Posts by doublelayer

Self-destructing thumb drive can brick itself and wipe your secret files away

If we assume someone with a need to quickly destroy data, then destroying the hardware is generally the fastest way to ensure destruction of the data. Yes, deleting a cryptographic key can often be done quickly, but then you need to demonstrate the security of the place storing it and the strength of it and that you can't still pull anything out of RAM, whereas if you can demonstrate that the thing where the data would be is now so broken that no data is coming off, you can skip those parts. In practice, that's not enough here, but a lot of secure erasure does take the form of complete destruction of the hardware containing that data.

Re: Where were the grown ups ?

It depends on your jurisdiction and specific laws, but in some, law enforcement can demand encryption keys, punish you if you don't give them, and report your delay in giving them as evidence of your guilt. In some jurisdictions, destroyed evidence can't be assumed to be against you, nor is it evidence of obstruction unless they can prove that it was against you or that you had been given a legal order not to destroy things before you did. If there's any jurisdiction with both of those, this could theoretically be better. However, in that place, a normal encrypted drive and an emergency drill to destroy it would still be better.

I would suggest never, since all you need to do to get data without it self-destructing is not push the button. Anyone who gets physical possession of one of these before the user pushes the button won't need to disassemble it. They'd just need to plug it in and copy away. If the button works, then anyone who gets possession only after the user pushes the button will likely disassemble it but, doing so won't help. The only reason why disassembly would help is if the button doesn't actually self-destruct the drive.

You are likely to be eaten by the MIT license: Microsoft frees Zork source

Re: XYZZY

We can give an LLM instructions to read the descriptions, name an action, and submit it for the next step. That is within their capabilities. It doesn't need to ask a question to do that. I'd expect plenty of unparseable commands, but it will likely be able to make at least some moves. I'm tempted to try this and see what happens.

Compare it to when an LLM was told to issue commands. It could issue commands without being specifically prompted to, and the problem was that it didn't stop when it needed to and continued to make up valid commands that broke stuff.

Re: Life forming

There are a lot of games, and while many, and several that are very popular, take the form of how can you shoot the thing that's trying to shoot you, there are ones that do have puzzles and problem solving. I don't play many of them, but I hope they do a better job than the average text adventure and think it's likely they did.

I too played many of these as a child, but I had a different experience to you. A few of them did have all the things thought through and could take multiple paths, whereas many others were far more limited. I remember many games that would require you to use completely illogical things because you could only break a window with one specific object and they would simply reject any other method you tried, when in real life we know there are many objects that can be used to break window glass. At other times, they taught monotony. I experienced several games where, if you saw a table, you had to enter "search table, search under table, search behind table, search in table, search in table drawer, search under table drawer, search behind table drawer", with a healthy chance that none of those would give you anything, just because there would be one piece of furniture where one of those seven incantations would give you something necessary to winning. This kind of had the opposite problem to the "you can't break the window with the stone statue" problem because that's a realistic difficulty for conducting a real search, but it also made some operations more tedious. That also happened a lot when you had to get information from a character, because you needed the specific topic to ask them about before they'd mention anything.

Don't get me wrong, I played so many of these because there were some really nice and enjoyable ones. Unfortunately, I gave up on playing more because I had this happen far too often and had several games where I either couldn't find the way to keep going or needed to cheat to do so, and knowing that there's half a story left if I can only find the object that can break a window, but it's none of this collection of heavy objects I've already collected, was frustrating.

Magician forgets password to his own hand after RFID chip implant

Re: "Not everything on the World Wide Web is forever"

Except that a lot of things on it are a lot more forever than their offline equivalents ever were. It's much easier to find archives now that they're not in paper, and if we're motivated, and several organizations are, we can create distributed archives of those. Meanwhile, even before digitization, plenty of small archives were running out of money and recycling their paper in bulk. Lots of things we might want to look at from a couple centuries ago are unavailable because they were stored on paper and it burned. I think short-term historians will be fine. I make no promises for those in the 3000s, but I would also not be too confident if we were still printing stuff because, unless we start chiselling our records into something stable which neither fire nor water immediately destroys, we are not building stuff guaranteed to survive.

Fired techie admits sabotaging ex-employer, causing $862K in damage

And how do you manage that? Simply by removing PowerShell from anything Windows and not installing it on Linux? What if I bring it back, even a portable version, in order to execute that script? And, without it, have you removed everything else I can run a script in, Bash, the old CMD shell for Windows, PHP (if it's a web server)? Maybe you have; that is possible, though it can make debugging and operations quite a bit trickier. But unless you have, you are probably patting yourself on the back for having done nothing because PowerShell was not responsible for this. Bad access control was responsible for this, and any way of executing the commands would have worked. PowerShell was chosen, not because it had any special powers to make this happen, but because the attacker needed something capable of running a foreach loop and that was available.

Re: But How Is It Damage?

Would you like me to run untested code on your computer safe in the knowledge that, since I don't know any guaranteed ways to make it catch fire, I can't damage it by your definition, or might you be a little worried that I can break all sorts of things by doing so? And if I break some things, that would be damage. It's just that, since it wasn't the hardware, it's damage you can repair. You made up the hardware-only definition for damage, it is wrong as you can easily damage software and data, and practical demonstrations of that are easily obtained.

Re: Focus, people

Because none of the nine examples they linked to were wrong, and all had some effect. We could compare them to other types of attacks which have had larger effects or happen more frequently, and The Register does cover other types of attacks regularly. But this article was about an insider threat and they are able to demonstrate that they can and do happen, thus you might want to do something about it. That's not over-selling them, it's accurately reporting news.

Another disconnect between your comment and the reality might be in this part:

"proper implementation of 'Zero Trust' is going to limit what damage an insider can actually achieve."

And this might be a reason for a place that hasn't implemented enough controls on internal behavior to do so, because without a proper implementation, any threat, be it an insider or a compromise, can be much worse. The textbook version of such a policy is also limited by reality in a few ways, meaning that even when policies have been created, there are usually a couple gaps in them which would be good things to know about at least.

Devs gripe about having AI shoved down their throats

Re: Don't get this, you do have that?

I think they did miss the sarcasm, but their other point is parseable. Rather than reading the man page, whether it's one of the terse ones I was complaining about or the more detailed ones that are useful, having someone give you the incantation can at times be useful, either because it gets the job done without spending the time learning*, or because it requires less trial and error. For example, the man page for ffmpeg is not terse, and you can find a lot of information through it. It is also over a hundred thousand words long. If you need something that's not in the first two sections, you'll spend a while at it, which is why I've been asked several times to help find the magic command that makes it do what is wanted.

* Laziness is not the only reason for choosing not to learn something. If you're only using it once or twice, a lot of people wouldn't opt to learn the thing backwards and forwards until it becomes clear that they won't have wasted most of that time. This isn't bad. If I was a new starter on your IT team and said that I must familiarize myself with the Windows printer driver API before I would try to fix the driver problem a user reported, that would make me a bad employee because that knowledge is very likely not required to solve this and time spent learning it will not be useful, even if at some later point that knowledge would fix some other problem, because at the earlier time, you wouldn't know or expect that.

Re: "Questions such as the syntax for a particular command "

Something in between would be best. Written by humans so there aren't inaccurate parts, but I want something a little more informative than fitting the list of parameters onto one screen and cutting out as many words as possible so they fit. The typical format in reference pages is more to my liking. I find many man pages to look helpful but not provide enough information. The XKCD man page is far too close to real ones for comfort.

It's a good time to be the arms dealer for the AI boom

Re: Flowerpots

Yes, probably a few months after the bubble has popped, RAM manufacturers will realize that they made too much of it and now need to get rid of it and scale down production. At that point, prices will likely fall. We don't know how long that will take to arrive, though, and there are a couple options which don't give you the nice low price from a glut. If the RAM manufacturers correctly predict it, they'll lower production in time and there will be no glut. The shortage pricing will decline a bit, but that's all.

If the AI bubble doesn't pop as much as it slowly deflates, then it could be even less dramatic. I think there is a chance of that. For long-term economic performance, that would be worse, though for short-term investors it would be a bit better, but as long as people still harbor hopes for a new model meaning massive economic benefits and are willing to keep pumping in money, a lot can escape and still have running companies. The bubble popping idea works if many people decide they made a huge mistake and give up, and that's an option, but there's also a possibility that people do that at different times and the companies, while they would no longer grow exponentially, could stay functional for some time.

Cloudflare broke itself – and a big chunk of the Internet – with a bad database query

Re: Bad Rust code was the problem...

How have people who blame Rust for any bug written in it become so much more annoying than the Rust promoters they attempt to decry? Maybe it's because they use a similar tactic, but they took it one level farther. Rust fans have often pointed to any memory-related bug and said "look, that's why you should not use C", but at least the replacement they suggested would have actually done something about those. Whether it's this or one of a couple other articles, we're now beset by people who blame Rust for any bug written in it even if, as in this case, exactly the same bug could have been written with equal ease in any language of your choice.

If you don't want more people to support Rust just because they're annoyed at you, you would do well to follow your own statements. "Remember, Rust is [...] just another tool", and if you insist on blaming it when the tool is not the reason for the problem, you're going to have trouble getting agreement except for those who already hated that tool. I don't like writing code in Javascript, but I don't blame it for every time someone does something I dislike with it. Unless JS made that happen, which it occasionally does because it does have some defects, the specific piece of code and its writer, not the language or its promoters or other things written in it or people rewriting something in it, is to blame.

Re: Er...

You do know that the "they" in the sentence you quoted was talking about CrowdStrike, not Microsoft, who weren't the they in any sentences in that comment. And that, while CloudFlare does handle lots of DDOS attacks, that's not related to what they were doing this time? Your comments are not making much sense in context, and devoid of that context appear to simplify to "Programs should just never have errors" which is a very nice option if you can make it happen.

Brits to help foot power bill for datacenters under government AI plans

Re: Yikes! Can we afford to stay here?

Woops. Let's agree not to notice the US comments, then. It's still true that the Vancouver area has quite low prices for electricity even by Canadian standards. Hydro is often cheap where it's plentiful, and certain areas of North America including British Columbia and Quebec have a lot of it. To me, that's a good argument for AI companies to go where power is plentiful, pay for the power they consume, and not deserve any help with their power usage from us, especially if they put their GPUs in places without plentiful power already.

I don't really understand the reason for wanting to spread out their infrastructure so much. I get it for cloud, where some customers have latency or sovereignty requirements, but LLMs already have plenty of latency because you have to get resources and start new sessions, so what does it matter if you have a few hundred milliseconds more. As long as UK traffic isn't going to New Zealand, I think the users wouldn't notice the latency effects. Sadly, people assume not only that AI can solve any problem and will make everything better but that everything it touches is also wonderfully beneficial, so they're jumping over each other to have buildings that benefit nobody but construction companies and not even them for very long.

Re: Yikes! Can we afford to stay here?

Unfortunately, you moved from the third lowest province in Canada for electricity rates to the third-highest state in the US for electricity rates. The difference isn't national. States in the US close to British Columbia also have low rates and for the same reason because they're sharing a lot of the hydroelectric power, either by using the same rivers or sometimes by sharing the power plants too. Massachusetts, on the other hand, has a bunch of natural gas plants and shut down most of the rest of it, including old nuclear and coal plants, so they are also importing a lot of their electricity from other states.

Cloudflare coughs, half the internet catches a cold

Re: Ideological crash. Rust is well named.

Ah, so your definition of "Rust's fault" is that code written in rust was running when the problem occurred. Not generally the definition most people use, but sure, let's go with it. Anyone who has ever written the wrong condition or failed to check for an error can blame their programming language, because somehow it was supposed to stop them. This is definitely not what a religious view on programming languages looks like at all, trying to crowbar any problem that happens into evidence of that language's inherent badness when it's patently obvious you have no basis for that but deeply want to have.

Re: Ideological crash. Rust is well named.

And the source for the Rust change being responsible for or even involved in this is where, exactly? Or might that be your religious objection to it? They've got a description of the cause up now. Maybe you'd like to read it before deciding whether to continue with this argument.

They can. If Manchester was the only problematic area, they would have. The problem was that all the nodes weren't working in the same way, so sending you away from Manchester wouldn't have solved the problem, just showed you a different city being down.

Re: How long until it all goes FUBAR?

When was the last time the internet went down for a long time before it came back up, and did that affect everything else? Because from my experience, the answers are never and no. Stuff goes down. Unfortunately, a lot of services run on a small number of providers, and that means that small problems make big outages. But that doesn't tend to be a complete collapse of communications in an area. When one ISP fails, the others tend to still be working, and since I have both a wired connection and a mobile internet plan through different providers, at least one of them is likely to be working unless there's a widespread power issue. I have tons of systems through which I can communicate, from email (colo-hosted), Signal (AWS-hosted), Teams (Azure hosted), Google services (Google Cloud hosted), Jitsi (self-hosted in my house), and phone calls. I have never seen an outage that would take them all down.

And, when there are outages, they get fixed. If I can't talk to someone for a few hours because some system is in the way, that's probably not an emergency. None of these outages have tended to affect the things that really are emergencies. To have anything like what you're describing, you would need system failures that spread, even though that's not how tech failures tend to go, and you'd need nobody fixing them even though the companies that make the services need them running to make their profits and thus hire hundreds or thousands of people to fix them in that situation. The situation you describe could happen if there was a concerted attempt by attackers trying to break everything, but even that would likely be harder than you'd think and, if they were doing that, it would almost certainly be as part of an invasion which would be the bigger concern than not being able to call your friends.

Your amateur radio system is not much different. If you're using anything short-range, then you're likely relying on repeaters to get your signal to someone you want to talk to because otherwise you're only slightly longer range than a big megaphone would be. If power fails for those repeaters, you're disconnected from anyone not in line of sight distance. If you're using HF, then you have more ability to communicate directly with the person you want, though you will also need a lot more power at either end for that to work and I question whether you're operating backup generation for high-power HF transmission.

It's not enough text for me to take a guess. The repetition of "spike in traffic" does sound unnatural, so maybe that suggests LLM usage, but since it's three sentences whose only purpose is "We're fixing it, then we'll debug the cause", I don't really know or care how they generated them.

Re: Funny The Register Could Not Stay Up

That would depend on what business you were in. Let's take two hypothetical businesses and see how it would work for them. Our other alternative involves a couple million in expenses:

Stock trading platform:

Cost of being down for two hours: People who must trade now can't. The price changes significantly, so they lose an opportunity. Possible lawsuits, possible rich clients taking their valuable business elsewhere.

Is that higher than 2M currency: Yes.

Do they have backup: Yes.

Tech news website:

Cost of being down for two hours: People who want to read articles have to read them in the afternoon instead of the morning. Maybe a few of them go to some other tech site and read articles there instead, costing you fractions of a penny in advertising revenue you'll never get back, probably less than the amount of ad revenue they didn't get because I've got an ad blocker enabled.

Is that higher than 2M currency: No.

Do they have backup: No.

If your business loses a lot when you're offline, then you need more backup, and surprisingly enough, that's exactly what we see. A lot of online businesses don't lose much if they go offline occasionally as long as people don't expect it to happen very often. At that point, you do want your solution to be economical, because if implementing the ability to switch to something else, switching to it, and using it through the gap costs more than just letting the outage roll through, they'll do the latter. But, if you can make the alternative economical, more people will use it.

Re: Single point of failure

That's an approach we could take. Just wondering, who are your neighbors and do you think any one of them might have committed the smallest of criminal offenses? You see, I really don't like speeding, I consider that terrorism, so I'm planning to drop a bomb on your neighborhood if one of them broke a speed limit. That's not going to cause any problems for you, right? Oh, in case we live in different countries, would you mind telling your government that yes, this does look like a very overt act of war, but it is just normal law enforcement now and they should feel free to drop bombs on anyone over here they think committed a crime?

Re: Single point of failure

Let's ignore the obvious implementation problems like not knowing who installed malware on the computers that are doing the attacking. I'm sure that, at great expense, we can take all the law enforcement people who investigate technology-related crime away from their investigations of ransomware and financial theft and crypto scams and put them on to investigating botnets that are DDOSing a technology blog, and then we'll find the culprits. Problem solved.

But are you really advocating the technique of treating a comparatively minor crime as terrorism because we don't like it? What would your opinion be when that got only slightly modified to be a crime you don't think should be a crime, like accessing a site without submitting your identity information as required by the Online Safety Act? Some people probably think that can be treated as terrorism too. Are you willing to go along with that? If you're not, and if you are we have much bigger problems, then this is not an acceptable replacement. DDOS is annoying and should be treated as a crime, but it is not terrorism.

Re: Single point of failure

You have an excellent way of insulting everybody. Of course, you clearly intended to insult everyone except infra admins, but you're also insulting them. Do you actually expect that a single infra person can be hired for £24k per year (I'm assuming pounds because $24k or €24k would be lower) and can fix all the problems you would have when CloudFlare goes down if you had originally decided to put them in front of your main systems? Those I work with cost more and have to plan a lot more ahead, including buying other expensive infrastructure in order to do that. You say nothing about how expensive having the infrastructure for that admin to manage would be, since a server swamped by everyone's requests now that there's no CDN to handle it isn't going to be much different from one that can't be reached.

Most businesses that lose millions if their connection goes down for a few hours do have redundant paths, and it costs them a lot more than that to have it. A lot of the internet doesn't have that business model. For example, how much do you think El Reg's outage with CloudFlare's wobbling cost Situation Publishing? A lot of readers would just come back later anyway. That even goes for many companies that involve lots of money. For example, if a video streaming service went down, they've already got subscriptions. Unless it happens so often that they lose subscribers, their customers feel the pain and they don't have a reason to care, and since they can blame CloudFlare this time, they have an excuse that will get rid of most complainants.

But I don't want to get too much in the way of you wanting to believe that you're worth your weight in gold and save millions by your every hallowed key press. One would hope that you recognize that a pizza that's nothing but raw dough is not really what people are going to buy, so though you can't manage the pizza without it, you also can't do so without the toppings or the oven.

Alibaba releases chatbot that produces error when asked about Tiananmen Square

Re: Tiananmen Square in China

"Communism in the Soviet bloc was an unwanted presence imposed by a foreign power, while communism in China was the government chosen, at least in some sense, by the 1940s populace (go study Chinese history if you don’t believe me)."

That's an interesting way to describe it. China's CCP installed itself following a long civil war. The Soviet Union's CPSU installed itself following a long civil war. In both cases, they had plenty of citizens fighting in their armies trying to have them succeed for one reason or another. In both cases, they had plenty of citizens fighting against those armies, hence civil war. Why do you think there's a dramatic difference between those stories? In fact, I'd argue that the difference indicates less support in China's case because there were enough people opposed to the CCP that they set up another country, whereas White Russia did not have enough popular support to maintain any control of land. You chose to compare China with the Soviet block, the largest member of which was the Soviet Union, so your comparison isn't making much sense to me.

"Further, student protests in the 1980s harked back too closely to student radicalism during the Cultural Revolution a generation earlier."

In the sense that they were also students, sure. In any other sense, no, given that the students in the 1960s were killing people following vague instructions from Mao and the students in the 1980s were being killed on instructions from the party.

"To put it another way, while my understanding is that a solid majority of the population of the Soviet bloc wanted their Communist regimes out, this was not true within China in the 1980s,"

Of course, shooting people is a good way to make sure that you don't find out if in fact they did. That was the story after every other unsuccessful protest trying to remove unpopular governments: this did not represent the feelings of the people, because of course nobody but a small fringe group would be stupid enough to want this, right? Everyone else supports us? Which is also related to why you think the CCP has so much approval. Of course China's citizens aren't brainwashed, but many of them are smart enough to recognize that their opinions on the party do not matter and they are not welcome to express them, so if they don't like them, are they going to tell you about it?

Re: Just launched? I've been using it for months

Specifically, it's the expansions of Qwen3 that they released. Models labeled Qwen have been available since 2023 and the third generation since April, but the four variants that are expanded or tailored (vision, for example) are the new ones.

Linus Torvalds is OK with vibe coding as long as it's not used for anything that matters

Re: Boring is good

Most of the things updates fix aren't about you being online. Many of them work just as well from something with limited local privileges looking to have some more privileges later on. Anyone who saw floppy-spreading viruses under MS-DOS knows that the internet is not required for security vulnerabilities to have an impact. Anything you do to reduce the access that untrusted software or data has to your system will help, but updates for known problems will never be unimportant.

Selling your identity to North Korean IT scammers isn't a sustainable side hustle

Re: Audricus Phagnasay?!

Exactly, which is why anyone thinking enough to look up how many years you could get or how many others who did this have gotten would not do this or would demand more and hide it better. But if you eliminate those people and only consider those who don't consider the risk, the payment makes more sense. They had to copy their ID and plug in a laptop. That's not the kind of aiding and abetting that requires big payments to find someone who can do it. And if they were a little more careful, they could probably have posed as victims, the way that most stolen identities were copied from someone else's insecure database rather than being sold, and gotten off for lack of evidence.

Re: Audricus Phagnasay?!

Criminals smart enough to do the risk-benefit analysis would probably decide the risk of any kind of involvement with North Korea was high enough that it wasn't worth the effort. There is a cap for how much North Korea can pay from the proceeds before it's not worth it for them either. For someone who isn't calculating the risk but goes for the much simpler cost-benefit analysis, the cost for doing this is much lower since it takes relatively little effort to provide copies of a license and store a laptop. Given the large number of people available who are greedy enough to agree to this and stupid enough not to consider the risks, it's not that surprising to me that the price for the service is relatively low.

More broadly, there are a lot of criminals who, when you see the risks they're willing to go to and the benefits they get, don't seem worth it. Small-scale bank robberies, for instance, carry a relatively high risk of getting caught and a moderate risk of having much worse happen to you and tend to have somewhat small payments, and yet people have been willing to do those, sometimes routinely, for a while, at least they did not too long ago though they've gotten much less common. Part of this might be that a lot of us posting here are in careers that are somewhat stable and well-paid, so what seems like a small return to us might be bigger for someone else, but I don't think that's the whole story. I think there are plenty of people who don't think things through, enough that finding accomplices who don't need to do much is easier than we'd like it to be.

Developer made one wrong click and sent his AWS bill into the stratosphere

Re: $1-2K per month?

No, I didn't, and you know that. Unless I used spot instances, I don't get preempted for other users because I'm paying. It does scale very quickly unless you need tons of expensive capacity right now. And although we could argue on the quality of their security, they do employ a bunch of security people and have more secure defaults. None of those would apply to any attempt to rent out unplanned unused capacity on a two-server setup.

Re: $1-2K per month?

"Maybe you could sell the otherwise-unused CPU cycles of your servers to other people."

Sounds great. How much are you willing to pay me for the residual cycles on my computer? It's run by some random nobody you don't know, hopefully I have any security in place for both our sakes, you get preempted whenever I get spikes, and it can't scale above two servers at absolute maximum. I'm expecting a competitive price.

"As to your monthly power bill: did you think AWS, Azure, or GCS would not include (somehow) those 'leccy costs in your bill?"

Of course they do, while I'm using the resources I provisioned. When I am not using them, then that part is paid by the people who are using them instead. The question is whether their markup on the times when I am using it is greater or less than my wasted spend on self-hosted hardware when I'm not.

Re: When you don't return from lunch to log out

You can easily do that with a script, but if you want to do it with a GUI, you can. It's more complicated than it needs to be because AWS, but you can do it. If you expect to need to, which this person probably didn't.

Re: I ask the other way around...

Because the alternative is that when the system shuts down, it gets automatically deleted. There was a person who deleted some old VMs because they were probably unused. Take a look at what the comments said about that. Do you think the dev or Amazon would have been let off the hook if the problem was that important systems got wiped because the opposite was the default?

The problem is that no matter what that setting defaults to, something can go wrong. In neither case is it the fault of the cloud provider. The same thing could happen with owned servers, although it would be less a cost overrun and more a problem when all the disks filled up with unneeded images and new ones couldn't start. Depending on how expensive downtime is, that could even be worse. Oh, but there'd be warnings if the disks filled up, just as there could have been but evidently weren't alarms on cost usage. Computers have lots of options and unfortunately, some of them can have important effects and need to be treated with care.

Re: WHAT?!?

True, and if AWS could add more options including a method of automatically stopping some things when a budget was hit, that would be better. You can script that, but you would have to plan what you wanted to do in an unexpected funding situation ahead of time. However, if all they have is alarms, then you should at least set the alarms.

Altman sticks a different hand out, wants tax credits instead of gov loans

Re: Workshy Layabouts

You are incorrect and numerous comments already gave you the details. For example, that when the tax credits are refundable, they result in direct payments from the government even if you owed no tax and when they're transferrable, they do the same as long as you sell them to someone else who owes some tax. And, even if they are neither, they can often be stored until you do owe tax, which means that while you do have an incentive to be profitable, which evidently the profit wasn't enough of already, it still amounts to the government giving out money to specific people. If you make up an incorrect definition, you can indeed make them as good or bad as you want them, but you didn't even do that.

UK tribunal says reselling Microsoft licenses is A-OK

Re: Common sense prevails?

Some machines, especially those intended for corporate customers, are more customizable. Machines sold to individuals don't tend to have so many options. But also, I don't think you would actually find that a single model really has anything near that many options. For example, what are those five WiFi options? Some of them might have WiFi 6E for an extra charge, and maybe there are some with 6E, 6, and 5 as choices, but very few if any will have a fourth no WiFi option and I'm not sure what the fifth would be. In my experience, they don't tend to offer different WiFi cards based on different chips but with the same capability in the same laptop model, and most models have exactly one WiFi option and if you want 6E but it doesn't have it, you either pick a different one or replace the card yourself.

I think you'll find that they do have plenty of prebuilt machines in warehouses for many configurations that are standard. Some models don't have any other choices, and the ones that do still have ones that are more often chosen where speed to shipment is easier if they've already been assembled. At some level, usually an expensive bulk-purchase one, they will custom-build the model requested. This was my original point: they can remove anything, but it does add some work which means it's not as less expensive as it looks from the bill of materials, which is why they don't offer a remove any part you don't want option.

"the whole we don't agree appeals should not be something thats allowed"

They're not. What the statement translates to is "We're going to appeal when our lawyers have decided what the least stupid sounding acceptable reason is, but we don't know what it is yet. They'll find something; they're lawyers." That argument has to be one of the acceptable reasons for appeal, and their lawyers are going to write something that says it is and will keep doing that until they run out of appeal chances or a court rejects them.

Re: Common sense prevails?

That's technically true but in practice wrong. For example, what if I want to buy a certain laptop minus the disk it ships with. I have enough spare disks, or maybe I want a really big one which I'll install separately. Shouldn't it cost less to sell me a laptop without that part? Yes, it does, if you only look at the cost to manufacture the thing. However, when you look at the cost to have multiple lines, track them so you don't accidentally ship someone a diskless laptop when they don't know how to install the disk and then install stuff on the disk, have double the SKUs on your catalog, manage customer complaints when they select the cheaper one because they don't have any idea what "No SSD" meant, install or remove disks from machines when the demand for one model was different than what they guessed during manufacturing, it ends up not being worth it for the manufacturer and they don't bother.

There are many companies that have options without disks or without Windows licenses, on models where they get enough demand for those that it's worth the expense. For a lot of them, they don't see the purpose in doing either, so they don't. This is not unique to computers. Pretty much every physical product is sold in a way where you get all the parts they decided belong together and don't get to select the ones you want individually. There are potential legal problems with OEM license agreements used for the Windows part, but manufacturers' choices are not those.

Why Elon Musk won't ever realize the shareholder-approved Tesla payout

Re: Impossible, unless...

True, if his plan is to sell the shares for cash, he won't get anything close, though he can do that eventually and he would get a lot more than he should. However, that's not what he is going to do. Not only can he borrow against those shares and get a lot more, but the major value of them is that they let him control the actions of the company where he can extract money from it. For example, voting to have Tesla buy AI services from his AI company, services which aren't explicitly defined but a price tag that is. He can take that payment from the AI company which is privately owned.

Developer battled to write his own documentation, but lost the boss fight

Re: I used to own a sports bar/restaurant

Well, if we want to be more specific than we should, it is almost certain that after the drivers find their cars, they do want to relocate them to their next destination, and if they can't find them, they will be unable to relocate them. So although the sign is missing the medium stage, it is telling the customer what they need to do in order to do the thing they almost certainly want to.

Another question is whether or not we should even need a sign to tell you that, if your car has not been relocated by somebody or something else, then it's where you parked it, so unless your intention is to abandon it, you should probably take any necessary steps to remember that.

Re: Hmm

I am fortunate enough that I have never encountered someone who did this severely. Most who I have found need to say something but don't get too unhappy if their changes don't get made. Unfortunately, I know at least one person who had to deal with someone who demanded so many changes that they went to the extent of deliberately including things for the critic to complain about because they would otherwise send round after round of mandatory feedback and force all the team members to stay late into the evening to implement those changes before deadlines. It did not do that person's mental health any good, and of course introducing deliberate confusion or errors into drafts could have had all sorts of other problematic results.

Re: Hmm

Even if we assume all the opinions in the article are wrong, if we agree to accept the facts alleged, the tech writers were not sitting down with the developers to learn the product; they were communicating by written messages volleyed back and forth. Even if the documentation produced by the programmer was complete gibberish, you couldn't make it better without understanding the software, instead getting the kind of thing you would get if you had an LLM write it: clear, well-organized, grammatically correct, and useless. So I still don't think we have enough information to turn the benefit of the doubt to favor them. And if we aren't willing to accept those facts, we might as well make up any story we like because we have no information other than that from the article.

Re: Hmm

I'm not so sure. Of course, we'll only ever have one person's description of it and they're likely to edit anything that they don't want to appear, but nothing in the description says that the problem was missing things which the writing department asked to be filled in. I've known people, and I'm guessing you have too, who could not review something without proposing changes. I wouldn't count out the combination of people trying to justify their jobs and not necessarily being good at them. Most programmers I know would be all too happy to not write documentation, sometimes so much that they don't even though we don't have any writers to do it instead, and the writers probably weren't getting any complaints if the documentation wasn't good.

Ubuntu 25.10's Rusty sudo holes quickly welded shut

Re: I disagree with this statement

I still disagree, with the clearest reason being this sentence:

"When this ends up creating a potentially more insecure binary, it's a problem with all this rust stuff."

Not at all. When this ends up creating a potentially more insecure binary, it's a problem with this particular piece of code. If it was part of Rust, it would impact everything else, but if it was a bug in that one rewrite, then it's as much a problem with all the Rust stuff as sudo's insecure config file vulnerability was a problem with everything written in C (which it isn't, in case a C fan was not sure what I am saying).

If someone badly rewrites something in a language, it does not make the language or the others using it at fault. When we compare the C version of sudo with this Rust reimplementation, it's also not so clear that the rewrite was bad. Yes, the Rust version has vulnerabilities, but so does the C version, and so far, the Rust one has not had one that allows a unprivileged user shell to turn into a root one whereas C sudo has. I think I can sympathize with the negative reaction to something that has been hyped too much, and Rust has received enough hype to be annoying. When that annoyance turns into hyping any problem with the new thing more severely than the original hype, especially with inaccurate statements meant to make a problem seem worse or more unusual than it actually is, then we have another problem.

Re: ninjed me!!!

How is that the logical conclusion and what does it really tell us? What you have in doas is something that does some of what sudo does with an amount of code between that of su and that of sudo. You lose reporting and monitoring, but maybe you didn't need it, but you still have per-user command filtering, but not as many options, and it's still bigger, which we have been using though probably we shouldn't as a proxy for likelihood to contain bugs. All we have from this is the fact that yes, doas also exists and could be another option.

Re: sendmail.cf

I was surprised to see the comment about m4 not getting used precisely because it's used in autoconf and automake and I see those all over the place. I don't really like them, although I admit they are better than not having them is, but I have to use them a lot and therefore I see m4 and things relying on it with some regularity.

Networking students need an explanation of the internet that can fit in their heads

Re: Networking students need an explanation of the internet that can fit in their heads

Funny, most of the copies I find online don't write it like that, because writing it like that is weird. Here's one:

"government of the people, by the people, for the people, shall not perish from the earth." is how they are using capitals. That's how all the search results on the first page are using capitals. That's also how most things are transcribed. To use a less US example, if we look at the famous Churchill speech, we can see that it's generally transcribed "That is the will of Parliament and the nation.", because Parliament is being referred to as a proper noun and "the nation" is a specific instance of a noun that's not a proper one.

The internet is the instance of internet we're referring to, mostly because those smaller other internets are not ones we interact with. The original comment clearly understands that there is more than one, but misunderstands what makes a noun a proper one. If there's only one instance of something, or if there's only one instance you choose to care about, that does not make nouns proper by default.

Re: Google maps for Networks !!! :)

But implementors of what, precisely, because if it's an engineer building WiFi equipment, they don't generally have to reimplement the networking part, they have to reimplement the wireless communication part which is very different, and after decoding that to supported traffic, the network equipment they're connecting to handles that part. If they're building that networking part, they're generally either writing code or connecting existing systems together and making them work correctly in a group. In the comment where I described these two groups, I did say that these were a simplification and not the only ones, but lumping everything into implementor is getting the set of students wrong. There is something the student is coming here to do first, and it's likely not poking bits down a single pipe.

Happy holidays: AI-enabled toys teach kids how to play with fire, sharp objects

Re: And none of them would be legal in EU

I'll tell you where I live. I live in a world where I thought GDPR was going to make lots of abuses illegal because the law said it and there were nice large penalties, large enough to keep things in line. I lived in a world where I let my optimism run wild. And I live in the world you have to live in where there has been almost no effect from what looked like a revolutionary privacy law. Where it's rarely enforced, and when it is it's against companies that did relatively little compared to the obvious abuses of larger tech companies. Where despite the law's ineffectiveness, politicians from the same countries that passed it are trying to weaken it. I need more than the confident assertions from someone to actually believe that these things get enforced. You disliked my "pseudo examples", which I wasn't really writing as examples, but I note you mentioned not a single piece of legislation that would stop these, not a single enforcement body, not a single example of these things not being available. If specificity is your objection, then why don't you cite the reasons for your confidence, since you must have them if you're not making assumptions.