Posts by doublelayer

Still waiting for a Pi 500 and wondering what do this summer?

Re: Point

Nothing needs an SSD; I could boot my laptop off a USB disk and it would still work. However, one of the selling points of the Pi 5 was that you could use an SSD, which is sometimes relevant. One of the cases where it is especially relevant is in a desktop computer, such as the one the article is about. I don't want to hold every application I might want to run in 8 GB of RAM. That wouldn't leave me a lot of RAM for memory-intensive things. Nor do I want to get another computer to provide network storage and run a Pi as a thick client that still has to execute everything. If I'm doing that, I might as well run the computing on the server providing the storage and use an earlier Pi as an actual thin client.

Fortunately for me, I wouldn't have to, because that's one of the main reasons why NVME was added. I don't know how well it works because I haven't bought a Pi 5 (there's a cap somewhere for how many Raspberry Pis you can have before you have a problem, and I might be near it). I wouldn't be surprised to hear that elsergiovolador's summary of reliability is simplistic. However, your response that nobody needs it kind of sounds like you also think it doesn't work and are trying to make excuses for that.

Re: Point

No, that's not how it translates because of two things I think you probably already know:

1. On an X64 processor, you don't need custom images of any operating system, and you usually don't need custom kernels either. On a Raspberry Pi, you definitely need custom images, and sometimes you also use custom kernels. On other ARM boards, you always need custom images, and you often use custom kernels. The more "custom" things you have in a build, the more annoying the process can be when something doesn't work as expected. For instance, in-place upgrades from one standard distribution to another are a pretty common test target and generally work well, whereas doing that with images sometimes breaks or just isn't available for a while, and if your kernel has patches which haven't been upstreamed, you may not get to update the kernel at all unless you can find the sources and try to patch it yourself.

2. If you really do want to run Windows, the Raspberry Pi can do it. Probably better now, because the last time I tried, it was on a Pi 3B. Windows 10 didn't like the single gigabyte of RAM and, while it ran, it wasn't fun to use.

If you insist on misstating what people say, you paint yourself, not as someone who understands the distinction and has a good argument, but someone who has a pointless adherence to a product without the knowledge to explain why. There are reasons to favor the Raspberry Pi, but you haven't stated any of them.

Biden tries to cut through fog of confusion caused by deliberately deceptive customer service tricks

Re: I like how Apple makes it simple

There are a lot of services that do that, but they don't advertise it. I've had many experiences where I have a thirty-day trial, cancel it on day 27 to be safe, and get the message that it will continue working through day 30. I know people who do that with Amazon services and streaming in general, but I couldn't make a full list and it could change at any time. However, since so many people are doing it, I wonder if there is a requirement somewhere that is making them. Otherwise, I would have expected them all to cancel as soon as they got the button press.

Apple is coming to take 30% cut of new Patreon subs on iOS

Re: Make the app free

The app is already free. The app isn't the product, just the way to organize payments to others who don't have an app of their own. Anyone who wants can pay through this by going to their website instead of their app. However, they will not be able to continue to use the app and direct people to any other payment systems, either in-app or on a website. Outside the EU and South Korea, Apple has forbidden doing so. Inside those areas where it is required, Apple has placed so many restrictions on doing so that they're still effectively forbidding it but pretending that they aren't.

I'm guessing by the comparison to Rockbox that they wanted features the iPod's music player software couldn't do, such as playing formats other than the two that Apple supports or transferring music not using iTunes. Of course, then I start to wonder why they bought an iPod instead of something else they didn't have to hack. At the time, I'd have preferred an iPod running Rockbox to something generic, but if I didn't know that Rockbox would be supported, I would have bought a cheap one instead rather than deal with the limitations.

I think the restaurant shouldn't get to charge me for going to someone else's restaurant just because I have gone there in the past.

This is not about paying more for iPhones. I've done that and willingly to get the benefits of the phone, such as updates that don't stop coming after two years. When Apple does something, I am willing to pay Apple. When they don't, I am not willing to have to pay them more. Trying to tax any financial operation that involves an iPhone, even when they have done nothing at all during that operation, is not the same as charging higher prices for their own products.

Before we put half a million broadband satellites in orbit, anyone want to consider environmental effects?

Most of those areas are less populated, which means two things:

1. Geosynchronous satellite's capacity in their area isn't divided very much, so it provides perfectly fine service unlike some more densely populated areas.

2. Starlink is unlikely to serve those areas because they don't have the regulatory approval. For mountainous areas around the Andes, they have obtained some of the licenses they need, but for your "volcanic island in the middle of the Pacific not near any existing fibre links", they're not likely to get that.

For instance, Tonga's internet was taken out a while ago, so maybe people there might like Starlink. Take a guess whether Starlink has bothered to get approval to sell to that small market. They haven't. In addition to probably being beneath their consideration, the other reason for that is that being far from links also means Starlink doesn't work very well. If Tonga's link goes down, the satellites have to send a lot of data over a mesh network until they find the next ground station, which means a lot of transfers because Tonga isn't very close to other things. This is a problem that geosynchronous can solve more easily. You're overstating Starlink's functionality with your own examples.

Software innovation just isn't what it used to be, and Moxie Marlinspike blames Agile

Re: Blame........

I'm inclined to agree with you in many areas, but I think your main point still gets it wrong. There is indeed a lot of complaining, including on things that are not worth complaining about. I've pushed back on several of them already. While I haven't talked much about Agile here, and I tend not to like it, it too seems mostly irrelevant to most of the things that we're discussing.

However, this is not something where we can just articulate what the problem is, because the topic in which we'd try to find the central problem is "what is wrong with software in general, worldwide, and why". There are lots of problems in that area and almost none of them apply to everyone. When you have a question as vague as that, answers are less likely to work because most of them won't apply well to all software writing. Those that do will probably be worse, because the only way you can claim to comment on all programmers is to have ridiculously broad stereotypes (E.G. young people are terrible because not one of them learned anything other than JavaScript, old people are terrible because not one of them can write in anything other than VAX assembly). No simple statement of a problem, no matter how accurate, will make that the problem.

Re: Agreed

Now tell me: when did I recommend doing so?

You don't have to do that to use a framework. There are lots of ways to manage dependencies that don't clone a repo on invocation and just roll with it.

Re: He's right about black boxes and over-abstraction though

"Some OO languages (C#, I'm looking at you) prevent individual data items being passed by reference, thus forcing an entire objectful of data to be passed into a method rather than a pointer to the single item which is to receive a new value."

There are several problems with this description. First, it's not C# or any language doing that. It's the writer of the object labeling a member private or protected or not exposing it directly. If it's your library, you can change it quickly without breaking compatibility. If it's not your library, it leads directly to the second problem, which is that this is done on purpose for a reason. It's done because it lets the writer of the library restrict their code to defined behavior. If they don't want you manipulating an internal value without going through the setter, it probably means their setter is doing something or it might in the future, and if it does your direct manipulation might break stuff.

This is the same reason why, even though I can, I don't write to internal data of other parts of a program or dependency. Maybe it works now, but there's no guarantee that it will continue to work when something changes and if it doesn't, the failure is likely to be annoying to debug, unlikely to show up first in testing, and potentially damaging to the user's data or environment. It also makes debugging harder because, if you put something invalid there, the problem will not be detected when you do it. It will only show up when some later operation tries to work with it. Debugging will require tracing back from where it broke to where you inserted the invalid data.

Re: Tradeoffs

This probably depends on your definition of framework, but people use frameworks because they want something that is likely to work and they don't want to spend long times implementing and maintaining it. We do it all the time with operating systems. I could write something without using Linux's system calls. I know how to do it. They taught me how to and made me do several when I studied operating systems. If I'm working in something embedded, I will. If I'm not, I won't. I won't because I want my program to run later on, so if the system call gets improved, I will get the benefit. I also don't want to waste time I could be spending getting new things to work redoing something that's been done before, probably better than I will because they've got years of experience finding and fixing bugs in it. If I'm writing another platform, library, framework, or whatever else this is, then of course I'll reimplement because I'm trying to make something better than they have. If I'm trying to build something that needs such a platform, library, framework then I won't rewrite it unless their one is not good enough.

There are lots of good reasons not to use a dependency, but ascribing laziness to those who do is a ridiculously broad stereotype that does no good to anyone. Marlinspike's comments were aimed, as he says, at those who cannot implement such a thing, not those who don't. A large part of knowing how to do something properly is knowing if it makes sense to do that thing.

How to ingeniously and wirelessly inject malware onto someone's nearby Windows PC via Google's Quick Share

Re: Quick Share?

Google started it, but Android still has a place where apps could store their data and you could see and modify it. A lot of apps choose not to use that, and it's not a recent thing. Google enabled this, and almost from the start, but app developers deserve at least some of the blame when they have an option to avoid it.

Re: Quick Share?

Yes, sometimes, but not always. For one thing, there are a lot of Android apps that have worked to kill the filesystem and don't place their files in a place where you can easily find them, or sometimes, a place where you can't retrieve them at all unless you have root access. Some of those might support other forms of sharing, though.

Then you have the problem that connecting a USB cable and enabling media transfer allows the person you're connecting to to read all the files that aren't locked in the previously described way, not just the one you want to send them. You also have a compatibility issue. If you connect an Android phone to a Windows computer with a cable, things will tend to work. If you connect two Android phones together with one cable, then you have to work out how to tell both devices which one is presenting MTP over this cable and which one is receiving, and you can't go in both directions. That will take some time to figure out. I would also point out that Mac OS and Linux don't mount MTP devices (virtually every Android device uses this) as conveniently as Windows does and can't access them at all without installing other software, but that probably isn't relevant because it sounds like Quick Share doesn't run on those either.

We're thirteen years on and XKCD 949 remains a major gap.

Secure Web Gateways are anything but as infosec hounds spot dozens of bypasses

"For some of us (a minority), features like USB access are the whole point of computers. I'm willing to give up internet access to have USB access."

I don't think I understand your desires. If that's what you want, why can't you use a computer now. The browser does the internet stuff and all sorts of other things can do USB. The only point of letting the browser do USB is to let internet-based things access USB devices. If you're giving up internet, then that doesn't help you anyway. Also, in my experience, the main reason why a browser-based thing wants access to USB devices is as a profiling tool (keyboard IDs would be a pretty good fingerprint). Malicious pages have even more nasty things they could do with that access. The one use that hasn't been that evil was a serial console for a development board, implemented in Javascript, but I have plenty of native programs that can send serial over USB.

Re: The complexity of the modern internet browser

"a. I thought modern browsers ran in a sandbox?"

They don't, but they create sandboxes for the scripts that run. This means that a script will have to either find a vulnerability to escape its sandbox or get a user to do so. For instance, assembling a malware file on the user's computer, downloading it, then telling them to go open it.

"b. If the SWG can inspect SSL traffic doesn't that mean the SSL traffic isn't really secure."

Yes, in this particular case, which is what is intended. If you specifically allow the traffic to be intercepted by installing something with the rights and capabilities to supply its own certs, you know it. This requires configuration on the endpoint. If you control a network link that my computer connects to but you can't put your certificates on my computer, you'll be unlikely to be able to do the same.

US 'laptop farm' man accused of outsourcing his IT jobs to North Korea to fund weapons programs

Re: To Fund Weapons Programs

It's not private enterprise. In order to get a network connection to start doing this work, you need approval from the government to have one, often not even in North Korea. The scale of the operation and repeated statements, including from workers, managers, and government leaders have demonstrated that this operation is government-controlled. So yes, the money earned from doing it goes into government coffers. They spend it on whatever they want, including agricultural supplies, fancy stuff for the Kims, and weapons manufacture and research programs. Not in that order.

Faulty instructions in Alibaba's T-Head C910 RISC-V CPUs blow away all security

Re: Obit

Would it kill you to actually understand what people say? In this case, the comment you replied to did not say that this instruction was fine. From that comment alone, you can determine that they think RISC-V in general is bad and that this vulnerability, while bad, is better than everything else. If you need more clarification, look at the other comments posted by the same person. I don't agree that it's quite that bad, but you've taken up a valiant effort to attack a point that nobody said and the specific person you're responding to would probably disagree with more than anyone else.

Re: "They've also published a website, ghostwriteattack.com"

You seem to have two separate points. Why have a website for a vulnerability? I don't know, so you can find the information faster than finding the website for their institution, which I certainly couldn't have told you was https://www.helmholtz.de/en/about-us/helmholtz-centers/centers-a-z/centre/cispa-helmholtz-center-for-information-security/, then find the information wherever it's posted. Educational websites are often a maze and sometimes break links because there are multiple teams working on the site and none of them speak to each other, let alone the researchers. While this looks to be a research-focused organization rather than a university, I doubt their site management is very different.

Then you complain about the name. What name is it supposed to be? The vulnerability is called GhostWrite because you can write when you're not supposed to without detection, and it is a possible attack. The only other one that seems likely is ghostwritevulnerability.com. What name would you not object to?

Re: i want one

The SBCs it's in right now are not as cheap as you describe, but whether your number is correct or not is not the major issue. These are easy to find because they describe the SoC used right on their product pages. What we don't know is what else has one of these chips in it. For instance, manufacturers rarely tell you what CPU powers a printer, a television, a security camera, or lots of similar embedded things. Some of those can get code, either as a firmware update or as a third-party addition (for example, a networked television installing an app to stream something) which could exploit this. Now, there is a beachhead on your network and they have root access on it so can do things that a sandbox might have prevented.

That's just considering consumer or office stuff you're likely to have, and given the youth of this chip, that's probably the most likely kind of device to find this chip in. However, such a thing is also a favorite attacker of infrastructure. I'm sure several RISC-V SoCs have been built into industrial equipment that can have effects on safety if disabled or messed with. Probably not this one, but I don't know that for sure. The kind of people who like turning off water and electricity would quite like being able to elevate or to trigger something that requires a restart. In fact, they can combine their efforts. Elevate to root, install something that will execute the instruction that crashes the machine as early in the boot process as possible, then execute it once. Kind of like the CrowdStrike bug did, but to embedded infrastructure instead of desktops. Ideally, it should be harder to get this to execute on those machines due to other security measures, but that isn't an ideally I want to rely on too much.

Hello? Are you talking on a Cisco SPA300 or SPA500 IP phone? Now's the time to junk 'em

Re: Phones still OK on an inside non-routable network?

It depends on your setup. I'm not sure what these models look like and I'm not going to bother looking it up, but a lot of phones like this that I know have have two ethernet ports. You plug in the one cable from the wall, then you plug a passthrough cable for the computer. Now that phone has its own internal address which you can firewall and it's got access to the user's computer traffic as well. It can send traffic as the user's computer, allowing it onto that network. So if you do that, probably firewall rules won't be enough.

Re: Phones still OK on an inside non-routable network?

I suppose the theoretical attacker who has lots of time on their hands and good skill could make this really nasty by installing C&C systems on all the phones. Then, after something like a ransomware attack where the computers were completely wiped, you think they're gone because all the computers have been reimaged from a clean state, but they can come back from what looked like a dumb desk phone and do so over any part of the network in which those phones are installed. It would still require the same access you described, but that's probably the worst thing they could do with it. The risk may be low, but unfortunately the potential harm in the worst case is substantial.

Study backer: Catastrophic takes on Agile overemphasize new features

Well said. Your comment reminds me of a blog post from several years ago that gives some good examples of ways people misunderstand simplicity and its value in product design.

Re: Agile would be great if not for all the people

I have to agree here. If there's one thing that the manifesto actually does state clearly, it's that the type of mismanagement described is harmful. It doesn't say how to avoid it, but given how a lot of implementations work, I'm not sure it would matter much if it did since management would ignore it anyway. I've worked in places which were better at this, often by having a more informal team structure as Agile recommends. On that point, Agile has recommended the right thing. It should be obvious but sadly is not.

Re: You Keep Using That Word

"And on the subject of 'comprehensive documentation'. That is in the manifesto because software code IS documentation."

No, it isn't. It never has been. It never will be. Code is a set of instructions for a computer, not a set of instructions for a human, and definitely not a set of instructions for a user. A user does not care how the program does something, and they do not want to and should not be expected to have to read through in order to figure out how to use the thing.

I've worked at places where that was tried. One team went as far as to put in their readme file (all ten lines of it) RTFC. The result: weeks of wasted time trying to figure out which parts of their library worked and how. Did I mention that one of the people wasting their time figuring this out was on the team that wrote it? Because they did not document, and incidentally did not check, anything properly, their code was impenetrable. To make it worse, their library called out to another library which was written the same way. This is why you have reference documentation. What this function does. What parameters it can take. Otherwise, you too will find yourself spending time trying things over and over again because all the invalid calls return empty sets, but some valid ones have zero results so also return empty sets. Now was this one a failure or success? If only someone had written that down.

And that's in a situation where everyone involved could do that. What Agile proponents often fail to recognize is that most of the people for which software is being written are not programmers. They cannot read the code. They don't want to either, but even if you made them, they would not be able to do it. Some of them don't have the code in the first place, since not everything is open source.

Re: Air traffic control

Any comparison of that nature is so vague that it can't really be used. For instance, ATC that is available for five minutes per ten hours is not going to be very useful even if it is right. What are the chances that it chooses to be available when you need it rather than being available for five minutes of routine flight. It also presumes what "not right" means. In reality, an ATC that is inaccurate probably isn't completely random or guaranteeing wrong answers but has some chance of error. If that error means that a flight makes two turns instead of one because they read out the wrong number, the result is very different than if it is told to taxi at a building the pilot cannot see.

In general, a system needs to be available and right quite frequently or it won't be useful. We then have to consider what harms are caused by unavailability and incorrectness of the type that actually happens to decide how bad those things are. Our goal is of course to have 100% correctness and 100% availability, but our tradeoffs have to be calibrated for the actual outcomes. Often, the incorrectness isn't something we can predict accurately because it is due to irregular events, especially human error, which is why we try to design around frequent causes of error rather than calculating probabilities on something unpredictable and planning with those unreliable results.

Except when you find that users actually do want new features. There are many features that get developed for a set that's so small that you might as well ignore them. However, many customers do use features to decide what to buy and complain if something doesn't have them.

Everyone has a level at which they don't really want many new features. If they were very thorough, they'd name four new ones (one that could work for other people, three very specific only useful for them) that they would like added. Everything else that's added just annoys them. However, it takes a product a while to get to that level, and if it hasn't gotten there already, they want the new features and will choose the option to use based on them. As with everything else, you have to manually determine where your product is in this cycle or it will not work.

Re: Nope.

In most systems, including basically everywhere I've worked, devs don't get to put stuff on the backlog, and that's stuff that's unassigned. If I took something I had been assigned, didn't finish it, and put the tasks on the backlog to disguise this, not only would I be doing something I'm really not supposed to do, but they're likely to find out quickly and be very unhappy with me. Nobody does that.

Backlogs can be a problem. They fill up with stuff that's never going to get done, and if the project manager or enough devs don't want to do something, it can get shunted into the backlog and nobody will ever see it again. However, it is not the tool for devs who don't intend to do what has already been assigned.

There are at least two phases in an engineering project, and the first few steps can be done using something similar to Agile. When researching what works and making initial designs, you can afford to try something that might work and see whether it does or not. Eventually, you have to stop doing that and decide on a good design for the product that's actually going to be sold. Continuing to use the informal methods when making the product will lead to lower quality. Not using a more experimental approach in R&D is likely to prevent the invention of new capabilities which would make the product better.

As with software, you have to know when it is safe or desirable to use a method and when it is not, then run those things separately. This doesn't work well with people who demand a single solution for everything. They demand that either Agile is a great system and can work with anything or Agile is bad at everything and there is a different one that isn't. Neither is true.

Report: Tech misconceptions plague the IT world

The reason is that, while you were working with this stuff in the 1970s, a lot of the people your age weren't working with it at all. They don't understand the hardware like you do any more than a younger person who hasn't studied it does. The stereotype that young people should know how computers work isn't new, and I can't say the starting reason is wrong. A lot of people who grew up without computers use them now but not very well. As time goes on, this is weakening, but I've helped quite a few older users set up a computer who do not understand how to use it (let alone how it works). They can do a small number of things by rote memorization. For example, to read the email, you click on this mail icon. If the icon moves, they get confused. If they're using someone else's computer without the mail client, they won't know what to do. They see a young person who knows how to access their webmail on any computer, and they can see that this person knows how to make the computer do something that they, the older user, doesn't. In fact, the younger person may not understand how to set up a mail client, but in comparison, their tool lets them access their mail and the other guy's doesn't work as well, so their one seems better at the time.

They then jump to the incorrect assumption that, because the young person can make the computer do what they wanted, that they must understand how it did so. To bolster this mistaken impression, the younger person has learned some tech-related terms that the older person doesn't understand. In fact, the younger person may be using them wrong, as I'm sure we've all seen from users from time to time ("The server isn't working because the WiFi driver isn't plugged in"), but the less knowledgeable user doesn't know that. I'm sure that these younger people will get old, some new technology that they've lived without for decades will come along, and they'll be looking at their grandchildren who use it naturally and make incorrect assumptions about what they're doing. The grandchildren will in turn make incorrect assumptions about what skills their grandparents must have had just because they don't instinctively know the hand gestures needed to make the AR environment launch their game.

Verisign under fire for increasing .com prices each and every year it can

Re: Who operates .US?

History killed it. If, when .us was the first country TLD to be created, people could register them the way they could .com, it might have taken off. .uk worked out that way. But instead of doing that, for the first seventeen years, you could only register weird geographic domains that were ridiculously long. Did Apple want to be apple.com or apple.cupertino.ca.us? It took until 2002 to remove that limitation, and there's still no organized third-level domains like .co.uk because .co.us is already reserved for Colorado.

Re: Verisign believes...

It's also very unlikely. I don't think the people who hold domains intending to flip them are going to mind a $2 increase. There is a level of increase that would actually get rid of them, and getting rid of them might be nice, but the increase required would have so many other negative effects, for instance making buying a domain for a small site prohibitively expensive, that I'd rather have the bots parking what they think are nice domains. Increasing by small percentages does nothing except mean that more money from the domain resellers goes to Verisign, and it also comes from everyone else. Verisign does not deserve that power, and their abuse of it suggests that we might be better with someone else running the registry altogether.

Incidentally, I wonder whether anything has happened with Nominet recently. It has been a while since they had to be restricted from trying a similar thing, but since their CEO was removed and some board members changed, there has been nothing from them, which I hope falls into the "no news is good news" category. If they eventually succeed in getting reasonable leadership back, maybe they could take a turn running .com. It probably wouldn't go that way, because someone in the US would freak out if someone not in the US was named to run it, but I'd be willing to try it. Only if the relative silence indicates they've improved, though.

Michigan probes Musk-backed PAC website that weirdly tried and failed to help register people to vote

Re: Not just Michigan

Actually, I'm guessing that there was a combination of you not understanding what I was replying to and I not phrasing my comment clearly enough to point that out. Obviously, this particular site was not redirecting people, although it sounds like it was in some other states. However, the comment to which I replied was asking why, in general, there are sites from people other than the government that help people register to vote. There are many such sites. It is not uncommon for American political groups to have a voter registration page. For instance, from a quick search, I can find several organizations external to the federal or state governments whose purpose is either specifically to help people register to vote (example 1, example 2), or is political in nature and has a voter registration page on their sites (example) or from political parties (Democratic, Republican state party website doesn't seem to have one but maybe it's on another site). The existence of these pages is relevant because it is why the misleading page from this PAC was so dangerous; people may expect based on the existence of many similar pages that this one might be trustworthy.

My comment was intended to answer the question of why such pages exist at all. My comment that most of them direct to governmental pages refers to the legitimate ones. The fact that I was speaking in the plural rather than the singular was intended to reflect that fact. I suppose it was not clear enough. I suggest, however, that you may want to consider the context of a thread before making incorrect conclusions about the meaning of a comment.

Re: Not just Michigan

I'm not sure it's needed, just that a lot of places that get visitors who might want to vote tend to put up instruction pages. From the description in the article, it sounds like most of those just redirect to the right government site anyway, so they're only driving traffic rather than submitting applications themselves.

Punkt MC02: As private, and pricey, as a Swiss bank account

Re: Pricey?

Not exactly, just willing to pay a lot more for a phone than I am. Maybe you actually use some of the things that make that more expensive, but I won't, so I am not willing to spend that much. There are also people who would find that price difficult to fit into their budget, but that's not the only thing the line referred to. After all, you could probably pay twice as much for that phone as you did, but you might not have been willing to.

Re: About google translate mentioned in the article

As far as I can see, that's basically just a proxy. While it works, Google will only see the proxy's address instead of yours, so less tracking of you, but they'll still see the material you're translating and the proxy will see both. This is also until Google breaks it, either deliberately or accidentally.

Fortunately, the AI boom has also meant more capable models which can be run offline and are actually open source. For instance, the models that are now available in Firefox, while they support only a subset of languages, provide reasonable quality and don't use a cloud server to do this.

Re: No Need For Privacy?

I wonder how much of this is privacy theater. If I need more privacy than I can achieve with the hardware I have*, I'm building my own environment. That limits my hardware options and I may have to do some modifications to the software, but using something open means I have at least a little more ability to do that. A modified Lineage or Graphene environment doesn't have a connection to someone else's cloud, doesn't have a mail client that only works on an email account I'm unlikely to use, and still lets me customize as needed. True, that means I lose their VPN, but I'm not quite sure whether their VPN is any more trustworthy than another.

Google paying to be default search on phones is totally against antitrust law, judge rules

Three reasons:

1. Because you're just wrong. Using Bing, the first result for "change search engine on Amazon Fire tablet" tells you how to do exactly that.

2. You can also install other browsers on that tablet. So even if you couldn't change the search engine, and you can, you could install a different browser and set it there.

3. Because Bing is not a near monopoly in search and Amazon is not a near monopoly in tablets. Not that many people buy Fire tablets. This ruling didn't say that paying to have your search engine used was illegal for everybody, but that doing it from such a dominant position to crowd out competition was anticompetitive.

Second patient receives the Neuralink implant

Problem description indicates design fault

Musk said, "The long term aspiration of Neuralink is to improve the AI human symbiosis by increasing the bandwidth of the communication. Because, even in the most benign scenario of AI, you have to consider that the AI is simply going to get bored waiting for you to spit out a few words."

Or, maybe, you could program the AI* not to do boredom. There is no reason why the AI should need to feel bored, and several downsides. An AI that gets annoyed at slow users probably doesn't need faster users. It needs to be a better AI. The same goes for all sorts of other emotions such as anger, schadenfreude, terror, hatred, etc. In fact, we could probably manage without some of the positive ones as well.

The more I hear from "visionaries" or "futurists", the more I see people who read a lot of science fiction without thinking as much as any one of the authors that wrote it. The writer was trying to write an interesting book. The visionary is trying to predict the future and plan the way there. You would think they'd recognize that they need to think even more to successfully do that.

* AI: The science fiction concept of a conscious, intelligent program. Not an LLM. Those don't have emotions.

50 years ago, CP/M started the microcomputer revolution

Re: CP/M Gets AC From Idiot To Mostly Competent!!!!

"What is the core point here apart from making a wrong statement by getting a date a decade wrong?"

We agree that the dates are wrong. Their point, which is mostly irrelevant to TeX, how powerful it was, and when it existed, is that some people care about the visual layout. They said this in order to respond to someone who did not care about the layout:

AC: "if I was writing a modern replacement for "War and Peace", surely I'm interested in the words and not the fonts?"

Their main point was that people do care about layouts sometimes, and they are the reason why WYSIWYG tools existed, and before WYSIWYG tools were practical, non-WYSIWYG tools which handled more than just the words of a document were used. Incidentally, they never claimed that LaTeX was WYSIWYG as it was specifically their example of a non-WYSIWYG tool. They got the tool wrong in that description, but their core point, although it has mostly been lost to smaller details, is correct. Some people do care about more than the words. They are the reason why WYSIWYG editors have existed, and that is at least partially the reason why LibreOffice has so many features that take up so many resources.

Re: CP/M Gets AC From Idiot To Mostly Competent!!!!

"TeX itself is a decade older, and contemporaneous with the Alto, but TeX is not even slightly WYSIWYG."

But they weren't saying that it was. They were saying that it was a non-WYSIWYG way of writing when you care about the visual design, rather than just writing down words, pointing out that, even without WYSIWYG software, people wanted to do that. Most of the LaTeX software isn't WYSIWYG either, though they've now got some that render instantly.

Tesla that killed motorcyclist was in Full Self-Driving mode

Re: human was just a passenger

I think self-driving cars can be a good thing. I expressed so yesterday in these forums. However, what Tesla has, and for that matter all the other things that an individual consumer can buy, are not self-driving and it's important that we make this clear. There may be a time where some cars are safe enough to be driven by software, but that time is not now. Right now, the perfect isn't being the enemy of the good. The perfect and the extremely bad are teaming up to be the enemy of the good. If people keep seeing the stories of supposedly "full self driving" vehicles killing pedestrians, passengers, child-sized mannequins, and everything else that Teslas can't prevent themselves from hitting, then the public is going to believe that self-driving vehicles are a misnomer and never will be safe. This means that we should do two things.

The first is preventing anyone from saying, suggesting, or implying that their car can drive by itself when it cannot. That means that level 4, I.E. the user's attention is not required at all during automated driving, at least, is required before using any of these terms. Perhaps this will need to be extended to level 5. Second, that people who enable features that are not self-driving should be as liable for damage caused as anything else. They can turn around and sue the manufacturer if they want, though they'll probably find it hard because they now have a manual full of paraphrases of "yes, we lied about the self-driving", but they can try. The manufacturers should be liable for selling a product using deceptive tactics, but the driver needs to be liable for using them in a dangerous way.

Linux updates with an undo function? Some distros have that

Re: Atomicity

"I think mobile devices get this right—OTA updates, sandboxed applications, and fool-proof system upgrades..."

Sandboxed applications work great until you want to do something with more than one of them that wasn't already thoroughly thought through by its author. If an application wasn't courteous enough to store your data in the accessible storage locations, then you have an annoying time getting it back out, and that's if you have root access. If you don't, you're probably not getting it out, and it doesn't matter too much if you can because you'll never get it back in. By the way, if it does store the data in accessible locations, then there isn't much sandboxing left because anything with access to the storage can read and write everything there.

Also, I'm not sure calling Android system updates "foolproof" is entirely honest. They rarely brick things, but that's mostly due to the small number of them and the fact that they should be easy to test before the manufacturer releases them. If they do brick things, there is no automatic recovery. There is no manually selecting a recovery. No backup image is stored because there's not much storage in phones and they've already taken plenty for the system-installed apps, so taking double that for a backup partition isn't considered a good option. Since everything is custom to the device, your only options to recover from a bricked device are these:

1. Find a system image from your manufacturer (a few of them have it, but mostly good luck). Manually boot to recovery and sideload it over (unless it won't let you, which is many of them).

2. Go to XDA and find a post by someone whose identity and trustworthiness you don't know. Download the image and tools they provided and run them. Hope that they don't contain malware and that they're actually for the device you have.

I don't think that mobile devices are a great model for how we should do updates. Ripping and replacing a root partition to update a single binary in it just means using about a hundred times more bandwidth than you need without providing any more certainty that it will work or that you can recover if it didn't. Having two root partitions, with or without full replacement on an update, at least lets you recover from a bad update. Snapshots give you even more ability to rewind.

Ransomware infection cuts off blood supply to 250+ hospitals

Re: Out of the generosity of their hearts?

There are a lot of nonprofits in the industry. They can still sell services at an expensive price so long as they reinvest the profits into their organization or pay it to the employees rather than having shareholders to return it to. When doing blood donations, they likely think that the potential for profit is low and people may be more willing to donate to a nonprofit. Even many hospitals are nonprofits as well, though by no means all of them. There are many for-profit parts, including insurance, independent labs and clinics, a lot of individual practices, and who knows how many middlemen, but that doesn't mean that every part is.

Re: Data Stewardship License (Overran the Edit Time-Window)

From their description, they are using a fallback plan. We don't know how effective that is, but there is a reason why blood suppliers from other places are sending their backup blood to this organization, not directly to hospitals. Clearly, they still have some ability to get the blood where it needs to go, just a degraded capacity.

Also, many of your alternative methods would have very different effects on their operations. An earthquake near their main computers would likely leave those in other locations (four US states covered) undamaged. A blizzard might interrupt power, but backup power would still work fine, but driving might be the problem. They would need different contingency plans for many of those scenarios, and only they know whether they have them and how good they are.

Five months after takedown, LockBit is a shadow of its former self

No, can't have that. That would give the evil west something, and that has to be prevented at all costs. Lots of other options are acceptable: imprisonment, forced work on some state computer thing, just take all his money and set him free to make some more, but there will be no sending criminals away for someone else to try. I'm also guessing that, until law enforcement announced his identity, the attention from the central government was probably quite low.

Probably a record of a specific contact and payment method, so something that can be used to track them down, but not as convenient as names and addresses of its members. Affiliates that were good at their jobs would probably have good enough opsec that their contact method doesn't identify them and, for those who got payments well before the raids, have probably already extracted their money and hidden again. Those who are not so good could perhaps be identified by law enforcement based on their connection to the organization.

DigiCert gives unlucky folks 24 hours to replace doomed certificates after code blunder

Well, yes, that would have been simpler, but on basically any other descriptor (better, more likely to actually get used, more functional, less frustrating, less corrupt, ...) it would have come out worse. Perhaps the only simpler method that would be anywhere close to secure is if certificates were granted by domain registries, mainly because a lot of certificates are granted because the person requesting them has DNS control. Even then, there are reasons to prefer something else.

Compared to other distros, Vanilla OS 2 'Orchid' is rewriting how Linux works

Re: chicken come home to roost

So your answer to what better thing that USB replaced is...USB? I don't think they were talking about the port shape, and nothing about USB limits how many of them the laptop manufacturers put on their devices. That's a separate issue which doesn't depend on what ports they've provided not enough of.

US border cops really must get a warrant in NY before searching your phones, devices

Re: Unfortunately

I agree that this is what should happen. I am less confident than you appear to be that this is what will happen. Partially, this is because the court does not have to reverse any precedents to confirm the CBP's exception to warrants, an exception that would appear illegal to me. It is also because today's court is quite different from the 2014 court that ruled in the Riley case. There are three judges now that weren't there before, the political situation is very different, and those judges and others have proven more willing to overturn precedents when they disagree with them.

In particular, the US has become more hostile to migrants, and it would be easy for CBP to be seen as a migrant-specific enforcement body even though it is not. A ruling indicating that noncitizens are not protected during entry would not surprise me. Unfortunately, neither would a more expansive version including citizens and extending the situations where it applies. I do not believe that judgement is legally correct, but I am less confident that this is the basis on which it will be decided.

How deliciously binary: AI has yet to pay off – or is transforming business

Re: Snake oil

This is the problem when you assume that what you don't need is also unnecessary for everyone else.

"Self driving cars are a particularly good example. We don't really need self driving cars."

Let's see your arguments:

"For occassions when we don't want to drive, there's taxis."

Unless you're traveling in a way that taxis don't want to. For instance, a long distance that isn't already covered by public transportation. Taxis work in cities, not so well in suburbs, and may not be available at all in rural places. From your comment, I'm guessing you've got access to taxis at convenient prices and wait times, but not everyone does.

"The "work whilst your travel" argument has been lost, because if you can work in the car on the way to the office one can also never leave home in the first place and acocmplish the same thing."

Unless, that is, you might have to travel somewhere and still want to work. You don't have to work while commuting to an office, but what if you have to drive out to a variety of locations during the day and could work while doing that? Or what if you want to travel to somewhere else and to do something, work or leisure, while you're doing that? I'm guessing from your comment that you mostly drive to commute or used to do so, but that doesn't apply to everyone.

The many other purposes of automatic driving weren't considered. There are many companies that want to have those for automated cargo delivery. The human drivers don't like this idea, but the people paying for deliveries would like it if it can be done more cheaply. People who cannot drive may like the idea because it gives them independence in transportation that they now lack. People who like to go on road trips may appreciate doing something else while still using their preferred mode of transportation. Families with only one car may appreciate the ability to send the vehicle unattended to pick someone up rather than having to do that work manually. From your comment, I'm guessing that none of these situations apply to you.

Be careful when you say that something is a pointless waste of time that nobody needs. Sometimes, people have different circumstances to you which is why someone is spending money trying to solve their problem. If all the things I don't like and would never buy did not exist, your life would likely be less pleasant than it is, because it is quite likely that some of those things are things you use frequently.