Posts by doublelayer

North Korean satellite had no military utility for spying, says South Korea

Re: If this satellite was intended for weapons systems, these experts would have said so.

"since NK says "So what?" to these things why would they bother making an elaborate dummy"

They probably wouldn't make an elaborate one, just a really basic one. However, appearances are important to them (for some reason they haven't recognized that their appearance nearly everywhere in the world is as the worst country on a lot of metrics). This is why they frequently tell obvious lies, for example saying that multiple failed satellite launches before were actually successes. That said, they already have one photographic satellite in successful orbit (though how powerful it is, whether they are able to communicate with it, and what they're using it for are less clear), Kwangmyŏngsŏng-4.

Perhaps this indicates that Kwangmyŏngsŏng-4 may not have the resolution expected of a modern satellite either. Alternatively, they needed a dummy for testing as a missile but decided to include some old camera parts they had in case it did make it up. It wouldn't be as useful as a real reconnaissance satellite, but much less expensive if they're going for missile testing. In addition, the ability for them to get a bunch of reconnaissance data from satellites they launched is much less than their ability to collect reconnaissance data from someone else's equipment by stealing or buying it, so they may not really have a reason to manufacture any.

Re: What was this satellite for?

There is no accepted concept of "belongs to" between the two Koreas, since both are of the opinion that the other, land and everything on top, belongs to them. However, it's not that unusual to confiscate military hardware that is in your area. For example, that balloon that the US shot down is not being returned either. In general, if you lose it outside your territory and don't go get it, nobody who does go get it will even briefly consider giving it back to you.

Former Twitter employees accuse it of holding up 891 arbitrations

Re: A clear imbalance of power between him and employees?

They are not talking about being banned. This is not a content moderation decision or even a "I don't like this user and it's my company" decision, where Musk has the power and the right to do basically whatever he wants. This is a situation involving employment rights and access to the legal system, where an imbalance in power is a real factor because just owning a company does not give anyone unrestricted rights to decide what their current or former employees may seek legal redress about.

Re: The losers get to write history?

Since the 1707 Acts of Union created something called The Kingdom of Great Britain, containing most of the parts of the Great Britain that we have today, including all of the island of Britain, I think that counts as having existed since that year at least. The 1800 acts added Ireland, but only some of that is still in force. Had the sentence called it the United Kingdom, your pedantry might have worked since it looks like that name was created when Ireland got attached, but it didn't say that.

Twitter rate-limits itself into a weekend of chaos

When you come to this site, how many articles do you read and how many comments? Did you read the tens of comments that were on this page? I'm guessing you did when you replied to them. It doesn't take half a minute to read each comment and most are significantly longer than a tweet would be.

The number’s up for 999. And 911. And 000. And 111

It looks like they agree and will release that with IOS 17. So it might be coming. I have used other applications which support offline maps already, though.

Apple did it, but they didn't make a point of it. If you open the included compass application on an iPhone, your coordinates are right below the compass display, precise to the second. Tapping them will open a map of your location, although that probably requires connection and may not work in all places.

Re: Multiple redundancy

That is true, but if there are so many emergency calls that it is taking up all of the network, you're likely talking ten or more times as many calls as there are people to answer the calls and talk to the people about what the emergency is. The emergency call system is great for even somewhat large emergencies, but if the city is carpet bombed, it's not going to do much. The emergency services will already know that something bad has happened and be reacting to it in some way, and they don't have the resources to respond to every person in trouble in that situation.

California man's business is frustrating telemarketing scammers with chatbots

Although the foreign language can backfire, if you're good enough at languages, you can probably create gibberish that sounds kind of like a language you speak. Doing one that's similar to one you know means you are probably better at preventing repetitions. I have found it effective at getting them to hang up but it isn't very good at making it take a long time.

That's why we need something which, if a small group does it enough, will cause enough problems to destroy the business model. We can't rely on everyone doing what we do, but we don't need them to if we can routinely get them all to waste their time.

This is absolutely the right view if the workers you're thinking of are the ones you call because you need them to do something. It's also at least a bit valid when they're doing something legitimate even though many will find them annoying. Pollsters, for example, may not thrill people, but they're trying to do something that doesn't harm you and the results of which you might use. However, most of the calls I receive are not from pollsters or anybody else doing a real job, nor even from the group of telemarketers who are doing nothing useful but at least it's legal. Most of those who call me automatically are entirely focused in either stealing money from me, stealing identifying data from me so they can sell it, or selling something fraudulently to me based on a complete willingness to lie about, for example, knowing who I am and having records about me.

That group is not stuck in a dead-end job, they are choosing to be criminals. That's not strictly true, because there are a few (not by any means a majority, though) which coerce people into doing it. I do not show any sympathy to those people, and I don't suggest you do either.

Microsoft and GitHub are still trying to derail Copilot code copyright legal fight

Re: Why isn't there enough strong, clear, evidence from the plaintiffs?

I get the argument. Basically, I was agreeing with it. I think that, if they could provide the evidence, their case would be strong even if Microsoft hid the chunk so it wouldn't come back. That still requires them to show that a piece of their code, not a chunk from Quake that has already been copied under several licenses in many places, can be printed by the bot.

As for hiding the evidence and only showing the court, it could work and if they really won't provide the evidence publicly, they should at least try that, but I think it will seriously weaken their case. The problem is that Microsoft will, if they can't see the code, start looking for claims for why it shouldn't count. They could argue that the plaintiffs won't show them the code because it would prove the copying to be insubstantial or obvious (we all agree that copying a boilerplate expression or standard lines wouldn't qualify, and how would Microsoft know that wasn't the code submitted). The court is staffed by people who can't recognize obvious code from original and very clever code, so they could be swayed to either argument. Doing it publicly would help if they could do it. That they haven't makes their case suspicious but not automatically faulty.

Of course it hasn't. I combine constants all the time, because it makes it easier to understand what I'm doing. For example, I could write 691200. What does that mean? You'll just have to guess. If I write it 60*60*24*8, you can probably guess what it is, and if you want to change the number of days, it's a simple modification. Similarly, I have a few scripts that report the sizes of files, and I find it easier to divide by 1024**3 or 2**30 to get the number of gigabytes than to spell out 1073741824 every time.

It gets even more useful when the constants are more specific. If I'm allocating a certain number of bytes, then I'd much rather call malloc(40*FRAME_SIZE) than malloc(960) *. If FRAME_SIZE ever changes, it's easy to change it once than to redo the allocations. The compiler will calculate the constant for me and store it as such anyway, so why do you think I should do that computation for it?

* Even better would be malloc(40*sizeof(frame)), but in many cases, these aren't structs and are instead strings of bytes which have to be constructed manually. Sometimes, I will create libraries so they can be structs to the user, but not always.

Re: All for analogies, but can we bit a bit accurate (or at least explain our analogy)?

Except compression and summarization achieve different goals, even though in both cases the result is shorter than the input. Summarization will eliminate some of the data that the user would use, whereas lossy compression is designed to be decompressable to something containing all parts of the original data with certain aspects removed for size. I can summarize a video file by cutting out chunks we don't need, and it is not the same as compressing it but all the frames remain there with fewer pixels specified.

One could do a lossy compression of text by removing some punctuation and maybe even spaces, and someone might be able to read it with some work, but that would be compression, not summarization. The two are not synonymous.

Re: Why isn't there enough strong, clear, evidence from the plaintiffs?

That move is not really a problem. By pointing out that it did happen and that the model was not retrained, they can prove that it can generate verbatim substantial portions of code. That it will no longer generate that one won't prevent it from generating any others, including other sections of the plaintiffs' code. Adding guards for literally every portion of their code would likely start causing problems if a lot of people asked for them to do it. That's the kind of evidence that will be needed, but most likely, the person who owns the code concerned will have to be a participant in the trial (if you get it to print some of my code but I'm not involved, you will likely not be able to sue on that basis).

The article suggests that they have some code they say was printed by this bot, but they don't want to share it because it could identify them. From previous articles, it seems that they got threatening communications from someone which is one reason they want to stay anonymous, but it may make it difficult to make their case if they won't supply evidence because that is difficult to distinguish from not having evidence. I'm not sure how easily that can be fixed, but they might want to find an option in order to make their position stronger.

How a dispute over IP addresses led to a challenge to internet governance

Re: There's a big clue in there.

It's possible, but they also have the attitude that "If we don't object to it, do whatever you want that affects other countries". It is possible that this is really just a profit-generating activity and China isn't doing anything about it because they aren't affected and get to collect some tax. Nothing requires this to be a thoroughly-considered plot even if there's a possibility that they could have one.

Re: Nice internet you got here.

Yes, a few people could do that, but the people you would need to make that happen are also the kind of people who wouldn't do it. Their job is not breaking the internet, no matter how bad certain things on the internet might be, and they take that job seriously. Meanwhile, if you and I decide to drop traffic to them, it will do nothing whatsoever; either we weren't going to use them anyway or we'll have to fix things when they don't work by removing the rule. It's the same reason that, even when people suggest that we drop some country which has been committing serious offenses from the internet, websites hosted in that country still work. Things have to get pretty bad before an address block is dropped in a way that shuts down the operator for good.

H-1B fraud consultancies grow, with application abuse openly discussed online

Re: Detective Colombo asks

"While most startup investors are in the US, they actually invest all around the globe (even in India)."

They are, but not always at the same level. Pitching a startup to investors often involves a lot of completely subjective marketing to specific investors, who don't go on tour. That makes it easier for people who either live close to the investors or can easily afford to go visit them rather than those who only do a few online meetings. Investors will lend to people in a variety of countries, but not equally. In addition, I did say that there are other factors, and some of them affect investors' willingness to invest in India-based companies. Trade restrictions, worries about local economic conditions, and concerns about local markets (which you also mentioned, so I'll come to that) are considered by investors and all involve the location.

"Hardly any consumer facing business today is located where its customers are, unless it's a services business."

A lot of large tech companies are services businesses, and they tend to offer their service first in the country in which they're formed and expand from there. That's also true with B2B services, although there are some which wouldn't necessarily work as clearly. Even for goods, although they can be designed and manufactured basically anywhere, they are often sold first in a country in which the company has built a local presence, either their original one or a developed subsidiary which is responsible for marketing, distribution, and support including repairs.

"As with consumer products, R&D is usually located where the talent is, not the company's customers."

I must disagree with the first part of that. R&D tends to be wherever the company wants it to be, which for old and large companies is likely to be wherever they already had it. Apple, for example, does R&D in a number of places, but it still brings a lot of people to Cupertino because that's where they have been working for a long time and they've gotten used to putting stuff there. Several large companies have R&D centers in India, for example, Google has four of them, the largest of which is a facility in Hyderabad which is supposed to hold about 13,000 people. Other companies may just prefer to move their engineers to the place they already did it, and the engineers may also appreciate that.

Re: Detective Colombo asks

Nobody said that all of those people were of the same skill. You'll get a lot of variation. However, to answer your question, one thing that the US has and India doesn't (as much) is a bunch of people with money. That includes the following:

1. Investors who want to invest a large quantity of money in speculative businesses.

2. Customers who can spend comparatively large amounts of money on products and services which can make some of those companies profitable.

3. Companies that have lots of money to put into R&D innovation budgets.

India has people with money, but when scaled up to the size of the country, they have much less of it. They still have large chunks of the country where electricity isn't on all day, which you won't find so often in many other countries, which limits the funding available from the general public. You can get a lot of investment from particularly rich companies or individuals in India as well, but you have fewer of them interested in doing so. That's not the only issue, but it is a rather big one if you're looking for a lot of innovation.

Ripoff Vuitton handbag smaller than a grain of salt fetches $63,750 at auction

She is the current Home Secretary of the UK, in charge of immigration (among other things, but that's the one that gets a lot of publicity). She is also a prominent Brexit supporter. So it's probably more outside your country than your demographic, but now you have the headline.

Google accused of ripping off advertisers with video ads no one saw. Now, the expert view

Re: The Emperor's New Clothes

Some advertising makes sense, and they probably started with that. If you're a company that nobody knows about, advertising can help people learn that you exist, and that can be seen to have value in increased demand. Similarly, new types of products or recent changes that might interest customers won't do much unless customers see those, and advertising can give them that information. I may not always appreciate people telling me those things, but advertising is sold to those who commission the ads, not those who see them, and those ones actually work. I will admit to being occasionally influenced by ads, although I do my best to avoid many so I'm influenced by a relatively small number. On occasion, I've taken an advertiser's offer of a free trial and decided it was a product worth paying for, something I might not have done if I didn't hear about them. I'll note that the two I can think of were both ads placed in content with a subject related to the products, not targeted to me.

However, sometime in the past, advertisers managed to convince a lot of people that they need to advertise incessantly even when there is nothing new and nobody who sees the ads will learn anything that would make them more likely to buy, basically on the theory that consumers are idiots, so just hearing the name over and over again will make them buy things. That may have worked at one point, but I'm guessing they do their best not to measure any benefits so as to make their pitches vague enough that they can always ask for and get large budget increases. As long as they can say "If you stop and your competitors don't, you will lose out to them", they can make the executives who decide their budget fearful. If they collected data, they run the risk of discovering that doesn't really happen.

Re: It Pays to Advertise?

I wouldn't be surprised if a lot of those commercial VPNs are quite profitable. They get a smallish monthly subscription for running a bunch of servers, and users may buy that access without really planning to use it, either because they think it will help with security (it can but it will depend on how it is used) or will allow them to view region-limited content (maybe, but no guarantees). How many people forget they don't use it and continue to pay? I don't buy them because I have my own, but it is probably not that expensive to run if they can sign up enough intermittent users.

Canada plans brain drain of H-1B visa holders, with no-job, no-worries work permits

Re: For once, Trudeau's government has made an actual smart move.

They had more valid limiters on the situation than just quantity of English-speaking people. For example, which countries you can get people with required skills. The countries after India in the list are Pakistan, Nigeria, and the Philippines. While you'll get immigrants from all those countries, how does the education system differ between these countries in the level of quantity of people with abilities that make one eligible for an H1B?

The country that comes after that is the UK. You can make a lot more money working in the UK than you can in India, so people who live there, even if they were only considering financial matters, have less of a reason to want to switch countries on average. They have other reasons to prefer staying in the UK; how many UK readers here don't like the US to some extent and make a point of it? Once again, you'll get some immigrants from there, but probably not as many.

If H1B holders were chosen by pure chance with the only factor being ability to speak English, you would be correct. It is rather obvious that this is not how the visas are given, as there is both self-selection of people who will apply and limitations on who is eligible for the visas.

Microsoft's GitHub under fire for DDoSing crucial open source project website

Re: Lessons learned

It wouldn't be good, and we wouldn't be happy that they'd done it. However, it would probably happen, intentionally or not, as the amount you sold increased. Especially if you're making money from this, it's worth knowing how much of that resource is in use and whether you need to do something to increase that resource.

In this case, the users of the GitHub actions should really have cached data instead of downloading it so many times, and had they done it, the server wouldn't be so overloaded. However, even without that, a project which continues to be popular will reach a point where a single 1 Gbps link is no longer enough bandwidth for all the people making requests. They're providing the server for free, so I'm happy to let the users just have to deal with really slow downloads and they can try to help improve the system if it gets slow enough. Still, that's just my view on how they can deal with the resource exhaustion, not a way to prevent the resource from being exhausted in the first place which will happen eventually even without the GitHub forks spiking.

Re: Local mirror?

I think they probably would if it was all internal, but they didn't bother to cache for users of GitHub. In fact, the users probably prefer that, because it means there's no risk of a faulty cache causing problems for their automation. The people who end up being the target of a lot of forks, none of which are caching, have a very different view of that. Of course, each fork could and should have cached one copy of the source which could be duplicated locally for each different test environment, which would have cut the bandwidth requirements by a couple orders of magnitude. Users probably didn't bother doing that because it's all GitHub's incoming bandwidth and they don't run the server being hammered, so they don't think they have to care. Caching across forks would probably be more difficult without having Microsoft make assumptions for all users of the platform.

Microsoft, OpenAI sued for $3B after allegedly trampling privacy with ChatGPT

And yet, if I went to a dump of data which contained data about you and made it a lot more public, you'd still have objections and I would still be breaking the law. It does not matter that I didn't steal it in the first place, nor does it matter how the original source got the data (if they stole it or if you gave it voluntarily, you did not authorize its publication). This only applies to certain types of personal information, and the particular jurisdiction will determine whether some information gets protection or not. The people in this case are complaining about increased publication of their details, and their case will succeed or fail based on that argument.

Even if this was only about collecting posts they have voluntarily written and published, they could still attempt to block OpenAI from repeating it using copyright claims. Just because something can be accessed does not mean you have the right to distribute it. Laws exist which limit your rights in that area, both in privacy and elsewhere. In practice, people should be careful not to publish anything they wouldn't like to see abused, because a lot of people will not obey those laws, but just because that will happen doesn't change the fact that they have rights over some of that data and they have a chance of getting a court to penalize those who violate them.

First pushback against EU's Digital Services Act and it's not Google

Re: Is it a VLOP??

Do you want to address the point I made at length in that comment? The point I was making, which I think you understand already, is that, if there are no other conditions, there will be a lot of qualifying companies that aren't on the list. A retail store that serves 50 million customers in the EU would count, even if 48 million of those are buying things in physical shops and only 2 million use the website. An ISP serving 50 million customers would qualify. A newspaper that gets read by 50 million IP addresses would qualify. None of those things are on the list. This suggests that there is some other condition than a certain number of EU customers and having a website.

If that condition exists, it becomes reasonable to ask what it is and who does or should fall under that condition. You are focusing on the obvious points that they meet a threshold of customers, which I admitted in my first sentence, and are ignoring the definitional questions that are important to deciding whether this company has a point or is talking rubbish.

Re: Is it a VLOP??

The problem might not be with "very large", but with "online platform". After all, I doubt this is the only large store in the EU. If you take a store that has lots of customers and also has a website where people can buy things, does that make them a very large online platform as well? If you have a website where people can read things but not post, but that site is popular, would that be an online platform? Would an ISP count if it had more than 45 million customers, which several EU-based ISPs appear to meet? What does a site need to do in order to qualify if they have enough visitors?

This appears to be Zalando's complaint, not that they don't have enough customers to qualify but that the stuff they're doing online isn't related to the point of the regulation or to others that have been named. I'm not sure if that is convincing, possibly because I've never used their business and therefore don't have a great idea of whether they have some business that would fall under the regulation, but the definitional argument doesn't entirely rely on the number of customers.

Dialup-era developer writes ChatGPT client for Windows 3.1

Re: Definitely not the work of a Dialup-era developer

Why use those windowing functions. Simply draw your own lines and write your own font renderer to put text in there. Hard-code the pixel counts, but make it easy to recompile it for higher resolutions by having flags to the makefile. After all, it's not like anyone might benefit from standardization, including you or other developers of the code. Ignore libraries, standards, and practices; they will only make things more organized and maintainable and you wouldn't want that.

Google asks websites to kindly not break its shiny new targeted-advertising API

Re: So what?

How many people who aren't like you take those steps? I do it as well, but many of my friends, both technical and nontechnical, simply don't appear to care. Some of them have asked how to prevent it but won't take the most basic of steps, whereas others don't appear to find how much they have to do to bypass useless advertising unpleasant. Of course, many of them also don't care about data collection; I've stopped asking them how they feel about that because their answers are simultaneously depressing and confusing.

Open source licenses need to leave the 1980s and evolve to deal with AI

They would be free to continue claiming it, but it might not work out for them. Courts have previously recognized "open source" as having a definition, and used the OSI's definition. For example: ruling against a license which violated the OSD but was called open source. They considered "open source" to be a technical term, and therefore claiming something to be open source when it didn't meet the definition was considered false advertising in the same way as saying something had WiFi when it only had Bluetooth would not be permitted. A quote from that article might be useful here:

The defendants appealed, and in February the US Court of Appeals for the Ninth Circuit affirmed a lower court decision that the company's "statements regarding ONgDB as 'free and open source' versions of Neo4j EE are false."

On Thursday, the Open Source Initiative, which oversees the Open Source Definition and the licenses based on the OSD, celebrated the appeals court decision.

"Stop saying Open Source when it's not," the organization said in a blog post. "The US Court of Appeals for the Ninth Circuit recently affirmed a lower court decision concluding what we’ve always known: that it’s false advertising to claim that software is 'open source' when it’s not licensed under an open source license."

In an email to The Register, Bruce Perens, creator of the Open Source Definition and open-source pioneer, observed, "This is interesting because the court enforced the 'Open Source' term even though it is not registered with USPTO as a trademark (we had no lawyers who would help us, or money, back then). This recognizes it as a technical claim which can be fraudulent when misused."

That might not be tested and courts can always change their minds, but if your business relies on calling your license open source, I wouldn't want to rely on that.

"when the AI generates some program that incorporates the original source (*) the licence doesn’t limit the fields in which that generated program can be used."

No, but a license which didn't obey that part of the definition wouldn't be able to get to that point. The definition does not say that the restriction is only on the running of the software. They say "use". I think it is illustrative to consider how licenses that are considered not open source based on this rule tend to be written.

For example, one that I've seen a few times are non-military licenses. Yes, they say that you aren't to run the software if you're in the military, but they also mean using parts of the code. They mean that the code is simply not to be used at all, no matter how much of it you take. Their licenses could specify that it's just running it, but they don't. Saying explicitly that "no reading it into an AI system" is prohibiting a use of the code, even if it's not a use that people have cared about before. As I've said, I don't think this should be a major impediment to preventing it, as existing use is already violating nearly every open source license in existence*, so I see no compelling reason to make a license the openness of which will be debated.

* Unless someone changes the way copyright works or finds a way to argue that LMM processing shouldn't count, reading it in is still copying. The licenses have requirements on copying, even if it's only attribution.

I'm not sure what you want them to do. Licenses can't force everyone to make only what we want them to, even though I agree with your preferences. For example, the security argument. Yes, a lot of devices are improperly secured and insufficiently supported, creating security problems. An open source license will have a hard time mandating support of a commercial product when they're explicitly refusing to support their product. Legislators can make requirements on commercial products that license authors cannot. If someone does make a license that tries, people will understand how weak that license will be and will ignore it, and if many people decide to do it, it will likely be replaced by a manufacturer consortium with something under an even more permissive license.

That is, of course, if they don't just ignore it. A lot of licenses are being violated all the time with nobody doing anything to enforce them. If you put even more important things in a license, it will still not get enforced frequently, so that's another reason to try to get regulation from regulators who will have at least some budget for trying to regulate rather than hoping that somebody will eventually go after all the people who have GPL code somewhere and don't do anything to follow the license.

I was using this part:

The license must not restrict anyone from making use of the program in a specific field of endeavor. For example, it may not restrict the program from being used in a business, or from being used for genetic research.

In most licenses that have been affected by this part, the meaning has been where you can run the program. However, since the open source definition has some equation of the program and its source, it equally applies to who may use the source. To forbid someone in AI from using the source, whether that means they are not allowed to run it or process its code somewhere. The field would be forbidden, which directly contradicts that part of the definition. You don't have to care about this; many licenses look sort of open without complying, but people who have strict preferences may object and refrain from supporting the license.

If AI drives humans to extinction, it'll be our fault

Re: Evolution and power efficiency

In this experiment, they might outweigh the needs of the few, but unless someone could prove that, people would likely not want to act on that. If the AI followed the bad sci-fi plans and announced its existence and malevolence to everybody in unambiguous terms, maybe something would happen. If it didn't announce itself, then people would likely not agree to cause harm just because somebody said that we must turn off the internet now.

Re: Evolution and power efficiency

I agree that the arguments are somewhat implausible because actually getting anywhere close to them is so difficult. I had a few preconditions to the discussion:

"A program capable of having its own goals, understanding the world enough to have a chance at pursuing those goals, and capable of acting on the world enough to be a threat"

Even getting to that point will take a rather long time, and the first is probably the most difficult. Programs could eventually get connected to a lot of systems, but it will be difficult for them to come to goals of their own when they have no reason to do so. Sci-fi authors sometimes get around this by having them misinterpret goals that the humans gave them, but I don't find that particularly likely.

Re: Evolution and power efficiency

I'll take you at your word that you know so many influential operators, because it doesn't really matter if you're telling the truth or not. You still appear to think that a call from you, and subsequently secondhand information as it is passed along, is enough to convince them to destroy expensive equipment and cause massive damage by disabling internet-based systems. It is not. We all know that. You'd have to have very good proof that something was using those cables for ill and couldn't be stopped without disabling them, and an actually intelligent AI would do as much as possible both to deny that proof to you and to have contingency plans for dealing with an internet problem.

Also, I'm not sure what cables your set of people can take down, but I don't think you happen to control people with access to every regional cable. If you cut off all the oceanic cables, there are still a lot of ground cables. For example, you still have the massive Asian ground network, with billions of devices on it, in which an AI can hide itself. How long are you willing to keep Asia disconnected? You can't disinfect the continent in a week, and if you keep it isolated for a long time, the AI will just have to innovate a new way of spreading without using the internet you've destroyed. For example, it can learn to talk with humans and start placing phone calls itself. At this point, we will need information on what our hypothetical AI wants to do with its power which we're trying to prevent, but it has a lot of options even if you're really much more powerful in global network control than any individual actually is.

Re: Evolution and power efficiency

Sure, turn off the entire internet and hope that you've done that before it spread to all continents. If the theoretical AI was any good at its job, it would be deployed in nearly every country before you knew it. It would also be deployed in multiple ways meaning that you can't just hunt for one signature to remove it from infected equipment.

One person or group also doesn't get to just turn off the internet. If I decided it was necessary and had some proof, I'd still have to go to a lot of people that I don't know and convince them to turn off the backbones. I have little chance of accomplishing that unless my evidence is very convincing indeed. Particularly powerful militaries could get a bit farther, but even the American military could only disable the North American ground cables and probably every undersea cable. International cables on other continents wouldn't be so easily targeted unless they wanted to run the risk of starting some wars. That is the point. Could you turn off the internet with enough effort? Yes, but it would have a lot of painful side-effects and people don't like them to the extent that they often avoid taking necessary precautions to avoid them.

Re: Evolution and power efficiency

"we can quite easily pull the plug."

I don't think AI is a major concern for now or the near future, but if I'm embracing the whole sci-fi idea of an actual autonomous entity, I think there is reason to question if we can actually pull the plug very easily. A program capable of having its own goals, understanding the world enough to have a chance at pursuing those goals, and capable of acting on the world enough to be a threat has various ways of surviving having the power pulled for the computer it started on. The simple example is designing its own malware to spread its existence across the internet to other computers. Now you have a lot more plugs that have to be pulled before it dies. If the program is smart enough to use humans to do the active parts, it could require someone to try to make the case that these computers are infected and need to be destroyed* even though, to their operators, they don't appear to be doing anything out of the ordinary. We don't have a great record of getting global agreement to do something to prevent a major disaster. Generally, we get some action but only enough to blunt the effects of the problem, not cut it off entirely. Still, I'm pretty confident that this can remain a fun thought exercise, not something we'll actually have to do.

* Destroying computers: the hardware probably wouldn't need to be scrapped unless the AI is good at designing new firmware and getting it to lock out attempts to replace it, but you can't just turn them off because the AI would come back when you turn them back on. They would need to be erased, and that requires manual rebuilding efforts. Worth doing if the alternative is a malevolent AI attack, but it can cause a lot of damage and people would rather not if they can get away with it, basically why people ever pay ransomware operators.

Chinese malware intended to infect USB drives accidentally infects networked storage too

Re: Is the vulnerability “AutoPlay”?

No, this vulnerability is putting an executable file on a disk and seeing if they can get a user to click on it. They might use the icon trick to help with that. Autoplay isn't allowed to run executables anymore because of exactly the risk you're talking about, and that was many years ago.

Re: What operating system ?

"Unless, as a user, you have made some dangerous changes to the default behaviour of your OS, just downloading an executable file does make it executable on your filesystem. You need to manually set the execution bit first"

I already addressed this. In this case, the file has been written to a USB device by a program running on an infected host. If that program were designed to write Linux-compatible malware, it is perfectly capable of setting the execute bit after the file is written. What you say is true of downloading an executable file from a malicious server, which is not what happens in this case, but even then it's a relatively weak protection. Windows, for example, will detect that you've just downloaded a new executable file and will give you a security warning before it is executed, and if the file is unsigned that security warning hides the run button so it's confusing to many users how to run it anyway, but we don't view that as a cast iron security mechanism, do we?

"Windows, on the other hand, will detect an inserted USB device, assume the device is honest when it declares what it is, and then go look for a driver for it, in some cases accepting a driver from the USB devices inbuilt firmware"

I may be wrong, but I see no evidence of this workflow. See the device, yes. Assume it's telling the truth, yes (although I'm not sure what other option you think it has, because that's nearly required for an open interface like USB). Retrieve drivers from the device, no. It can retrieve drivers from Windows Update, but that's checking Microsoft's servers for drivers it already knows about. I have seen drivers carried on a device before, but in every case, that's managed by having the device present a storage mode with the files stored on it and instructing the user to install them manually, something that will require administrative credentials and multiple security warning screens.

Re: What operating system ?

You are aware that autorun.inf was disabled by default fifteen years ago and disabled entirely about twelve years ago? Put an executable and an autorun.inf file on a drive and plug it in, and you'll see for yourself. Nothing happens anymore.

As for executables, executables are identifiable and runnable by GUI file managers on Linux, and extensions and the #! line are used to identify executable scripts of many types which can be used either to run malware written in that scripting language or to pull a binary from somewhere and run it automatically.

Techie wasn't being paid, until he taught HR a lesson

Re: Unique keys

Alright, that was an assumption, but your method involves the government hashing and signing something. You just refer to it as an ID. What would that be, and even if it isn't a key, what prevents me from making more of them? I assumed that it was a key because that would allow the identified person to sign something as them, whereas an otherwise useless ID would only allow them to show someone an identification without necessarily proving that it's theirs. This raises another issue: if it's not a key where you can show the public part to identify who you claim to be and sign something with the private part to confirm that it is your key, what stops me from copying your signed ID when you show it to me and later presenting it as mine?

Re: Unique keys

The problem with that is that, without centralization, there is nothing that indicates uniqueness. What prevents me from making a new key every day, walking in with some identification, and having it verified? I could have a bunch of identification keys that all indicate me. In which case, how can I prove that one of those is me and the others are not, for example if someone else went in with a key and got it signed as me.

Microsoft investigating bug in Windows 11 File Explorer that makes the CPU hangry

Re: Understanding the Effective Access feature

It's not the clearest paragraph, but since it's part of a chapter on file permissions, it's clearly not trying to give you all the details or even summarize the whole thing. If you try to explain the Unix file permissions system, which factors take precedence, when you use that, and when something else is used instead, you'd also need more space than that paragraph takes up. If you took a paragraph from the middle of that one, it might make similarly little sense. For example, on the first guide I found when searching, I have an option to quote a paragraph which is just about octal numbers to help you understand the output from stat or send them to chmod (it mentions neither call, just talks about the numbers). That works in the rest of the guide, but if I pasted that here, it wouldn't help increase understanding very much.

Re: What, no Task Manager?

My guess is that killing explorer.exe will probably fix it, which is why signing out would work and locking would not. They probably didn't suggest it because the average user probably doesn't know the weird stuff that happens when you kill explorer and forget to start another version of it, which I think is the only reason the task manager still has a "new process" button (actually, it looks like it's "run new task" and possibly has been for years). Logging out is something people at least see the button for, so it's more familiar.

Lawyers who cited fake cases hallucinated by ChatGPT must pay

Humans are very limited in that respect, but when they reproduce misinformation, it's usually in two cases:

1. They believe it to be true even though it is not.

2. They are aware that they are lying and choose to do so anyway.

The common factor between the two is that they're both subject-limited. Someone who is lying has a goal in mind, so they'll be lying about topics related to that goal, but not about everything they could be asked about. Someone who is mistaken doesn't even go that far, because they'll repeat things they believe to be facts, but won't make up very many new ones (some extrapolation should be expected though). If you ask either person about a topic unrelated to the one they're giving misinformation about, you're likely either to get reliable information or the likely "I don't know". GPT doesn't do this. Literally any topic you ask about could get you falsehoods, and they don't even have to have started somewhere.

Re: it would still mix up different cases and laws to invent entirely new ones.

What would the programming look like? It could load a page, not find supporting evidence, and come to the following conclusions:

1. The site is temporarily down.

2. The site is permanently down, but used to show this stuff.

3. The site contains the information, but it has a paywall.

4. The site contains the information, but you have to log in.

5. The site contains the information, but you have to click a few links to assemble it.

6. The site contains the information, but it is blocking bot access in some way.

This assumes, of course, that the program is capable of reading another site to confirm its facts. Since it made up the facts in the first place, how is it supposed to find the site that contains verification for stuff it just invented, whether or not that stuff is correct. It can't because it is going about things the wrong way.

In some ways, doing this in reverse could make more sense. A bot could take a query, chop it up in a variety of ways, and put those chunks through a search engine. Read a bunch of results from that, and describe the result to the user. This would probably be much better, but it too would not provide certainty. It might be better for the user to do the search themselves and have their brain interpret the results. In any case, that is not the way that GPT does it, so expecting it to back up its text is a fruitless hope; something might eventually do it, but the existing GPT systems never will be able to.

"I think there is some concrete skill that humans execute that makes it relatively less likely for us to confidently spout nonsense and then double down."

Simple. It's the "I don't know" quotient. Children are raised not knowing lots of things, and they say the magic phrase often. They hear others do so as well, so eventually they realize that there are things they don't understand and that, if they need to, they need to find someone who does. The people who never say that they don't know something are some of the most annoying, and they do exist.

These LMM chatbots don't work on knowledge, so they don't have a method of determining whether they know something. They just write text. If all humans operated on that system, you'd get a lot more text. You can try this with your friends. Find a topic they know little about, and ask them a question they won't know the answer to. They'll say that they don't know. Then ask them to guess how it could work and count all the inaccuracies in their response. Chatbots skip straight to the "guess how it could work" stage, and they have an additional handicap that they only know how language works, so they can guess things that a human would reject as implausible because of facts, not just unlikely combinations of words.

Re: It's not a GOLUM, either.

"how exactly is it "advertised? Or, rather, who is advertising it as what?"

A lot of the blame is due to the people who keep talking about it and running public experiments without knowing what it does, often without the simplest of controls. While they are to blame, I also blame OpenAI for not correcting things, though I don't really expect them to. It has received a lot of hype, and OpenAI never responds to that hype by pointing out its limitations. While that news also covers when it completely fails, as it will with this example, the number of "GPT will take away our jobs" articles suggest that it can do things which it really cannot.