Posts by doublelayer

Framework starts taking orders for 16-inch repairable, upgradeable laptop

I would also like more ports, but the modules are not large enough to put a bunch of ports in one section. A module measures 3 cm square and about 0.7 cm thick, so you're not going to be able to get two card slots and a USB port in one of those. You could probably get two USB-C ports into a module that size, although I'm not sure how that affects charging through one of those ports and connecting to a device through the other as they're both handled by one upstream port. I have hoped that others would manufacture modules to increase the set of choices. So far, only one has been made that way. Not all the ports are £20 or so, as the basic ones tend to be £9.

I ended up accepting this anyway because I've found most alternative laptops to be somewhat lacking in ports as well. Sometimes they include more in total, but that often includes something I won't use. If the alternative machine I'm considering only has a few ports as well, then I have no reason to prefer one over another.

Re: Laudable, but perhaps not commercial

"Now fast forward a couple of years, when there's more demanding software, inevitably bigger files, and newer machines are faster and more capable. Will an upgraded Framework machine still be viable option? For some it will be. But for some it won't, and that erodes the parts sales potential etc etc."

I'm curious what problems you envision. If Framework continues to follow the plans they have for two generations, then one of the upgrade options is a new CPU. If you bought one of the first generation with 11th-generation Intel processors, you can open it up and swap in a 13th-generation Intel or 7th-generation AMD board keeping the rest of the computer. So if software gets bigger and you need something faster, why wouldn't that be sufficient to give you that access?

Of course, if Framework doesn't keep making mainboards or switches the format, that could stop being an option. I don't think that is likely as long as there is sufficient demand. The alternative is that the laptop can't be upgraded at all, so you'd just have to buy a new one. The value of spares is only helped if they can be used on more and more models, so if they end up being less valuable than spares for models that can't be upgraded, it would seem that's down to their company selling fewer laptops altogether.

Re: I have to say I would really like a laptop with the touchpad to the right

I suppose that depends when you replace your laptops normally and why. If you need the latest processors at all times, the new mainboards are a somewhat expensive way of doing it, but if the old ones are still used, then it might work out for you. I don't think it would prove that much differently than buying new laptops as frequently, although the old ones could be more useful than the old mainboards. If instead you are like me and replace computers because hardware has failed, then the Framework's model makes more sense. The last computer I replaced was replaced because the following had happened to it:

1. The battery was weak (relatively cheap and easy to fix on a Framework machine)

2. The disk had failed once and I didn't like that it was in an unusual form factor (Framework, along with many other computers, uses a standard M.2)

3. I had worn out the included keyboard, which wasn't too bad a problem but a bit annoying sometimes (also replaceable)

4. Apple had blocked me from installing new Mac OS versions without overriding them.

Of this list, only point 4 would require a processor change, that only happened because the computer was nine years old when they dropped support, and I was still fine with the performance I got out of that CPU. Had the other parts of the hardware kept up, I would have used it for longer, and I do have it running a few things, just in a less primary role.

I don't understand your comment. That address loads fine here, so the site at least exists. It could be better organized, but all the information is there somewhere. What problem did you have with it?

Re: Obligatory

Yes, it will, and there are guides for installing four popular distros. Those who use less common ones can probably extrapolate from those to figure out any other issues. Linux users, perhaps unsurprisingly, are among those who value a repairable laptop most.

Judge lets art trio take another crack at suing AI devs over copyright

Re: Extension of the Existing Situation

While unfamiliar with the cases, I looked up a summary. The cases I can find where a suit was successful involved using the characters' names at least and often large parts of the setting. So it's not just some child being sent to a magical school, but children using the same names from being sent to schools invented for that book, sometimes both applied and sometimes only one. Of course, there may be others that Wikipedia didn't choose to list.

Re: Whoops ... I Hear Solicitors Getting Rich

I don't think satire means what you think it means. I'm not sure it was intended as satirical in the first place either. Extrapolating or exaggerating something doesn't automatically make it satire.

Re: Whoops ... I Hear Solicitors Getting Rich

Since the law works on the basis that copying is not allowed unless you have the right to, it already holds that ebooks are illegal unless you have permission to make them. Interpreting it in a different way would be very difficult. For example, even if a judge takes the strongest position against the creators and operators of LMM programs, giving the most rights to the original creators of training data, it would not prevent them from making something out of training data to which they have the copyright. Microsoft could still train on the code they wrote. An author could train on their own writing (subject to their contract with their publisher). So if you really think a judge could somehow ban ebooks as a concept, I'll take the other side, and I'm curious to see your proposed logical error that could lead them to do so and have any legal viability (if it doesn't have that, then another court will quickly throw it out, so that will be a requirement to obtain the situation you describe).

Re: Can you 'own' a style?

That's not what they are claiming or asking for. They are not saying that they own a style and you can't produce anything that looks too close to that. They are saying that the bots are only able to imitate that style because they have, without permission, used a lot of their copyrighted artwork to produce those new pictures. In some cases, identifiable pieces of that work have been produced by models such as this. The court has to decide whether those parts are sufficient to be violations on their own, and whether there is a right to use copyrighted content as input to a program without permission and despite complaints from the copyright holders.

Re: Whoops ... I Hear Solicitors Getting Rich

Not a problem, since that is already how the law works. If I scan a book, make an ebook out of it, and sell that ebook, I'm violating copyright. If the publisher does it, they have the copyright and can grant themselves the rights necessary to make that ebook. The law already works as you describe, and it always has done. In my opinion, that's how it should work.

Re: Extension of the Existing Situation

The problem comes when we try to decide whether LMM processing counts as reading and understanding, like a human brain does, or mashing and reconstituting, like a dumb program does. It isn't clear, and although media hype likes to paint these programs as sentient systems that build an understanding of concepts, their output indicates that they are not.

Parallels are difficult. Here's an attempt. I have recently opened up an embedded software image and extracted the important program from it, which I am disassembling. It's not even clear whether I'm legally allowed to do that, which is one reason I won't name or describe the product. I'm interested to see what this software does and I'm just reading for that point. However, let's assume that I was going to use that software for my own purposes. If I were to port that software to run somewhere else, large parts would be left behind. The entire UI system is related to the manufacturer's proprietary hardware, which I wouldn't be using. All that code would have to go and be replaced by something that could handle a different set of interfaces. There are some components I could do without. Those would also be deleted and the various gaps covered. There are also certain aspects where the software could use some improvement, so I'd be making lots of edits. Since I don't have the original source code, a lot of the decompiled bits would be significantly changed, by compilers and other tools, in order to fit them into my modifications. My theoretical version would end up being very different, both in appearance and in function, to their original version. If I published it, there's a reasonable chance they would never notice that I had used their software in developing mine. If they did figure that out, especially if I admitted what I had done, they would not accept that as legal use of the software and neither would a court. It didn't matter that I've used only a small part of their work and added plenty of my own, it wouldn't count that my binary didn't contain chunks of theirs, and it wouldn't matter that software made many of the edits; that wasn't my software to use.

Bots that cheerfully quote sections of text or reproduce original images make it rather clear that they have no ability to avoid printing significant portions of copyrighted content. There's an argument that, even if the program doesn't print the content, it is not legal for it to be trained on that content unless it has been legally obtained, and since copyright does not include an automatic license to produce derivative works, it may not have been. This won't be the last time the human-to-bot analogy will be made. We will have to decide for ourselves whether having a computer provide plausible deniability by randomizing things so much that you might not get the original input back is sufficient to equate its actions with that of a human. I don't think the legal arguments clearly indicate a winner.

World's most internetty firm tries life off the net, and it's sillier than it seems

Re: Workers will still be on Google's internal network and have access to the normal tools

If the air gap is implemented with "You can contact Google Cloud, and Google Cloud can contact the internet", then they're doing it wrong. I can put a machine in Google Cloud, so their air gap needs to isolate their machine from that instance I've created in both directions. A network on which everything is disconnected from the internet qualifies. A network in which some things are and some things are not is just a more inconvenient part of the internet.

Meta can call Llama 2 open source as much as it likes, but that doesn't mean it is

Re: OSI vs FSF definition

I think we mostly agree on this, but not so much with this part:

"Although I completely agree that "open" is too vague, and is therefore vulnerable to misinterpretation and abuse."

Sure, "open" isn't very clear, but neither is anything else. "Free software" is more often used to mean something else, simply because it is also the right phrase to describe software which I'm not going to charge for, even if I won't give anyone the source to it, hence all the speeches about speech and beer. The developers of software for which there is no charge don't always refrain from using the term, and there isn't another one that is easily understood by the general public.

This has led some people to start using the term "libre" instead. This doesn't have a second definition, so points there, but it's also not an English word. It works for people who speak French, Spanish, or one of a few other primarily Romance languages in which that's a word, but those who do not and want to interpret it as an English word will have a bit more trouble with it. It also isn't at all clear about what kind of license terms qualify as libre, I have not seen a "Libre Software definition". For example, some people I know thought that libre software meant that software would have a stricter license that placed additional restrictions on what a distributor would do, and used it as a contradictory word to free software. In their misconception, they had proprietary, for which you'd probably need to buy or negotiate a license, free which you could use with relatively little effort in software you intended to be free, and libre which you could use only if the licenses were compatible because they would likely place so many restrictions on a work that they couldn't practically work together. I took issue with this definition, and the group eventually decided that libre didn't mean that, but it doesn't make it any clearer what qualifies and what does not.

Meanwhile, both "free software" and "open source" have definitions which are easily understood, not too difficult to use to check whether a license qualifies or not, and at least known by most people who work in this field. I can't see a better way to classify things except if the FSF and OSI trademark those terms and attach them to their definitions. If they did so, I imagine at least some people would be unhappy with them.

It depends what definition you are using, but I'm sure you already know about the OSI's definition, which is much more expansive than you claim, including requirements to provide the right to distribute, to make derived works, to not discriminate or place requirements on the user that would limit those rights significantly, etc. Has that stopped everybody from claiming to be open source? No, it has not. However, neither have people been stopped from declaring something "free software" when they do not meet the FSF's definitions either. I've linked a case above where a court agreed that the term generally requires more than the source being readable. People who are interested in clearly defining how much rights a certain license provides have a lot of terms to describe different levels, and their use of "open source" is not the same as "source available", a term whose common use is much closer to the situation you describe.

Re: Multiple definitions of open source (lower case)

They're just a group who published a definition and certify some licenses as being compliant with, or not compliant with, that definition. You are free to ignore them. However, there are two risks in doing so. The first is that some of us agree that their definition is a good one and prefer compliant licenses. This doesn't mean that we need to see it on their list, because it's usually pretty easy to read a license and see for ourselves whether it meets their relatively small list of requirements. However, when I see a license that doesn't meet those few requirements, I'm usually less pleased with the decision, and that tends to make me less likely to contribute to the project. If you don't care about that, no problem.

The second is that some courts have acknowledged that "open source" is not a term you can apply to anything you want. It has been held to have a specific meaning, and a company that claimed to be open source without following those requirements was successfully sued for false advertising. That was one court decision, and it may not stand if other cases come up, but it does indicate that the definition from the OSI has some acceptance which grants it some legal validity.

Someone just blew over $190k on a 4GB first-gen iPhone

I don't know when that became the case, because I was able to successfully activate an iPhone 5S without an internet connection about three years ago. That may no longer be possible, and it might not even have been possible had that device been running the latest version of IOS available for it, but at the time, I was not prevented from doing it.

Re: The BOFH, his Boss and the iThing

How about this one, although the Apple products involved aren't iThings. The comments on the article seem more in line with the boss than with the BOFH, though. I guess there are more people interested in IT antiquity than I'd expect.

I wonder if it even had a need for remote activation at that point. I don't know if they had any anti-theft systems on the first model, which is the primary reason they do online activation these days. In fact, you can activate a modern iPhone without an internet connection as long as it's been properly reset and doesn't still have an activation lock from the last user (whether or not that last user was you).

Re: I don’t think they understand

That became one use of "value" as soon as money became generally accepted, meaning that you could sell something to someone and use that money to buy the things you needed. If that disappears, such as your desert scenario, then it has lost a lot of value. The word's been consistently used in multiple forms, meaning either a specific amount of value to you, but not necessarily anyone else, and a more general level of value, often a shortened form of "market value". It's how the economy has worked for centuries.

Probably not, because if it's been discharged this long, there isn't much potential energy left to make that happen. Charging a battery adds plenty of potential energy which can make a bloated battery into a small fire, but if it hasn't become damaged to the point of ignition now, it's likely not to without a new source of energy. If it's plugged in, no guarantees of anything. Given the loss in value that cracking it open would bring, it's probably not worth it to collectors.

Re: I don’t think they understand

I don't agree with your definition of scarcity. It could be manufactured again, but two factors apply. First, if it did, it would be the 2023 run of the devices, not the original run, which collectors care a lot about. Second, it's not going to be made again. Let's say that I wasn't a collector and actually wanted a device like this because I have something that requires one. There's no chance that Apple, hearing my situation, would go make some more for me. I would have to find one that already exists and try to get it to work, and there aren't many available for me. They are scarce because I can't make one when I want one and the existing supply is low. That doesn't make them valuable; a lot of scarce things are unwanted, and this thing has no useful purpose other than a collection item, but it is still scarce.

The same applies to a bunch of old bits of technology. Not that they're all of interest to collectors, but if you have a computer from 1992 attached to some expensive equipment, not that rare a situation, and part of it breaks, you may find yourself wanting a replacement part. Those things could be manufactured again. Sure, not all the components on the boards are still made, but those too could be re-manufactured if you can get access to the designs, and probably quite cheaply because the cutting edge manufacturing methods of 1992 are now the basic available to everyone methods. In fact, you might find that some of them are cheaper to redo on cheap modern manufacturing methods because the ones in use are so old that they're no longer used today. Yet, doing that will prove so difficult in practice that nobody will do it. Instead, you'll have to scavenge for original, 1990s-made versions of those parts in order to get that machine running again, and they'll be scarce indeed.

BOFH: You can be replaced by a robot or get your carbon footprint below Big Dave's

Re: Error in binary expression at line 61

It's a perfectly functional synonym for "closer to being carbon neutral". Since you can easily measure your level of neutrality, and therefore you can easily compare being not neutral but close to it and not neutral by a wide margin, you can be less neutral by either pumping out more CO2 if you're carbon positive, or sequestering more if you're carbon negative. Since being less neutral is possible, being more neutral isn't that hard to understand either.

This is even clearer in a position where neutrality isn't measured. It is possible to determine whether you are exactly carbon neutral, whereas it is not possible to determine if you're politically neutral. This means that it's even easier to understand, if not implement, becoming more politically neutral.

Google toys with internet air-gap for some staff PCs

Re: Suggestion

I don't think that will do what you think it will. There are several problems that mainframes would bring. Here's one: process isolation. If you're running lots of software on one computer, that software has a lot of chances to mess with other software. Well-written software won't, of course, but if somebody manages to hack one of the pieces, they have extra chances to attack other programs also running on that machine. When the only connections between programs are network links, effectively serial lines, the attacker needs to find new attacks for each system and firewalls can go in between to block many attempts or set off alarms if it happens. Two processes on the same system are much closer together, given that they are sharing a lot of resources which are maintained by a single management system, and there have been many vulnerabilities which are much worse for two processes under the same OS than two computers on the same network.

There are also some problems with your idea. For example, you refer to X86 being insecure because it runs on everything. This is really not a major factor. X86 has had a couple vulnerabilities in itself, but so has ARM and probably so will any sufficiently complicated processor architecture. Most vulnerabilities, though, are in software instead of hardware. I have no less of a problem breaking into an insecure Linux box that has a RISC-V CPU at its heart than I do with a similarly-configured box with an X86 chip, since in almost all cases, my attack pattern and payload will be exactly the same. If people have access to the software that the mainframes are running, and they will, then they will be able to attack it no matter what the hardware looks like. People will have that software because people who are going to build for mainframes at some point will want to test their code somewhere. Somebody will compile it for the common architecture.

There's one more class of problems, and that's the feasibility of switching to mainframes anyway. Regardless of whether or not it would help, and I've already explained my view on that, there are a lot of places that can't just swap in a mainframe for the many servers they use today. Things that operate at scale may have so many records that a single mainframe, no matter how expensive it is, isn't sufficient to process all the stuff they have. I'm not sure if you're allowing clusters to qualify as mainframes, since they're not a monolithic system. There is also the issue of reliability, because most large systems are geographically distributed and a mainframe generally isn't. There are some classes of job where a single mainframe is perfectly capable of doing the job, some of which are already using existing mainframe systems, but since it won't be all problems, and since general purpose hardware can be used for nearly all problems, it's more likely that people will continue using those than adopting a more limited and no doubt expensive alternative.

Re: Go Cloud!!

Admittedly, an internet airgap will have a similar effect on on prem systems as it would for cloud systems. Either they mean that they're making a complete air gap, where the machine is not allowed to talk to any machines that have internet access, in which case both are out, or they're allowing use on private networks but not on public ones, in which case it is possible to create private networks with cloud instances on them. The only difference is that you could have an air-gapped private network with some other air-gapped on prem boxes, as is done in particularly secure facilities, but I doubt they're intending to do that. They haven't been clear about what kind of employee would be using this system, which makes it hard to understand what kind of facilities will be needed.

Some jobs could adopt this system easily enough; someone working on code which is all internal or uses static dependencies which have already been cloned could download all the needed docs and proceed without a connection. Other jobs would find it nearly impossible to successfully implement. I hope they're considering that before enrolling people in this. Having recently made the switch from a job where the internet going down was a minor inconvenience because I had all my tools and VMs on my laptop to one where even my temporary code needs to reside on a remote server, needing the internet at all times is more annoying than I'd have predicted given my connection virtually never dies.

Tech support scammers go analog, ask victims to mail bundles of cash

That's another point, as they'd have to mix them thoroughly before using it and exchanging it for cash is harder as you get into smaller scale criminals. Still, I think the difficulty getting the nontechnical to get it probably doesn't help its case either. I wouldn't want to try walking someone through all the steps needed to successfully buy and transfer cryptocurrency over the phone; there are a lot of moving parts in that transaction.

They're employing the tactic because it makes it hard to get the money back later. Transfers into someone else's account has been a popular method, but they can't often set up plenty of their own accounts and need to commandeer someone else's to do it, with some chance of things getting blocked in the middle. Cryptocurrency has the not being taken back points, but it's rather difficult to get people to understand how to get it and transfer it, what with that talk of private keys and exchanges waiting until funds are present before you can take it. Cash is pretty hard to revoke and pretty easy for victims to get, so they're trying out that method. It might prove difficult after a while, but they innovate with their stealing methods to try to keep the cash flowing.

Linux has nearly half of the desktop OS Linux market

Re: I’d imagine that

Anyone could have found that vulnerability in Windows, but not enough people looked hard enough to do so and not enough people patched. Linux isn't immune to vulnerabilities that hang around. Various commonly-used packages have been subject to bad bugs that have been there for years or even decades. People also don't always immediately patch, hence why I had some fun finding boxes that were still vulnerable to Shell Shock months after that became well-known (for context, that bug was in code from 1989 to 2014). The only question is how many people will exploit something when it is discovered and how quickly they will do so. Millions tried it with Shell Shock, but if every consumer computer was running Linux, that would have been even more people. Linux does not provide you a security guarantee, and if you act like it will, you open yourself to risks that you don't need to.

Re: ChromeOS is a fake linux

"Normal, every day, people do not want an enormous array of choice. They generally want a curated experience. Look at the phone ecosystem - iPhone and Android are both very rigid in how they work."

I have to agree you on the general concept that users don't want as many choices as I do, and disagree about Android proving it. With Android, you have lots of choices of how your phone's going to work, but unless you're going to make those choices with ADB and sometimes even if you're willing to, they are choices you can only make once and then you're stuck with them. I refer to the different versions of Android made by every different manufacturer. Google uses plain Android, since it's them who are writing it, but they also have some Pixel-specific features. Other manufacturers have their own versions of things. The launchers will work differently based on what they wanted. The built-in applications will not be the same. This has gotten to the point that reviews of Android devices tend to spend a while on the manufacturer's software and some people have strong opinions for or against one manufacturer's version of Android without having the same feelings toward others (I'm mostly thinking of the relatively strong opinions of Samsung's software at various levels). Anyone who does research before picking an Android device will hear of these differences and have to decide, for example, whether they want a stock or close-to-stock version or whether some customization is acceptable.

This isn't even thinking about the kind of things that I do. The length of security updates or the speed of feature updates is also different, but I'm guessing it's not commonly explained to buyers who aren't explicitly looking for it. Similarly, I don't expect any nontechnical buyer to care about unlocked bootloaders or rooting. I'm only referring to what you see when you unlock your phone, and there are significant differences.

Re: Huh?

I do think application compatibility is part of the picture, but I'll point out that most of those shims only work with some kinds of applications. For example, try running a Linux-based service using one of those. Most of those layers have left out the services stack, because it's not an operating system, and haven't plugged in Linux services into the host's service stack either. As such, they're similar in spirit to virtualization, because they have an environment in which you can run other things which is not the same as the host. Of course, the definitions get blurry here, because there are multiple service systems in Linux kernel OSes, so there's not a guarantee of compatibility there either. Still, that's why I don't consider Android to be a Linux system; their applications are incompatible with each other in nearly all cases.

Re: ChromeOS is a fake linux

My opinion is quite different. I think Chrome OS certainly does count as a variant of Linux. I do not extend that to Android, because there is no compatibility between it and any other Linux, but since you can run Linux programs on Chrome OS and it meets the other requirements, I think it counts. If I were interested in having a rating board of how many Linux installs on non-server devices exist, I would count Chrome OS.

The reason I don't support Chrome OS is that the number of kernel and userland installations is not of much interest to me. What is of interest is the freedoms that non-Chrome-OS Linux distros tend to provide, which Chrome OS didn't and Chrome OS Flex only sort of does. I dislike Chromebooks for various reasons, including the designed-in dropping of security updates for no good technical reason, something very contrary to the ethos of most other Linux-related projects, especially the kernel itself. I don't like the locked bootloaders that the hardware often bring. I'm not very concerned about the year of the Linux desktop, as it's not going to happen and I don't really need it to, but to the extent that I would like it, I would like it for what it means for users, which means that Chrome OS wouldn't count.

US adds Euro spyware makers to export naughty list

Re: Who's fault is it?

Because device marketers don't advertise their devices as being completely impossible to hack. They advertise them as being pretty secure. They're not idiots; you advertise anything as unhackable and you open yourself to lawsuits as soon as someone finds a vulnerability, and nothing can be perfectly secure. You couldn't point to any advert that actually claims perfect security, and you are already aware of that fact.

If you're going to train AI on our books, at least pay us, authors tell Big Tech

Re: Never mind the quality, feel the width

That's their problem, and they're certainly welcome to pay someone for bad writing to caution against. However, I've seen enough bad writing that's freely available online that I figure they could probably find enough for free to add to the caution pile.

If they don't think the authors' work has any benefit, they are free to leave it out of the training data. That they have not suggests they think there is value in having that text in there, and they are using that value to make money. It's not on us to decide how much value they are getting from any given book, but on them to decide whether they are willing to pay for the use of copyrighted data they don't own. They can decide to exclude something because it is not available for sale, because it isn't worth as much as is being asked, or because they think it will be detrimental.

Typo watch: 'Millions of emails' for US military sent to .ml addresses in error

Re: The

"I just love the way people appear to be trying to argue that not having encrypted email is in some way a good thing."

And I just love how people are trying to pretend I said something I clearly didn't, since my point was that encrypted email was and is a difficult thing, not a bad one. My assumption about what you would have done had PGP been flawed was an attempt to explain what I saw in your reply: in my opinion, you're blaming Microsoft for deficiencies in standards, even as others implemented standards in the same way and Microsoft didn't write them.

"Oh, and BTW the encryption being done by (purely for example) PGP occurs *outside* of all of the email standards: it occurs on the body text, which means it can be - has been - implemented purely in the text editor and be nothing whatsoever to do with the mail client. You know, for all the decent mail clients that let you set your favourite editor?"

If that was a defense, then let's apply that to Outlook. Open your favorite editor, write some text, encrypt it, paste it over. It's really easy. I've done it myself repeatedly. If that's all you want, then Outlook has it just by implementing copy and paste and the generic Windows edit box. Clearly, that's not what is really needed here. The benefits of encryption inside a mail client are such things as automatic decryption of received messages and verification with stored keys, and if the client only implements encryption by calling a text editor, it doesn't do that.

"Better if it can be part of the email standard, of course - then it can even protect some of the extra data that is flowing put via all those newer headers."

Agreed entirely. This is what I would like to see now, and if we had seen it in the 1990s, all the better. It is also what Microsoft could not have done given their goal, because by the time they wrote a mail client, they needed to be compatible with existing mail systems and those systems used the RFC. They could have tried making a Microsoft Mail Standard and replacing email with it. I'm glad they didn't, since 1990s-era Microsoft tended to try locking people into Microsoft products and a format particular to them would probably have balkanized email. If you're saying that you'd have preferred Microsoft to abandon the open standards and pursue a proprietary encrypted standard, then I misunderstood and I still disagree that it would have been beneficial.

"I've stuck with PGP/GPG on the simple basis that it actually existed and was therefore a candidate. Please supply your better candidate, let us all learn together."

You misunderstand. I didn't say that there was something better. I meant that any form of encryption was rare at the time, and a program intended to have compatibility with what existed was going to focus on the unencrypted standard first. A rare standard which was used by the small set of security-conscious people would have been worth adding, but it was not likely to be in the spec any more than a browser of the time would have implemented any of the various encryption systems that were in rare use.

"And why do you accept that? Why aren't you railing against the worst case scenario we have now?

Or do you simply believe we must shrug our shoulders and all be happy? Even if *you* don't want to bother, are you really saying that the bulk of users shouldn't even have the option, shouldn't even be made aware by their email clients that there is a better way (amd this client can't be arsed to give it to you)?"

I don't think we should just accept it. My comment to you was mostly focused on whether Microsoft deserves the level of blame you have assigned, which in my opinion is misplaced. As for what we should do today, I think Outlook should add PGP support, although I don't use it, partially because I need PGP support and the lack of the feature meant I would use something else, in my case Thunderbird. I'm afraid that people do not appear as interested in encryption as is needed for a relatively complex system like PGP (I've scanned keys on business cards, but I don't have much hope of training everyone to know how to do that correctly), and if we think that end-to-end encrypted mail, not just transport encryption, is critical, we may need a new protocol to get more adoption of it. We could try an extension of the certificate system currently used to identify servers and allow them to sign keys for addresses at that server, which could be stored by mail clients and requested automatically by senders, but obviously that protocol has a few more potential vulnerabilities than decentralized PGP would. I'm fully in support of more secure email, including multiple changes to the old RFC email we've been using. I just don't think that, from a historical perspective, Microsoft is to blame for us not having it or would have made a good one in the 1990s if they had tried.

Re: The

Yes, the particular line was from Outlook, but the inclusion of the original message wasn't Microsoft's fault. It was, once again, the fault of the specification. Email could have been specified as a structured format where the original message was attached to the new message as a separate object. One could have chosen top or bottom posting as they liked if that was done. The RFCs don't specify that, though. They have the message as one big blob, and that leaves clients with only a few options:

1. Paste in the old message somewhere.

2. Turn the message into a file of some kind and attach it.

3. Discard the old message and only send the new one.

The one which is easily parsed by humans, no matter what client or operating system they use, is number 1. Number 3 works if they keep copies of everything so they can refer back, but is harder to organize, and option 2 starts the game of what format should be used (for example, try opening the .msg file format that Outlook saves messages to if you don't have Outlook; it's quite annoying). To blame Outlook for something that A) is required by the RFC and B) is done by every other mail client, just not in an identical way, is falling into a situation where some company is automatically blamed for anything we don't like, whether they had anything to do with that or not.

Re: The

The problem is that you're being quite simplistic, throwing the blame onto one company who did the same thing as many other companies. So Outlook didn't support PGP, and neither did Apple, and neither did a number of other email clients that existed at the time. You can point to a couple that did and assume that everyone should have supported what they did, even though that wasn't part of the standard. Let me guess, if PGP had turned out to have a systemic flaw and Microsoft had adopted it, it would be their fault that we were using the flawed system too?

Outlook was designed to follow the specifications, just like a lot of mail clients. That didn't and doesn't make it a good mail client, but it's akin to complaining that a browser, written to work over HTTP, doesn't support the Tor protocol and you have to use other software if you want that level of security. There might be some advantages if every browser did build that in, but they aren't built for every use case in existence and use other software to manage those alternate cases. Like it or not, PGP was somewhat rare in 1997 as it is today. Microsoft would not have seen a reason to adopt something that wasn't in common use and introduced some significant usability problems* when it would have meant that many users would select to encrypt their mail and send it to someone whose client wasn't capable of reading it and whose user didn't have any understanding of why not and what they could do about it.

* Key management. It's not easy. It wasn't any easier back in 1997. It isn't easy now. It's not like TLS security, where we've accepted a relatively simplistic certificate system signed by a small number of central, trusted authorities and software just assumes that any connection should be checked through that for authenticity. With PGP, both then and now, the key management was a manual process which made sense only to those who knew what they were doing and why. Neither was true of the average user, who was not thinking too much about security when they sent messages around. It's not true of them today either, when most mail clients in typical use still don't support it (shall we have a blame session for Google because GMail doesn't have PGP support, or should we forget it as pointless because GMail is an online client anyway). Email encryption isn't as simple as we would like it to be, and the causes and responsibility for why that hasn't improved as quickly as we'd like isn't as simple as you want it to be, either.

Re: Whatever.

Are there people with verified scores that high? I can think of several in fiction, where making up random high numbers is the code for "I'm going to have this character do unrealistic things later and I'm hoping that this number will work as my get out of scoffing card". The way that IQ tests work today, however, makes those scores prohibitively difficult to happen. They are hard-coded to produce bell curves, whether that's a good idea or not (it's not the only bad idea in many such tests), so a score of 220 would pretty much require the smartest person to have lived in the past century and wouldn't necessarily include them either, since it's a one in ten trillion chance. The old way of assigning scores by age, which incidentally stopped working on graduation from secondary education, could allow a score of 220 if, for example, a child aged five was operating at the educational equivalent of one aged eleven, but for various reasons, this system has not been used for some time.

I doubt you can find someone who actually has a score of 220. There are probably people who claim they do, but they're likely to be lying on the assumption that people don't know how IQ scores work or what they mean.

Microsoft's Surface Pro 9 requires a tedious balancing act

Re: I used to have a Surface Pro

I used one when volunteering for a while. It was acceptable as a laptop, but I found some of the same unpleasant aspects as the author when trying to use it off a desk. The kickstand meant it required more footprint to stand and wasn't comfortable on a lap. Meanwhile, I didn't find it that useful as a tablet, though in its defense I don't like or have tablets anyway, so I'm not the target market for that part. Either way, while it could work fine as a laptop, I saw nothing in its favor while it was doing that job, so I prefer other laptops.

I did find it to have great Linux support, though. That was something in its favor, and I've heard from others, especially those who do like tablets, that subsequent versions are also good with it. I don't know if that applies to all of them, but it's at least a few.

We will find you and we will sue you, Twitter tells 4 mystery alleged data-scrapers

Re: Four IP Addresses

It is very easy, but that's less often done than detecting the first burst of requests and blocking entirely for a while. The reason is the same one as the reason Twitter's view limits aren't good. If a user scrolls through a set of data which hasn't been entirely retrieved, the frontend may issue a few requests quickly to catch up with the speed of their scrolling, common if they don't care about a lot of the content and are skimming to find something they do like. If they put in a one-second delay between requests, that process could become jumpy or broken, whereas if they check how many requests were issued in the last thirty seconds, they will be more easily able to tell between a user doing something quickly which the app turned into a burst of requests and someone running an automatic script which isn't going to stop any time soon.

Either way, it's the kind of thing that a system which acts at scale either does routinely or has made an explicit decision not to do. It shouldn't be causing Twitter too much difficulty now.

Re: Unjust enrichment?

I see another person who didn't read the terms of service. Does this part mean anything to you:

8.2 You retain all your ownership, copyright and other interests and rights in your comments but by posting any comments on our Website you grant us a non-exclusive irrevocable and royalty free worldwide licence to use, modify, alter, edit copy, reproduce, display, make compilations of and distribute such comments throughout our Website.

Twitter will have something similar. Yes, the effects of "I have a license to use the thing you wrote because you granted it to me" and "I own the thing you wrote" are similar, but the concepts are not at all the same. The former applies to most social media.

Re: Business owners are such babies

I disagree about the scraping permission being contrary to the spirit of the internet. It certainly would be if the precedent stated that blocking scrapers wasn't permitted, but that's not the case. The reason I want that to remain is that allowing sites to make scraping a legal offense makes it too easy to attack people for accessing a resource they made public. If YouTube could go to a court and tell them that, because I used youtube-dl instead of a browser to view a video, I've committed a crime (decided on the basis of "it's a crime if you do what I don't want you to do and I don't even have to decide beforehand what counts and what doesn't"), I think that's a lot more contrary to the spirit of the internet.

Nothing prevents site owners from looking for bots using a lot of different measures and blocking them by technical means. Is it annoying that it may become necessary to do so, yes. However, it's the same point as the all you can download internet plans; the ISPs were not forced to provide those or to sell them at the price they do, and if someone has a dozen terabytes they want to download, they have purchased a service which claims that they can do so. The ISP can add a fair use provision, technical limitations, or change their business model to prevent that person causing problems, but they shouldn't be allowed to decide that they want to make that action retroactively criminal.

Re: So, nobody left has the router password?

What's your point? They have a lot more than one IP address for their website, including all the backend stuff. It is still possible that they have resources in Akamai as part of their diversification efforts to prevent single points of failure. Not guaranteed, as I think they would still have someone who would catch it if this were actually their own, but just demonstrating that their main domain's A record goes to an address they've directly allocated says nothing about where all the rest of their systems are.

Among other things, we know that they have a lot of systems on AWS, since that's one of the suppliers they tried not to pay, so that suggests that some of their internal systems may use AWS IP addresses.

Re: Four IP Addresses

The suit also suggests that they scraped millions of pages, and unless they spread those requests out, that probably means thousands per minute. Network analysis can be set to detect thousands of requests from one IP address in a minute and block that address, probably temporarily. It does a pretty good job against heavy scrapers unless they spread out their requests or their IP addresses.

Bizarre backup taught techie to dumb things down for the boss

Re: The old story, Employee is always smarter than the Founder

I disagree. I've already posted my response to their comment, which takes issue with many of their points, but I think their view is understandable and deserves an accurate response. I think they posted what they did out of a misunderstanding of how the user-IT relationship often works, possibly missing something common in their own profession, and not knowing the ways their response struck us as insulting based on a very incorrect interpretation. I don't think it was meant as trolling.

As such, I think it is useful for us to explain how this story fits into the normal pace of IT work, or in my case user interaction with the results of my programming. This might help them to understand why we think that a reaction toward a user is very different than a reaction toward a patient. They may disagree with us at the end, but I hope they will at least understand more about our views than they did when they started. My attempt was posted above, and I suggest that we engage this kind of response rather than virtual killfile it.

Re: It could be worse

No, it's not. People don't need much technical knowledge to use the three-step Outlook rules function, which walks them through a lot. They're not as powerful as other rules someone might use, but they're perfectly capable of doing some automatic tasks. I've known people without IT knowledge who figured that out without assistance, so I know it can be done.

Sure, more complex handling isn't as easy. There was a time when I set up message rules which used regular expressions on message subject and body (don't ask), and that I wouldn't expect everyone to do, but the more straightforward rules do not require any particular knowledge.

The kind of developer who assumes users see the new folder button and understand what it does, or since it's been there since the first GUI mail clients, have read the manual which would have explained it thoroughly. They could provide other default folders, but the best organization system will be created when the user decides on their own folders. The three ones included by default are the bare minimum, not the suggested set.

Re: Using the recycle bin as storage location.

If you try to run an executable from the recycle bin in modern Windows, it won't let you. It won't let you open any files from the GUI. You can do it from the C:\$Recycle.Bin folder if you figure out the paths, but that would seem complex enough to prevent the average person who doesn't understand that. In older Windows versions, I wouldn't be surprised to hear that it worked differently, which might be why you can't just open files from there anymore.

Re: Training?

The poster who suggested that we should all get certification wasn't talking about users. They were talking about us. They basically said that, without certification, there was no way to determine whether we were competent and predicted that we would rapidly make incompetent mistakes in our work. I was responding to that, which is a more computing-related claim.

Re: It could be worse

Email clients can handle that if you set up rules, but people don't bother to do it. The secretary might have a better understanding of how to file things, but that requires a lot of knowledge about the content of mails that nobody wants to train into their mail clients. However, if you keep a massive archive folder, the client is very capable of giving you all the messages sent with a subject line from a certain set of people in a specific time period, which is more than the paper-based archives could often do.

Anyone who wants can set up folders and drop mail into them. It is not the fault of client writers that people don't do that. All of the features that people who used paper mail had and needed are available in the software, but most are unused, maybe because they're no more convenient and most of us don't have another person onto whom we can pawn off the work.

Why do cloud titans keep building datacenters in America's hottest city?

Re: home to the largest nuclear power....

It looks like it's the largest in the US, with one in Ontario about 50% larger which is the largest in North America. Largest could refer to the largest nuclear plant by capacity in the country or the largest plant of any kind in the country by actual generation (the only larger plant by capacity is a hydroelectric plant in Washington which is not generating at full capacity).