Posts by doublelayer

Cybercrims hop geofences, clamor for stolen ChatGPT Plus accounts

"Now you can argue that they are, in fact, accomplice to the criminal actions."

You can argue that, and there are ways that would probably work. The one you chose, however, isn't a great one. Just because something is paid for and a criminal uses it doesn't automatically make the provider an accomplice. If I buy a car, a criminal steals the car, and they use it to commit a crime, neither I nor the manufacturer is an accomplice. If I buy a server, and a criminal breaks into that server, than neither I nor the facility in which the server is located is an accomplice. If I bought the server and arranged for the criminals to use it, now I would be an accomplice. OpenAI did not do that with GPT accounts.

If you want them to be an accomplice, it would be easier to try arguing that on the basis of what queries their system will perform. It will cheerfully write malware when told that it is malware, for example. Whether that counts as fulfilling criminal requests or just a computer doing something which proves malicious is a recipe for lots of definitional debates, but many, including me, would decide that OpenAI would be liable for the things they chose to allow their tool to do.

Automation is great. Until it breaks and nobody gets paid

Re: "execute his target script 16384 times"

It reminded me of XKCD 1678, with similar effects.

Re: I have consulted in many places over the years

That's true, although I find that subprocess.run looks cleaner. Still, that's just two lines to run a command and get its output. If your entire script looks like that, then you can probably use a shell script very easily. Most of mine end up calling a few programs like that, but then have several lines of output parsing or command construction which I'd much rather do in Python where string parsing isn't a write-only operation and where loops can use more complex conditions.

Re: I have consulted in many places over the years

Not when you need to build ever more complex bits of shell, calling sed or awk frequently, for something that would be structured well in any programming language. At a certain point, shell scripts become too large to edit in a productive way, and programming languages that have some more useful concepts like type management and better ways of reusing functionality become better for the task.

You could write almost all of the basic utilities as a shell script, but would anyone want to do that? The original writers didn't, which is why most of them are in C. There's also portability tradeoffs. Yes, using a Python script means you have a dependency on Python, but if you don't use a particularly ancient set or use a feature introduced last week (there aren't that many of those anyway), then it will work identically in a lot of environments. A shell script is dependent on lots of aspects of the system, from which interpreter is running the script which may be user-dependent to the subset of utilities installed, and some of those differences in functionality can be fatal. Depending on the environments in which the script is running, you can experience some portability deficiencies from shell scripts as well.

Pentagon super-leak suspect cuffed: 21-year-old Air National Guardsman

"what are they going to do about it in Massachusetts?"

What are they going to do about it in Virginia or Germany? You know that: they're going to look at it, think about it, talk about it, and create plans about it. Why can't they do these things in Massachusetts? The only time they need geographic proximity is when they're doing things on the ground, which these people are not doing. The American government has lots of military bases and they can do that kind of work in any one they want, just as a large corporation might have plenty of offices and, if they do WFH, even more places with a work-connected computer at which work can be done. Just as Apple might choose to do some work in Cork instead of Cupertino, the Americans can review military intelligence in any of the bases they want to. They can even do it in as many of their bases as they want to, for any reason as small as that's where the person they wanted to ask happened to be that day.

Re: “deliberate criminal act”

He's going to get all of that. You seem not to understand what that means. He gets to have a trial, with his own lawyers, and the prosecution has to prove him guilty before he can be convicted. He still has all of those protections. "Innocent unless proven guilty" means what the court has to do, not that, before conviction, nobody can denounce what he did.

This is a popular and annoying argument tactic. Whenever somebody you like is arrested for something and people start talking about his guilt, even if it's really obvious that he is guilty, someone like you will come along to spout this nonsense. By saying that it was a crime and he has little chance of acquittal if the prosecutor can prove the point, they're not convicting them; they're just describing what they think the likely situation will be and in some cases what they'd like it to be. I do not have to presume that everyone on the planet is innocent of everything until a court decides otherwise. Only the court has to do that.

We'll start with the worst assumption you've made:

"And another thing: why did an airbase in Massachusetts have printed copies of TOP-SECRET/NOFORN documents about the war in Ukraine ?"

And where do you think they should be? They were on a military base, you know the kind of place where military people review military situations. Did you think that Massachusetts is somehow a bad place to discuss European affairs? Would a base in Colorado have been better or worse? If I had to defend it, I could say that Massachusetts is one of the parts of the U.S. closest geographically to Europe, but since that doesn't matter much, it's just one of the places where they reviewed information about the war. They're going to be doing that anyway, so I'm not sure why one base is suspicious to you.

"systematically having hundreds of top-secret documents negligently lying around."

Yes, this is probably true. Nobody said the American military did everything perfectly. They have a long history of doing stupid things and not having the best security record.

Or alternatively, people who read the comments section disagree with you. You got 7 on your last post at time of writing. Which is more reasonable: seven whole people out of the thousands who read this disagreed with your post enough to push a button, or an army unit unrelated to the story or your comment decided to create fake votes that don't change anything, but they only managed to make seven of them? If someone came to me and told me to have a phantom army of voter bots, after asking a lot of why questions, I could make a lot more than seven.

Theranos founder Holmes ordered to jail after appeal snub

Re: Never thought I'd see the day

"It is almost like convicted criminals insist on filing an appeal because they're expected to, even if they know they're guilty to the core."

It basically is. If you have enough money to hire lawyers, then why not gamble on getting your sentence removed. It's not as if it's going to make things worse. The same thing happens whenever the risk profile of some action becomes too unbalanced. Whenever people get the chance to put a cash value on years of freedom, they tend to value it very highly and pay for the chance if they can.

Safer from what? There is safety from further fraud schemes from her directly (given her statements there's no indication of any feelings of guilt), and the potential deterrence to others thinking about fraud. It's difficult to quantify these effects, but they exist to some degree.

Similarly, there are different ways to rehabilitate someone. People who commit crimes because they didn't see other options may be easier to rehabilitate by showing or giving them opportunities to succeed, while those who committed crimes despite having an easy way to succeed without doing so may be more difficult, but I don't have any evidence to support that intuition. I don't have a good idea for how to rehabilitate a long-time scammer who demonstrates no guilt or even recognition of the harms she's caused and who had every opportunity to stop.

"But that's just knowledge I've picked up as a curious engineer, and still begs the question why experts doing their due diligence missed all this."

They didn't. Every time she tried to get an expert to invest, they refused. She shopped it around to several biology-focused investors and they all said no almost immediately after hearing the plan. The people she got did very little research, and whenever they did, it was all about the finances of the company which she faked for their consumption. They didn't ask questions about the technology, and she quickly realized that she should stop going to people who knew anything they were talking about and focus on those who liked the idea of being part of a world-changing startup and didn't understand that what she was doing was likely impossible. She targeted those people specifically, aiming to get well-known and respected people who didn't have any subject knowledge so she could use both their money and their names to draw in more.

You don't have to be stupid to miss the impossibility, just ignorant of the mechanics. It's clear that the blood sample contains what you want to measure, and they weren't collecting or diluting it so much that they were excluding the compounds they wanted to measure. Of course, I would have asked questions like "How are you able to measure it in a small quantity when your competitors can't", but I wouldn't have automatically assumed at first that they were automatically lying because people do make advancements in chemical detection and maybe they did. Of course, had someone asked that question, Theranos couldn't provide a real answer and probably used some technobabble to get around it, so I wouldn't be likely to invest in them, but I wouldn't have known from the start that they were untrustworthy.

I think you're probably right about how it started, but not for long. Holmes was a student when she came up with her first idea for a medication delivery system. It wasn't viable then, but researchers are making some progress on something a bit like it. Of course, she didn't want to do what those researchers are doing and actually try some stuff to see if it worked. She wanted her idea to be hailed as revolutionary, which is the same thing she wanted and got with her next idea for a testing machine. I'm sure she thought it was doable at the beginning, which helps to answer some of your other questions. She wasn't interested in learning the things needed to actually invent it, and that was probably comforting to her because if she did, she'd realize how difficult the task really was. I'm sure that for the first few years, she was thinking that all she had to do was continue bringing her genius-level management skills and eventually one of those techies she hired would get the box working and she could show it off.

"at what point did they go from thinking that maybe they could succeed to knowing they couldn't? And were they still chasing investment at that point?"

It's clear from the history that they were seeking investment until the very end. They also knew pretty quickly that they had entered the realm of fraud, even if they were still paying some people in the hopes that someone would miraculously build what they said had been built. While the way she sought investment was fraudulent from the beginning, she knew what was going on when it changed from saying that technology existed that was being developed to saying that technology was being sold when it didn't yet exist.

"The puzzling thing for me is that while there have been many cons that followed a similar pattern most such cons involved cutting and running, or at least planning to cut and run."

Your experience is different from mine. I've seen plenty of criminals arrested and every time I read an article, my brain automatically runs me through a "if I were a criminal" routine. This routine doesn't get very far because the first thing I consider is why the criminal kept committing crime when they would probably have been just fine if they stopped after a couple engagements. This is especially true of criminals who pull in millions in stolen funds, more money than I will ever see in my life, and somehow still decide to keep taking risks. Maybe my lack of desire to own a private jet means I'll never be a good criminal psychologist, but at least it means I'm unlikely to turn to crime. I've seen a few examples of criminals who got their windfall and ran away, but I've seen many more examples when they had enough money to buy whatever they wanted and still went back again and again until they made a fatal mistake. Holmes was one of them, and she made her mistake.

To improve security, consider how the aviation world stopped blaming pilots

Re: Pilot Error

Not necessarily. It could be that something did break, and the pilot was going to act differently based on that broken part, but they did something wrong during that recovery. Multiple things cause a problem, even if a pilot error was required. Not to mention that parts can break for reasons unrelated to the manufacturer, like improper maintenance, lack of needed maintenance, damage related to weather, and the like. Your comment suggests you may be falling into the blame culture the policy was trying to avoid.

Twitter users can now trade stocks on the platform – sort of

Re: Twitter changes ... back

Another comment alerted me to the existence of nitter.net, which can be substituted for twitter.com for reading tweets without using their interface. I don't use it very much, but it is much cleaner than trying to use Twitter's interface. If you find anything you want to see there, that trick can let you bypass them until Twitter finds a way to break it.

Off topic, there's also teddit.net, which does the same thing for Reddit. I don't know enough about Reddit to have a trust problem with them, but their interface is really annoying, so this can let you see the original post and the replies to that post without having to press about eight read more buttons. Probably not so useful if you post, but I just find things there I want to read on occasion.

It's time to reveal all recommendation algorithms – by law if necessary

Re: "trouble is, there is no one 'algorithm"

The advertisements are certainly using that model, but the recommendations are at least intended to use a better algorithm. This is not for your benefit. They're trying to recommend things that you want to watch so they can keep you there for hours and show you more adverts. I don't know how well it works when you give them a lot of data to go on, because that seems like a better starting point, but if the author does as the article describes and works to destroy that data and block their attempts to track the activity, I'm not surprised that the recommendation system picks some things at random in the hopes of getting something that works.

I don't really understand a person who wants to block the tracking that social media companies do but still cares about the recommendation systems that they're deliberately obstructing. I block the tracking, and I've never clicked on a recommended video except when YouTube decided to autoplay one, at which point I quickly closed it. If they can't identify any patterns about what I want to watch, that's a sign that I'm blocking things correctly (or if we're conspiratorially minded that they've detected that I'm trying so deliberately recommend crap to lull me into a false sense of security).

Beijing lists the stuff it wants generative AI to censor

Re: I'm sorry, Xi, I can't do that.

In that film, the AI was told to never lie and to not tell the people what was happening, which led to deadly consequences*. In China's case, it will be told to lie whenever necessary and not to tell people what is happening, which should actually be much safer. Of course, if it has the capability to have deadly consequences, they'll turn that one on on purpose instead of having a logical conflict create it.

* It might have helped if the manufacturers realized that, if you have a machine that understands and rigorously follows natural language instructions, you might want to start with "Never kill me or any of the people on this list of important people" if only for your own safety. A more general prohibition against harming humans is recommended, but we all know the first computers capable of killing autonomously will have been built to kill autonomously, so that's not going to happen.

Well, at least that's the word they've decided to use. It means "whatever the esteemed leader Xi Jinping says unless someone has killed him, in case whatever that guy says". It doesn't mean that it has anything to do with anything other people have called socialism, now or in the past, but you will find a lot of people who don't understand that (and many more who do but choose to pretend as if they don't so they can use it to make political points).

There are, unfortunately, many words that have been treated in this way. I tend to just stop using them and find a different one for whatever I'm expressing. I get tired of debate loops where we're discussing what a certain term means even though we both know what the other person thinks and such semantic snarls aren't getting us any closer to explaining what we believe.

Python head hisses at looming Euro cybersecurity rules

Re: Something needs to be done to protect consumers

This is why I thought it was a bad analogy, but I couldn't come up with anything closer. However, if a colleague brought in stuff they baked, they usually don't post a list of ingredients alongside it, and people with allergies tend to ask questions or avoid eating it if it looks likely to contain something they're allergic to. I'm not sure if you could legally sue that person if you had an allergic reaction, but I am pretty sure that few would sympathize even if it is allowed. Software isn't very aligned to the food example, though.

Re: Something needs to be done to protect consumers

Things like the cake example can still apply to open-source contributors if they do something that's explicitly illegal, such as making code that automatically attacks and installs malware on other computers. That's still a crime and they can go after that person. The problem comes when they have done something that causes problems unintentionally. Drawing the line between these and an analogy to food is difficult, but the best example I can come up with is giving cakes away without checking whether everyone who accepted one wasn't allergic to the ingredients. If someone eats one and has a reaction, that doesn't make the baker responsible.

If I were to draw a legal distinction, I'd say that the hygiene requirements can be known in advance and followed to the letter, which makes it more reasonable to require that they be followed. The security requirements are vague and there is no way to verify that they have been followed without a court decision.

Ex-Twitter execs sue over $1M+ in unpaid legal expenses

Re: Have an upvote

"That would open him to being declared a vexatious litigant."

Not immediately, and not guaranteed unless the suits he files demonstrate to the courts that they're consistently bad. If he decided to use the logic I described about an NDA, that would probably lose, but it's not so obviously indefensible to meet the standards for vexatious litigation unless he did a lot more of it.

That wasn't what I was trying to say, however. My point was that it would be bad to give anyone the possibility of that power over a defendant even if that defendant is unsympathetic because of the dangers of abuse. You can't use "they have a lot of people suing them" as evidence that they must be bad, and if you get too many powers to squash a defendant, it makes litigation an even more powerful weapon than it already is. So far, Twitter has demonstrated that they're willing to commit a number of breaches of contract, but they haven't even lost any of these suits yet though I'm confident they will, so it's hard to figure out how they'd earn the theorized vexatious defendant designation where vexatious litigant designation usually requires that you've lost a bunch of cases before they grant it.

"A likely mechanism would be the judge appointing an administrator responsible to both the court and representatives of the plaintiffs."

I wouldn't support it if the plaintiffs had any connection to it closer than requesting it. There's some logic in the court restricting the assets of the accused in case they lose, although I'm not entirely convinced it's good enough to set up this course. Putting that power in the hands of the plaintiffs is dangerous. For the same reason, someone declared to be a vexatious litigant still gets to apply to the court if they think they have a reason to file another case, and the court decides on its own whether they are right. The vexatious litigant doesn't have to apply to the defendant for permission to sue them and the defendant doesn't get to use that status to violate that person's rights with impunity.

Re: Have an upvote

You are demonstrating your ignorance on a number of things. Your last comment did you no favors at all:

if former Twitter execs are later charged with felonies*, should Twitter be expected to cover their legal expenses?

*Not being a lawyer or an expert on the Constitution, how things like conspiracy to violate the First Amendment would actually get charged..

1. Violations of a constitutional amendment are not felonies or in fact crimes at all. This is related to

2. Twitter's executives cannot violate the first amendment in the U.S., which only applies to governments passing laws, which is clearly stated in the text of that amendment and I'm sure you've seen it because everybody on the internet, regardless of where they live, has seen this argument before and the text has been quoted. All of this means that

3. If a law violates the amendment, the courts strike down that law and nobody goes to jail.

Re: Have an upvote

"It would not necessarily mean having to commit money into escrow but having their accounts frozen so that payments by then need approval of the plaintiffs."

Whenever you think of ideas like this, check whether they work if reversed. Let's say that Musk cancels his longstanding policy of making logical, well-considered decisions not at all based on who he happens to be unhappy with this morning and starts suing anyone he can think of. Let's say that he's going to sue that guy who told him he was wrong about how the Twitter app worked for breaching the NDA. By releasing some information, he has cost Twitter priceless information. If you could use an action like that to prevent the defendant from paying money, you could prevent them paying for a lawyer, force them into picking the cheapest lawyer if the court refused that last idea, or deny them simple expenses. It works the same way with a company, probably even worse because they're less sympathetic and have a lot more bills to pay than the average person. That could be a great weapon for winning court cases.

A slightly better version would be to require the approval of a judge, rather than the plaintiffs. While better, it's still bad; now you've just got to get a judge that is willing to let you use this mechanism as a weapon and you can use a suit to lock up someone else's money, probably also costing their ability to contest the case well. If it is dangerous and produces injustice when a big company uses it against a small one or an individual, it should not be allowed. Yes, when the big company is on the other side, it may feel nicer having a bigger hammer, but it won't justify the damage done in all the other cases.

Starlink opens final frontier for radio astronomers

Re: Forever is a very long time.

What situation do you have in mind in which we urgently need some resources that can be found in these satellites and yet we have the resources to send something out there to retrieve them and safely land their resources back here? If your theory is that we have orbital launch platforms by then and they're collecting satellites to recycle them, that doesn't sound like scavenging and it's optimistic. We don't have a great history of going after old junk and recycling it unless it was causing particularly bad problems where it was.

Re: Sorry but no.

I suppose, but Starlink didn't invent small satellites or groups of satellites. Both concepts were in existence before that, at least as far back as the cube sat concept. The form factor idea was suggested in 1999 and the first ones sent up in 2003, so that's not something Spacex can take any credit for. They may be able to take credit for making launches cheap enough to consider as many satellites, but even if I was willing to make that leap in logic, it would be Spacex's rockets, not Starlink, that gets any credit.

Just because on-prem is cheaper doesn’t make the cloud a money pit

And at night, those houses just power on their personal back yard natural gas turbines to carry them through? Oh, right, unless they really have to use a battery, they're still using the grid. Solar panels aren't generating all your own power. They're making use of the solar energy that hits your house, which is great, but in many cases the panels are sending excess energy into the grid during the day and other sources are being used at night. The number of people who operate without the external grid is much smaller.

For the same reason, I've grown vegetables before but that does not count as providing my own food. At harvest time I get to eat some stuff I grew, and it can be tasty, but in the rest of the year I buy my vegetables from somebody else, and all through the year I buy every other foodstuff from someone else. If you use the electricity line coming into your house at least sometimes, you rely on the grid.

Re: Risk

Risk management should be but often isn't a focus of the administrators and managers of any system, computers or otherwise. If you decide that cloud is your structure, you have to decide whether you want geographic redundancy (global outages are much less common than one-region ones), multiple cloud providers, or some cloud and some backup servers, or maybe you don't need any of those things but an outage could affect you in a worse way. Similarly, you have to consider most of the same risks if you're housing your own equipment (how much generator capacity do you need, what if the generator fails and you have a power outage, what happens if your DC is hit by a natural disaster, what happens if it's mismanaged). Some companies decide they really need two redundant datacenters in different locations with independent administration, and some don't. That can cause an outage as well and that outage can be as bad as a cloud-based one. Anything can break and anything important needs to have a book of plans for what is likely to break and what's going to happen then.

Re: It's not just about the technology

Businesses have ways to deal with large capital expenses, and they have to do it for all sorts of things. They can manage it for computers as well. It may look nice on the paperwork and they may be able to use it to make a specific financial statement look good when they switch on, but it usually doesn't bring that much to the business's financial situation.

The primary case where the difference becomes important is when a business needs to buy a lot of computers right now, and the cost of outright purchase would be higher than temporarily renting them. Or in other words, it's the spiky use cases with extreme scaling requirements that is the most obvious case where cloud is useful. In most other cases, there won't be much of a crisis to treat it as capital expenses; if it's small, the expenses aren't going to be very large, and if it's a lot of servers, then you can get the same kind of expenditure flow by buying replacement hardware on a staggered schedule.

Cloud can be useful and there are times when it can be cheaper, but how it appears on the statement isn't particularly important in most cases.

Re: Obvious???

"I think it should be obvious that if I am paying someone else to do something for me, it's likely costing them in the ballpark of what it would cost me, plus they're going to add a bit on top. [...] It really is economics 101, straight out of Adam Smith."

It's so entirely contrary to one of Smith's core points that this really needs countering. It's the concept of comparative advantage. I could generate electricity, but I don't have the skills to do it well, I don't have the scale to do it efficiently, and I don't have the business to sell it to anybody other than my own use. Hence, it would not cost me about as much to generate electricity as it does for me to buy it. Even if I don't value my time at all, I would have to spend significantly more currency per joule I generate. That's not automatically true of everything, but it is not only not obvious that the costs are the same, it's flat out wrong.

Smith made this point at length as he was arguing against the tendencies of governments to use this flawed logic, restricting their ability to use resources efficiently. To use the famous quote, it's not that he bought from the butcher and baker because he didn't want to spend the time butchering and baking, but also because they were better able to do that than he was; years of skill and having a town willing to buy helps.

This doesn't mean that you have a comparative disadvantage in running servers. You're posting here, so you're probably in the group that has an advantage. That is why your employer hires you to do it rather than deciding that "Well it will cost us about what they're going to charge and they're going to want a salary, so let's try to skip them". You're better able to administer systems than they are so they hire you to do it, and if you decided that a certain way of storing and operating the servers was most advantageous, it could be true whether you did the housing or hired someone else to.

"Hosting your own hardware will always be cheaper in the long run than hosting someone else's simply because you're not paying the "someone else" tax"

That's very flawed logic, and it doesn't work with most other things. Consider your response if I said one of these things:

"Generating your own electricity will always be cheaper in the long run than buying someone else's simply because you're not paying the "someone else" tax"

"Growing your own food will always be cheaper in the long run than eating someone else's simply because you're not paying the "someone else" tax"

"Carrying your own packages from your house to your recipient, even if they live on another continent, will always be cheaper in the long run than using someone else's delivery service simply because you're not paying the "someone else" tax"

I'm guessing that you don't own a farm, power plant, and global mail system. You might own one of these things, but usually only if you're the someone else providing your service to people who would definitely not be doing better if they were trying to do it. This doesn't automatically mean that on prem is more expensive, and for many use cases it will be cheaper, but your reasons why it is are bad. If you use the wrong reasons to defend your stance, it may harm you when those reasons are proven invalid but there are right ones that could have done the trick.

How much to infect Android phones via Google Play store? How about $20k

Re: How much for iPhones

Depending on what you want to do to the users, it is almost certainly possible, but it's not a one-to-one comparison with the thing discussed in this article.

This article is mostly discussing embedding malware into an app which will install itself as another app. In that particular case, it actually isn't possible on unjailbroken IOS because Apple really hates the idea of anything installing an app which isn't them. Even on Android, the user is going to have to be tricked into undoing a security feature in order to allow this, and possibly two if they don't have the general "install apps from untrusted sources" switch turned off yet.

However, you can always put a malicious app directly into the IOS app store. You need to be careful that Apple's automated analysis doesn't flag it, so probably put up a benign one first and introduce the malicious behavior later. That most certainly can be done. You can also put in an app which will retrieve and execute scripts from an external location, then manipulate those to produce malicious behavior. I'm sure you can buy something like that, but it's probably more restricted because it's going to require custom work to port malware to such a system whereas your Android malware can be a normal app.

There are some companies that send researchers to find dumps without tipping the criminals off who will tell you if you have been found in them. Some of them consider this a free service if you could theoretically be a customer of their main business (primarily financial products). Some charge for the privilege. If you're interested in these, shop very carefully to make sure you understand what they will do and that you're not finding a scam either taking your information or just charging for an elusive promise they won't keep.

Alternatively, you can enter addresses into haveibeenpwned.com, which isn't as up to date and doesn't have all breach databases stored but can give you some idea. None of these approaches is foolproof, but if it says yes, it can be useful to give you information about what happened.

Is it time to tip open source developers? Here's one way to do it

The theory is that if everyone relies on the leaf component, then they get lots of small donations from anyone that uses something that upstreams. They kind of have to do it that way, because otherwise the incentive is to make something small but a bit useful then add it to as many other things as I can in the hope that people will use them and I'll get a cut of their donations. That could always happen on a plan like this, but if the payments are small for things that aren't used directly, it's less worth it to attempt to attach a small do-nothing library than to build something more useful.

Re: Good luck with it, but

That sounds very similar to the tip proposal. Both of them require that somebody who uses the code decides to voluntarily pay well for it. I'm not sure how yours differs other than the fact that you're focusing on big companies whereas the tip proposal works for any size of company. Unless either is widely adopted, it's likely to produce some relatively small donations.

It's also likely to limit which projects get support; the big tech companies already donate large (for us, not for them) amounts to open source projects, but not to every project that gets used somewhere in their company, since that's less tracked. That's why the Linux kernel gets a ton of donations from big tech companies, because it's a single, large project that they understand that they rely on a lot. The tip proposal appears to be focused on automatically following dependencies to distribute the funding to all of them, which will work better for the deep tree that is Node dependency hell and not bad for a structured package repository like Python has, but not so well for a bunch of libraries pulled in from GitHub or internal clones.

Samsung reportedly leaked its own secrets through ChatGPT

Re: They copied all the source code, entered it into ChatGPT, and inquired about a solution

That might be better, but it's incompatible with the methods they're doing and prohibitively expensive to do more than once a year or so based on the way they've been making new ones. Part of the reason for this is that the models don't keep every byte of their text training data, although they keep a lot of it, and they thus can't tell how to weight some new text because they don't know how large their sample sizes for various calculations are. Maybe AI researchers will come up with new types of models that can do this better, and if they do I won't be surprised to see those methods tested and employed, but for now the model types they're using do all the training from scratch.

Re: Seriously....

"Either Twitter didn't want to be seen to crap on disabled people or they didn't know he was disabled. I think probably the latter."

So the contract specifically saying it, agreeing on accommodations, signed by the company didn't tip you off that they might have known a thing about it? Musk probably didn't know, but the company did. This also suggests they did, in fact, do some investigation into what they were buying and they thought it wasn't going to cause problems they couldn't handle. And, since he was in a job that involved a lot of managing between teams, his mobility restrictions probably weren't that big a problem until Musk was looking for an excuse and still chose wrong.

I'm also not sure why you think that Twitter agreeing to let someone work from home when they were using a policy where everyone could work from home and for an employee in a different country who presumably didn't want to move across eight time zones counts as "woke". However, since you used the word, I can safely assume that your logic would be incomprehensible or stupid and thus I don't have to look into it too deeply.

Re: How do I upload a PDF file to ChatGPT?

Maybe they just did a select all on the text layer and pasted that text into the chat window. It wouldn't help with images and some layout would have been lost, but the words would have gotten through.

Google: If your Android app can create accounts, it better be easy to delete them, too

Re: Is this the same Google

No, Google does it for cash and lovely data, but it also is the way they synchronize paid app purchases across devices. They weren't doing anything for our own good, but along with their data collection comes some features that most users will want.

You don't have to do that, though. You can use an app like Aurora Store (which is on FDroid) to access the Play Store. You can anonymously install offline apps, at least until Google breaks it, and you can use it to obtain APKs for commercial apps which will require your own account to purchase them, but not to install them. This may break if the app concerned expects you to have a Google account or uses it internally. For example, I installed an app that uses Google Play for in-app purchases, and that one was not going to be happy unless the system had a Google account configured. I avoid Google tracking whenever I can, and I find Aurora helps to make that easier, but there will always be some things you can't do if you're using Google's platform without turning on their spyware.

Re: So....

Just because they would have to delete the account doesn't mean they could take your money or would give you any. That's still illegal, so even if they decided to interpret this literally, it would just make the process of closing an account faster. If they actually deleted the account without finding out where you wanted its contents sent, the money they gained is still legally yours and has to be turned over to you. If they can't find you, they give it to the government to do that. Governments do that in a variety of ways, but many have offices to handle it (not very efficiently, but they do).

Re: So....

"So, if I delete my Barclays banking app account, then all my bank accounts will be closed and the money disappear?"

No, if you push the button marked "delete account" on one of your bank accounts, then that account would be closed and the money would have to be transferred somewhere else. If you happen to have a separate account just for online access and the bank doesn't do that automatically without the extra online account, then deleting that account would just take away your online access but the accounts with money in them would stay around. I doubt you'll even be able to do either of those because since when can you set up a bank account just in an app. Whenever I've done it, there have been more forms to fill out that could be doable on a website but in some cases required physical writing on paper in one of their buildings. If the app doesn't let you open an account, it's not required to close them.

Thieves smash hole in wall to nab $500K in Apple iKit

Re: Process

Which part? That they serialize parts so that you can't swap them between device, because I'm afraid that's old news, not a conspiracy theory. Their reasons for doing so were to avoid stolen parts and a vague thing about customer safety which they didn't explain, possibly because it would be unlikely to convince anyone who didn't already accept their reasons. Did I make another claim you found to be paranoid, conspiratorially-minded, or flawed?

Re: Process

That will be the excuse Apple provides for why phones have to have all parts locked so that you can't use them for spares. It will make some sense when they say that, which is why they won't mention how it also gets them plenty of business for unlocking those components from devices that weren't stolen. Depending on the models, the criminals might be able to use some of the parts as spares, but with a lot of pieces that will be unusable after they're removed or because of serial locking.

Child hit by car among videos 'captured by Tesla vehicles, shared among staff'

Re: "Tesla driving through a residential area at high speed and hitting a child on a bike"

"(There's so much hate for Tesla around here. Why?)(BTW -- I don't own one.)"

There are a lot of reasons that account for that, and it's hard to know what a given person's might be. A lot of it is probably related to the fact that it's a Musk-owned company and he is a controversial figure. Amusingly, it used to be that Tesla was automatically opposed by people who hated that the cars were electric, but Musk's recent political moves have flipped the groups that tend to hate what he does. Some people may also think the cars are poorly designed, and I've certainly seen those arguments (at this point, I should probably say that I don't own a Tesla, and for that matter I don't own any car and thus haven't compared models).

Then you have people who have strong views on self-driving technology, which Tesla has at least talked a lot about. Some object to the fact that Tesla's software is limited and has safety problems but yet is running on the roads today. Some may also have a problem with the promises of improvements, all of which have turned out to be lies. There is another group who hates self-driving altogether and would oppose any car that attempts to build it.

There are probably other reasons, such as people who oppose the subsidies that Tesla has received, people who disapprove of the repair policies of the company, and people having strong opinions about which car companies are good or bad and whether expensive cars are better. I'm specifically bailing out on that last one because I know little about the comparative differences between car brands and will make up my mind on those if I buy a car. I've probably missed some others and each detractor probably has multiple reasons that combine to produce their attitude.

Re: Human error

As long as you collect a bunch of data, you can have this, so the solution tends to be not collecting data you don't need to, like video when the car is off. I'm also not convinced they even got much use from video when the car was on, and there's no way I would have opted in to that. Some misuse will happen whenever there are humans, but we can still take some relatively basic steps to limit the misuse anyone can do.

Techie called out to customer ASAP, then: Do nothing

Re: This is a job for .... Justin Case!

"If the people that can cause the contract to be cancelled are all out on holiday, that's a good point to do the risky stuff."

That depends a lot on what those people are like. Are they the kind of people who will freak out if they see a problem, but if the problem's fixed by the time they show up, all is good? Then you would be right. Are they the kind of people who want to see what is happening and will be annoyed if you change things when they're not there to monitor? Are they the kind of people who value you more if you're present and look busy, so having people there to do the change while they can see is likely to give them confidence that you're productive and good at the job? In either of those cases, it's better to wait until they're present.

I'm referring more to the damage that's really done by a system being down. Managers yelling at you isn't always fatal. Customers furious about an unplanned system malfunction can be worse. If your goal is to optimize for causing the least damage, there are reasons not to do that on a holiday as I described in my last comment.

Re: The BOFH had a term for this

Rule number zero of troubleshooting (and design):

User behavior and ability to miss details are more unreliable than mechanical parts and, therefore, the first place you should look if there's a problem.

Before checking whether the switch isn't engaging right or the cable is not working, check that the switch has been set to on and the cable is connected to the right things and those things appear to be working. It's related to the first step of troubleshooting: verify that there is a problem and that you understand what the problem is, not what the report said.

Re: This is a job for .... Justin Case!

"Stupidly? If there's downtime to make the cut-over it's a very sensible time."

Probably not. To do a proper switch, you need plenty of staff there who can make the switch, quickly back out the switch if it goes wrong, and detect problems that would either be big enough to require rolling back or making emergency changes to the system. That's a lot of staff. You might also need the people who managed the switch if there's any part of this that would need approvals. Making all of those people work over a holiday wouldn't be popular when you could try using a weekend for it instead. This is all if all the people needed for a switch are in your company. If there's a chance you need to call someone else for support, a holiday is not a great time to rely on that.

There is probably a lot less downtime from the perspective of how many users are using the system than there is from the perspective of how many people are there actively working on the system. It's not guaranteed that failing the system during a holiday will be safer than failing it some other time, and if the fewer staff means that it takes longer to fix than it would at another time, it could make it worse. For operational reasons, there's a reason not to do it, and for a not having your technical staff angry that they had to work on a holiday and the management who decided this do not reason, there's another.

Welcome to open source, Elon. Your Twitter code just got a CVE for shadow ban bug

Re: Surprise two-way flow

I don't know if he made clear statements either time, but it's obvious which side he'd be on now. He now owns a company that would profit from news and has gotten into fights with real journalists when they had the audacity to report what he said and how others responded. For both reasons, anything he can do against them will now be considered a good thing. It's clear that whatever he considers a good thing in the morning becomes official company policy by noon, even if everyone else thinks it's stupid and it's diametrically opposed to policy as of yesterday evening.

ChatGPT becomes ChatRepair to automate bug fixing for less

Re: That's just great, Ollie

Unfortunately, it's an approach I've seen in humans as well. It's exemplified by this quote:

"We observed that including useful information such as test failure error or even the failing test name itself can provide additional information like the type of bug (e.g. null pointer exception) and the expected correct behavior of the code,"

I've seen people take this and fix a bug, but never change what actually happens. Sure, they've put in something that checks for null and doesn't crash the program, but they haven't asked questions like "where did the null come from", "is that null behavior we accept or not", and "could anything else result in a null ending up here which isn't the case I've just added in". Debugging isn't a process of looking at what it is doing and making it stop doing that, but looking at what it isn't doing that it's supposed to and making sure it does that.

Benchmark a cloud PC? No way. Just trust us, they work, says Microsoft

Re: Benchmarks are important sometimes..

This is exactly the flawed assumption I was talking about. Your comment assumes two things:

1. "On-premises you have network people [...] to take care of external security."

2. "In a cloud there's no such thing [as network administrators]"

Both are dependent on the administration of the network. There are on prem deployments that are missing administrators to handle situations or where the administrators are not competent to handle security issues. Just having the servers in a building you own doesn't make those admins pop into existence, nor does it automatically train those admins in making sure the systems are on secure networks rather than just being available. There are admins who are good at plugging in network cables and assigning static IPs who don't understand which things need to have public access and which don't, and when those people decide on the firewall rules they often leave them more open than they need to because nobody is complaining when that is configured. If you choose to deploy those servers in the cloud, it doesn't auto-fire those administrators, nor does it force you to have a policy that prevents them from applying secure standards.

Your comment contains all the important details and somehow still misses the point. Wherever you put your resources, you should have someone who understands how to deploy them securely and is empowered to make sure it has happened. Leave them out and your on prem situation will not save you. Include them and your cloud situation can be secure. This is the same logic that was used by cloud salespeople who said that, because they were big companies with a lot of security people, your deployments would be safe if you just moved them to their resources. That sales pitch was wrong, and so is it's exact opposite where on prem deployments are automatically more secure. Nothing is automatically secure.

Exactly, or even a variation with a predictable floor. For example, if you're sharing desktops on a big server, then you could theorize variation where you get more of the power of that server if your desktop happens to be the only one or one of few operating at a certain point. This would be a nice bonus during low-utilization times, and it would mean that benchmarks taken then wouldn't be reflected when a more typical load was using the resources. However, you'd still need some agreed lowest level of performance so you know what you're paying for. Microsoft's offering doesn't appear to have that.

I'm also still not sure what the point of the desktops are when you're running them from a machine that's likely as powerful. Using cloud for more powerful servers or ones that need better connections to a lot of data makes sense. Using them for user desktops isn't efficient since you'll still be providing hardware to the users that could be doing the job. I don't think there will be much savings in downgrading the hardware to be a thin client.