes a penetration beachhead inside the organisation to host an APT, so I'd say here too a Linux desktop would offer substantially less risk."

That substantially less risk is due to what? We're already positing an attacker that has malware running on the user's computer, so why would that computer running Linux instead of Windows do that much? In both cases, the malware can copy their files, inspect their actions, copy their passwords, intercept their mail, and access things on the section of the network their machine is on. Linux doesn't have different security policies on any of those things. It would have a different set of bugs between that machine and other things on the network, but that's no guarantee that an attacker can't find them, especially as there are plenty of successful attacks against companies that spread from Windows beachheads to Linux infrastructure, so spreading from Linux ones shouldn't be much more difficult. The largest asset is that attackers who already made a Windows loader malware will have to make a new version that targets Linux.

Re: All I'm saying is...

Probably that you should be very careful about saying something's secure before you rely on it being secure. How many times have we had a three-day gap between someone claiming unhackability and a hacker proving them wrong.

To some extent, lying will have helped them. Had this actually been a new OS, then I wouldn't have bought any security claims, whereas starting from something that people have been securing for years is a good way to get some security from the start. However, if someone told the Indian government that it was invulnerable and they believe it, they are still at risk.

80% of execs regret calling employees back to the office

Re: We have expensive real estate.

As I understood the context of those quotes, they were referring to the choice to change from assigned desks to hot desks in some of Google Cloud's offices, not requiring people to come in. Of course, by making that change so they could have fewer offices, they also made the office worse. This is the general problem that I have with people advocating the office. There are some advantages to working there, but if they try to skimp on the office so much that they destroy those advantages, then they might as well just have everyone work from home and save the spending accordingly. Requiring that everyone comes into an office that they all hate isn't going to provide any of the benefits of working from the office or from home, but making a decision either to have an office that works for the employees or not having one at all are more likely to work.

AIs can produce 'dangerous' content about eating disorders when prompted

Re: Realistic goals

Telling them is certainly easier. I have been doing it for months. So far, people haven't cared too much. Not even when I send them AI-written essays and surprised them with a fact check. I still know people, not many but they exist, who go to GPT to answer questions. For now, it's the intersection between people knowledgeable enough to use a frontend to it* and lazy enough not to use search engines, but as it becomes easier to use such models, that will likely only increase.

* Not that it is very hard to use such services, but for now, you still have to make an active decision that you want to use one of these chatbots and to pick a frontend, whether that's the official frontend for which you need an account or one of the various third-party ones which seem surprisingly popular for a program that simply takes your text, pastes it into a session, and sends some text back without changing it. There are a lot of people I know who can't answer a question as simple as "what search engine do you use", and for now they don't use GPT or its ilk. With the popularity of these models at companies that also make operating systems and browsers, I don't have confidence that this will remain the case.

Can you raise $100M+ from AI investors with no product? SEC says yes

Re: generative AI right now

I don't particularly value LMMs either and would be happy if all the companies building them all decided to stop today. I feel the need to contest you on the point that they're a "pyramid scheme". They are many things, including some possibility that they're duping investors, customers, and the public, but a pyramid scheme is a specific, structured fraud and places like OpenAI aren't doing that. They don't have people trying to recruit a lower level and passing money up to a higher level, so calling them a pyramid scheme suggests that you don't know what one is or what they're doing and distracts from the rest of your valid points.

Re: What's the difference...?

I don't think there's really much difference, but as I understand it, "pyramid scheme" is more often used for something where no product exists, whereas "MLM" is more often used when there is some product being sold to someone using the same structure where they get salespeople to work very hard to sell something useless while not paying them.

It does contain 22.2 million people, so there's a large sample size to draw from. For context, there are four times as many Floridians as there are Scots, so patterns aren't necessary to get this many fraudsters from a large set of people.

Charging your iPhone literally costs Apple millions as Batterygate saga slams shut

The suit exists because they engaged in a few deceptive practices which people didn't understand. The initial story, which isn't the whole truth but did happen, is that Apple slowed down their phones (to delay the boot problems) but didn't tell anyone. When people complained about their phones being slow, Apple told them to buy a new one rather than admitting what had been done. By the way, we aren't talking about devices that were six years old when this started happening. The batteries would reach the level of degradation where the throttling was enabled in about a year. This leads us to the next deceptive practice.

The batteries they put into affected devices were not good enough. I don't think this was deliberate, although some have alleged that it was, but I assume Apple specified batteries that couldn't provide enough additional voltage to run their boards. Had phones started failing as quickly as they did, a lot of people would have been covered by the warranty, including everyone who had the extended Apple Care. By slowing down the CPU without telling people, they were able to delay the problem until that coverage expired. I owned one of these devices and never disabled the CPU throttling. It still eventually got to the point of repeatedly crashing, rebooting, going from 60% battery to 4% battery in five minutes, etc. It just took a bit longer to reach that point. Does this happen to any old device you have? I've used laptops to the point where their batteries last very little time, but they still don't spontaneously fail like that. People have suggested that this was Apple's attempt to avoid warranty claims for another hardware failure, something that Apple has done repeatedly.

I don't think they were malicious about this or knew from the start that they were going to limit their phones in that way. However, as Louis Rossman has said, when Apple repeatedly has hardware flaws and avoids warranty requirements on them, and each of them just happens to earn them money, then it becomes reasonable to ask whether it was deliberate or if they have failed in their duty to their customers. There is consumer protection law to handle this in a lot of countries.

Veilid: A secure peer-to-peer network for apps that flips off the surveillance economy

Re: Count Me In

I still disagree with basically all of your points.

"Whereas the telephony industry has been highly successful in ensuring that any telephone can call / SMS any other telephone, anywhere on the planet, the Internet industry has been infected by greed, self promotion, and the inevitable lack of interoperability."

From my point of view, the internet industry allows me to contact any computer that agrees to take my connection and transmit to them, and if we agreed on what protocol we're using, we can communicate just fine. Yes, there isn't one single protocol that communicates with anybody, but I can, in fact, use any of the options equally well or I can build my own and it will work too. The internet industry needs interoperability between the links that allow my packets to flow, and they have it. This is why I can have a video call between me and people on two other continents, encrypted, through my own server, and I don't have to pay the prices I'm still charged if I were to make a single voice call to one of those people using the phone system which has its one standard and is much more greedy.

"You do agree with mandated standards - you depend on them entirely, just to be able to make posts here (for example)."

Not really. I use a lot of standards, but not mandated ones. I use the WiFi standards because it's convenient, but if I had implemented my own point-to-point wireless protocol, it would also work. I use the Ethernet standard because that's the ubiquitous cable, not because someone told me that other cables were forbidden. As for TCP, UDP, DNS, and HTTP, all of those are standards which are optional and maintained by people who make them available, not demanded. Should I decide to implement my own network protocol over the basic IP level (also not mandated, but it's what my ISP supports), I am free to do so, you are free to use it, and if we do, we can talk to one another over it.

"The fact that we've not been able to move on from SMS/MMS is because the companies that do this say there's (presently) no point having the costs of implementing a richer IM layer as part of the next mobile G, because the large tech companies have fragmented the market and locked people in."

I agree with them for a different reason. It's not worth adding another version because we now have network communication, so we don't need them. There are advantages to a communication system that's not tied to phones, so you could send a message from a computer that doesn't have to hand the communication part on to a phone. If I want to send you an SMS, I have to use one of the weird email-to-SMS bridges that some providers probably still have, and if you want to reply, there's a chance that the bridge doesn't go the other way. If I want to send you an email or use one of the many other chat systems that are generic, I can do it from anything with a data connection.

Oh, and on the encryption front, you're correct about the provider having the ability to damage the software you're running, which is one reason I don't use WhatsApp even though it is encrypted. Using open source software and/or decentralized clients helps with this. I have the knowledge to check that, as I'm sure you do as well. Dismissing it based on that risk isn't very convincing when the alternative is no encryption or really any security at all.

Re: Count Me In

"We all knew what IM looked like, back when BlackBerry Messenger was all the rage. Mandating a standard such functionality (not BBM itself) as a license condition for network operation should have happened years ago, just like a network operator is supposed to support phone calls..."

I disagree. It makes sense for a phone network operator because they will be given a lot of limited resources, whether that's a monopoly on providing service to the public (the wired model) or a large chunk of spectrum which only has room for a few companies (wireless). On the internet, there is no real limit and no central authority giving anything away. The great part of the internet is that I can put whatever bytes I want through it and expect them to arrive, so I don't need to apply for my protocol to be accepted before it can be used. I don't agree with a mandated standard for that reason, but there is another reason for it: feature support.

We've had IM for quite a long time, and it generally works the same, but it lacked many features we have today. For example, encryption. A lot of people want end-to-end encryption, and any attempt to create a single standard encrypted protocol would end up having to specify a key management system, which is likely to prove fragile. Meanwhile, multiple encrypted IM systems can figure out their own key management, and we can pick between the models as is useful. Even outside of encryption, there are other features that people might want, or want to avoid, in their IM. Is IM just for text, or can you send images as well? If you can send images, can you send files? Do the files go somewhere or are they streamed directly across? Does it come with video or audio communication? Should the identifiers be phone numbers, email addresses, some new address format, or a combination thereof? Is there a part of the structure which allows for per-message billing, and what data collection is needed to facilitate it? Is there a distinction between intra-country and international communication? What if Canada adopted one standard and Germany adopted another, but someone wants to communicate between countries? I prefer letting the users pick between options for one that supports the features they want and is convenient for their use.

Re: Peer-to-peer?

The local addresses are not routable, but you can still open a connection out. That connection can contact something with a public IP, which can relay your traffic to more nodes, eventually connecting to another connection from someone else who has also opened out. You don't have to accept an incoming connection to communicate with someone if you can coordinate initiating your connections. This is inconvenient for most use cases which is why getting more usable address space will be useful, but it doesn't make the problem insoluble.

This is, by the way, only for CGNAT situations. For a NAT setup with a dynamic IP address, you can still forward ports to allow inbound connections, and there are tools like UPNP to allow programs to do so without asking for your assistance (or permission, which is why you might want that turned off).

It depends what you're referring to. If you meant the initial infection, the way that some attackers use IPFS, it doesn't sound like it. They use IPFS because there are still public relays that allow an HTTP client to access files on IPFS. The decentralization there is an asset because it makes deleting their payload harder, and the relay allows someone to download the file without having to do any setup. This protocol, on the other hand, doesn't appear to have any bridge system set up, nor does it implement a single application. Therefore, for a user to get a file, they'll have to set up a client of some sort to connect to the protocol and then open communication with something. That's friction, and attackers try to have the least friction possible when getting the initial connection.

If, instead, you meant for existing malware to contact command and control infrastructure, you may be more correct. However, there's not a lot that can be done about that. Malware writers have been using the internet for payload delivery in lots of ways that hide the traffic from inspection, and although I'm certain some will use this protocol, it won't be the first encrypted network that they've used for that purpose, often created from their own infected nodes.

Cumbrian Police accidentally publish all officers' details online

Re: How?

You organize your data so you avoid it, but you don't have locks on everything making it entirely impossible to upload something you shouldn't. Your success in not posting stuff that shouldn't be public is due to being careful, and the steps you take are designed to make that easier.

My problem with the calls to fix this in software is the assumption that, somehow, computers have to make careless users harmless. Somehow, if a user is physically capable of causing a problem with the system, then it's the system's fault. This is not used in a lot of other parts of the world. Take physical security. There are some people who work in extremely secure facilities where they may not take anything in or out and they're subject to lots of scans to ensure they haven't. Does everywhere you have worked do that? My offices have not; if I want to steal something, I can scan my credentials to unlock the door, pick something up, and walk off with it. This doesn't mean that, because theft was possible, the security system is at fault. If we took that attitude, you'd eventually reach the point where every employee or visitor would have to have MRI scans on entry and exit. At some point, designing the system to prevent idiots doing stupid things is worse than working a bit harder to have fewer idiots and to make sure they understand information about whether what they're doing is stupid.

My point is that people often don't like being told that they were not as good as someone else, even if it's true. What you suggest turns any performance review period into a "here's why one of your colleagues is better than you" experience including a full league table, and nobody likes those. Not to mention that, for most complex jobs, it is relatively easy to make up a lie about a non-discriminatory reason for different levels of pay, whether it's true or not, so any disparity you ask about will have one whether or not the actual reason was justifiable.

It looks like the request was for a list of names, so you are allowed to know who works for the police, just not every other detail about their jobs including their salaries. Why you want the data is another question, as it's usually pretty easy to determine either whether a certain person works for the police or which members of the police were involved with a certain situation, but it looks like you are allowed access to the full list if you find that data useful.

There are potential benefits, but I also foresee some problems. If someone deservedly gets paid better than others, will the others simply accept that their performance was better, their skills unmatched, their work ethic stronger, or will they feel they've been treated unfairly? If they do, how would you suggest handling that without either withholding what you would have given to the stronger employee or dealing with more people quitting, which places more work on everyone who stays. This is just thinking of the problems from an employee's perspective as that's my position, but there are problems from the company's as well which aren't necessarily indicative of malpractice on their part.

I'm not blind to the benefits of transparency of salary data, but I think it might cause quite a few problems. I think you probably do as well, which is why you limited it to employees of the company; some people advocate that financial information be available to everyone in the general public, but I think a lot of things would go wrong if that were attempted. I think the more limited version would produce fewer problems, but that some would still exist.

If you're Russian to the Moon, expect traffic: Moscow's Putin a lander into orbit

Re: Look at me!

I'm quite sure they will. Russia has basically nothing they can be that proud of except for the fact that they have a much larger nuclear force than even many other nuclear powers. This is how they can still count themselves as a superpower even when nobody else would. That is the kind of incentive that is needed to make sure you keep hiring people to maintain and operate the facilities even when there is basically no realistic situation in which those weapons would need to be fired.

Re: Star Trek style warp drive can never work

What, you mean that people writing science-themed entertainment shows in the 1960s weren't very good at theoretical physics as we know it today? That's a disappointment.

Of course, we have a lot of questions in physics that we don't understand yet. For example, whatever dark energy is, whether it's a single phenomenon, multiple combining ones, or a mistake in existing models, it seems to allow things to move in ways that the existing models suggest they can't. Maybe that will turn out to mean that we could also do so. Or maybe it means that we could try to do so and die in interesting new ways. Or it could be like fusion: a fun way to spend decades getting nowhere, but it will be here in about twenty years. Be careful when you say that physicists can prove for certain that something is impossible, because physicists have said that at previous times, and sometimes, physics has proved them wrong.

Hacktivists attack Japanese government over Fukushima wastewater release

To be fair, either of those can kill you. Most isotopes of uranium take a rather long time to decay, but they can also kill you with radiation (and poisoning, but you can probably more easily refrain from eating it). However, the ones with really short half-lives, while more dangerous at the start, are also the ones that will quickly turn into something else without having to be stored for a long time. Depending on what that something else is, it may not be radioactive anymore and therefore the radiation risk is eliminated.

The price of freedom turned out to be an afternoon of tech panic

Re: Spreadsheet imports

This kind of thing wouldn't surprise me, especially as a lot of software that accepts spreadsheets as input have lots of available columns. If they were importing something structured, like XML, JSON, or SQL of some sort, then those fields would have names they could check against. I've seen spreadsheets that looked like this:

<itemname>, 0, 0, 0, 0, 0, 29.99

With all the zero columns being for fields that you weren't using. When there are already columns like that, one more doesn't stand out too much. This is one of the things that caused me as a child to stop using spreadsheets to store information when it got too big and use a format that wasn't as prone to user error, although that also taught me a long-lasting fear of nulls which don't always mean the same thing.

Lacros rescues Chromebooks by extending their lifespans

Re: Limited life span?

"You are incorrect. All Chromebooks released after 2020 now have an 8 year support life from the release date. Even the £150 ones."

I stand corrected. It doesn't make me feel that much better about them, but it is a bit better than when it was less than eight years, so some points back to Google there (they're still on negatives).

"The second problem you list "no technical reason for the end of support". There isn't for Microsoft stopping providing Windows updates either. Or Apple providing MacOS or iPadOS updates. Yet, they both do?"

This wasn't always the case. For example, it wasn't the case for Windows until Windows 11 happened. You could install Windows 10 on any compatible hardware, even a Pentium from 2000. It wouldn't work well, but you could do it. Even when they did add that in Windows 11, they didn't do it very strongly, as bypassing the hardware check and installing it anyway is a quick process that still works even though people have been doing it for two years. A similar argument applies to Mac OS, where you can install new Mac OS versions on old Macs and they function. I don't approve of Apple's cutting of support, and I have complained about it frequently. The fact remains, though, that you can install modern Mac OS on Macs that don't agree to install it and all the features will work, whereas you cannot install modern Chrome OS after the AUE death date. You can, of course, install Chrome OS Flex and lose several features that they could quite easily leave in. My argument remains the same: Google is worse for no good reason.

Tinker Tailor Soldier Pi? Asus's 'NUC-sized' SBC aims to out-Pi the Raspberry

"Which it I am referring to is obvious."

To you, perhaps, but I am at the very least the second who doesn't know. At first, I assumed you were referring to the Asus model, either having found its price or having mistaken something else for it. Now, I'm not even sure of that since you indicated that you didn't have the price of that but still think it was obvious.

There are a lot of SBCs out there now, and many of them are at a similar price point to the Pi, although in my experience their specs and software support are usually not as good. For example, there are really quite a lot with quad A53 CPUs, which is getting a bit old now. The quad A55 is certainly better, but it's still a six-year-old core and intended for the little half of the cores. Of course, this isn't necessarily a problem depending on what you're doing with it, as for a lot of networking or automation, the A53s are fast enough and the machine is connected to mains power; I have a few doing that kind of task. I sometimes want higher performance or better power efficiency, though, which is why I've been waiting for better SBCs to come out eventually. The ARM-based SoCs that manufacturers have been making are really great compared to the ones we have access to.

"Raspberry Pi unfortunately (albeit predictably) priced themselves out of the market with v4."

I don't get that. Sure, they have been difficult to get, but not because the price is unreasonable. My experience with other models is that their prices tend to be worse. You can sometimes get a faster chip or a different peripheral for that, but often the prices are somewhat to a lot higher than the Pi's prices just for the bare board. In the kind of projects I do, I also price in things like non-universal power supplies and cases, but I'll leave them out for now. Then, most of them have to be imported and the shipping prices add to that. This isn't to say that the Raspberry Pi is perfect or competitors are bad, but in terms of price, I've often found that the Raspberry Pi in particular can boast about that. I would have been much less surprised if your trouble with the Pi was around performance, power consumption, or available options. I'm wondering what your experience has been and if ours have been so different.

Zoom's new London hub – where 'remote work' meets 'we need you back in the office'

Still not the downvote guy. I don't bother with this much either because it's not as much about what I'm doing right now than what you need. If I'm available right now, I will go read your message. If I'm really busy right now, I will ignore your message (there are ways to get my attention if it's that urgent, which it probably isn't). If I'm only slightly busy, then I can quickly determine what is going on and whether I think you can wait, so that's what I'm going to do. Rather than having you make the judgement, I prefer that you send me your question. For one thing, if you ask a question and I'm too busy to answer it, then when I come back to it a few minutes later, I can give you the answer even if you're not there.

I wasn't the thumbs down guy, but I don't like this. I'm on the nohello side. If you have one question, put that in the message and I can start responding to it immediately. If it looks like a long question, I'll send an in progress message to let you know I've started. If you have a lot of questions, then either send the first one or send a message asking for a talk, ideally with some context about why.

The reason for this is that I have to quickly decide when a message comes in whether I should switch to that one or continue doing what I'm already doing. If I don't make that decision quickly, I become distracted. Switching to the chat software to acknowledge your greeting and ask what you want, then wait for you to type what you want will be that distraction. This means I'll either run the risk of being distracted when I shouldn't be or I'll ignore something from you because I don't have information which, if I did have it, would have gotten me to switch more quickly.

The alternative isn't better. I'm thinking of the last phone I had without downloaded voice messages, where retrieving them required using the voicemail IVR system. The one I had would read phone numbers before every message and very slowly. On the positive side, it would be very easy to write them down. On the negative side, after listening to a phone number for twenty seconds, I was quite irritated and was no longer paying attention because I wanted the system to shut up. I tried to turn off that feature, but in that case, finding out the number for someone who didn't say it in their message would take about twelve button presses to turn it back on and then off because it was only available as a global option.

Re: I think it is the perfect time to start a new company : Gloom

I'm less convinced about the idea. At least if the business does short-term office leases to a particular client, that client can use the office for some purpose that someone benefits from, like having a bunch of people work on the same thing in person temporarily before going back to remote working or having a public place where others can be directed. While there certainly are people who would rather not work from home, not all of them really value a rented hot desk much, since it won't provide them much that they couldn't have had at home, and if they're paying for it out of their own pocket, they could probably buy the things they're using with a few months worth of rent payments. Some people will really like the experience and become customers and I could see a lot of people finding that there is an occasional day when it's convenient, but in order to accommodate that latter group, the office would have to have a lot of vacancies which is not very profitable.

India launches contest to build homegrown web browser

Re: Our global internet is being killed off by governments.

I think they'll find it very hard to get people to adopt this voluntarily. My best guess is that they'll talk for a while and eventually give up. However, we are talking about the country that really likes turning off the internet for whole states* for weeks, so I don't think more sophisticated censorship is inconceivable.

* By states, I mean places with larger areas and populations than some countries. It's usual for the people cut off from the internet to count in the millions. Also, those shutdowns don't tend to be universal, because it more often applies to the mobile networks than terrestrial ones. A lot of people only have mobile connections, so that isn't as easy to deal with as those of us for whom home internet is generally available.

Re: Nationalism for the sake of Nationalism?

Yes, I imagine that's what they'll get, but the Kazakhstan parallel is why they wouldn't just ask Google to use the CA. Kazakhstan wasn't going to make their own browser, they were going to require people to install their CA, so the browser writers made sure that doing that wouldn't work. That may be why India has decided they need to control the software so they can insulate it from any sneaky decisions where Firefox allows their CA for six months then pushes an update that revokes it the way they've proven they're willing to do with other untrustworthy CAs. I'm pretty sure you won't get any other features that can't already be found in browsers.

Re: I wish them luck

You are absolutely correct. Unfortunately, India did announce that they were going to make their own mobile OS. Then they announced that they had. Guess what it was. If you guessed that it was a version of Android with the name changed in a couple places, you win. Making a real new browser is hard. Cloning one and saying you have is easier.

Re: Nationalism for the sake of Nationalism?

"what can an Indian made FOSS browser offer over just encouraging contributions to, and maybe even mandating use of, existing FOSS browsers?"

My interpretation from the article: control. For example, we've got this bit:

The desired browser will have its own trust store, use a root certificate from India's Controller of Certifying Authorities,

This may sound familiar. It is what the government of Kazakhstan said they were going to do about six years ago. An attempt to be able to MITM all traffic by making any certificate they wanted. The open source browsers responded by both refusing to include that certificate by default, and a couple versions later, modifying the code so that, even if it was installed, they would refuse to use it. Mozilla doesn't like shredding its users' privacy for a dictatorship's benefit. So what would they do if India suggested that its government should have that level of control over certificates? I don't think they'd let them.

If I'm correct, India will have to do more things to make sure people use this browser, because as I said in an earlier comment, I don't think people will be installing it very often. They have indicated a willingness to punish those who don't comply with restrictions, even odd ones, that they've just made up. They have the option to be much stronger about this if they're interested in increasing control. At the moment, I don't think they have sufficient investment to get what they've asked for, though, so it's probably not a big concern at the moment.

Re: I wish them luck

I wouldn't count on that. For one thing, my prediction, and I'll be happy if I can come back and say I had it wrong, is that the final result will be another wrapper around Chromium. This I base off the fact that it's all people do nowadays when they want to announce that they've developed a new browser. Who, other than Firefox, has built something around Gecko recently? The only people I can think of are those who cloned an older version of Firefox at some point when they didn't like what Mozilla was doing, which is fine, but not really the same thing that has been built around Chromium. If IndiaBrowser is just a wrapper around Google's code, then Google will have as much power as they ever did.

The other part is assuming that, since India payed some money to the writer of the browser, that Indian citizens will start using it. It's the same thing that happened when people assumed that everyone in China would run Huawei's Harmony OS (they don't), that every company doing business in India would use their videochat platform (they don't), that everyone in India would buy Indian-made mobile phones (they don't), that everyone in the US would buy one of those "only made in America" products (they don't), or any of the other times when someone assumes that some ill-defined concept of patriotism means they don't have to make a good product just because they think they've attached it to their country. They don't even refrain from buying from hostile countries unless the government bans or significantly restricts it. If they do build this browser, people are still going to get the default one their operating system brings, and a lot of them are going to go to a Google site, get the Chrome ad, and install the thing. Few people will go to the site and install India's version. I can see India doing some things to make them install and possibly even use this browser, but if they don't, it's not going to be adopted.

There's a good chance your VPN is vulnerable to privacy-menacing TunnelCrack attack

Re: Looks like I'm safe!

I wonder what statistics are available about use of public WiFi. While I don't go to places with those networks often enough and most of the time, I'm not trying to connect, I remember using them somewhat frequently a few years ago (I have a VPN) which now feels less necessary with a mobile plan with more coverage and a less limited data throttling policy. I'm sure there are places that don't have that level of mobile coverage or quality, but for the many countries with developed networks, I wonder if public WiFi has become less often used in general.

Re: Network routing working as intended

It doesn't have to be that narrowly targeted if an attacker with a public access point either collects a lot of known VPN addresses and spoofs them all or even tries it for every client. In the latter case, a lot of clients will receive something weird with their first request that isn't really trying to establish a VPN connection, but most of those first requests will be an OS service or a connectivity check, so they won't see it. That said, it's still a relatively complex attack that is difficult to do automatically, so it's unlikely to be seen very often on even those malicious access points that I occasionally find.

Lawsuit: We've got the stats to prove Twitter ax fell unfairly on older, female engineers

I didn't say you had to trust me or them. I didn't say all their statistics were wrong or falsified, although when you see statistics from lawyers, you know they are the set that support their case. That may be the only correct way to view the data, but it also might be very wrong. I do not want to convince you of a particular point. I will, however, explain some things you questioned.

First, you don't understand why I said that 16 employees created the divide they're talking about. Here's how I got that. There were, as the article states, 248 people over 50. 60% of them were fired. Of the set below 50, 54% of them were fired. Had they fired 54% of those over 50, that would have come to 133.9 people, which we can round to 134 although I rounded it to 133. They actually fired 149 people, which makes 16 more than my original rounding of 133. Therefore, the difference that they are pointing to, which is 6 percentage points, is 15-16 people. This may but does not necessarily indicate a small sample problem. For a simplified example, if they fired the three-person team mentioned in my original comment, you could say that they fired 100% more women than men, but the difference is one person, which makes it more likely that it wasn't for that purpose. This is a simplistic understanding, as there are plenty of reasons other than simple chance that could have been used. Some would indicate discrimination and some would indicate normal running of a business. If the sample size was large enough, assuming that some other factor was necessary would make sense. Since it is smaller, that is not as evident and other factors must be investigated.

The difference becomes larger in other sets. For example, the female-to-male divide consists of 221 people, which is a much larger sample. That still doesn't necessarily indicate discrimination, but that is much less likely to happen by random chance. By far the best number they have is when they limited the numbers to engineering roles. The reason for that is that, if there were a lot of women and few men on the moderation team, then when Musk decided to demolish the moderation team to get started on destroying the business early, the women would end up in a worse situation for a reason that will not count as discrimination in court. They will probably have to make a lot of similar subsets to demonstrate discrimination when controlled for what kind of job was being done by the person who got fired.

Bringing in random chance is already a problem, since even with the extremely poor quality that was used during the process, people don't get fired by random chance. Calculating how likely this would be if the decisions were made using dice is not the right way to determine discrimination or not anymore than you would expect your raise to be determined by flipping a coin. You still might be treated unfairly, but it would be due to decisions of your employer that they didn't want to give you more money, not valuing you accurately, or discriminating against you, none of which is random. When you start comparing something to random chance, you open yourself to lots of arguments about what counts as a positive result which will dramatically change the random value. When that comparison is of no value, it is often not useful to bring it up because you'll end up in a stats fight.

Re: At will, aka "Right to Work"?

They're really not the same thing. You can be in no union at all and have more barriers to leaving a job or getting fired from one, or you can be in a union but can leave or be fired very easily. Or, of course, you could have both or neither, but the difference is most noticeable when you consider one of the two at a time. It is always possible that being in a union will increase the barriers to getting fired, but that is not guaranteed. There are also many jobs that simply will not have a union involved, so the policies on whether you have to join that union* aren't very relevant to that one, but the policies about when and why you can be fired still affect you. The things are not synonymous.

* Technically, it's not that you are required to join the union, but that you could be required to pay the price of union membership. Participation is optional.

Cops cuff pregnant woman for carjacking after facial recog gets it wrong, again

She probably didn't identify herself for the same reason I wouldn't. I don't really want to be questioned by the police. The stolen phone example has already occurred to me: someone found a phone on the ground and brought it to me because they thought I would have the skills to locate its owner. The phone had been reset and locked by Google's anti-theft mechanisms, but wouldn't tell me identifying information about the owner. Now do I want to try activating a stolen phone on my network in the hope that Google tells me who to return it to instead of deciding that I stole it? I brought it to a mobile store, asked them if they could find the owner, and left as soon as possible. I don't know what if anything they did with it, but I certainly don't want to be the point of contact for the police on a situation that isn't related to me. The best case scenario is that they record information about me in a system that's likely unprotected and will be leaked in a few years.

US Supreme Court allows 'ghost guns' to fall under federal purview

"I really can't wrap my head around why they're so determined to allow untraceable guns."

It's typical reaction to a strongly-held opinion. They think "I don't like restrictions on guns. This is a restriction on guns. Therefore, I should not like this". If it stopped there, they might think twice and figure out how weird it got, but they've added another statement to their syllogism: "I do not like restrictions on guns. I hate the people who suggest restrictions on guns. This is a restriction on guns. Therefore, I should not support it and I should hate the person who does". At the point that they've added a bad person who can be blamed, they don't feel the need to keep thinking about whether the idea they just had makes sense, even under their previous opinion of guns being great. It's not limited to that opinion, either.

It's a common logical failing that affects many of us, including me. Not about guns in my case, but there are things that I strongly support, and I am more easily prone to making quick decisions about things related to those without considering all the factors. I try to remind myself to review things that I've made instant judgements about to reevaluate whether that was a good judgement. I'm not great at that, nor are many others I know. Some others I know never even think that their opinions could be wrong, so as soon as they form one, it is set in stone and may never be questioned.

Ukraine's Victor Zhora: Russia's cyber 'war crimes' will continue after ground invasion ends

Re: It couldl all have been so very different

Yeah, that's not what happened. Russia has had a lot of opportunities to be involved with the west. Most of the time, they've been invited to work with those countries on international issues and they've taken that opportunity. I'm not sure which specific incident you're thinking about this time, but not every time that they aren't given a chance to join in is a permanent snub from the rest of the world saying "you might as well turn yourself into a country that everyone else hates". Russia's current isolation is a result of repeated attacks on other countries with which they have no legitimate cause for war, not the openness or lack thereof from the United States. In fact, while they were conducting those attacks, they received a lot more approval and support than they deserved because countries in the west kept hoping that, if we didn't close them off, establish closer ties, keep helping them improve their economy, make sure they never feel in the cold, maybe some day they'll stop invading other countries. That failed.

4 in 5 Chromebooks sold to US students in Q2 as demand rises

Re: Lifespan

I accept your premise, but I disagree with the conclusion. You estimate that a device can be kept for four years. Theoretically, that means Chromebooks are fine, since they'll get 6-8 years of support. The problem is that the longest times are for the flagship models, the ones that cost as much as a Mac and you're certainly not buying. That leaves you with the standard 6-year support cycle, and they get that support from some time of the manufacturer's choosing, which isn't when you obtain them. You can go and find Chromebooks sold as new which are already four years through their lifetime (I think the manufacturers started counting before they finished making them). Those tend to be the cheapest ones, you know the ones that a cash-strapped school might buy so everyone can have them. Now you've got machines which you think will last four years, which the school will budget for lasting four years, and which probably will continue holding together for four years, but you'll only get two years of security on them. Even the worst Windows laptops will have security updates for that time, even if they're annoying to use. I haven't tried the low-end Chromebooks, but I wouldn't be surprised to hear that they're also painful to use, especially having seen Chrome's hardware requirements.