Posts by doublelayer

X/Twitter booted out of Australia's disinformation-fighting club

Re: False premise

They don't need a local office to be collecting revenue. They have two major sources, both of which are available in Australia. That would be payments for advertising and anyone who subscribes to the various levels of check marks. Those payments, coming from Australians, have to go somewhere, and if they're going to be flouting Australian law, Australian law enforcement can act to confiscate or block those payments. Twitter could simply shut down their entire business in Australia, or they could operate the discussion part without any of the parts that bring in money, but I don't think either is that likely. Of course, people can go around an Australian attempt to confiscate payments, but few would. I think the most likely outcome is Australia not actually doing anything to collect on the ever-growing fines, but if they decided they were willing to go to some effort, they could be successful.

Tesla sues Swedish government after worker rebellion cripples car biz

Re: Postal Service

If I had to guess what they are asking, I'd hypothesize that they disapprove of specific targeted strikes. This is less common in various countries, where workers strike, not against their employer, but against somebody else they don't like, for example the postal workers refusing to deliver because they don't like Tesla but they don't have any strike against the postal company going on. I'm not entirely sure that's what they were saying, but it is my best guess.

Re: FFS

Are we reading the same article? The unions are targeting Tesla. That's the entire point of what they're trying to do, hence why they're not delivering license plates specifically to Tesla, not anyone else, and a different union is only refusing to unload Tesla vehicles. So when he says that Tesla is the target of the union's actions, he's completely right. Not that he does anything right after that bit, but that part of his statement appears undeniable. This makes me wonder why you express a different view. Did one of us miss an important fact here, or are you making a point I'm not understanding?

AWS plays with Fire TV Cube, turns it into a thin client for cloudy desktops

Re: shuttle to mission control SAY AGAIN

Presumably, they are set by the company admins before they dispatch the device to its eventual user, not by Amazon before they deliver it to the company. Therefore, the user would not need to set them when they start it up, and time from receiving the device to logging in would be short. At least, that's what I think they were saying.

I can't really see why a business should bother. You can run everything on a $100 Android tablet, but not very well, which means you'll probably end up outsourcing some of it to a remote desktop somewhere. If you're doing that, why not spend slightly more on the computer and have most or all of that run on that instead? Similarly for the choice between a tablet and a laptop. Why use a cheap tablet and separate peripherals when, for around the price of all that stuff, you can buy a laptop which has all of those and is more easily transportable?

I imagine that any cost savings on the hardware will be wiped out by getting all the software to run well in an Android environment and more frequent hardware replacement. I, for one, do not want my business software running on the average Android tablet running who-knows-what software, no security updates, and no ability to apply a reasonable corporate standard to the above. Not to mention that many businesses are willing to buy laptops, Windows, Mac, or Chrome OS, that are much more expensive than they really need. If they're willing to pay 50% more than they need to, maybe the cost savings on a one-off purchase for several years isn't very concerning to them.

Re: Er, is this article 15 years old ?

But Amazon wasn't building them then. It's not that the concept is new, just that another company has decided to make them, and maybe they'll have more success as they also provide the remote desktops and surely somebody must be running them. Meanwhile, I've worked at companies using AWS but they aren't using AWS-located desktops any more than anyone was using Microsoft's Azure remote desktops.

Videoconferencing fatigue is real, study finds

Re: Landlords

You had to make some large unsubstantiated assumptions in order to reach your predetermined conclusion that their study must be wrong. If you read it, you might be able to come up with reasons it's bad that sound more plausible, and if you read in detail, you might even find a real flaw with it. From a glance, I see a few possible complaints that would have held water. It's a lot harder to spot on an online forum than when you completely make it up, like you've just done.

Re: "the video version also impacted nervous systems"

In my experience, watching someone else and being watched myself are pretty different, even if I'm watching someone else while I'm being watched. There is a similar difference if I'm participating in a meeting, where I'm supposed to be doing something, and watching something passively, where if I stop paying attention then at worst I have to rewind it a bit.

Comparing watching television or online videos and a video meeting is not going to get you far.

User read the manual, followed instructions, still couldn't make 'Excel' work

I've had the more limited version of this, where the computer acts like a modifier key (it's never a normal key for some reason) is stuck down. The key is not stuck down. Pressing it once somehow unconfuses the computer and returns the keyboard to normal functioning, but for a while there, every letter you press is now executing some keyboard shortcut. This can leave you in a weird situation if you type quickly enough to rack up a few of those in sequence. I assume this is a hardware cause as it's not been limited to any OS, and it is compatible with the keyboard dome getting stuck somehow, but maybe it's our machines showing their mild revenge at how many times we blame them for our own mistakes.

This was a generic example, but look at it. Does this sound like product documentation? It looks a lot more to me like the documentation of an internal process. Yes, it would be nice if internal processes never had bugs that the documentation worked around, but it's much more acceptable there than in a released product, since the people using it can be required to follow the procedures.

In addition, the example phrase was a bug. It could have been anything else: instead of crashing, the "general type" or whatever we want to call it is undesirable but needs to be left in for some edge case. Or it is one phrase that refers to something outside the interface you're working with in the middle of a lot of text that all refers to that interface, so a reader assumes that everything they are doing is located in that interface. Basically, if there is some detail whose obviousness is significantly lower than the other details, it can help to accentuate it. When the details it's mixed with are extremely obvious, it can be logical to remove them and only state the nonobvious ones.

I disagree about the docs being identical, because if you actually do know what you're doing, it gets really annoying having to read through too much obvious stuff.

To make a new image, open the main interface, click on "Image", then click on "New". In the "Image Name" box, write the name of the image. Image names should be memorable. Set the scheduled build date for the image. If you want to release the image immediately, you can click on the "Now" button. Otherwise, set the day, month, and year to your release date and optionally set the time using the hour and minute controls. If you don't set the time, the image will be released on midnight of the date you selected [which the hour and minute box say]. Select the image location using the "Location" control. [Five more paragraphs of this]

After a while, you either skim or skip it entirely, and that means you miss the line in the fourth paragraph that says "When you're setting the image type using the Type control, selecting the General type makes the resulting system crash". Meanwhile, concise documentation for people who don't need to have every label repeated can just say "Create an image. Do not select general as the image type as that causes a crash."

Do we really need another non-open source available license?

Re: "source-available" or other semi open source licenses

I don't think we're reading the article the same way. The article is talking about open source licenses, including the GPL, which do not restrict your use of the software. It is also talking about semi open source licenses, like the FSL and BSL, which do restrict your actions. That is what I see the writer saying, and it agrees with the definitions with which I am familiar.

You have unilaterally defined GPL as source-available, even though the definitions the writer is using would categorize it as among the open source ones, not the source-available ones. I agree that the tendency has been to provide binaries, but nothing says that anyone has to and there are many projects where building it yourself is expected. And although GPL and basically every license allows you to sell it, one of the points of open source is that the user has so many freedoms that relying on being the only one who is allowed to sell it is not an option.

Re: "source-available" or other semi open source licenses

The part about not being allowed to use the software in a way that competes with the business. It's in this license. It is not in the GPL V3, AGPL V3, or any other version of the GPL, AGPL, or LGPL. That's the difference, and that's the point we're all discussing.

Re: Financialisation versus origination

That article is not the only source on what open source means. One major source is the licenses that implement it. Commercial uses are specifically mentioned in them.

"Use of open source without paying its contributors can be viewed as wage theft in the UK, however, there seems to be no appetite for regulators to enforce law nor I am not aware of any contributor taking companies using the software to court."

The reason they don't is that it's not wage theft unless you have some agreement that I'm owed wages. If you use the code I made available for free, I am not owed wages. If I do some work that is useful to you, but you didn't agree to pay me for it, I am not owed wages. I am owed wages when we've agreed that wages are to be paid or when I am mandated to work. Neither applies if a company uses available open source or if someone contributes to their open source software.

Re: "source-available" or other semi open source licenses

It's not. It's considered a fully open source license, at least based on the OSI definition. Things like the BSL do not comply with that definition, but you can see and modify the source, so that's why they categorize that as semi open source.

Re: Financialisation versus origination

Basically everything you said is wrong.

"Open Source has always been about free for personal use."

Most licenses, the ones that go back decades, specifically include the fact that you can sell the code, you can sell the use of the code, and various other clearly commercial rights. It's not new. They restrict how viable a commercial product can be, since you can't be the only one to sell the code, but they very clearly include it.

"Rather than taking an apprentice, they can publish "open source" project and let the public contribute. Then often if they like the work of some contributors they offer them work."

This has a right and wrong part:

Right: This is a way to get free work.

Wrong: There's any problem, legal or moral, with that. The only free work they get is from people who deliberately choose to do so. Nobody is making anyone do that. If nobody is interested in solving their problem, they don't get their problem fixed. They can hope that someone comes along and takes a liking to their code and they can snap that person up, but if that's their plan, it's not going to work too well.

Re: Isn't there an obvious flaw?

Yes, that can happen, and it has for most of the big cases. Amazon forked Elastic's products and made OpenSearch. Terraform has been forked to make OpenTofu. Basically, the quick switch to proprietary is not necessarily going to bring the cash the companies want, but it is virtually guaranteed to cause chaos in the community of users and contributors who now have to decide which fork to use. In Elastic's case, they deliberately introduced breaking changes to try to prevent OpenSearch from being compatible with their version, which caused some extra chaos for both projects.

Re: If Only

No, people don't see that as non-free, as it's trivially accomplished by not having a contributor license agreement that reassigns copyright or gives unrestricted rights. Linux, for example, doesn't have the copyright to every part of the kernel, and therefore can't change the license without some difficult effort. This might lead to a backlash against CLAs. At one point, a CLA made some sense because it allowed a central project lead to control the project even if you, the part-time contributor, got bored and left. Now that the concern is that the central project lead will switch to proprietary, giving them that control seems less desirable.

Re: "proprietary gatekeeping wrapped in open washed clothing"

"Nobody paying attention will run along with this. This is just Big Capital pulling the wool over the unwary."

The concern is that it will spread. When someone announces something open source, there's no way of knowing whether it's about to change license or not. If there's any corporate structure, then someone could buy or otherwise gain control of it and completely change the terms. If people start to avoid anything that looks too much like a company making open source software, you run the risk that larger open source projects get fewer users and developers. While it's always been possible for open source software to die, it usually happened by a slow loss in continued updates rather than an overnight switch to proprietary.

Author hopes to throw the book at OpenAI, Microsoft with copyright class action

Re: Zzzzzzzzzz

From the claims in the court case. If they had purchased a book, the case would have said something like "Defendant purchased a book but used it for purposes we believe do not qualify as fair use", but it doesn't say that. Their case agrees with the "we don't think it qualifies as fair use part" but includes the additional claim that they didn't purchase a book, and we know from many previous cases that they didn't purchase anyone else's book, so there seems to be no reason to expect that they'd have made an exception for this one. Of course, OpenAI is free to prove otherwise, in which case that part of the claim can be immediately dismissed. Do you see them making that very simple statement and getting rid of that claim? I don't, which suggests that they cannot.

Re: So what about all the students reading books to write papers?

The argument is that reading a book as a human and processing the book in a process called "training" aren't the same thing. Thus, just because one is acceptable doesn't mean the other is. It gets philosophical when we start to ask what the model is really doing with the text it is ingesting, but it should be clear that I can't use whatever copyrighted information I want just by calling whatever my program is doing training.

Remembering the time Windows accidentally sent Poland to the bottom of the sea

I think you need to look at a time zone map.

"Most of Spain is West of the Meridian."

True, and some parts use UTC+0, but most of it uses UTC+1.

"Portugal is the same longitude as Dublin."

And it uses the same time zone as Dublin. WET, UTC+00:00 during standard time. Exactly what you'd expect it to use.

"Greece, Romainia, Bulgaria are really in +2."

Oh, I should call them and tell them they have to stay there, then, because all three of those countries are already in +2.

In trying to prove a point that the EU insists on a single time zone, which it doesn't, you missed that all but one, if we're being charitable, of your examples are simply wrong.

Re: Rome or Vatican?

Of those states, one of them is not just a city, but a city and surrounding area including several islands without urbanization yet. It is a state that only has one real city in it, but not a state that's entirely enclosed in a city. Another is a state that is entirely enclosed in a city, but that city is not enclosed in another city, which is what they were talking about. So there is only one state that fulfills their criteria.

Your password hygiene remains atrocious, says NordPass

This was their method of advertising their services. They find some data about how bad passwords are, which is basically the same data as last time an article was written about it, but this time they get to have their name as the password manager company that suggested it. That's all they did in this case.

Re: For best results, use a password generator that can give you a long, random string"

"The most fundamental rule that is not being imparted is:

a password is not to give you access -- it's to deny access to others, so don't make it obvious.

But I've never seen that stated plainly in any password policy I've seen over two decades of consulting."

I didn't think we had to, since that seems rather intrinsic in a definition of a password. I think users know what a password is for. They either don't care as much about the desire to make it secure or don't understand how password security works, and the latter is a point on which we can help, but I think they understand why they've got one.

And you assume that they're providing their customers' passwords why? Did you read that in the article? Did you read that in their statement? Does it make any sense whatsoever, given how password managers work?

They didn't.

Re: What about sites that force you to make it easier?

I usually assume the worst with sites like this. One reason this could happen is that someone copied and pasted some validity checking code for no reason, but the most plausible reason I can come up with is that the password is stored raw in a database and they're worried that some characters will mess up an SQL statement, meaning the service is vulnerable to SQL injection and has my passwords in plain text. Maybe that's not true, but if I see those requirements, I assume that they hold and act accordingly.

Re: Streaming Passwords

This is true in my case. If I expect that I will have to enter a password on something with an annoying input device, the password is likely to look something like hzycdkbkfamxptdjdl. Length makes it secure, but by having no characters that aren't on the lowercase keyboard, I don't have to keep switching layers to enter it. This is, of course, if I have the luxury of encrypting it and looking it up only when needed. I imagine that people who have to enter it frequently or share it with others don't bother with that either.

LockBit redraws negotiation tactics after affiliates fail to squeeze victims

Re: You write this as if

"personally I don't think we should blame the victims for making sensible business decisions."

This is where we diverge. I have a problem when people blame the victim for their misfortune, but that's not the same as making a decision not to do something that harms them. If they decided not to install fire suppression equipment in their room full of flammable stuff, then I won't have sympathy for them if it burns down, and I think it is their fault. It doesn't matter that they thought it made economic sense not to have that stuff set up.

I don't blame the companies for having ransomware installed. Theoretically, they could have taken some other step to prevent it, but they're fighting against an active adversary who is trying to get around that, so their failure isn't automatically their fault. I don't blame them if their backups were lost because the ransomware operators were diligent about finding them; while I'd like if everyone had so many backups that it would be impossible to do that, not everyone will. I do blame them if they knew about the benefits of backups and decided not to bother having them. Not that I suggest doing anything based on that blame, but if the question is whether I feel sympathy for their plight, the chances are much lower if they knew the risks and chose to ignore them.

I'm not sure it's as simple as email addresses rather than an internal communication system, but either way, that's a good target for investigators to go after.

Re: You write this as if

They are a business in most respects, other than having a corporate entity that pays tax, but nearly everything else they do is done like a business. That doesn't prevent them being scum, and they certainly are.

HP sued over use of forfeited 401(k) retirement contributions

Re: Who benefits if this changes

"So a 401K account is a pension scheme with only one member/beneficiary…"

Pretty much. There's more self-direction involved as well, as the single beneficiary gets to decide what they invest it in and how much they take out, subject to a variety of restrictions. As I understand all the options, I think it's comparable to the UK's SIPP accounts with an employer connection or Australia's Super funds.

Re: Who benefits if this changes

I don't think it works that way because 401K accounts aren't a pension which pays out specific amounts. They are tax-advantaged individual investment accounts. An employee who contributes a certain amount can invest and withdraw from that money subject to certain legal requirements, and someone who put less into it simply has less to work with. Since there is no common pot, the forfeited funds can't be put in one unless they stop using 401K accounts altogether.

Who benefits if this changes

As far as I can tell, nobody stands to gain if this case decides that the forfeited amounts can't be used the way HP was using them. HP loses, because it needs to leave that money locked in the account until it finds something else it was allowed to spend it on, but just because HP has to leave the money there doesn't mean that anyone else could get it. This raises two questions in my mind. The first is why the people suing HP here are doing it, because presumably they wouldn't gain from having the rule changed. The second one is whether that will make it more difficult for them to prove that they were harmed, which is often a requirement to pursue a case.

The best answer I have to this question is that, if HP was not allowed to use the forfeited money for most things, maybe they'd change the plan to avoid forfeiting it and people employed at that time would benefit from the new plan. While possible, this doesn't make much sense to me as HP would end up spending exactly the same amount of money if they lock it away or give it to employees, so nothing says that they have to stop using a vesting schedule if they lose this case. Maybe I'm missing something simple here.

To pay or not to pay for AI's creative 'borrowing' – that is the question

Re: Two questions for the price of one

This is all true, but if you train a 5 GB model on 1 GB of training data, those weights would end up including a great deal of the training data. Not so much if your 5 GB model was trained on 1 TB of data, though some of it could be. How large is GPT4 again? We have no idea, because they didn't tell us. This means that it's difficult to know how likely it is to contain certain chunks of the source material. Without knowing that, we have to start relying on less reliable measures such as whether it quotes large chunks, and it really isn't as difficult as you state to make it do so to the extent that OpenAI had to implement extra guard rails to reject any question that explicitly asks it to quote something copyrighted. If it didn't have that information in there, they would not have had to do anything, as the model would consistently fail. They added it because it was not consistently failing.

Re: Two questions for the price of one

Just because something's been reorganized and turned into floats doesn't mean the original data is not there. If things were that simple, I could eliminate piracy and copyright in one plan by making a suitably annoying obfuscation system. The way you can determine that the data is still there is when models like that start to reiterate the training data verbatim. They have been known to do so, sometimes on their own and more often when prompted with a starting point. They have to do some calculations to reconstitute the original work, but it's in there.

"Isn't the copyright holder reimbursed when the trainer buys the book in the first place?"

So far, no, because they didn't buy the book. They found illegal copies online and used those for free.

Even if they started buying individual copies, buying a copy of the book doesn't necessarily let you do whatever you want with it. For a very simple example, if I buy a copy of a book, I don't get to start printing and selling my own copies and saying that the author got their compensation when I bought the first copy. There are limitations on the use of the content of the books, and it is not clear whether AI training qualifies. I think it should not, but the law doesn't clearly answer either way.

Re: Is it legal? Who cares. *Should* it be legal is the question to debate

True, we should be discussing that, but it's likely not to happen until some court has decided what the current law says. Once a decision has been made, lobbyists for AI companies and publishers will start to try to change the law to better serve their companies, and we can start having that conversation, not that our views will be at all important to the politicians making the final decision.

In the spirit of having that conversation, I'm on the side of copyright here. I don't think the benefits of more articulate programs outweigh the costs of effectively telling anyone that, if their program is large enough, they can use anyone's copyrighted information in any way they please. We all know that this power would only be available to companies that are large enough; if I ran a copy of the Windows source code through as training data, Microsoft would not agree that it's acceptable, even as their friends at OpenAI effectively do the same to lots of others.

Re: Two questions for the price of one

That's not the argument at all. This is not about temporarily copying the text into buffers during processing. It's about two other copies:

1. The copy in the training data, which is not temporary because it's kept around for months to train models on, if not forever so it's available for subsequent models.

2. The storage of the processed work, which in many cases includes most or all of the work, just sliced into pieces, in the final model.

The copyright holders are claiming that point 1 is a violation of their rights because the companies did not get permission to obtain the work at all, and that point 2 is also a violation because it involves the storage and reproduction of their work. There are arguments that the second is not a violation which I don't find convincing, but either of those can be a problem for those who use copyrighted material as training data.

Re: IP is an industry

Whether it is valuable is not important. It could be valuable, and thus we find it useful to protect it. If it's crap, then nobody will buy it and its protected value will still be low. If it is not, the people who put in the effort which resulted in it not being crap deserve to benefit from that effort.

And yes, there will be an IP litigation industry, just as there is an industry for any profession, including ones that rely on negative aspects of our world. There is a toxic waste disposal industry, a fraud prevention industry, a repair of electronics after their manufacturer has dropped support industry, and an IP litigation industry. If we had less toxic waste, fraud, premature obsolescence, and copyright and patent violations, then we would need less of those things.

Re: Two questions for the price of one

"If it were instead a breach of contract with such a stiff penalty, that would seem to open the door for very onerous EULAs."

I don't see that as any stronger than an open source license. It's still based on the copyright rights to the content, and rather than applying a license to modifications you make, it limits your ability to store it on a different system. Not to mention that most of the ways you could store it on a system that would actually incur their investigations would themselves be copyright infringement, and they would go after that instead. While their term technically means that scanning it is not allowed, they're unlikely to do anything to someone who did for their own use unless that person also published, sold, or made a commercial derived work from those scans.

Qualcomm promises 'premium performance' in Gen 3 Snapdragon 7 phone chips

Re: Cue lukewarm applause

While I'm mostly in the low-priced camp, how about some of these? I've had to guess on some things, like what is required for a camera to be "very good" (I've limited it to 30 megapixels or higher). You can customize these, but there seem to be quite a few options there.

IBM pauses advertising on X after ads show up next to antisemitic content

Re: That's rich.

That episode is why IBM in particular is rather touchy about Nazis. We can analyze the events of the 1940s in a variety of ways to try to answer questions like how much did the IBM headquarters know about the particular use their machines were being put to. There are various levels of responsibility there, as the Nazis didn't exactly send a message to New York saying "we want to build a genocide database, please", but neither did they build the entire system themselves on IBM hardware. No matter where we fall on IBM's culpability, the current leadership of IBM wasn't around for it and they tend to make sharp turns any time their company and Nazism get too close to each other.

Lawyer guilty of arrogance after ignoring tech support

Re: clicking on the screenshot

This happens to me on occasion. I run make, it fails, I see the compiler error and fix it, run make, it fails, check that I saved the file after I edited it, run make, it fails, delete all the binary files in case they somehow got stuck, run make, it takes a lot longer but still fails, close and reopen the editor in case it got stuck, make still fails. Then, I realize that the code I'm building and the code I'm editing are in different directories. Maybe I fixed a problem in one file but a similar error was detected in another one. Maybe these are two different copies of the source, since I often have parallel copies for adding unrelated features. Either way, the editor and the terminal both print the directory I'm in, and if I was just paying attention to those, I'd have noticed that they weren't the same.

Meta's fix for teen online mental health? Hold Apple and Google responsible

Re: Support for a federal law? Eh? It already exists.

"If the device doesn't have a comprehensive set of parental controls and parental controls apps are imperfect and easily worked around, how do you expect parents to actually parent?"

The way they have for a long time: instead of finding a magical way to make it impossible for their child to do something they don't want them to do, taking reasonable steps to make it difficult and explaining to the child why they should not attempt to bypass those measures. It's not perfect, but nothing is. Depending on your tolerance for your children doing things, you are free to find a parental control application that does block ADB registration, and I know this is possible. Other parents, in my experience a majority, won't install any such app at all. I'm not convinced that you will get better results with your stringent measures than they will. I am not responsible for ensuring the tools you want to exist really exist. Nor are device manufacturers.

"Are you under the impression kids don't talk to each other and "Install Platform Tools, connect to phone, open a terminal, type this" is too complicated for them?"

In my experience, yes, it is too complicated for quite a lot of them. However, I know some will learn to do that. If they do, I expect that they won't have much trouble finding other paths around software restrictions, even if the ADB method is blocked, and therefore I think they must be handled differently. At some point, technical restrictions become ineffective and something else must be used. You are free to keep relying on technical solutions, but since they will always be somewhat imperfect, there may be better ways than a technical arms race.

Re: Support for a federal law? Eh? It already exists.

If a child learns enough to use ADB to disable that overlay, they're likely to know plenty of other ways to do whatever they want on that or other computers. ADB use is not that common for kids, or for that matter adults, and if they're going to do it, it requires another computer on which they could probably do whatever the phone is blocked from doing. This is really not a realistic concern for how such a feature could be disabled, and if this is really concerning to you, you might suggest that the provider of the overlay blocks the ability to change developer settings, therefore preventing the child from authorizing a computer for ADB control in the first place.

This is not a convincing argument for why the device needs to have special software baked in for parenting reasons. No desktop computer has it either. Even if you're the kind of parent who builds a customized Linux image that has very specific permissions set up, it wouldn't prevent some child from theoretically finding an exploit that allows them to escalate their permissions and disable your work, but that this is possible doesn't justify requiring someone else to write it for you.

Right-to-repair fight going national as FTC asked to lay down the law

Re: So whats the balance?

I know. I was explaining why they don't have to do that for any security purpose, as they and their fans like to claim. If they didn't do any of that, their devices would be equally secure, but they'd have less revenue from repairs and unnecessary sales of new devices.

Re: So whats the balance?

"I can no longer trust that a lost iPhone is secure cos somebody can replace the magic-security-pixie / fingerprint reader"

That's not how that works. Here's what would happen:

1. You lose your phone or I steal it from you.

2. I take it apart to replace the fingerprint reader with one that I've designed at great expense to work the same way the Apple-developed one does but always accept my fingerprint. Somehow I manage this even though the part is not open and so making that would require difficult and expensive reverse-engineering.

3. I put the phone back together, never having turned it off.

4. I scan my fingerprint on my compromised reader. Nothing happens, because the reader is not hot-swap capable. The phone won't read from it unless the sensor is present at boot.

5. I restart the phone to pick up the new reader. The phone restarts and demands the passcode, since without an active session, biometrics can't decrypt the phone. My reader won't be able to get through that.

In short, your scare story is completely invalid. Not to mention that there are several other ways to design a phone that would prevent a sensor swap from breaking encryption. For example, you could put the encryption key in the sensor, and then swapping the sensor locks the data away since it doesn't have the key. Users who need to replace the sensor can decrypt with their code before swapping in another sensor and re-encrypting with that. There are lots of options other than preventing the sensors from working.

Rivian bricks infotainment systems in 'fat finger' fiasco

Re: Wrong security certificate?

Here's my guess: the image they sent was correctly signed with their certificate, but they have some component which must receive firmware signed with a different one, either for license checks or for more levels of firmware security. They signed that with a certificate that worked for some models, I'm imagining two components that do the same job and every unit has one of them, but didn't work on another one. That would explain why some people are affected, not everybody. It would also make more sense why they didn't spot it in testing, as I think they would have noticed if literally every unit was disabled when they did the update. Of course, that guess could easily be wrong.

As the Top500 celebrates its 30th year, with a $5 VM you too can get into the top 10 ... of 1993

Re: Stupid question

Probably not, although it depends on how expensive power is where you are. For example, the current price in the UK appears to be £0.270/kWh, so £5.00 should be able to buy you 18.52 kWh. If you use the same amount of power consistently through the month, that allows for an average power consumption level of 25.7 W. That level of power consumption won't be sufficient for a desktop, but you have two ways to make it work. The first is to create an optimized system for getting as much computing as you can from that power limit. You can get some pretty good CPUs in that power limit, along with some SSDs for low-power data storage. The other way is to share hardware with someone else who is paying for their computing needs. Either way, if you do one of those, your power bill will likely be lower than the rental cost for this machine. Of course, you wouldn't necessarily need to run either the rented machine or your own machine at all hours, in which case both bills would decrease.