Posts by doublelayer

US faith-based healthcare org Ascension says 'cybersecurity event' disrupted clinical ops

Re: Because that's where the money is...

It won't do anything about the hacking. It is a lucrative hacking target because, if the systems aren't up, people get hurt. That is not changed if the government is paying for the medical services; the patients will still get hurt if important systems are unavailable. It is worth considering that another popular target of ransomware has been education, including a bunch of publicly funded schools.

The only reason it might decrease is if the ban on governments paying ransoms applies to them. The problem is that it probably won't because, even if the government is paying the hospitals, the hospitals themselves are run independently. If it would help, the problem could also be solved just by banning private organizations from paying, which I think would be somewhat helpful though not perfect.

Re: Ascension - a "faith based" healthcare organization must have better protections than most

As a nonprofit organization, they already have to. You could start with this. I probably have many points of disagreement with some of them, but I have no trouble believing that a place that has hospitals covering a third of the country has done a lot of surgeries. It doesn't mean that all or even many of those surgeries have been free, but I am pretty sure they happened.

Stack Overflow simply bans folks who don't want their advice used to train AI

Re: (What kind of person is turned on by silly little badges? Dumb scores?)

That depends on what you were doing with it. If it was something where they were answering people's questions, and you were hiring for a teaching position, that could prove that they have a passion for teaching and, if you read the posts, you could get an idea of how well they teach. As jobs go, a teaching position is probably one of the ones where SO posts are most relevant. That doesn't mean that it's necessarily useful enough to consider, but including it may not be as daft as you imply.

Re: Is it time to just get out? Past time?

"You would have gone through the same process before posting on this site. Would you be pleased if the Reg decided it owned your posts, and could do with them what they wanted?"

I wouldn't really mind. They don't, by the way, because the operative part of the terms (specifically 8.2) is a lot tighter on El Reg than Stack Overflow's terms. However, I've already decided to write the posts I make here and give them away for free, to the extent that anyone values them anyway. My feelings on how much I should own them are very different from something I've written elsewhere. While I have defended and will continue to defend copyright owners against LLM companies beliefs that their business model supersedes the law, I am less concerned when a real legal agreement exists and is valid at all levels. Those who posted on Stack Overflow did so for a reason and knew they weren't going to be paid for making those posts. They can have and express any views they have about the decision, but I won't mind my few answers before I abandoned the site being used for this purpose.

Baidu's PR head has a PR problem after workaholic social media posts

Re: 996?

They also get to choose. I have a feeling you're overestimating how common it is, but it certainly happens. The point, however, is that they are doing that because the business they decided to run will do better with it and they're willing to make that sacrifice. It is very different when I'm willing to sacrifice your time.

There are situations where I'm willing to work long and stressful hours, but I need to have a reason. Because you want me to is not an acceptable reason. Because you will earn more money if I do is also not an acceptable reason. It is time that they realize two important facts:

1. That kind of schedule is not going to help them in the long term and is probably not as useful in the short term as they think it is. It's one thing when people are doing a mechanical job and working them harder means a linear-ish increase in output. At least in that situation, it does something; it's cruel and unacceptable, but you can see why they do it. With knowledge workers, you're likely reducing their productivity to the extent that you get worse results out of them. This is even true if they're voluntarily doing it, but when it is forced, that decline is fast and extreme.

2. People won't take it. I think they are slowly learning this. A lot of corporate culture things have changed slowly but in this general direction. Employers have learned a lot that treating employees as humans helps, failing to do so is harmful to the business at first, and failing to do it for long enough results in some severe backlash.

Huawei's latest smartphone features mostly made-in-China components

The base unit with this SoC costs CNY 5500 (about £608, $761, or €706). They have more expensive versions available. That is quite a bit more expensive than some devices with faster chips. If your primary concern is price to performance, you can do better. However, there are a lot of people who don't need much speed. They're probably also better served by getting something cheaper, but that also means that having the highest benchmark numbers is not that important.

Hypothetical TSMC invasion 'absolutely devastating' says Raimondo

Re: Arizona

"Wait, so the US is getting TSMC to open up shop in Arizona..."

Yes, by paying TSMC lots of money.

"... so that the US won't have to defend Taiwan so much?"

Yes, that's one of their major goals.

"And the Taiwan de-facto government isn't saying anything about this?"

TSMC has the right to do it. I'm sure the Taiwanese government has concerns about the weakening of their silicon shield, but there's only so much they can do to prevent it from happening. It will hold for many years to come because setting up more fabs takes a really long time. Maybe they think it's unstoppable and would rather see a TSMC-controlled international industry than one built by other companies who got the subsidies instead.

CISA boss: Secure code is the 'only way to make ransomware a shocking anomaly'

Re: Devils Advocate moment.

It's worth focusing on what specifically we say cannot be done. My other comment describes what I think is a nonstarter, but also suggests lots of places where we can and should increase our standards. In short, trying to solve it with one big change isn't feasible and wouldn't work anyway, and although making lots of small systems more secure is more work, it is the possible option.

Tearing it all down won't work

There are a number of suggestions in these comments that advocate ripping out something that has existed for a long time and writing it from scratch. It's not that this wouldn't make something better if you could accomplish it, because a new OS, written from the ground up would probably be better than what we have now. There are two problems: you can't do it and it wouldn't be perfect. We do not have an environment where starting massive things from scratch is feasible. People don't want to have an operating system released four years from now to account for all the development effort required to get it working in all the places that Linux does which will need new software written to use it. They won't buy it, they won't run it. Even if they did, there is no infrastructure that will entirely prevent vulnerabilities. It's important not to let the perfect be the enemy of the good, but it is also important not to praise the good as perfect or it will end up looking bad when it arrives.

We will have to work on securing things at multiple levels. It is more work, and it is a lot more painful, but it is not something we can avoid. No secure hardware design will prevent an insecure operating system from existing. No secure operating system will prevent an insecure application from existing. No secure application will prevent an insecure administration from existing. Only by getting security at all of these levels will we get anywhere. It is not possible to do that worldwide, but we can focus on making sure the parts we interact with are as close to that as possible. This means that IT people cannot ignore their requirements to make and enforce security policies and maintain their equipment by blaming the software for allowing something insecure to exist and that software writers cannot rely on the administrators to work around the parts they didn't want to write securely.

I realize that this sentiment is as broad and difficult to implement as Ms. Easterly's statements, but I still think it's worth keeping in mind. We will not solve this problem in one single leap. We will likely not solve this problem at all, but we can at least improve our position.

Re: Mint and capabilities

"Since Linux is the most used operating system in the world on servers, mobiles and embedded devices do you think they aren't looking for security holes in it 24/7? Think again I'd say. It's just that they can't find any (or very few)."

Yes, they are, and they find them. The main reason why desktops would be different is that, to hack into a server, you generally have to find something wrong with the configuration. And they do. Put out a Linux system on the public internet and within an hour you'll have had a thousand attempts to get into it. If there are vulnerabilities in that that are already known, those thousand will try them. It's not just trying basic passwords in SSH even though those are very common. But still, you have to find your own door in. The number of Linux-compatible ransomware strains, specifically designed because there are a lot of Linux servers and that's the most valuable thing to encrypt demonstrates this.

With a desktop, you have the other method of trying to get a user to do something for you. Email them a shell script and tell them to run it. The shell script downloads a binary and runs it. No vulnerabilities needed, you now have access to that user's privileges just as much as if that was a Windows box. Of course the admins can configure the box to make that more difficult, but they can do that to a Windows machine too and they don't. If you think anything is impregnable, you do not understand security.

AWS customer faces staggering charges over S3 bucket misfire

Re: This is just one example

You can save money with cloud resources depending on what the alternative is, but it requires work. The sales pitch of it always being cheaper and you hardly have to do anything was a lie, but so is the assumption that it's always more expensive than anything you could do. It is heavily dependent on what resources you want and what you're comparing them to.

Re: Gaming the system

Given that inbound bandwidth is one of the few things they don't charge for, this doesn't seem very useful. I am charged for each put request to S3, but if I put an object there and it is a gigabyte in size, I'm not charged any more for that. I would be charged to store it, but if I simply read it and deleted it, that is very cheap. Therefore, building a protocol around free unauthorized put requests wouldn't save you much at all.

Re: This is just one example

Because we're debating about one or two servers versus cloud. A company that needs neither of those because the only employee's personal mobile phone and company email ([e-mail]) is all the communication they use isn't relevant.

Bucket names are globally unique. [name].s3.amazonaws.com. The first to register it is the one who gets to use it. There is no naming your bucket the same as mine. The first one of us to set it up gets the name. In this case, their name was evidently used as a placeholder somewhere and people didn't update it with a real address.

I don't think that's the point in the statement. This bucket demonstrates two things:

1. If you don't allow public accesses, you can still be charged for unsuccessful attempts.

2. If you do allow public accesses and an open source library uses your bucket name and people don't change it, they end up handing you gigabytes of their data. They probably don't want you to have gigabytes of their data. They have a security problem. I think this is what they were trying to say.

Ten years since the first corp ransomware, Mikko Hyppönen sees no end in sight

It isn't that hard. The two hard parts are getting IT to do it in the first place and getting the business set up so that such a mode does not negatively affect productivity. The second issue is often the largest obstacle, because no matter how much IT might demand to do it, if stuff breaks, they'll often be overruled. However, IT not wanting to is part of the problem in some cases and shouldn't be ignored.

Tesla layoff circus runs into fourth week with another round of cuts

Re: Clown.....

"I hate to point out, but if something is being flogged at substantially less than the more established competitors are charging, then it likely means they are loss leading (i.e. pricing at below cost in order to get customers)."

While that is a possibility and I know nothing of Tesla specifically, that situation can also arise when the established competitors have a nice margin and don't want to give it up. There have been many companies who charge less than their competition either because they can provide it cheaper than their competition can or just that they are willing to take less profit than their competition currently does. Charging less does not mean they're inherently doing anything wrong, not that having a loss leader is automatically wrong either.

Microsoft doesn't want cops using Azure AI for facial recognition

Re: Seriously???

The ethics committee voted down the drones as well. They were ignored, although the company didn't end up actually making them, so it kind of worked eventually.

Ten years ago Microsoft bought Nokia's phone unit – then killed it as a tax write-off

Re: Myth of charging Nokias once a week

And how long would it last when using the features? A page online suggests that that largest battery gave you eleven hours of call time, which is great compared to the 4 hours from a 1999 Nokia I discussed in a different comment, but it still limits the applicability of your numbers.

It's hard to figure out how much per-day calling you could get because I don't know how much it drained in standby mode, but we're talking at most 20 minutes per day and likely significantly less. Maybe you just needed the ability to call but didn't use it much. However, a lot of people used a lot more calling than that, either because they received or made business calls on the thing or they just enjoyed talking to their friends. If they did, I'm pretty sure it didn't last a month.

Re: Myth of charging Nokias once a week

I tried an Android device provided by an employer with a different low-power configuration: screen off, no apps in use, hotspot on broadcasting a WiFi signal, three devices connected to the hotspot for 24 hours a day, transmitting over the data connection frequently. It lasted five days. When I turned the hotspot off and didn't use much other than messages and MFA apps, it lasted two and a half weeks. So this probably varies based on the device, but it does happen.

Re: Myth of charging Nokias once a week

That might have been true of Snake, but looking up some specs from the time, it probably wasn't true of calling. The Nokia 3210 from 1999 advertised a talk time of 3 to 4.5 hours. That was sales time, so I'm inclined to divide it a bit, but let's take that at face value. Every smartphone manages a lot more talk time than that unless the battery is seriously broken.

Re: Stupid execs

"They only had to stick to Symbian and its large install base instead of trying out 4 other platforms who never ever took off..."

That doesn't work forever. Eventually, people want new features and if one manufacturer isn't providing them, they'll buy from a different one. This is especially true for things that don't have much connected to them. Switching from Windows to something else means finding new applications. Switching from Symbian to Android only meant that for those users who had many applications running on their phones, and while some existed, there were fewer of them and fewer people using their phones for such things than there are today. That means that a lot of users looking at the two only had to consider learning a new interface when switching.

UK inertia on LLMs and copyright is 'de facto endorsement'

Re: Robots.txt says hi

The point is that robots.txt is trivially ignored. It is not the responsibility of companies to try to put in rules there to prevent other companies from breaking the law, and doing so does not prevent those companies from breaking the law. Robots.txt is a nice mechanism to prevent search engine bots from doing something stupid and abusing your resources. Otherwise, it's not very useful at all.

Re: Robots.txt says hi

Because these companies have demonstrated that they definitely care. When, for example, there is a paywall in front of it, which is much stronger than robots.txt, they bypass it anyway. What makes you think that a simple rule in that file would do anything, especially when the copy they absorbed was obtained from a site where you don't control that file anyway? Some of them have said that they respect robots.txt for the general web crawls. Let's assume we believe them. It doesn't apply to extra datasets like books 1-4 or probably more at this point or the dedicated news ones. You know, the datasets where most of the copyrighted works are.

Let's see an example. From nytimes.com/robots.txt:

User-agent: Amazonbot

Disallow: /

User-agent: anthropic-ai

Disallow: /

[...]

User-agent: ChatGPT-User

Disallow: /

User-agent: ClaudeBot

Disallow: /

User-agent: Claude-Web

Disallow: /

User-agent: cohere-ai

Disallow: /

User-agent: DataForSeoBot

Disallow: /

User-agent: Diffbot

Disallow: /

User-agent: FacebookBot

Disallow: /

User-agent: Google-Extended

Disallow: /

User-agent: GPTBot

Disallow: /

[...]

So we should be pretty assured that the New York Times has no articles in the training data, right?

Got an old Raspberry Pi spare? Try RISC OS. It is, literally, something else

Re: OS on UV EPROMS

Of course you can implement them, but something isn't object oriented unless it has already implemented them for you and uses that paradigm to do things. I can easily make object-like things in C. C is not object oriented because other things don't use that model and the work to build it has to be redone. C++ took C and bolted on object orientation, so it is an OO language.

For the same reason, I can't say that AMD64 is binary compatible with ARM because, using nothing other than AMD64 assembly language, I can write an emulator for ARM assembly language. Unless it's part of the native design, that's not how it works. From the sound of it, there is no object-oriented desktop in Risc OS, and such a term is kind of weird in the first place. It's especially weird because neither of the languages used to build Risc OS are object oriented. If I had to find an object-oriented desktop, something like NeXTStep might actually fit.

Some scientists can't stop using AI to write research papers

Re: A solution maybe?

For me, it would be much slower. I don't think there are many people who are using LLMs in this way. However, if there are people doing that, there's nothing wrong with their resulting work. I could conceive of someone who is not confident in their writing skills trying this intending to do as I've described, though I expect that even those people will often give up in disgust when trying to edit properly and go back to writing themselves.

I think those who have made the rules calling all use of AI misconduct probably feel similarly, but I also think they're not trying to enforce it at that level. Their regulation is likely aimed to make sure that someone who is exposed as having submitted a flawed paper can't get away with blaming the AI for the problems in it. I'm not convinced that they ever could get away with it, but formalizing that isn't surprising.

Re: A solution maybe?

I'm not sure it matters. The problems with AI are not things that a well-meaning user hits. If you are writing a paper, use prompts to an LLM to aid in writing, then go back and meticulously* analyze every sentence to make sure that it never says anything your research didn't show, then you're fine. The problems come when the LLM is used because the writer no longer cares about accuracy and just wants something that looks convincing. It doesn't matter that they're using an LLM instead of a ghost writer or even their own effort to write about fictional research. The only difference is that faking papers to that extent used to be hard and now it's trivial, so you'll see a lot more of it. Hacks like banning the use of AI to write papers are trying to make this point. What is misconduct now is the same kind of thing that was misconduct before.

* This comment had no LLM input, meticulously nonetheless.

Lights about to go out on US Affordable Connectivity Program

Re: Solving the Wrong Problem

I don't think that's the problem. If you don't use the internet, then what communication method do you want to use instead? Voice calls? Faxes? SMS? Paper mail? All but the last one require similar infrastructure to an internet connection, and the last one is generally more expensive than anything else. I'd also point out that the internet is one of the least proprietary of those options given that nearly every part of it is an open standard, implemented with open code.

I don't think you will solve the problem of people not having internet access by trying to pretend that it's not important technology to the way we live life today. People without it will at best be rewinded to a 1980s-style experience, and if you're serious about mandating that everyone has a non-technological communication method, make that a 1940s experience. Helping people have modern technology is more likely to assist them than trying to pretend that it isn't useful.

AI Catholic 'priest' defrocked after recommending Gatorade baptism

It could be that they paid someone to plug in prompts to a couple chatbots until they got one that didn't forget its role immediately. Lots of bots essentially take an existing bot, prime it with something like "Pretend you are a priest named Justin who believes in the Catholic Church's teachings and wants others to do so", then just make sure that they start all conversations with that. A bit more prompt engineering time can add necessary statements like "Don't say you hate types or classes of people because you are trying to be convincing". I wouldn't be surprised if that's what they spent the ten thousand on and that they probably could have managed it for less.

Open Source world's Bruce Perens emits draft Post-Open Zero Cost License

Re: define your freedom

You've misinterpreted my comment, mixing something Bruce Perens said (in quotes) with something I said. I was quoting his comments which you can read in more detail in this article. The effects of the license discussed there are, in fact, specifically applicable to companies. It is also specifically mentioned in the Open Source Definition:

The license must not restrict anyone from making use of the program in a specific field of endeavor. For example, it may not restrict the program from being used in a business, or from being used for genetic research.

I understand that you don't think corporations should have the same rights as individuals in such licenses. This means you will probably support Perens's current plan more than I do. It does not change the fact that open source licenses do not, and by the OSD are not allowed to, discriminate against companies. Post-Open licenses can and will, which is one reason I oppose them.

I can also tell that you're trying to bring corporate personhood into this. If I did, it wouldn't help your case as it is a generally used legal construct, but it is not part of my argument anyway. We can disagree about this and it sounds like we will. I just hope that you can understand what my opinion is and I yours, including the references I have made when making my arguments.

Re: Very interestingt

We could do that, and there are some examples where we have. There are some open source programs that have been widely adopted. I'm thinking of things like Firefox, Signal, Audacity, etc, where they have been designed so that the average user can use them and they have been adopted by many people in the general public. Firefox may no longer be the most used browser, but it's still used by a lot of people and doesn't take technical knowledge to run.

Getting people to build with that in mind is a challenge we should face, and it is more likely to happen if those people are effectively told to do it, which usually means paying them to do it. It doesn't work as well if people only do what they want. I know this firsthand. I've written a program which only has a CLI interface, and I know there are at least a few people who don't know how to use that, don't want to learn, and would like a GUI. But the work of writing a GUI for this is quite a bit (this program has a bunch of parameters and several of them have special parsers, so a simple form is not going to be enough). It is plenty of work for me to do and it isn't interesting, so I haven't done it yet. I know that, if I want the general public to use this, I'm going to have to get over that and actually start writing that bit.

What I don't see is how this payment model will actually encourage anyone to do that. It doesn't pay people specifically to design with the average user in mind. It doesn't exclude people who only write for technical users. Quite importantly, it doesn't help convince people to run the thing if the devs did make it easier to use, and another reason why we don't always design with that in mind is that not many average users will run it even if we did because they don't want to do the small amount of extra work that our version would necessarily have over a managed version. Consider LibreOffice. For a lot of people, this can do all the same things as Microsoft Office can. Some exceptions may exist for some power users, but for the average student, there is no important difference. I don't have Microsoft Office on my computer. I've told people about this and showed them what I have. Still, I have been asked to help them find deals on Office licenses, and when I showed them the options, they preferred paying for a non-subscription license rather than using the other version for free. This was not because LibreOffice wasn't capable of doing something; they never tried it and I know that it can do the stuff they need done. They just valued the relatively cheap price over their idea of what learning an alternative would require. If we want them to adopt an open source version, we will have to be able to explain why they should. License details won't change this.

Re: Very interestingt

I agree that we should try to fix this. I don't think your solution does, and from your statements, I'm surprised you think it does. The problems of paying developers and causing them to write user-focused software are quite independent of each other. If I'm completely wrong and the Post-Open license is a global success, it will pay developers for their work, but it won't do anything to make them write their software differently.

If you want to make open source software more popular among the general public, then you have two problems to solve:

1. Somehow get the average computer user to understand why open source, or proprietary but we try to pretend it's the same, is better than using what they already have. Your primary asset will be privacy. Your primary liability is that they will now have to pay for it (at minimum, they'll have to pay for servers where necessary and more powerful equipment where the current software would outsource to the cloud). If you can convince the general public to embrace privacy, I'm all ears. I've been banging my head against that wall for a long time, and I'm likely to keep doing it, but I can't say I've made much progress.

2. Convince developers to do the boring work making their software more user friendly. You can't count on companies doing this for them. Companies could have improved any number of applications, but few of them chose to do so. You could just ask them, but I don't think that's likely to get as much support as you'll need. My suggestion here is that you make an actual company where you pay them to do it, then try to sell the resulting software or, if you're making real open source, the hosting thereof. If you can solve problem 1, that will work fine. If you can't, it's likely to fail. I've seen a few people fail at this mission before. It hasn't stopped me from considering trying to do it from time to time, but it has stopped me from actually quitting my job to found a company competing with big tech with more expensive products.

Re: Very interesting

Depending on how you try to do it, they may be mutually exclusive, or rather they may torpedo each other. Let's use an example I mentioned: Jitsi for video conferencing. Someone replied saying that they considered and rejected it because it wasn't good enough. Fair enough; they were probably considering it for actual work purposes whereas I was setting it up for an early pandemic situation where many other things were overloaded. It looked fine to me, but I wasn't trying to run a business from it. Let's say that we relicense Jitsi under this new license. The main effect will be that nobody ever uses it again.

A business can adopt Jitsi now. If they don't like what it does, they can pay someone, either their own employee or one of the original devs, to fix that problem and keep using it. Or they could just live with it. If they have to pay 1% of revenue for this, then they have to compare it to the alternatives. Teams does not cost 1% of revenue. Google Meet doesn't cost 1% of revenue. Nothing costs that much. Your version is now extremely more expensive than anything else. The money that's supposed to make the post-open version better won't show up because the proprietary ones are both better and cheaper.

This also raises a philosophical point. If someone made this post-open videoconferencing tool, why is that any better than a proprietary tool? Open source is better in my mind because of the freedoms it provides me. Some of those freedoms are already explicitly lost with a post-open version, and I don't see how most of the remaining freedoms will last if this takes off. It no longer works as a community effort. It's just another proprietary product with more onerous license terms. There are few differences in practice between a post-open product and all the other non-open "you can give us your code for free and we can still decide not to let you run it" licenses.

Re: define your freedom

The quote was also considering corporate requirements. So have all the open source licenses. It's been clear from the start that individual use only would not qualify. Maybe you think that is wrong, in which case you are free to write a different kind of license, but there is a reason why I don't support those.

Re: Very interesting

As I understand it, the rules work as follows:

1. Company earning less than $5M, using the code but not in a product: no payment.

2. Companies under $5M: using in a product: 1%.

3. Companies above $5M, using the code anywhere: 1%.

So it sounds like the medium-sized company using it internally would have to pay around $50k per year for their internal use. This is why I don't think it will be accepted. Companies will get near that threshold and either hide the fact that they're using it or go find something else.

Re: Doesn't go far enough in some ways, goes too far in others

It looks like the original commenter understood that and thought that was a bad idea. I think that's one of the only good ideas in it, so I won't be arguing their point for them, but I don't think your clarification did much to counter their statements.

Re: Who will benefit?

Even though I oppose this license quite strongly, I don't think this is a major concern. Getting small amounts of money may complicate tax filing, but it also gives you extra money to help deal with that problem. If the amount of the payment is so low that you don't care, you are free to decline the money, not receive it as income, and therefore not have to file. How much it adds to the difficulty of calculating your taxes depends on what country you're in, but for most situations, it's one number added and one piece of paper. I don't think developers are going to have too much trouble figuring this out.

The noncommercial use only tools are a valid concern, but I wonder how many developers are relying much on these in their work. A lot of development tools are already open source, so it doesn't apply to them. If the expenses would end up being more than the revenue from doing the work, then the developer has the options to find a tool that doesn't impose that cost or to decline the money so they're noncommercial again and can use the tool. While I don't think people would do that for tax reasons, if the tool prices were more than the revenue, they might.

Re: Pay who first?

The context of that sentence means that, of the two mentioned groups: artists and stockholders, the artists get their money first. You are right that other debt would get paid before artists, but the artists payments, if any, would come before any payments to stockholders.

Re: Very interesting

The sales pitch of "I can remove your $7 million license department and all it will cost you is $3 billion per year" doesn't sound like it will convince many companies, especially because there are two reasons why their license department probably won't get any smaller at all:

1. I'm guessing that simply paying the assigned amount to the organization isn't enough and a listing of used projects and some way of figuring out how important it is to the company* will be needed to distribute funds as fairly as possible. Someone needs to track and report this. That sounds like the open source compliance department.

2. There will still be lots of software that is still open source, so the compliance department still needs to exist to deal with that.

You know this better than I do, so maybe I'm missing something.

* I assume that funds will be allocated based on how much a given project is used in the company, meaning that my 200-line library which I got someone to include in one rough internal tool won't receive as much money as the million-line project with critical security requirements used in hundreds.

Re: Very interesting

"Big firms don't like change - give them a choice of paying out some money or writing their own version of libz or openssl, they're going to pay up."

I don't agree. For example, when Elastic switched their license to a non-open one so that cloud providers couldn't use it anymore, AWS could have opened a negotiation, figured out how much to pay, and given them the money to keep hosting Elastic Search. They could have afforded that easily. If Elastic tried to bargain too aggressively, AWS could have just bought out the company. The recent sale to IBM is about the same as one year of 1% revenue collection. Amazon could have owned Elastic entirely, meaning that not only do they not have to pay any more fees, but they could start to collect them from other cloud providers instead. Amazon did not choose to do either of these things. They forked and supported it, allowing other contributors to help them, but still taking on plenty of extra work requirements. They did this because it costs less to pay some people to run this, including some of the people who contributed back when they didn't own it, than to buy or license it. If the price is high enough, companies will choose work over money, and 1% of revenue, while it looks small, really isn't.

Re: Very interesting

The fee is supposed to be 1% of revenue, so the cloud provider, unless they are also making only £4M, will be paying more. As I described above, I think that will mean that cloud providers end up making sure that projects like this are not used in their systems and their doing it will make sure they're not used in lots of other ones as well.

Re: Very interesting

So go proprietary. We already acknowledge that public good by having copyright, and it's a lot longer and more powerful than patents. You can write whatever you want and sell it to anyone you want. The one thing you shouldn't do if you want to sell something is give it away first.

I've written code as open source, but I've also written proprietary stuff. There have been projects where I thought I might be able to sell them and that I'd rather do that than let anyone use and modify it for free. Advantage: I could get paid, and not through external schemes but for the work I'd already done. Disadvantage: I wasn't going to get free work from contributors or the free publicity from lots of users picking up the free version. I was free to decide how I'd sell this. I could let the buyers see the code or keep it private. I could let buyers modify the code or block them. But it was still proprietary, because in order to make sure that I could sell it, I didn't grant anyone a license to use, modify, and distribute the way that I do when I put an open source license on things. If they wanted to use it, they had to pay me for the privilege and it would come with more restrictions.

Re: Very interestingt

"The problem is that our developers make software for themselves and people like them. How do you get them to make apps for the common person?"

I don't think this correctly describes what exists. There are a lot of open source applications out there that do the same things as proprietary ones. Since you mentioned Google, I can think of very few things that Google has that there isn't an open source alternative to (mainly Search). People choose to use Google Meet instead of Jitsi or something like it because Google Meet doesn't require you to admin a server, do manual account management, or pay for bandwidth. People either don't understand the privacy differences between them or don't care, but the problem isn't that an open version is unavailable. The same thing applies to Docs and the online version of LibreOffice from Collabora, Maps and OSM-based software, and on and on.

Re: Very interesting

It doesn't run any interference. It isn't intended to. All it's intended to do is to get money from corporate users and hopefully return it to the developers, which I don't think it will actually do.

However, I am less concerned about the things that you mention. I already have a form letter for requests to add something to an open source project that aren't on my plan. It tells them that the suggested feature is not on my roadmap, that it is open source so they are free to contribute, and that I use a variety of methods to decide what is worth my time to implement it. Essentially, I tell them that if they want me to write something that I don't plan to write, either they provide me convincing evidence that a lot of people would benefit, they provide me with money, or they do the work. I will usually review their idea a bit so that, if it's something I won't merge, I can tell them ahead of time. If they have sent a request, they'll usually get something like that.

If they threaten me, they won't even get that. I do not respond well to threats. I haven't had the same experience that you have because I've received very few abusive communications. Those I have received have been from individuals, and I've informed them that I consider their messages inappropriate, and if they keep sending threats, add an email rule to automatically delete them.

Re: Very interesting

I think one central disagreement we have is this: "If you want to get paid to make Open Source". You may want to be paid to do all sorts of things which doesn't guarantee that you will get paid the amount you want. One of the downsides of writing open source is that others can take your work and use it without having to pay you. They might, and you can do things to encourage it, but you don't have any guarantee of that specifically because I have the freedoms to use it, modify it, and distribute it without having to do something for you or get your permission. The alternative is obvious: proprietary. You write the software, you sell the software, you get money. People who try to pretend that these two can be merged end up making something that looks and works a lot like proprietary software, then try to claim that they're operating in the same spirit as actual open source authors. They are not.

I don't think I'm telling you anything you haven't seen before, in fact anything you haven't argued a lot better than I have. For example, I can refer you to this article. This includes comments from the OSI and from you about claims of something being open source when it's not. I don't think you're claiming that this new license would be an open source one as it obviously isn't compliant with the OSD, but I think it's also harmful to try to claim it's even slightly close to the spirit. If you think the original open source idea has failed, fine, but make it obvious that this is a third, unrelated, path so real open source isn't damaged as badly if any of my concerns expressed above prove valid.

Not a Genius move: Resurrecting war hero Alan Turing as your 'chief AI officer'

Re: Erm...

As others have explained, there are some cases where there are legal rights to use an image or likeness which I'm guessing this company has not bought. However, the situation is more basic than that. Even if they do have a legal right to use such things, they should choose not to. Whether or not their actions can land them in a court and be ruled illegal, they are, in my opinion and I think those of others here, unethical, in poor taste, and bad ideas. You are allowed to do something that is all three of those, but it would probably be best if you didn't.

Re: What does the "C" stand for . . .

Of course it's more complicated than that. If I buy a car and it has a faulty brake system where, after a year of driving, the brake stops working and accelerates the car straight into whatever is in front of me, you don't blame me for having chosen that faulty car. The blame goes to the manufacturer who built it, and the consequences for them will be different if it's something they knew could happen or not. If I messed with the car and broke the brake, then it does become my fault. The software running the car is not something the average driver controls, meaning that there are plenty of reasons to hold the manufacturer, not the owner, responsible for failures that are entirely due to software malfunction.

The money that will be spent will actually intend to implement your decision, as it is the manufacturers who want to make sure that, if their software proves unsafe, they're not the ones who have to pay. There are situations where putting it all on the manufacturers is unfair as well. It really is a complex issue that needs more discussion and regulation.

Re: What does the "C" stand for . . .

Not really, though it could be brought up. If it relies on any laws from the original country, it is not a valid precedent, and if it is counteracted by any laws of the new country, it would hold no relevance. However, there are some cases where one common law country does consider common law decisions from other ones, so it might be considered if a similar case was brought up in the UK or US. There is a reason to think that courts would decide the same thing independently just because there's no logical alternative of what to do.

Elon Musk's latest brainfart is to turn Tesla cars into AWS on wheels

Re: WTF? This is meant to be a tech site - why is nobody saying...

El Reg hasn't gotten it wrong. There is compute capacity, and they haven't attempted to quantify it. We know that the total of all the computers in Tesla vehicles everywhere would make a relatively powerful parallel computer. Thus, there is capacity. The only problem is that the computers aren't Tesla's to sell, you can't actually use them as efficiently as you could a set of servers in a datacenter, actually trying to use this would put a lot of wear on parts of the car, the power usage would be much less efficient and would lead to problems from users who don't need to waste their electricity on this, and about twenty more things. So El Reg isn't wrong to say that there is a lot of compute capacity, nor are they wrong to explain why it isn't as useful as the raw compute numbers (which they don't have) would make out.

Google pulls RISC-V support from generic Android kernel

Given how many Chinese companies design chips around ARM cores, then manufacture them, then write the software that runs on them, I don't think that's the reasoning. China can, whenever it wants, stop paying ARM for licenses and still crank out as many ARM chips as they want. I'm sure American politicians will figure this out in time and make statements about how they'll prevent them from doing so which will have about as much success as their desires to prevent them from using RISC-V, which is about as much if they announced that they will be banning them from using iron.

Meanwhile, to keep the code in the project means plenty of developer time spent testing and fixing these things, all for hardware that doesn't exist. It's not surprising that Google wants to wait until their work is achieving something before they take on the effort of maintaining it. Almost certainly, if Qualcomm starts to make RISC-V phone chips and gets someone to build a device around them, they will merge plenty of changes to account for how their version differs from the theoretical version. When they're done with that, Google can merge the important ones back into their project rather than trying to do that continuously. The effect of the delay to end users will be unnoticeable.