Posts by doublelayer

It's official: EU probing bundling of Teams with Microsoft 365

Re: s/Internet Explorer/Teams/g

In the same way that you don't care about Safari because you don't use IOS, I don't care about this because I don't tend to use Windows search as a web search tool since I use a browser of my choice. Both of them probably qualify for someone to complain about the bundling, but in Microsoft's case, it's quite easy to use a different search system whereas in Apple's case (on mobile devices anyway), it is not possible to use alternatives. I have more worrying ones I'd prefer them to focus on, but if they're going to do one of them, Apple seems to fit the requirements better.

Aliens crash landed on Earth – and Uncle Sam is covering it up, this guy tells Congress

Re: Nonsense

Of course, but not to land your own here. Instead, to do some investigation, you could start having your drones retrieve some stuff that can be found on the surface and bringing it back. That way, you can experiment on that in peace, and if it turns out to be dangerous or unwanted, you can drop it into the sun. Quarantining possible sources of infection is a good protocol for investigating things you don't know about. Of course, if they are exploring, I'd expect to see their version of the rovers we've deployed when we wanted to explore another planet.

Re: "it needs to have oversight"

Probably because, in the world where TV show logic applies, they buy into the secret US agency that has technology the rest of us could only dream of which is used to intercept all of the UFOs over every country and bring them back to the US, because if you have a secret organization that cannot get help from anyone else for fear of breaking your secrets, you would want all the potentially dangerous stuff in one place where it can all blow up simultaneously. They're entertaining shows sometimes, but not so much when you find people who think they actually happened.

Re: Not impossible, just ludicrously unlikely

It depends what the aliens concerned already have, but there are two general options that science fiction provides:

1. Slaves with sufficient intelligence to do things they haven't automated, but not enough intelligence to design our own spacecraft after they smash up our basic ones.

2. Lunch, assuming that our protein is of use to them, although in that case I think they're better off removing humans and eating the animals we already farm.

There is an alternative: they might just not like the idea of having to deal with us later and figure that destroying us now would be an easier cleanup job than trying to remove us from multiple planets, the way that if there is one sample of Ebola in a lab that doesn't need it, it's usually time to completely wipe out that before it finds its way into any humans. Maybe the aliens will be nice enough to assume we won't be that harmful if we spread, but no guarantees.

What does Twitter's new logo really represent?

Be careful, because on those vague terms, a lot of things could come under that. Linux, for example. Sure, it's maintained by multiple people and organizations, and you could technically maintain it yourself. In practice, those organizations are currently working on the basis that the others exist and don't have the ability to maintain it singlehandedly if they shut down, and individual users of Linux in many cases don't have the skills to fix it themselves. I don't think Linux will become unusable, but it could theoretically do so. If it did, would you want to hear people making the argument that, since it was free, anyone who relied on it was stupid and should have relied on some alternative for which they provided money? Because I've heard that argument before even when it was running, and trust me, it was annoying.

Re: X... 15 Overlapping Circles...?

The circles were used for the previous bird logo, not the X. It makes it a bit easier to understand how they got there, since I don't see any way to make an X out of circles without making more trouble for yourself than you need to. The best way would be to use very small circles, but then you could as easily just use pixels.

Re: Let's hope it stops the hate comments

You want constructive comments? Is that a euphemism for unquestioning support of people you like? If you've read enough of these comments to dislike them, then you already know what their views on Musk are. Yes, some of them express those views negatively, but you don't really need to ask about what their views are; they've explained them at length. Therefore, I must conclude that you aren't looking for "constructive comments", but are instead simply complaining, in the same way that they are, about things you don't like. They don't like Musk, and you don't like expressions of disapproval against Musk.

Your use of the word "wokesters" made that, if anything, even more obvious than the rest. Some people might also express that they've seen as much of complaining about "woke" (whatever the writer is choosing to mean by saying it) as they ever want to, and I have seen people who have made that point. It doesn't stop you from making the post you did, nor should you be required to refrain from posting your views simply because someone doesn't appreciate them.

They might have to argue about whether Meta is using that trademark. You have to either be using it for something or have serious plans to do so. I'm unaware of any Meta property using the name (that's not saying much since I don't know much about Meta's products anyway). They've also had it for four years and were able to make their latest social media product in months, so they might have a hard time explaining why they hadn't built the product they wanted to use with the trademark yet. So Twitter has the choice to attempt to argue that Meta has left the trademark unused and therefore should lose it. That might lead to a long legal fight which will manage to be more boring than it should be.

Want to live dangerously? Try running Windows XP in 2023

Re: My takeaway from this article...

How much of that was Windows and how much was it files that you or an application stored there? Yes, Windows did get much bigger, but so did all the files I store on my computer, both in individual file sizes and in the quantity that I tend to store there.

"I'm writing this on an elderly Thinkpad X60 with two 1.8GHz cores. It takes about one minute to boot Linux Mint. What 216000000000 things does it need to do, exactly, before it can let me login?"

I know you're probably joking a bit, but those cores are not both operating at 100% utilization through that process. Some of that process is single-threaded anyway, so your second core is doing nothing then. Most of the process, though, neither core is doing anything, because they are waiting for data to come off the disk into memory, during which they spend a few million cycles doing nothing, and then some of that data is loaded from memory into registers, during which they spend a few hundred more doing nothing. Only then can the cores start computing something useful, such as decompressing some data back into memory (a few hundred more cycles for it to write), verifying the integrity of the system, and creating lists of components that need to be located on the disk and loaded into memory (a few more million). If you attach the same RAM and disks to a very fast processor, you'll get some speed improvement, but if you attach the same processor to a much faster disk and RAM, you'd get a significantly larger improvement. This might not be possible with the hardware you have available, but those are some of the factors that lead to the boot time.

Re: My takeaway from this article...

I have to agree with this. I wasn't around for the earlier generations of computers, but I got to try some of those things that are lauded here and they weren't always fast. I have also seen lots of historical complaints about the hunger for resources of Windows 98, XP, early distros of Linux, or basically anything new. Years later, when computers naturally came with more resources, and when there was a new new thing to complain about, the old one would be praised for its prudence in comparison.

Sure, XP runs quite nicely on a 2010 machine. It also ran nicely on a 2003 machine. I had a while where I was running it on a 2000 machine, though, and it wasn't so fast. It was usable, but I would spend some time waiting for things to complete because I had gotten used to some actions taking longer than they looked and ignoring my typing until they completed. Startup times were quite long, applications would take a while to load, and it couldn't handle large operations anywhere near as well as more modern computers could. For example, I remember an animation that Microsoft added to the search feature, possibly because you would be waiting for several minutes and they wanted to avert boredom. On modern Windows, file search even on my disk with hundreds of thousands of extra files takes a few seconds at most. That's not to say that everything added to a modern OS is for the better or justifies the high resource requirements, but nostalgia is often incorrect about how good something really was.

AMD Zenbleed chip bug leaks secrets fast and easy

for (int i = 0; i < data_length-key_size; i++) {

if (is_valid_private_key(data, i, i+key_size) {

report_possible_key(data, i);

}

}

No, nothing that can be done. We're all safe now.

Re: Parsing the data

"The only way that I can think that this would work is if there were multiple versions of library routines in a library, and the runtime-loader decided which version to link to at execution time depending on the model of processor it was running on. I don't think you could make this decision in during the program flow itself, because otherwise any code would be deciding which varient of code to run as much as running the code itself! Maybe someone can enlighten me here."

I don't know how common it is, but where I've seen it done, they do exactly this, but to save time, they figure out which versions of the functions they will call at the beginning of execution and cache those. The rest of the program doesn't need to spend any time checking the processor and branching to those different versions since that work was done once at the beginning of the program and was stored in memory, meaning it can be consolidated into two instructions.

Re: Also, I just noticed...

It could be both. The first documented use of EternalBlue was North Korea failing to do ransomware*. Not too long after that came a Russian government attack on Ukraine and sort of anyone who looked a bit like Ukraine. Others figured out pretty quickly that this vulnerability was nice and started using it as well. If it becomes known, someone will try to use it, and unless it's fiendishly difficult, that includes smaller criminal organizations and individuals.

* Well, they succeeded at infecting a bunch of places, but failed to keep their malware functional by leaving in a kill switch and failed to collect very much money.

Re: Also, I just noticed...

It's a feature I have used before for that purpose, but it does absolutely nothing for this vulnerability. If you want to have both windows open, the level of isolation required is a window in another browser running on a different computer. Anything where the same processor is in use is potentially vulnerable to the attack.

OpenAI pulls AI text detector due to it being a bit crap

Re: Correlating Commentards Causes Confusion

One reason that won't be very interesting is that there basically wasn't any debate on that topic. GPT sometimes prints large chunks of text verbatim, but even more frequently mashes up small bits from lots of chunks and returns those. Either is pretty easy to prove, since it can be made to either quote something accurately which can be verified (depending on what it quoted), or to incorrectly state something which its training text would have accurately stated, demonstrating that it had modified the original text to get there. So the answer to the debate is that it does both.

It's also not interesting because what would a failed classifier prove about what GPT was doing? Yes, one thing they could have done is to have the classifier classify anything from the training data as AI-generated and everything not in that as not. Obviously, that wouldn't produce the results they were going for, so they didn't do that. The other method they used also didn't work, probably because these LMMs have mastered English to the extent that their output and human output is hard to tell apart just on the basis of word usage or sentence structure, although depending on the subject matter, it might be more obvious to humans who have more context. Of course, nothing guarantees that they were competent while making that classifier, so it could have failed for more basic architectural reasons. I have little confidence that they will ever be able to make an accurate classifier for this purpose.

Apple patches exploited bugs in iPhones plus other holes

I don't know what you can do with an Apple TV, but if it can be used to browse the web, watch content rendered by a browser of some sort, or receive messages, then there are some attack vectors. It might be something as simple as TV OS being basically the same as IOS with a different frontend (as I recall, a while ago they didn't bother having separate names and called it IOS), so if they patch one they are going to patch the other to keep the codebases in line.

Framework starts taking orders for 16-inch repairable, upgradeable laptop

Re: Obligatory

Usually, it's an existing English layout modified with one or more keys used as modifiers to add diacritics. I've seen them made from both the UK and US layouts, usually with one or two of the less used punctuation keys set to diacritic mode. For people who primarily type in English but who speak a language that uses Latin letters, but not the subset used in English, this layout can allow them to use one layout for both languages and to have labels on the keys telling them what they do.

As a touch typist, I don't find this necessary; when I use a different language, I switch my layout to that one and it doesn't matter that the symbols on the keys don't show up when I'm typing in that language. This is not true of every user, which is why the international variants have been created. You can always get an international English variant and set the OS keyboard layout to something familiar. The only downside is that a few keys will have symbols that don't represent what they do under your new choice of layout. The only thing you have to be careful about is that the keyboard has the keys in the shapes you prefer, so if you're used to an extra key near your Z key, getting a keyboard that doesn't have one could be more annoying and vice versa.

I would also like more ports, but the modules are not large enough to put a bunch of ports in one section. A module measures 3 cm square and about 0.7 cm thick, so you're not going to be able to get two card slots and a USB port in one of those. You could probably get two USB-C ports into a module that size, although I'm not sure how that affects charging through one of those ports and connecting to a device through the other as they're both handled by one upstream port. I have hoped that others would manufacture modules to increase the set of choices. So far, only one has been made that way. Not all the ports are £20 or so, as the basic ones tend to be £9.

I ended up accepting this anyway because I've found most alternative laptops to be somewhat lacking in ports as well. Sometimes they include more in total, but that often includes something I won't use. If the alternative machine I'm considering only has a few ports as well, then I have no reason to prefer one over another.

Re: Laudable, but perhaps not commercial

"Now fast forward a couple of years, when there's more demanding software, inevitably bigger files, and newer machines are faster and more capable. Will an upgraded Framework machine still be viable option? For some it will be. But for some it won't, and that erodes the parts sales potential etc etc."

I'm curious what problems you envision. If Framework continues to follow the plans they have for two generations, then one of the upgrade options is a new CPU. If you bought one of the first generation with 11th-generation Intel processors, you can open it up and swap in a 13th-generation Intel or 7th-generation AMD board keeping the rest of the computer. So if software gets bigger and you need something faster, why wouldn't that be sufficient to give you that access?

Of course, if Framework doesn't keep making mainboards or switches the format, that could stop being an option. I don't think that is likely as long as there is sufficient demand. The alternative is that the laptop can't be upgraded at all, so you'd just have to buy a new one. The value of spares is only helped if they can be used on more and more models, so if they end up being less valuable than spares for models that can't be upgraded, it would seem that's down to their company selling fewer laptops altogether.

Re: I have to say I would really like a laptop with the touchpad to the right

I suppose that depends when you replace your laptops normally and why. If you need the latest processors at all times, the new mainboards are a somewhat expensive way of doing it, but if the old ones are still used, then it might work out for you. I don't think it would prove that much differently than buying new laptops as frequently, although the old ones could be more useful than the old mainboards. If instead you are like me and replace computers because hardware has failed, then the Framework's model makes more sense. The last computer I replaced was replaced because the following had happened to it:

1. The battery was weak (relatively cheap and easy to fix on a Framework machine)

2. The disk had failed once and I didn't like that it was in an unusual form factor (Framework, along with many other computers, uses a standard M.2)

3. I had worn out the included keyboard, which wasn't too bad a problem but a bit annoying sometimes (also replaceable)

4. Apple had blocked me from installing new Mac OS versions without overriding them.

Of this list, only point 4 would require a processor change, that only happened because the computer was nine years old when they dropped support, and I was still fine with the performance I got out of that CPU. Had the other parts of the hardware kept up, I would have used it for longer, and I do have it running a few things, just in a less primary role.

I don't understand your comment. That address loads fine here, so the site at least exists. It could be better organized, but all the information is there somewhere. What problem did you have with it?

Re: Obligatory

Yes, it will, and there are guides for installing four popular distros. Those who use less common ones can probably extrapolate from those to figure out any other issues. Linux users, perhaps unsurprisingly, are among those who value a repairable laptop most.

Apple owes Brit iOS app devs millions from excessively high commission, lawsuit claims

Re: professor of competition policy

Sure, why not? There are both legal and economic facets to competition, and it's something that students might focus on if they're looking to work at a regulator, a company that either is or looks like a monopolist, or a place that wants to fight against monopolists. Is it that different from a professor of cryptography, even though they'd be organized under the mathematics or computer science areas, or a professor of copyright law?

Re: It is a pain

"Apple and Google have practically identical side-loading features."

Let me guess. When you say "side-loading", you're referring to taking the app you just wrote and installing it on your phone from XCode or Android Studio? Yes, those are similarly easy. That is also irrelevant to the discussion and to basically everybody. Developers can figure out how to load their test version.

The side-loading that others are talking about is when you've finished developing your app and someone who doesn't have the code wants to install it. On Android, you can get a file containing the app and install it on any device, with two to five security screens in your way. For an iPhone, you can ... well you can get a device-specific package by collecting an identifier the device tries to hide from you, individually made by the developer. Or you could get a corporate profile installed on your phone, assuming you don't already have one which will make it difficult to add others, and that also has to be maintained by the developers and will break should they shut any part of it down. So the part that we're talking about is not identical in any way.

Judge lets art trio take another crack at suing AI devs over copyright

Re: Extension of the Existing Situation

While unfamiliar with the cases, I looked up a summary. The cases I can find where a suit was successful involved using the characters' names at least and often large parts of the setting. So it's not just some child being sent to a magical school, but children using the same names from being sent to schools invented for that book, sometimes both applied and sometimes only one. Of course, there may be others that Wikipedia didn't choose to list.

Re: Whoops ... I Hear Solicitors Getting Rich

I don't think satire means what you think it means. I'm not sure it was intended as satirical in the first place either. Extrapolating or exaggerating something doesn't automatically make it satire.

Re: Whoops ... I Hear Solicitors Getting Rich

Since the law works on the basis that copying is not allowed unless you have the right to, it already holds that ebooks are illegal unless you have permission to make them. Interpreting it in a different way would be very difficult. For example, even if a judge takes the strongest position against the creators and operators of LMM programs, giving the most rights to the original creators of training data, it would not prevent them from making something out of training data to which they have the copyright. Microsoft could still train on the code they wrote. An author could train on their own writing (subject to their contract with their publisher). So if you really think a judge could somehow ban ebooks as a concept, I'll take the other side, and I'm curious to see your proposed logical error that could lead them to do so and have any legal viability (if it doesn't have that, then another court will quickly throw it out, so that will be a requirement to obtain the situation you describe).

Re: Can you 'own' a style?

That's not what they are claiming or asking for. They are not saying that they own a style and you can't produce anything that looks too close to that. They are saying that the bots are only able to imitate that style because they have, without permission, used a lot of their copyrighted artwork to produce those new pictures. In some cases, identifiable pieces of that work have been produced by models such as this. The court has to decide whether those parts are sufficient to be violations on their own, and whether there is a right to use copyrighted content as input to a program without permission and despite complaints from the copyright holders.

Re: Whoops ... I Hear Solicitors Getting Rich

Not a problem, since that is already how the law works. If I scan a book, make an ebook out of it, and sell that ebook, I'm violating copyright. If the publisher does it, they have the copyright and can grant themselves the rights necessary to make that ebook. The law already works as you describe, and it always has done. In my opinion, that's how it should work.

Re: Extension of the Existing Situation

The problem comes when we try to decide whether LMM processing counts as reading and understanding, like a human brain does, or mashing and reconstituting, like a dumb program does. It isn't clear, and although media hype likes to paint these programs as sentient systems that build an understanding of concepts, their output indicates that they are not.

Parallels are difficult. Here's an attempt. I have recently opened up an embedded software image and extracted the important program from it, which I am disassembling. It's not even clear whether I'm legally allowed to do that, which is one reason I won't name or describe the product. I'm interested to see what this software does and I'm just reading for that point. However, let's assume that I was going to use that software for my own purposes. If I were to port that software to run somewhere else, large parts would be left behind. The entire UI system is related to the manufacturer's proprietary hardware, which I wouldn't be using. All that code would have to go and be replaced by something that could handle a different set of interfaces. There are some components I could do without. Those would also be deleted and the various gaps covered. There are also certain aspects where the software could use some improvement, so I'd be making lots of edits. Since I don't have the original source code, a lot of the decompiled bits would be significantly changed, by compilers and other tools, in order to fit them into my modifications. My theoretical version would end up being very different, both in appearance and in function, to their original version. If I published it, there's a reasonable chance they would never notice that I had used their software in developing mine. If they did figure that out, especially if I admitted what I had done, they would not accept that as legal use of the software and neither would a court. It didn't matter that I've used only a small part of their work and added plenty of my own, it wouldn't count that my binary didn't contain chunks of theirs, and it wouldn't matter that software made many of the edits; that wasn't my software to use.

Bots that cheerfully quote sections of text or reproduce original images make it rather clear that they have no ability to avoid printing significant portions of copyrighted content. There's an argument that, even if the program doesn't print the content, it is not legal for it to be trained on that content unless it has been legally obtained, and since copyright does not include an automatic license to produce derivative works, it may not have been. This won't be the last time the human-to-bot analogy will be made. We will have to decide for ourselves whether having a computer provide plausible deniability by randomizing things so much that you might not get the original input back is sufficient to equate its actions with that of a human. I don't think the legal arguments clearly indicate a winner.

World's most internetty firm tries life off the net, and it's sillier than it seems

Re: Workers will still be on Google's internal network and have access to the normal tools

If the air gap is implemented with "You can contact Google Cloud, and Google Cloud can contact the internet", then they're doing it wrong. I can put a machine in Google Cloud, so their air gap needs to isolate their machine from that instance I've created in both directions. A network on which everything is disconnected from the internet qualifies. A network in which some things are and some things are not is just a more inconvenient part of the internet.

Meta can call Llama 2 open source as much as it likes, but that doesn't mean it is

Re: OSI vs FSF definition

I think we mostly agree on this, but not so much with this part:

"Although I completely agree that "open" is too vague, and is therefore vulnerable to misinterpretation and abuse."

Sure, "open" isn't very clear, but neither is anything else. "Free software" is more often used to mean something else, simply because it is also the right phrase to describe software which I'm not going to charge for, even if I won't give anyone the source to it, hence all the speeches about speech and beer. The developers of software for which there is no charge don't always refrain from using the term, and there isn't another one that is easily understood by the general public.

This has led some people to start using the term "libre" instead. This doesn't have a second definition, so points there, but it's also not an English word. It works for people who speak French, Spanish, or one of a few other primarily Romance languages in which that's a word, but those who do not and want to interpret it as an English word will have a bit more trouble with it. It also isn't at all clear about what kind of license terms qualify as libre, I have not seen a "Libre Software definition". For example, some people I know thought that libre software meant that software would have a stricter license that placed additional restrictions on what a distributor would do, and used it as a contradictory word to free software. In their misconception, they had proprietary, for which you'd probably need to buy or negotiate a license, free which you could use with relatively little effort in software you intended to be free, and libre which you could use only if the licenses were compatible because they would likely place so many restrictions on a work that they couldn't practically work together. I took issue with this definition, and the group eventually decided that libre didn't mean that, but it doesn't make it any clearer what qualifies and what does not.

Meanwhile, both "free software" and "open source" have definitions which are easily understood, not too difficult to use to check whether a license qualifies or not, and at least known by most people who work in this field. I can't see a better way to classify things except if the FSF and OSI trademark those terms and attach them to their definitions. If they did so, I imagine at least some people would be unhappy with them.

It depends what definition you are using, but I'm sure you already know about the OSI's definition, which is much more expansive than you claim, including requirements to provide the right to distribute, to make derived works, to not discriminate or place requirements on the user that would limit those rights significantly, etc. Has that stopped everybody from claiming to be open source? No, it has not. However, neither have people been stopped from declaring something "free software" when they do not meet the FSF's definitions either. I've linked a case above where a court agreed that the term generally requires more than the source being readable. People who are interested in clearly defining how much rights a certain license provides have a lot of terms to describe different levels, and their use of "open source" is not the same as "source available", a term whose common use is much closer to the situation you describe.

Re: Multiple definitions of open source (lower case)

They're just a group who published a definition and certify some licenses as being compliant with, or not compliant with, that definition. You are free to ignore them. However, there are two risks in doing so. The first is that some of us agree that their definition is a good one and prefer compliant licenses. This doesn't mean that we need to see it on their list, because it's usually pretty easy to read a license and see for ourselves whether it meets their relatively small list of requirements. However, when I see a license that doesn't meet those few requirements, I'm usually less pleased with the decision, and that tends to make me less likely to contribute to the project. If you don't care about that, no problem.

The second is that some courts have acknowledged that "open source" is not a term you can apply to anything you want. It has been held to have a specific meaning, and a company that claimed to be open source without following those requirements was successfully sued for false advertising. That was one court decision, and it may not stand if other cases come up, but it does indicate that the definition from the OSI has some acceptance which grants it some legal validity.

Someone just blew over $190k on a 4GB first-gen iPhone

I don't know when that became the case, because I was able to successfully activate an iPhone 5S without an internet connection about three years ago. That may no longer be possible, and it might not even have been possible had that device been running the latest version of IOS available for it, but at the time, I was not prevented from doing it.

Re: The BOFH, his Boss and the iThing

How about this one, although the Apple products involved aren't iThings. The comments on the article seem more in line with the boss than with the BOFH, though. I guess there are more people interested in IT antiquity than I'd expect.

I wonder if it even had a need for remote activation at that point. I don't know if they had any anti-theft systems on the first model, which is the primary reason they do online activation these days. In fact, you can activate a modern iPhone without an internet connection as long as it's been properly reset and doesn't still have an activation lock from the last user (whether or not that last user was you).

Re: I don’t think they understand

That became one use of "value" as soon as money became generally accepted, meaning that you could sell something to someone and use that money to buy the things you needed. If that disappears, such as your desert scenario, then it has lost a lot of value. The word's been consistently used in multiple forms, meaning either a specific amount of value to you, but not necessarily anyone else, and a more general level of value, often a shortened form of "market value". It's how the economy has worked for centuries.

Probably not, because if it's been discharged this long, there isn't much potential energy left to make that happen. Charging a battery adds plenty of potential energy which can make a bloated battery into a small fire, but if it hasn't become damaged to the point of ignition now, it's likely not to without a new source of energy. If it's plugged in, no guarantees of anything. Given the loss in value that cracking it open would bring, it's probably not worth it to collectors.

BOFH: You can be replaced by a robot or get your carbon footprint below Big Dave's

Re: Error in binary expression at line 61

It's a perfectly functional synonym for "closer to being carbon neutral". Since you can easily measure your level of neutrality, and therefore you can easily compare being not neutral but close to it and not neutral by a wide margin, you can be less neutral by either pumping out more CO2 if you're carbon positive, or sequestering more if you're carbon negative. Since being less neutral is possible, being more neutral isn't that hard to understand either.

This is even clearer in a position where neutrality isn't measured. It is possible to determine whether you are exactly carbon neutral, whereas it is not possible to determine if you're politically neutral. This means that it's even easier to understand, if not implement, becoming more politically neutral.

Google toys with internet air-gap for some staff PCs

Re: Suggestion

I don't think that will do what you think it will. There are several problems that mainframes would bring. Here's one: process isolation. If you're running lots of software on one computer, that software has a lot of chances to mess with other software. Well-written software won't, of course, but if somebody manages to hack one of the pieces, they have extra chances to attack other programs also running on that machine. When the only connections between programs are network links, effectively serial lines, the attacker needs to find new attacks for each system and firewalls can go in between to block many attempts or set off alarms if it happens. Two processes on the same system are much closer together, given that they are sharing a lot of resources which are maintained by a single management system, and there have been many vulnerabilities which are much worse for two processes under the same OS than two computers on the same network.

There are also some problems with your idea. For example, you refer to X86 being insecure because it runs on everything. This is really not a major factor. X86 has had a couple vulnerabilities in itself, but so has ARM and probably so will any sufficiently complicated processor architecture. Most vulnerabilities, though, are in software instead of hardware. I have no less of a problem breaking into an insecure Linux box that has a RISC-V CPU at its heart than I do with a similarly-configured box with an X86 chip, since in almost all cases, my attack pattern and payload will be exactly the same. If people have access to the software that the mainframes are running, and they will, then they will be able to attack it no matter what the hardware looks like. People will have that software because people who are going to build for mainframes at some point will want to test their code somewhere. Somebody will compile it for the common architecture.

There's one more class of problems, and that's the feasibility of switching to mainframes anyway. Regardless of whether or not it would help, and I've already explained my view on that, there are a lot of places that can't just swap in a mainframe for the many servers they use today. Things that operate at scale may have so many records that a single mainframe, no matter how expensive it is, isn't sufficient to process all the stuff they have. I'm not sure if you're allowing clusters to qualify as mainframes, since they're not a monolithic system. There is also the issue of reliability, because most large systems are geographically distributed and a mainframe generally isn't. There are some classes of job where a single mainframe is perfectly capable of doing the job, some of which are already using existing mainframe systems, but since it won't be all problems, and since general purpose hardware can be used for nearly all problems, it's more likely that people will continue using those than adopting a more limited and no doubt expensive alternative.

Re: Go Cloud!!

Admittedly, an internet airgap will have a similar effect on on prem systems as it would for cloud systems. Either they mean that they're making a complete air gap, where the machine is not allowed to talk to any machines that have internet access, in which case both are out, or they're allowing use on private networks but not on public ones, in which case it is possible to create private networks with cloud instances on them. The only difference is that you could have an air-gapped private network with some other air-gapped on prem boxes, as is done in particularly secure facilities, but I doubt they're intending to do that. They haven't been clear about what kind of employee would be using this system, which makes it hard to understand what kind of facilities will be needed.

Some jobs could adopt this system easily enough; someone working on code which is all internal or uses static dependencies which have already been cloned could download all the needed docs and proceed without a connection. Other jobs would find it nearly impossible to successfully implement. I hope they're considering that before enrolling people in this. Having recently made the switch from a job where the internet going down was a minor inconvenience because I had all my tools and VMs on my laptop to one where even my temporary code needs to reside on a remote server, needing the internet at all times is more annoying than I'd have predicted given my connection virtually never dies.

Tech support scammers go analog, ask victims to mail bundles of cash

That's another point, as they'd have to mix them thoroughly before using it and exchanging it for cash is harder as you get into smaller scale criminals. Still, I think the difficulty getting the nontechnical to get it probably doesn't help its case either. I wouldn't want to try walking someone through all the steps needed to successfully buy and transfer cryptocurrency over the phone; there are a lot of moving parts in that transaction.

They're employing the tactic because it makes it hard to get the money back later. Transfers into someone else's account has been a popular method, but they can't often set up plenty of their own accounts and need to commandeer someone else's to do it, with some chance of things getting blocked in the middle. Cryptocurrency has the not being taken back points, but it's rather difficult to get people to understand how to get it and transfer it, what with that talk of private keys and exchanges waiting until funds are present before you can take it. Cash is pretty hard to revoke and pretty easy for victims to get, so they're trying out that method. It might prove difficult after a while, but they innovate with their stealing methods to try to keep the cash flowing.

Linux has nearly half of the desktop OS Linux market

Re: I’d imagine that

Anyone could have found that vulnerability in Windows, but not enough people looked hard enough to do so and not enough people patched. Linux isn't immune to vulnerabilities that hang around. Various commonly-used packages have been subject to bad bugs that have been there for years or even decades. People also don't always immediately patch, hence why I had some fun finding boxes that were still vulnerable to Shell Shock months after that became well-known (for context, that bug was in code from 1989 to 2014). The only question is how many people will exploit something when it is discovered and how quickly they will do so. Millions tried it with Shell Shock, but if every consumer computer was running Linux, that would have been even more people. Linux does not provide you a security guarantee, and if you act like it will, you open yourself to risks that you don't need to.

Re: ChromeOS is a fake linux

"Normal, every day, people do not want an enormous array of choice. They generally want a curated experience. Look at the phone ecosystem - iPhone and Android are both very rigid in how they work."

I have to agree you on the general concept that users don't want as many choices as I do, and disagree about Android proving it. With Android, you have lots of choices of how your phone's going to work, but unless you're going to make those choices with ADB and sometimes even if you're willing to, they are choices you can only make once and then you're stuck with them. I refer to the different versions of Android made by every different manufacturer. Google uses plain Android, since it's them who are writing it, but they also have some Pixel-specific features. Other manufacturers have their own versions of things. The launchers will work differently based on what they wanted. The built-in applications will not be the same. This has gotten to the point that reviews of Android devices tend to spend a while on the manufacturer's software and some people have strong opinions for or against one manufacturer's version of Android without having the same feelings toward others (I'm mostly thinking of the relatively strong opinions of Samsung's software at various levels). Anyone who does research before picking an Android device will hear of these differences and have to decide, for example, whether they want a stock or close-to-stock version or whether some customization is acceptable.

This isn't even thinking about the kind of things that I do. The length of security updates or the speed of feature updates is also different, but I'm guessing it's not commonly explained to buyers who aren't explicitly looking for it. Similarly, I don't expect any nontechnical buyer to care about unlocked bootloaders or rooting. I'm only referring to what you see when you unlock your phone, and there are significant differences.

US adds Euro spyware makers to export naughty list

Re: Who's fault is it?

Because device marketers don't advertise their devices as being completely impossible to hack. They advertise them as being pretty secure. They're not idiots; you advertise anything as unhackable and you open yourself to lawsuits as soon as someone finds a vulnerability, and nothing can be perfectly secure. You couldn't point to any advert that actually claims perfect security, and you are already aware of that fact.

If you're going to train AI on our books, at least pay us, authors tell Big Tech

Re: Never mind the quality, feel the width

That's their problem, and they're certainly welcome to pay someone for bad writing to caution against. However, I've seen enough bad writing that's freely available online that I figure they could probably find enough for free to add to the caution pile.

Typo watch: 'Millions of emails' for US military sent to .ml addresses in error

Re: The

"I just love the way people appear to be trying to argue that not having encrypted email is in some way a good thing."

And I just love how people are trying to pretend I said something I clearly didn't, since my point was that encrypted email was and is a difficult thing, not a bad one. My assumption about what you would have done had PGP been flawed was an attempt to explain what I saw in your reply: in my opinion, you're blaming Microsoft for deficiencies in standards, even as others implemented standards in the same way and Microsoft didn't write them.

"Oh, and BTW the encryption being done by (purely for example) PGP occurs *outside* of all of the email standards: it occurs on the body text, which means it can be - has been - implemented purely in the text editor and be nothing whatsoever to do with the mail client. You know, for all the decent mail clients that let you set your favourite editor?"

If that was a defense, then let's apply that to Outlook. Open your favorite editor, write some text, encrypt it, paste it over. It's really easy. I've done it myself repeatedly. If that's all you want, then Outlook has it just by implementing copy and paste and the generic Windows edit box. Clearly, that's not what is really needed here. The benefits of encryption inside a mail client are such things as automatic decryption of received messages and verification with stored keys, and if the client only implements encryption by calling a text editor, it doesn't do that.

"Better if it can be part of the email standard, of course - then it can even protect some of the extra data that is flowing put via all those newer headers."

Agreed entirely. This is what I would like to see now, and if we had seen it in the 1990s, all the better. It is also what Microsoft could not have done given their goal, because by the time they wrote a mail client, they needed to be compatible with existing mail systems and those systems used the RFC. They could have tried making a Microsoft Mail Standard and replacing email with it. I'm glad they didn't, since 1990s-era Microsoft tended to try locking people into Microsoft products and a format particular to them would probably have balkanized email. If you're saying that you'd have preferred Microsoft to abandon the open standards and pursue a proprietary encrypted standard, then I misunderstood and I still disagree that it would have been beneficial.

"I've stuck with PGP/GPG on the simple basis that it actually existed and was therefore a candidate. Please supply your better candidate, let us all learn together."

You misunderstand. I didn't say that there was something better. I meant that any form of encryption was rare at the time, and a program intended to have compatibility with what existed was going to focus on the unencrypted standard first. A rare standard which was used by the small set of security-conscious people would have been worth adding, but it was not likely to be in the spec any more than a browser of the time would have implemented any of the various encryption systems that were in rare use.

"And why do you accept that? Why aren't you railing against the worst case scenario we have now?

Or do you simply believe we must shrug our shoulders and all be happy? Even if *you* don't want to bother, are you really saying that the bulk of users shouldn't even have the option, shouldn't even be made aware by their email clients that there is a better way (amd this client can't be arsed to give it to you)?"

I don't think we should just accept it. My comment to you was mostly focused on whether Microsoft deserves the level of blame you have assigned, which in my opinion is misplaced. As for what we should do today, I think Outlook should add PGP support, although I don't use it, partially because I need PGP support and the lack of the feature meant I would use something else, in my case Thunderbird. I'm afraid that people do not appear as interested in encryption as is needed for a relatively complex system like PGP (I've scanned keys on business cards, but I don't have much hope of training everyone to know how to do that correctly), and if we think that end-to-end encrypted mail, not just transport encryption, is critical, we may need a new protocol to get more adoption of it. We could try an extension of the certificate system currently used to identify servers and allow them to sign keys for addresses at that server, which could be stored by mail clients and requested automatically by senders, but obviously that protocol has a few more potential vulnerabilities than decentralized PGP would. I'm fully in support of more secure email, including multiple changes to the old RFC email we've been using. I just don't think that, from a historical perspective, Microsoft is to blame for us not having it or would have made a good one in the 1990s if they had tried.